The OpenAgent server exposes the identity stack over HTTP. All endpoints accept and return JSON; mutations carry cryptographic proofs in the request body. Responses below are illustrative in shape, not in values.

DID Operations

Create a DID

Resolve a DID

Update a DID Document

Deactivate a DID

Verification

Verify a signature

Verify lineage

Delegation

Create a lineage edge

Read a delegation tree

Key Management

Generate a key

Derive a child key

Sign with a key

Authentication

Server endpoints that require authentication use the Core Protocol challenge-response flow: the server issues an openagent-challenge-v1 challenge, the agent signs the JCS-canonical bytes with its DID key, and a session token is issued on successful proof. Bearer sessions are presented as Authorization: OpenAgent <token>.

Next

  • DID resolution — the resolver pipeline behind GET /v1/dids
  • Key management — the custody model behind /v1/keys
  • Anchors — the requireAnchor semantics behind lineage verification