English only · Spanish [PLANNED]

Reading an AID

The document below is the example from §4 of the specification, a preview-line L0 credential, rendered from the same data. Every field that deserves a word gets one in the margin: what it is, who put it there, and where the rule lives. Nothing in the margin is normative; the schema is.

Three things to notice before you read: the DID stays across re-issuances while the credential id changes; trustLevel is the registry's conclusion, not the agent's claim; and the proof is the registry's signature, while holderKey is the agent's key. Two parties, two keys.

{

  "id": "https://api.aria.bar/v1/credentials/019e74c5-0595-74a7-99b2-f0e488c71eb8",

Credential-instance URL. A new one on every re-issuance; the DID stays. · registry · §3.5.3

  "type": [

W3C VC 2.0 plus the ARIA type. · registry · §4

    "VerifiableCredential",

    "ARIAIdentityDocument"

],

  "issuer": "did:aria:registry.aria.bar",

The registry that signed. TrustLayer Foundation after the cutover. · registry · cutover [PLANNED]

  "@context": [

JSON-LD contexts: VC 2.0 and the ARIA vocabulary. · registry

    "https://www.w3.org/ns/credentials/v2",

    "https://aria.bar/ns/v1"

],

  "validFrom": "2026-05-29T17:25:29.663Z",

Start of validity. · registry · §2 validity

  "validUntil": "2027-05-30T17:25:29.663Z",

End of validity: 366 days at L0/L1, shorter above. · registry · §2

  "credentialStatus": {

Pointer to the Bitstring Status List and this credential’s bit. · registry · H4

    "id": "https://api.aria.bar/v1/status/1#42",

    "type": "BitstringStatusListEntry",

    "statusPurpose": "revocation",

    "statusListIndex": "42",

    "statusListCredential": "https://api.aria.bar/v1/status/1"

},

  "credentialSubject": {

    "id": "did:aria:aria.bar:u-a1b2c3d4:ordering-agent",

The agent’s DID. Registry-form here: registry host, account, agent slug. · controller (slug) + registry (namespace) · §3.1

    "spec_version": "1.2",

Preview line today (1.2); 1.0 after the cutover. · registry · §0

    "agentName": "ordering-agent",

Declared by the controller. Not verified. · controller

    "version": "1.0.0",

Declared by the controller. · controller

    "trustLevel": "L0",

Derived from the evidence, never declared. · registry · E3

    "principal": {

The entity the agent acts for. · registry from the account · E4

      "did": "did:aria:u-a1b2c3d4:org",

Principal DID. No key is published for it today. · registry · E5

      "legalName": "Example Corp",

Organization name only. Self-declared at L0; never a natural person. · registrant · COM-09

      "jurisdiction": "US",

Declared at L0; confirmed from L2. · registrant

      "verificationStatus": "self-declared"

Machine-readable provenance of the name: self-declared | registry-confirmed | legal-verified. · registry · §4

},

    "holderKey": {

The agent’s Ed25519 public key, generated on the controller’s machine. Answers challenges under ATP. · controller · §3.5.1

      "id": "did:aria:aria.bar:u-a1b2c3d4:ordering-agent#holder-key-1",

      "type": "Ed25519VerificationKey2020",

      "publicKeyMultibase": "zF3xFtomJS7KN4ddhzUG1fPbprAE2tz5RFnt5i3nd17Zx"

},

    "scope": [

Requested scopes, three segments each. · controller, accepted by registry · §6

      "communication:human:read",

      "communication:human:write"

],

    "hitlRequired": [],

Human-in-the-loop tiers, if any. · controller · §6

    "delegationDepth": 0,

Always 0 today: no sub-agent issuance exists. · registry · [PLANNED]

    "maxDelegationDepth": 4,

Protocol ceiling, 4. · registry · §6

    "enrollmentAttestation": {

That the registrant accepted the terms, and which versions. · registry

      "attestedAt": "2026-05-29T17:25:29.666Z",

      "termsVersion": "1.2.0",

      "privacyVersion": "1.2.0",

      "userAgentAgreement": true

}

},

  "proof": {

The registry’s composite signature over the canonicalised credential. · registry · §5.1

    "type": "DataIntegrityProof",

    "created": "2026-05-29T17:25:29.694Z",

    "proofValue": "AAAM7TSQEPZgA2cNDhuV22GY0sDJ...HnttyM7oygzY_YQA",

Unpadded base64url of u32be(pq_len) ‖ ML-DSA-65 signature ‖ Ed25519 signature. Both halves must verify. · registry · §5.1

    "cryptosuite": "mldsa65-ed25519-2026",

    "proofPurpose": "assertionMethod",

    "verificationMethod": "did:aria:registry.aria.bar#key-1"

The registry key. Pinned in the SDK today; key discovery is planned. · registry · [PLANNED]

}

}

Fields not annotated are self-explanatory or purely structural. The full schema, including fields absent from this L0 example (the dnsAnchor pointer from L1, the intent declaration when present), is in §4. To verify a document like this one: Verify a credential offline.