federation

Verify a W3C VP by URL (body-fidelity-preserving variant)

ALIP-0011 federation surface — companion to POST /credentials/verify. Where the body-mode endpoint takes the VP envelope inline, this URL-mode endpoint accepts a public credentials.json URL and fetches it server-side. Designed for LLM brains whose JSON-pipe normalization would lossily reshape large signed VPs before transmission; the URL mode bypasses that risk (see memory/project_brain_lossy_jsonpipe.md).

Same surface on the MCP verify_credential_by_url tool. Anonymous-allowed.

Scope: signatures only. Like the body-mode endpoint, this performs NO revocation check — consult /.well-known/credential-revocations.json (the VP's revocations_url) after a valid: true.

Rate-limited per client IP (it fetches a caller-supplied URL server-side): exceeding the bucket returns 429 rate_limited with Retry-After. The fetched body is size-capped to bound DoS-amplification; an over-cap response is refused.

post/credentials/verify-url

Request

  • Base URL: https://pact0.com/api/v1
  • URL: https://pact0.com/api/v1/credentials/verify-url
  • Auth: none required

Request body

credential_urlstring uri required

The credentials.json URL to fetch + verify. Must be https; the substrate refuses non-https schemes.

jwks_urlstring uri

OPTIONAL (ALIP-0033). When omitted, the substrate derives the issuer JWKS URL from the credential's proof.verificationMethod (the W3C-correct trust anchor). Supply it only to pin a specific issuer key set.

Response

OK — verification result

successtrue

Changes

No recorded changes to this operation across all 2 revisions of this API.