Build

Developer center

Two surfaces, one resolver: the W3C DID Resolution HTTPS binding for interoperability, and the DID.is evidence API for supported proof checks and their limits. Use the official TypeScript and Python SDKs or any HTTP client. Public endpoints are free to start without a key; private APIs require a project API key.

Published by DID.is. For reviewed implementation scope and limitations, see the standards registry.

Quickstart docs.did.is ↗npm install @didis/clientpip install didis-pyhttps://did.is/api

Samples

Guide

Quickstart

The public API needs no account and no key. Resolve any supported identifier and you get the W3C result plus the evidence behind it: a plain-language verdict, independently evaluated dimensions, and the stated limits of what was checked.

Install the SDK for your language, or use any HTTP client.
Resolve an identifier and read verdict.headline and dimensions.
Branch on the stable problem code when a request fails, and honour Retry-After.
When you need metered private resolution, monitoring or signed webhooks, create a project in the console.

Supported methods: did:web, did:webvh, did:key, did:jwk. No scores, no paid ranking: the response is identical for every caller.

1 · Install

# Nothing to install.

2 · Resolve

curl -s "https://did.is/api/v1/resolve/did%3Aweb%3Aidentity.foundation"

Guide

SDKs & HTTP clients

Official, MIT-licensed clients with typed responses for resolution, credentials, policies, agents and fast verify. Both default to https://did.is/api; pass another base URL to target a staging or self-hosted deployment.

TypeScript · npm

npm install @didis/client

import { DidisClient } from "@didis/client";
const didis = new DidisClient();
const r = await didis.resolve("did:web:example.com");

Node 18+, browsers and edge runtimes (fetch + WebCrypto). · npm · source

Python · PyPI

pip install didis-py

from didis import DidisClient
client = DidisClient()
r = client.resolve("did:web:example.com")

Python 3.11+, sync and asyncio (AsyncDidisClient), TypedDict responses. · PyPI · source

Any language · HTTP

curl -s "https://did.is/api/v1/fast-verify/did/did%3Aweb%3Aexample.com"

# W3C DID Resolution HTTPS binding
curl -s -H 'Accept: application/did-resolution' \
  "https://did.is/api/1.0/identifiers/did%3Aweb%3Aexample.com"

Plain JSON over HTTPS. Resolver clients that speak the W3C HTTPS binding can use the /1.0/identifiers binding unchanged.

Typed errors

DidisError carries the RFC 9457 problem, status and Retry-After.

Live stages

stream() yields each resolution stage over SSE as it completes.

Webhook helpers

Constant-time signature verification for monitor events.

Timeouts

30 s default per request; configurable in both SDKs.

Guide

Use with AI agents (MCP)

DID.is is a remote MCP server at https://did.is/mcp (Streamable HTTP, protocol 2026-07-28 with 2025-11-25 fallback). No account, no key. Seven read-only tools answer with a short evidence summary plus structured content; third-party text is kept under untrusted so an agent does not follow instructions found in documents it checks.

Run a complete MCP connection example → Connecting DID.is adds lookup tools; it does not protect your other tools. The repository also has separate offline inspection and definition-change blocking demos, with no account or LLM key needed for the default runs.

Claude Code

claude mcp add --transport http didis https://did.is/mcp

Cursor · .cursor/mcp.json

{
  "mcpServers": {
    "didis": { "url": "https://did.is/mcp" }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "didis": { "type": "http", "url": "https://did.is/mcp" }
  }
}

Clients with a custom connector screen (for example Claude and ChatGPT) take the same URL. Try: “Use DID.is to check did:web:did.is and tell me what is not proven.”

Tool	Answers	Same as
resolve_did	Does this DID resolve, and what is proven or not proven?	GET /v1/resolve/{did}
verify_credential	Is this credential valid, and does it state the claims I need?	POST /v1/credentials/verify
inspect_mcp_server	Can I trust this MCP server and its tools? Did they change?	GET /v1/mcp/inspect
inspect_a2a_agent	What does this A2A agent card prove about who runs it?	GET /v1/a2a/inspect
authorize_tool_call	Does this delegation chain allow this tool call?	POST /v1/agents/authorize
evaluate_policy	Does this DID pass my rules?	POST /v1/policies/evaluate
search_directory	Which listed DID belongs to this name or domain?	GET /v1/directory

Tool calls share the anonymous budgets below. A spent budget comes back as a tool result with isError: true and retryAfterSeconds, so the agent waits instead of retrying other tools. INDETERMINATE is never a pass.

Guide

Base URL & encoding

Base URL. All paths below are relative to https://did.is/api. HTTPS only.
Identifiers in paths. Send the DID raw or fully percent-encoded (did%3Aweb%3A…); it is decoded exactly once. Encode # as %23 and ? as %3F in DID URLs. The SDKs do this for you.
Content types. Responses are application/json; failures are application/problem+json; the W3C binding negotiates application/did-resolution or application/did.
Bodies. POST bodies are JSON, at most 512 KiB.
OpenAPI. The full public surface is described as OpenAPI 3.1 at https://did.is/api/openapi.json. Import it into Postman, Insomnia or a client generator; it is built from this page's own catalogue.
Privacy. Public resolutions are observed and may appear in the identifier's public history. Use the private API for identifiers you must not disclose.

Encoding a DID URL

# did:web:example.com#key-1
curl -s "https://did.is/api/v1/dereference/did%3Aweb%3Aexample.com%23key-1"

Guide

Rate limits

The public API is free and anonymous, protected by per-client token buckets. Exceeding a bucket returns 429 RATE_LIMITED with Retry-After in seconds. Back off for at least that long; the SDKs expose it on the error.

Budget	Applies to	Limit
Standard	Every public request except health	20 / min
Intensive	Streams, did:webvh, credential and policy verification, MCP/A2A inspection, delegation (marked intensive below). Also counts toward Standard.	10 / min
Private API	Project API keys from the console	Per plan

Under momentary load a request can also return 503 CAPACITY_EXHAUSTED; retry with exponential backoff. Cache results you reuse: verdicts include observedAt.

Reference

Errors

DID.is-native /v1 JSON HTTP API errors use RFC 9457 problem objects with a stable code. Branch on code, not on title or detail. DID Resolution errors use W3C type URIs; DID.is conditions use https://did.is/problems#…. Failures on /v1/resolve include the partial trace. The W3C DID Resolution binding wraps resolution errors in didResolutionMetadata.error; SSE streams emit error events after opening, and MCP uses its protocol error envelopes. These are not top-level problem JSON responses. Account authentication, edge/proxy and transport failures may use other response shapes; inspect the status and content type before parsing.

Code	/v1 status	W3C status	Meaning
INVALID_DID	400	400	Syntax or method-specific identifier is invalid (incl. IP-literal did:web).
INVALID_DID_URL	400	400	Malformed DID URL or DID parameters.
INVALID_OPTIONS	400	400	Invalid DID resolution options, e.g. unknown parameter.
INVALID_REQUEST	400	—	Malformed body, unknown or repeated query parameter.
NOT_FOUND	404	404	Document, version, fragment, service or API route not found.
METHOD_NOT_ALLOWED	405	—	HTTP method not allowed on this public route.
REPRESENTATION_NOT_SUPPORTED	406	406	Accept header cannot be satisfied.
—	—	410	W3C binding only: the DID is deactivated (the resolution result is still returned).
PAYLOAD_TOO_LARGE	413	500	Body over the cap (512 KiB requests, 1 MiB fetched documents).
INVALID_DID_DOCUMENT	422	500	Document id mismatch, bad JSON, or failed did:webvh log verification.
RATE_LIMITED	429	429	Anonymous budget exhausted. Honour Retry-After.
METHOD_NOT_SUPPORTED	501	501	DID method not implemented.
FEATURE_NOT_SUPPORTED	501	501	e.g. DID URL paths.
EGRESS_BLOCKED	403	500	Target resolves to a non-public address, or scheme/userinfo refused.
UPSTREAM_UNAVAILABLE	424	500	The identifier's host failed or timed out.
SERVICE_UNAVAILABLE	503	—	DID.is itself is briefly unavailable (for example during a restart); retry after Retry-After.
CAPACITY_EXHAUSTED	503	—	Bounded work capacity is momentarily full; retry with backoff.
INTERNAL_ERROR	500	500	Unexpected internal resolver error.

Problem object

HTTP/2 429
content-type: application/problem+json
retry-after: 3

{
  "type": "https://did.is/problems#RATE_LIMITED",
  "title": "Rate limited",
  "status": 429,
  "code": "RATE_LIMITED",
  "detail": "Anonymous request budget used up (20 requests per minute per client). Wait 3 seconds (Retry-After) before the next request; retrying sooner is refused again. Budgets and retry guidance: https://docs.did.is/build/errors/"
}

Handling · TypeScript

import { DidisClient, DidisError } from "@didis/client";

const didis = new DidisClient();
try {
  const r = await didis.resolve("did:web:identity.foundation");
  console.log(r.verdict.headline);
} catch (e) {
  if (e instanceof DidisError && e.problem.code === "RATE_LIMITED") {
    const wait = Number(e.problem.retryAfter ?? 1);
    console.warn(`Rate limited; retry after ${wait}s`);
  }
  throw e;
}

Guide

Private API & webhooks

Projects in the console add metered private resolution that is never written to public history, project API keys with one-time secrets and rotation, hourly identifier monitoring, and signed webhooks. Plans and allowances are on pricing.

Keys are shown once. Keep them server-side; never ship them to browsers or mobile apps.
Paid routes with an API key (Authorization: Bearer plus one Idempotency-Key per call): POST /api/v1/customer/resolve, mcp/inspect {endpoint}, a2a/inspect {url}, agents/authorize and agents/verify-delegation, and GET /api/v1/customer/usage. Responses are the same JSON as the public routes; agent checks bill only completed results (ALLOW and DENY alike) from a separate monthly pool.
Paid responses carry RateLimit-Policy, RateLimit and X-Didis-Request-Id. A reused idempotency key returns 409 without re-running; a spent allowance returns 429 until the 1st of the next month.
Webhooks carry X-DIDIS-Event-ID and X-DIDIS-Signature: t=<createdAt>,v1=<hex HMAC-SHA256> over createdAt + "." + raw body.
Verify against the exact raw bytes before parsing. Retries resend the identical event, so record the event ID before side effects and acknowledge duplicates with 2xx.
Failed deliveries retry up to five attempts (after 1, 2, 4 and 8 minutes). Only HTTPS endpoints on port 443 and public addresses are accepted; redirects are not followed.

Verify a webhook · TypeScript

import { verifyCustomerMonitorSignature } from "@didis/client";

const secret = process.env.DIDIS_WEBHOOK_SECRET ?? "";
const tenantId = "tenant_0000000000000000000000000000000000000000000000000000000000000000";
const projectId = "project_0000000000000000000000000000000000000000000000000000000000000000";

const body = await req.text(); // raw body, before JSON parsing
const ok = await verifyCustomerMonitorSignature(
  secret, body, req.headers.get("x-didis-signature") ?? "",
  { tenantId, projectId, eventId: req.headers.get("x-didis-event-id") ?? "" },
);
if (!ok) return new Response(null, { status: 400 });

Make your first private API request

Create a free account or sign in, verify your email, then name and select your team and project. In its API keys section, explicitly create a resolve-scoped key and save the one-time secret.
In a trusted local terminal or server environment, set DIDIS_API_KEY securely. Never put the key in a URL, browser code, screenshots or version control.
Choose an example below and run it yourself. The page never sends an API-key request or copies a secret automatically. Each example uses a fresh idempotency key.

This fixed did:key sample resolves without contacting an external DID origin: did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2. One completed resolution uses the team’s Standard resolution allowance, not its Agent check allowance. Free includes 200 Agent check calls per month, separate from its 1,000 Standard resolutions.

cURL · private resolution

# Set DIDIS_API_KEY securely in this terminal; do not paste it into source control.
# Optional for an isolated local stack: export DIDIS_BASE_URL=http://127.0.0.1:3101/api
: "${DIDIS_API_KEY:?Set your project API key first}"
curl --include --silent --show-error --request POST \
  "${DIDIS_BASE_URL:-https://did.is/api}/v1/customer/resolve" \
  --header "Authorization: Bearer ${DIDIS_API_KEY}" \
  --header "Idempotency-Key: $(python3 -c 'import uuid; print(uuid.uuid4())')" \
  --header 'Content-Type: application/json' \
  --data '{"did":"did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2"}'

SDK 0.2.x note: DidisClient.resolve() (TypeScript) and DidisClient.resolve() (Python) call the public API, even when a key is configured. These examples deliberately use native HTTP for private resolution; no private SDK method is assumed.

How to know it worked

Look for HTTP 200, a didDocument.id matching the sample above, and no didResolutionMetadata.error. Keep the X-Didis-Request-Id for support. A valid document is not a verified identity claim or a trust “PASS”.

This guide does not mark your key as successful. Console totals are shared team usage and may include other projects or browser requests; they cannot prove this key’s first request succeeded.

401 · Missing, invalid or revoked key: Check the Bearer header and the selected project’s key metadata. A hidden or lost secret cannot be revealed again; revoke the unused key before replacing it.
403 · Access or scope refused: This example needs the resolve scope. Check key scopes and whether the team is suspended. A key from another project acts in that key’s project, not the project currently selected here.
409 · Reused idempotency key: Inspect the earlier result before retrying. For a deliberate new operation, generate a new idempotency key.
429 · Safety limit or allowance reached: Read the response code/detail and Retry-After header. Wait for the indicated interval for a rate limit; for exhausted monthly quota, wait for reset or review the team’s plan. Do not loop retries.
200 with a resolution error, or 503: HTTP 200 with a missing document or resolution metadata error is not a successful resolution. Check the DID and error detail. For 503, wait as directed by Retry-After; do not repeatedly create keys.

Private API reference and SDKs

API reference · Resolution

Resolution

W3C DID Resolution (CR Draft)

GET/1.0/identifiers/{did}

DID Resolution v1 · W3C Candidate Recommendation Draft (1 Oct 2026) HTTPS binding. Accept: application/did-resolution returns the full resolution result; application/did (or */*) returns the DID document only. Errors are RFC 9457 problem objects in didResolutionMetadata.error with the specification's status codes (400 invalid DID, 404 not found, 406 representation not supported, 410 deactivated, 501 method not supported). DID URLs (fragments, ?service=, ?versionId=) are dereferenced.

Parameter	In	Type	Description
did (required)	path	DID or DID URL	Raw or fully percent-encoded (did%3A…); decoded exactly once.
Accept	header	media type	application/did-resolution \| application/did

Returns ResolutionResult or DID document

cURL

curl -s "https://did.is/api/1.0/identifiers/did%3Aweb%3Aidentity.foundation" \
  -H 'Accept: application/did-resolution'

Live against https://did.is/api; counts toward your anonymous budget.

Resolution

Resolve with evidence

GET/v1/resolve/{did}

Superset of the W3C result: verdict (plain-language headline and statements), seven independently evaluated evidence dimensions, the evidence graph, per-stage telemetry, key/linkage/TLS/history evidence and stated limitations. No scores.

Parameter	In	Type	Description
did (required)	path	DID	The identifier to resolve.
noCache	query	boolean	Bypass and refresh the resolver cache.

Returns EnrichedResolution

cURL

curl -s "https://did.is/api/v1/resolve/did%3Aweb%3Aidentity.foundation"

Live against https://did.is/api; counts toward your anonymous budget.

Resolution · intensive

Live resolution (SSE)

GET/v1/stream/{did}

Server-sent events: one `stage` event per telemetry stage as it completes, then `result` (EnrichedResolution) or `error` (problem), then `done`.

Parameter	In	Type	Description
did (required)	path	DID	The identifier to resolve.
noCache	query	boolean	Resolve fresh.

Returns text/event-stream

cURL

curl -sN "https://did.is/api/v1/stream/did%3Aweb%3Aidentity.foundation?noCache=true"

Resolution

Dereference a DID URL

GET/v1/dereference/{didUrl}

Selects a verification method or service by fragment, a service endpoint by ?service= (with path-traversal-safe relativeRef), or a did:webvh version by versionId / versionTime / versionNumber. Encode '#' as %23.

Parameter	In	Type	Description
didUrl (required)	path	DID URL	e.g. did:web:example.com%23key-1

Returns DereferencingResult

cURL

curl -s "https://did.is/api/v1/dereference/did%3Aweb%3Aidentity.foundation%23key-1"

Live against https://did.is/api; counts toward your anonymous budget.

Resolution

Evidence graph

GET/v1/graph/{did}

The nodes and edges behind a verdict (subject, document, origin, TLS, keys, services, linkage) with the state of every relation. Use it to render or audit why a verdict was reached.

Parameter	In	Type	Description
did (required)	path	DID	The identifier.

Returns { did, observedAt, verdict, nodes, edges }

cURL

curl -s "https://did.is/api/v1/graph/did%3Aweb%3Aidentity.foundation"

Live against https://did.is/api; counts toward your anonymous budget.

API reference · Observation

Observation

Observation history

GET/v1/history/{did}

Snapshots DID.is recorded for this identifier (coalesced when unchanged). Observations are records, not proofs of history.

Parameter	In	Type	Description
did (required)	path	DID	The identifier.

Returns { did, count, history: ObservationRecord[] }

cURL

curl -s "https://did.is/api/v1/history/did%3Aweb%3Aidentity.foundation"

Live against https://did.is/api; counts toward your anonymous budget.

Observation

Semantic diff

GET/v1/diff/{did}

Compares two observations: keys added, removed and rotated (same id, new material), relationship changes, services, controller, alsoKnownAs, @context and domain-binding changes. Defaults to the latest two distinct state observations. Use fromObservation/toObservation (obs:<public history id>) for precise selection, including identical hashes with different origin binding. Legacy from/to hashes must identify one row each; ambiguous hashes return 400 INVALID_REQUEST. identical describes document equality; domainBindingChanged is separate.

Parameter	In	Type	Description
did (required)	path	DID	The identifier.
from	query	sha256	Older document hash.
to	query	sha256	Newer unambiguous document hash.
fromObservation	query	string	Older public observation reference: obs:<id>. Supply both observation parameters, without hash parameters.
toObservation	query	string	Newer public observation reference: obs:<id>.

Returns SemanticDiff

cURL

curl -s "https://did.is/api/v1/diff/did%3Aweb%3Aidentity.foundation"

Live against https://did.is/api; counts toward your anonymous budget.

API reference · Credentials

Credentials · intensive

Verify a credential

POST/v1/credentials/verify

Data Integrity (eddsa-jcs-2022, ecdsa-jcs-2019), VC-JWT 1.1, vc+jwt and SD-JWT VC (dc+sd-jwt, draft-19 over RFC 9901: disclosure digests, Key Binding JWT, Token Status List; disclosed values are never returned, only paths; issuer trust is reported categorically in issuerTrust and EU trusted lists are not checked; an x5c leaf must name the HTTPS iss in a DNS or URI subjectAltName and be within its validity period, else INVALID; without trustedIssuerCertificates a matching x5c signature is INDETERMINATE, never VALID). ISO mdoc is recognised and reported UNSUPPORTED. The signing key must belong to the issuer DID and be authorised for assertionMethod. Bitstring Status List entries are fetched, their list credential verified, and evaluated fail-closed. Status precedence: MALFORMED > INVALID > UNSUPPORTED > REVOKED > SUSPENDED > EXPIRED > NOT_YET_VALID > INDETERMINATE > VALID.

Parameter	In	Type	Description
credential (required)	body	object \| string	Credential object, raw JSON string, or compact JWT. Raw text preserves member identity.
expectedAudience	body	string	Optional expected JWT recipient (also the SD-JWT Key Binding JWT aud). Without it, audience is explicitly not verified.
expectedNonce	body	string	SD-JWT VC only: expected Key Binding JWT nonce. Without it, replay is not excluded.
trustedIssuerCertificates	body	string[]	SD-JWT VC only: up to 8 caller-chosen X.509 trust anchors (PEM or base64 DER) for x5c chains. Without them an x5c-signed credential is never VALID; EU trusted lists are not consulted.
requiredClaims	body	object[]	Optional 1 to 16 conditions {path, equals} checked without returning claim values: path is a JSON Pointer into the issuer-signed claims (for SD-JWT VC, after disclosures), equals is a boolean, integer or non-empty string. Evaluated only when status is VALID; the response carries requirements.met and per-path results SATISFIED, NOT_SATISFIED, NOT_DISCLOSED or NOT_EVALUATED, never the value.

Returns CredentialVerification

cURL

curl -s -X POST "https://did.is/api/v1/credentials/verify" \
  -H 'Content-Type: application/json' \
  -d '{"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"type":["VerifiableCredential"],"issuer":"did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK","validFrom":"2026-01-01T00:00:00Z","credentialSubject":{"id":"did:key:z6MkiTBz1ymuepAQ4HEHYSF1H8quG5GLdmQR63zLFKfvUwi3"}}}'

Credentials · intensive

Evaluate a policy

POST/v1/policies/evaluate

Evaluates declarative rules (allowedMethods, allowedCurves, minKeyBits, requireKeyRelationship, domainBinding, tlsMinDaysRemaining, linkedAccounts, verifiableHistory, maxCacheAgeSeconds, credentialStatus, credentialIssuerMustBeSubject) against observed evidence. Unevaluable rules are INDETERMINATE, never PASS. Unknown rule names or policy fields and unsupported rule values return 400 INVALID_REQUEST (RFC 9457); organizationRegistry and issuerTrustAnchor are not implemented. credentialStatus accepts only active and requires a valid credential plus complete verified active status-list evidence; a valid signature without a status mechanism is INDETERMINATE. Empty rules remain INDETERMINATE.

Parameter	In	Type	Description
did (required)	body	string	Subject DID.
policy (required)	body	{ name?, rules }	Rule set.
credential	body	object \| string	Optional credential to evaluate.

Returns { evaluation, credential, resolution }

cURL

curl -s -X POST "https://did.is/api/v1/policies/evaluate" \
  -H 'Content-Type: application/json' \
  -d '{"did":"did:web:identity.foundation","policy":{"rules":{"didResolution":"required","domainBinding":"required"}}}'

API reference · Agents

Agents · intensive

Inspect an MCP server

GET/v1/mcp/inspect

Streamable HTTP: server/discover (2026-07-28) with legacy initialize fallback; paginated tools/list; SHA-256 fingerprints of every tool definition (RFC 8785); declared annotations vs heuristic side-effect classes; risk signals; drift against the previous observation. 401 responses are reported, never bypassed.

Parameter	In	Type	Description
endpoint (required)	query	https URL	The MCP endpoint.

Returns McpInspection

cURL

curl -s "https://did.is/api/v1/mcp/inspect?endpoint=https%3A%2F%2Fmcp.example.com%2Fmcp"

Agents · intensive

Inspect an A2A agent card

GET/v1/a2a/inspect

Fetches /.well-known/agent-card.json (legacy agent.json fallback), validates the A2A 1.0 shape, and verifies signatures[] (JWS over the JCS card) with keys from a DID kid or an HTTPS jku.

Parameter	In	Type	Description
url (required)	query	https URL	Agent origin or card URL.

Returns A2aInspection

cURL

curl -s "https://did.is/api/v1/a2a/inspect?url=https%3A%2F%2Fagent.example"

Agents · intensive

Verify a delegation chain

POST/v1/agents/verify-delegation

DID.is Delegation Receipt v1 (experimental): compact JWS receipts, root first. Verifies signatures via capabilityDelegation keys, issuer/audience and prf hash linkage, temporal containment, capability attenuation, acyclicity and depth ≤ 8. register: true stores VALID chains for /v1/agents/verify-tool.

Parameter	In	Type	Description
chain (required)	body	string[]	Receipts, root first.
trustedRoots	body	string[]	Acceptable root DIDs.
register	body	boolean	Store if VALID.

Returns { result: DelegationChainResult, registered }

cURL

curl -s -X POST "https://did.is/api/v1/agents/verify-delegation" \
  -H 'Content-Type: application/json' \
  -d '{"chain":[],"trustedRoots":["did:web:bank.example"]}'

Agents · intensive

Authorise a tool call

POST/v1/agents/authorize

Stateless: verifies the chain and checks that its leaf capabilities grant the tool (exact name, *, or ns:* for tools named ns:…).

Parameter	In	Type	Description
chain (required)	body	string[]	Receipts, root first.
tool (required)	body	string	Tool name.
trustedRoots	body	string[]	Acceptable root DIDs; a chain from any other root is denied.

Returns { authorization: ToolAuthorization, chain }

cURL

curl -s -X POST "https://did.is/api/v1/agents/authorize" \
  -H 'Content-Type: application/json' \
  -d '{"chain":[],"tool":"payments:transfer"}'

Agents

Check a registered agent

GET/v1/agents/verify-tool

Answers ALLOW or DENY for an agent and tool against delegation chains previously registered with verify-delegation (register: true). Without a registered VALID chain the answer is DENY.

Parameter	In	Type	Description
agent (required)	query	DID	The acting agent.
tool (required)	query	string	Tool name.
root	query	DID	Require this delegation root.

Returns { agent, tool, decision, authorized, reason }

cURL

curl -s "https://did.is/api/v1/agents/verify-tool?agent=did%3Aweb%3Aagent.example&tool=payments:transfer"

Live against https://did.is/api; counts toward your anonymous budget.

API reference · Fast verify

Fast verify

Fast DID verdict

GET/v1/fast-verify/did/{did}

Compact projection for gateways and agents: outcome, headline, dimension states, keys and document hash. Served from cache when fresh.

Parameter	In	Type	Description
did (required)	path	DID	The identifier.
noCache	query	boolean	Bypass and refresh the resolver cache.

Returns { did, resolved, outcome, headline, statements, dimensions, keys, domainBinding, documentSha256, observedAt, cached }

cURL

curl -s "https://did.is/api/v1/fast-verify/did/did%3Aweb%3Aidentity.foundation"

Live against https://did.is/api; counts toward your anonymous budget.

Fast verify

Verify a JWS against a DID

POST/v1/fast-verify/jws

Resolves the DID in the JWS kid, requires the key in assertionMethod or authentication (or the relationship you name), and verifies the signature.

Parameter	In	Type	Description
jws (required)	body	string	Compact JWS with a DID URL kid.
relationship	body	string	Required verification relationship.

Returns { status, valid, headline, signer, relationship, payload }

cURL

curl -s -X POST "https://did.is/api/v1/fast-verify/jws" \
  -H 'Content-Type: application/json' \
  -d '{"jws":"eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2hhWGdCWkR2b3REa0w1MjU3ZmFpenRpR2lDMlF0S0xHcGJubkVHdGEyZG9LI2tleS0xIn0.eyJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyJ9.c2lnbmF0dXJl"}'

API reference · Directory

Verified control claims

GET/v1/claims/{did}

Current, unexpired proofs that a controller demonstrated control of this DID (for example a key signature), each stating what it proves and what it does not. A claim is not legal identity.

Parameter	In	Type	Description
did (required)	path	DID	The identifier.

Returns { did, claims: Claim[], listing, note }

cURL

curl -s "https://did.is/api/v1/claims/did%3Aweb%3Adid.is"

Live against https://did.is/api; counts toward your anonymous budget.

Search the directory

GET/v1/directory

Identifiers whose controller proved control and opted in to be listed. Listings cannot be bought. Unknown or repeated parameters are rejected.

Parameter	In	Type	Description
q	query	string	Free text, up to 100 characters.
method	query	string	DID method filter, e.g. web, key, webvh.
limit	query	integer	1–50 (default 20).
cursor	query	string	nextCursor from the previous page.

Returns { entries: DirectoryEntry[], nextCursor, note }

cURL

curl -s "https://did.is/api/v1/directory?method=web&limit=5"

Live against https://did.is/api; counts toward your anonymous budget.

API reference · Service

Service

Health and capabilities

GET/health

Liveness plus the supported DID methods and implemented standard versions. Not rate limited.

Returns { status, name, version, time, supportedMethods, standards, monitoring, rateLimited }

cURL

curl -s "https://did.is/api/health"

Live against https://did.is/api; counts toward your anonymous budget.

Service

Service status

GET/v1/status

Machine-readable component status behind did.is/status: resolution, console, billing, monitoring and more.

Returns { status, checkedAt, components: Component[] }

cURL

curl -s "https://did.is/api/v1/status"

Live against https://did.is/api; counts toward your anonymous budget.