Verify an RFC 9421 signed request
Re-runs the receiver-side verification of the AY profile (`docs/identity/t2t-signature-contract.md` §4) and returns every step with its outcome, so you can see *why* a signature fails. Read-only: it does **not** consume nonces (the `nonce` step is reported as `skipped`). Accepts all three tags (`ay-t2t`, `ay-t2a`, `ay-agent`). No authentication, rate-limited. Never returns key material.
Re-runs the receiver-side verification of the AY profile (docs/identity/t2t-signature-contract.md §4)
and returns every step with its outcome, so you can see why a signature fails.
Read-only: it does not consume nonces (the nonce step is reported as skipped).
Accepts all three tags (ay-t2t, ay-t2a, ay-agent). No authentication, rate-limited.
Never returns key material.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/identity/verify" \ -H "Content-Type: application/json" \ -d '{ "method": "GET", "url": "http://example.com", "headers": { "signature-input": "string", "signature": "string" } }'{ "result": "ok", "keyid": "string", "did": "string", "signer_type": "twins", "reason": "digest_mismatch", "steps": [ { "step": "content_digest", "status": "ok", "detail": "string" } ]}Resolve a did:webvh DID GET
Returns the DID document plus the independently verified history. Own DIDs are read from the database, foreign did:webvh DIDs are fetched over HTTPS (`did.json` + `did.jsonl`). The history is re-resolved with didwebvh-ts (SCID, hash chain, proofs), so `log.verified` is the resolver's own verdict, not the host's claim. `credentials` lists the credentials published at this DID (today: the BusinessVerificationCredential of a business twin). Public, rate-limited, `Cache-Control: public, max-age=60` with `ETag`. Never returns key material beyond the public document.
Verify a Verifiable Credential (vc+jwt) POST
Verifies a credential issued by the AY platform or a listed issuer: signature (EdDSA, key resolved from the issuer DID), issuer allowlist, validity window and the Token Status List. Returns one verdict: `valid`, `expired`, `suspended`, `revoked`, `invalid` or `unknown` (`unknown` = a source was unreachable, no verdict). Use it for Agent Passports, BusinessVerificationCredentials and TwinMandateCredentials. No authentication, rate-limited. Never returns key material. TwinMandateCredential (AIOAY-5541): issued by the person, not the platform. `alg` is `ES256` (raw R||S, 64 bytes, RFC 7518 §3.4; DER is `invalid`), `kid` is `<user-did>#key-device` under `assertionMethod`. `iss` must equal the `controller` of the twin DID document (`sub`), otherwise `invalid` with reason `issuer_not_controller`. Status list: `/identity/status-list/mandates`.