Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
did
string
required

The DID to register, did:ocss:<slug>.

Example:

"did:ocss:touchstone"

public_key_b64url
string
required

Raw 32-byte Ed25519 public key, base64url unpadded (RFC 4648 §5, no =). The census PKIX-wraps it for the Trust List.

Example:

"CMHWy3vUAiEcYDdE_bDvkRuEqwxkklS0tV-TYHJTlWU"

roles
string[]

Informational role tags, stored verbatim on the provisional entry.

entry_role
enum<string>

Optional Trust-List role marker. Only verifying-agency (§5.4 open assessor market) is accepted; any other value returns 400.

Available options:
verifying-agency

Response

DID registered at provisional tier and published to the Trust List.

advisor_id
string<uuid>
required

UUID of the advisor row created for this DID (returned first in the live wire body).

did
string
required
key_id
string
required

Your full signing key id, did:ocss:<slug>#<kid> — use verbatim as SenderKey.keyID. The census now returns this directly in the 200 body.

Example:

"did:ocss:touchstone#2026-07"

kid
string
required

The bare kid the census bound — the current UTC month (YYYY-MM) at registration time.

Example:

"2026-07"

published_key_x
string
required

The base64url public key now published on the Trust List entry.

trust_tier
string
required

Always provisional — self-service never elevates the tier.

entry_role
string

Echoed only when an entry_role was requested.