AY Developer docs
ApiIdentity

Resolve a did:webvh DID

Returns the DID document plus the independently verified history. Own DIDs are read from the database, foreign did:webvh DIDs are fetched over HTTPS (`did.json` + `did.jsonl`). The history is re-resolved with didwebvh-ts (SCID, hash chain, proofs), so `log.verified` is the resolver's own verdict, not the host's claim. `credentials` lists the credentials published at this DID (today: the BusinessVerificationCredential of a business twin). Public, rate-limited, `Cache-Control: public, max-age=60` with `ETag`. Never returns key material beyond the public document.

GET
/identity/resolve

Returns the DID document plus the independently verified history. Own DIDs are read from the database, foreign did:webvh DIDs are fetched over HTTPS (did.json + did.jsonl). The history is re-resolved with didwebvh-ts (SCID, hash chain, proofs), so log.verified is the resolver's own verdict, not the host's claim. credentials lists the credentials published at this DID (today: the BusinessVerificationCredential of a business twin).

Public, rate-limited, Cache-Control: public, max-age=60 with ETag. Never returns key material beyond the public document.

Query Parameters

did*string
Match^did:webvh:
Lengthlength <= 512

Response Body

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/identity/resolve?did=did%3Awebvh%3AQmaedXifXFJ6Jk3LNz7GLjWjXsEWn3QUJL4S1zSDMxprYD%3Aapi-qa.aytwin.ai%3Atwins%3Aac220112-5d26-4548-8cb7-42b163403c4f"
{  "did": "string",  "method": "webvh",  "document": {},  "source": "db",  "signerType": "twins",  "deactivated": true,  "documentUrl": "http://example.com",  "logUrl": "http://example.com",  "log": {    "verified": true,    "error": "string",    "scid": "string",    "latestVersionId": "string",    "entries": [      {        "versionId": "string",        "versionNumber": 0,        "versionTime": "2019-08-24T14:15:22Z",        "updateKeys": [          "string"        ],        "verificationMethods": 0,        "services": 0,        "addedKeys": [          "string"        ],        "removedKeys": [          "string"        ]      }    ]  },  "resolvedAt": "2019-08-24T14:15:22Z",  "credentials": [    {      "type": "string",      "jwt": "string",      "status_list_index": 0    }  ]}

Use the resolver

Inspect any AY identity in the browser or over the API, and check a signature without consuming its nonce.

Verify an RFC 9421 signed request POST

Re-runs the receiver-side verification of the AY profile (`docs/identity/t2t-signature-contract.md` §4) and returns every step with its outcome, so you can see *why* a signature fails. Read-only: it does **not** consume nonces (the `nonce` step is reported as `skipped`). Accepts all three tags (`ay-t2t`, `ay-t2a`, `ay-agent`). No authentication, rate-limited. Never returns key material.