---
title: "Set or clear the self-hosted DID Web domain"
method: PUT
path: "/v1/dpp/certification-key/did-web-config"
tags: ["DPP"]
---

# Set or clear the self-hosted DID Web domain

`PUT /v1/dpp/certification-key/did-web-config`

## Request

- Base URL: `https://api.prod.keyban.io`
- URL: `https://api.prod.keyban.io/v1/dpp/certification-key/did-web-config`
- Auth: `X-Api-Key` (a scheme the document does not define)

Configure the bare host on which the tenant publishes `.well-known/did.json`. Pass `domain: null` to disable self-hosted DID Web (VCs fall back to `did:key`). Returns the updated DID Document for the integrator to copy-paste onto their domain.

## Request body

- SetDidWebDomainDto
  - `domain` string, nullable, required: Bare host on which the tenant publishes `.well-known/did.json` (HTTPS, no scheme/path/port). Pass `null` to disable self-hosted DID Web and fall back to `did:key`.

## Response `200`

- DidWebConfigResponseDto
  - `domain` string, nullable, required: Currently configured `did:web` domain, or `null` if self-hosted DID Web is disabled for this tenant.
  - `didDocument` object, nullable, required: DID Document to publish at `https://{domain}/.well-known/did.json`. `null` when no domain is configured. Regenerate on every certification key rotation.
    - `@context` string[], required: JSON-LD contexts. Includes DID Core v1 and JsonWebKey2020 suite.
    - `id` string, required: The DID identifier (`did:web:{domain}`).
    - `verificationMethod` object[], required
      - `id` string, required: Verification method DID URL (DID + `#fragment`).
      - `type` 'JsonWebKey2020', required: Key suite identifier per W3C JsonWebKey2020.
      - `controller` string, required: DID that controls (i.e. can rotate) this key.
      - `publicKeyJwk` object, required: P-256 public key serialized as a JSON Web Key (RFC 7517).
        - `kty` 'EC', required: Key type — always `EC` for P-256.
        - `crv` 'P-256', required: Curve identifier per RFC 7518.
        - `x` string, required: Base64url-encoded 32-byte X coordinate.
        - `y` string, required: Base64url-encoded 32-byte Y coordinate.
    - `assertionMethod` string[], required: Verification methods authorized to issue assertions (sign VCs).
    - `authentication` string[], required: Verification methods authorized for DID authentication.
  - `lastCheck` object, nullable, required: Result of the latest did:web publication check. `null` when the domain has never been checked (or no domain is configured).
    - `at` string, date-time, required: RFC 3339 timestamp of the most recent did:web publication check (manual verify or certification attempt).
    - `status` 'ok' | 'failed', required: `ok`: the published did.json matched the active certification key at `at`. `failed`: it was unreachable or did not match — new certifications fail until the tenant repairs it.
    - `reason` 'unreachable' | 'tls_invalid' | 'timeout' | 'http_error' | 'redirect_not_allowed' | 'not_json' | 'invalid_did_document' | 'key_mismatch' | 'missing_assertion_method' | 'blocked_address' | 'null', nullable, required: Failure reason; `null` when status is `ok`.

---

[API](https://skmtc.dev/keyban/apis/keyban-rest-apis.md) · [All operations](https://skmtc.dev/keyban/apis/keyban-rest-apis/llms.txt) · [OpenAPI document](https://skmtc.dev/keyban/apis/keyban-rest-apis/revisions/0bb79a1da961?raw)