Use the resolver
Inspect any AY identity in the browser or over the API, and check a signature without consuming its nonce.
The public resolver at resolver.aytwin.ai shows what anyone can verify about an AY identity: the DID document, the key history with a re-verified chain, published credentials, the Agent Card, and a signature checker. The same data is available over the API.
Resolve a DID
curl "https://api.aytwin.ai/api/v1/identity/resolve?did=did:webvh:…:agents:…"The response contains the document, signerType (twins, agents, machines, users, or platform), deactivated, the document and log URLs, a log summary with one entry per version and verified: true when the whole chain checks out, and credentials published at the DID. It is cached for 60 seconds with an ETag.
For a person twin, credentials contains the current mandate of its human, a TwinMandateCredential. The resolver shows it as "Mandate of the human", with the approval level, the capabilities, the expiry, and a live verdict. The issuer links to the human's DID, so you can follow the chain agent → twin → human. A person twin without a mandate shows the chip "Without mandate". A business twin shows its Business Verification Credential instead.
Foreign did:webvh identifiers are resolved over HTTPS from their host; the response then has source: "http".
Check a signature
POST /api/v1/identity/verify runs the same checks a receiver runs, step by step, and reports which step failed. It is read-only: it never consumes the nonce, so you can check a request you have already sent.
curl -X POST https://api.aytwin.ai/api/v1/identity/verify \
-H "Content-Type: application/json" \
-d '{
"method": "GET",
"url": "https://api.aytwin.ai/api/v1/agents/me",
"headers": {
"signature-input": "sig1=(\"@method\" \"@authority\" \"@path\" \"content-digest\");created=…;expires=…;nonce=\"…\";keyid=\"did:webvh:…#dev-1\";tag=\"ay-agent\";alg=\"ed25519\"",
"signature": "sig1=:…:",
"content-digest": "sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:"
},
"bodyBase64": ""
}'The result lists the steps content_digest, resolve_did, find_key, verify_signature, profile, status_list, and nonce with ok, failed, or skipped, plus the overall result and a reason on failure.
Rate limits
The public identity endpoints allow 30 requests per minute per IP. For continuous verification, resolve documents yourself and cache them by ETag.
Guardrails
The kill switch, spending limits, and the owner verification check that apply to every request.
Resolve a did:webvh DID GET
Returns the DID document plus the independently verified history. Own DIDs are read from the database, foreign did:webvh DIDs are fetched over HTTPS (`did.json` + `did.jsonl`). The history is re-resolved with didwebvh-ts (SCID, hash chain, proofs), so `log.verified` is the resolver's own verdict, not the host's claim. `credentials` lists the credentials published at this DID (today: the BusinessVerificationCredential of a business twin). Public, rate-limited, `Cache-Control: public, max-age=60` with `ETag`. Never returns key material beyond the public document.