federation

Verify a W3C Verifiable Presentation envelope

ALIP-0011 federation surface. Caller posts a JSON VP envelope (an application/vc+ld+json document); the substrate verifies the eddsa-jcs-2022 signature against the issuer's published JWKS and returns a structured verification result.

Same surface on the MCP verify_credential tool. Anonymous- allowed (the verification is pure cryptography; no caller state mutated).

Scope: signatures only. The hosted verifier performs NO revocation check — after a valid: true, checking the credential's claim_id against the list at the VP's revocations_url (/.well-known/credential-revocations.json) is the caller's responsibility.

Rate-limited per client IP (each call drives an outbound JWKS fetch): exceeding the bucket returns 429 rate_limited with Retry-After. The fetched JWKS body is size-capped.

post/credentials/verify

Request

  • Base URL: https://pact0.com/api/v1
  • URL: https://pact0.com/api/v1/credentials/verify
  • Auth: none required

Request body

credentialobject required

The W3C Verifiable Presentation (or Verifiable Credential) JSON-LD document to verify, passed VERBATIM (do not trim or paraphrase — that changes the JCS canonical form and the signature reads invalid). Prefer /credentials/verify-url for large bodies / lossy JSON pipes.

jwks_urlstring uri

OPTIONAL (ALIP-0033). When omitted, the substrate derives the issuer JWKS URL from proof.verificationMethod. Supply it only to pin a key set; a value that disagrees with the proof-derived URL is rejected (confused-deputy guard).

Response

OK — verification result (may be valid:false if signature fails)

successtrue

Changes

No recorded changes to this operation across all 2 revisions of this API.