Relying party / verifier — Partners

What ORBIS needs from you

You do not need an ORBIS account

The verification rail is public and CORS-open. You can check a proof today, from any origin, with no account, no API key and no application — and if that is all you need, stop here and go build. Apply only if you want a commercial relationship with ORBIS or a marketplace listing. The listing is NOT BUILT yet, so today an application buys a conversation and nothing technical: the verification rail is already open to you.

Nothing, to start verifying. /verify/catalog, /verify/request and /verify/result are public and CORS-open. The result poll carries the per-transaction resultToken that /verify/request handed you — a read capability for your own outcome, not an account and not an API key.
If you do apply: the entity, a contact, and which credential types you expect to check.

What ORBIS will never ask you for

A secret, a token, a private key, or a password — on this page or any other public one. There is no field for one anywhere in this pipeline. An operator token is revealed exactly once during provisioning and ORBIS keeps only its hash, so nobody at ORBIS can re-show it to you and nobody should ever ask you to send one back.

What the platform will prove before you go live

Not checkboxes — the real exercises, run against your integration, each recording the evidence it saw. This is what replaces weeks of email, and what stops anyone reaching production on a broken integration.

An OID4VP presentation completes end to end and verifies.
A revoked credential is refused against the signed status list.
A replayed presentation, a wrong audience and a wrong nonce are each refused.

Not built The engine that runs these is being built now. When it is wired, each check on your status page carries what it proves, what it saw, and — on a failure — the concrete fix.

The calls

Copy-pasteable, in order. Nothing here has been executed against the production origin and no value below is live data. Run everything against a demo- organization first.

Run this right now — no account, no key, any origin

# What can be asked for on this deployment.
curl -sS https://orbis.id/verify/catalog
# → {"types":[{"id":"...","name":"...","vct":"...","tenant":"...","claims":["..."]}]}

Ask for exactly the claims you need

curl -sS https://orbis.id/verify/request \
  -H 'content-type: application/json' \
  -d '{"vct":"<vct>","claims":["carrier_name"],
       "nonce":"<your session nonce>","aud":"https://your-app.example"}'
# → {"requestUri":"openid4vp://?request_uri=...","transactionId":"..."}
# Render requestUri as a QR. Binding the request to YOUR nonce and YOUR
# audience is what makes a replayed presentation useless against you.

Poll the outcome — it stays null until the round-trip really completed

curl -sS https://orbis.id/verify/result/<transactionId> \
  -H 'authorization: Bearer <resultToken>'
# The resultToken came back with the request handle. It is what makes the
# outcome YOURS: without it the poll reads null, exactly like an unknown
# transaction. It is not an account and not an API key — you still registered
# for nothing.
# → {"outcome":{"ok":true,"presentation":{...},"presentedNonce":"...","presentedAud":"..."}}
# → {"outcome":{"ok":false,"error":"<which link of the chain failed>"}}

Or run the chain yourself and depend on nothing of ours

# Resolve the issuer's did:web, fetch its signed status list, and check the
# five links in your own code. Both routes check the same things; the hosted
# flow is a convenience, never a trust dependency.
curl -sS https://orbis.id/.well-known/did.json
curl -sS https://orbis.id/status/1

Operations used on this path: GET /verify/catalog, POST /verify/request, GET /verify/result/{transactionId}. Their request and response shapes are in /openapi.json.

What happens next

Applied ORBIS acts

Your application exists and is in the review queue. Nothing has been provisioned.

What moves it: An ORBIS reviewer picks it up. You do not need to do anything.
Reviewing ORBIS acts

A reviewer is reading it and may come back to you with questions.

What moves it: The reviewer either asks you something or moves you to a sandbox.
Sandbox you act

You have a demonstration organization to build against. It is marked as a demo everywhere, permanently.

What moves it: You build the integration, then ask for certification.
Certifying you act

The platform is running the real exercises against your integration and recording the evidence.

What moves it: Every check on the readiness board passes. Each failure names the concrete fix.
Live nobody waits

You are a provisioned organization on the production rail.

What moves it: Nothing — this is the destination. Your organization is now managed in Organizations, not here.

No duration is published for these stages because none has been measured — see the pipeline for why that is deliberate.

Check an existing application

Already a partner? Sign in to the partner portal to see your status, issue and revoke your own API keys, and manage who else is on your account. To read your status without signing in, /partners/status takes your reference and contact email and nothing else.

The API reference lives at /developers and the machine-readable contract at /openapi.json. Nothing on this page restates them — they are the one source.