identifiers

📄️Create a decentralised identifier for an organization

Requires `Idempotency-Key`. Names an organization inside the caller scope; the issuance module reads the organization itself and takes nothing else about it from the body. An organization may hold one identifier that has not failed: a second is refused with 409 and code `identifier.exists`.

📄️List the identifiers inside the caller scope

Filtered by organization and status, in pages: pass `nextCursor` back as `cursor`. A cursor this list did not issue is refused with 400 and code `identifier.cursor_invalid`, at `query.cursor`. An identifier outside the caller scope is never listed.

📄️Read one identifier

An identifier that does not exist and one outside the caller scope get the same 404. This is the route to poll after creating: `status` moves from `placing` to `prepared` within seconds. `method` and `history` say which kind of identifier it is: `history` is `false` for `did:web`, whose changes cannot be verified against what came before.

📄️Read the exact DID document that will be published

The document as it will be published, the URLs it will be served at and the keys behind it. Reading it is what allows publication: publish is refused until the current document has been previewed, and a document rendered again since the last preview needs a new one. `document` is canonical JSON text; parse it to read it, and compare `documentDigest` with the SHA-256 of its bytes to know nothing changed it on the way. For a `webvh` identifier, `parallelDocument` is the `did:web` form served beside the log. An identifier still in `placing` has no document yet and is refused with 409; read the identifier until it is `prepared`.

📄️Publish the previewed DID document

Requires `Idempotency-Key`; takes no body. The agent signs the previewed document with keys that never leave their token, and the result is written to the identifier host: the log at `/.well-known/did.jsonl` and the `did:web` form at `/.well-known/did.json` for `webvh`, the second alone for `web`. The identifier then resolves, and a resolver may go on seeing the previous version for up to five minutes.

📄️Begin a key rotation for a published identifier

Requires `Idempotency-Key`; takes no body. Generates a new assertion key and renders the document again with it. The identifier returns to state `prepared` and the version already published stays served; preview the new document, then publish it. For `webvh` the publication appends one log entry, signed by the current update key, that a verifier can check against the entry before. For `web` it overwrites the document, and nothing lets a verifier tell that from a substitution. The replaced key is kept and listed in `retiredAssertionKeyIds`, because a credential signed under it must stay verifiable. The host and the method cannot be changed. An identifier that is not `published` is refused with 409.