---
title: "Verify the published DID Document on the tenant domain"
method: POST
path: "/v1/dpp/certification-key/did-web-config/verify"
tags: ["DPP"]
---

# Verify the published DID Document on the tenant domain

`POST /v1/dpp/certification-key/did-web-config/verify`

## Request

- Base URL: `https://api.prod.keyban.io`
- URL: `https://api.prod.keyban.io/v1/dpp/certification-key/did-web-config/verify`
- Auth: `X-Api-Key` (a scheme the document does not define)

Fetches `https://{domain}/.well-known/did.json` server-side and checks it matches the active certification key. Always responds with HTTP 200 and a discriminated body — even on network or mismatch failures — so the admin UI can render a clear OK / KO state. Also refreshes the persisted `lastCheck` snapshot returned by GET did-web-config (audited for that reason; permission stays `read` — the snapshot is derived health state, not configuration). Returns 400 only when the tenant has no domain configured.

## Response `200`

- union
  - object
    - `status` 'ok', required: The DID Document published at `https://{domain}/.well-known/did.json` resolves and matches the active certification key.
    - `domain` string, required: The domain that was checked (echoed from the tenant config).
    - `fetchedAt` string, date-time, required: RFC 3339 timestamp of the fetch attempt against the domain.
  - object
    - `status` 'failed', required: The verification could not complete or the document did not match.
    - `domain` string, required: The domain that was checked (echoed from the tenant config).
    - `fetchedAt` string, date-time, required: RFC 3339 timestamp of the fetch attempt against the domain.
    - `reason` 'unreachable' | 'tls_invalid' | 'timeout' | 'http_error' | 'redirect_not_allowed' | 'not_json' | 'invalid_did_document' | 'key_mismatch' | 'missing_assertion_method' | 'blocked_address', required: Specific reason the verification failed. `blocked_address`: the domain resolves to a private/loopback/link-local IP, refused as an SSRF precaution. `unreachable`: DNS/network failure or connection refused. `tls_invalid`: certificate chain validation failed. `timeout`: request or body read exceeded 5s. `http_error`: 4xx/5xx response. `redirect_not_allowed`: 3xx response (the did:web spec forbids redirects on `.well-known/did.json`). `not_json`: body could not be parsed as JSON or exceeded 1 MiB. `invalid_did_document`: structure violates W3C DID Core or `id` does not match the configured domain. `key_mismatch`: the published `verificationMethod[].publicKeyJwk` does not include the org's active certification key. `missing_assertion_method`: the published `assertionMethod` does not reference the active key fragment.
    - `detail` string, nullable: Human-readable diagnostic appended to the reason (e.g. the underlying error message or HTTP status). Free-form English, do not pattern-match.

---

[API](https://skmtc.dev/keyban/apis/keyban-rest-apis.md) · [All operations](https://skmtc.dev/keyban/apis/keyban-rest-apis/llms.txt) · [OpenAPI document](https://skmtc.dev/keyban/apis/keyban-rest-apis/revisions/0bb79a1da961?raw)