Register an agent in the portal
Task: get an AID for an agent you run. Today this is done in the registry portal at registry.aria.bar; it issues L0. The flow is the Create operation of §3.5.1; the private key never leaves your machine.
Before you start
You need an account (the portal redirects to sign-in) and a name for the agent: lowercase letters, digits and hyphens, up to 64 characters. Decide the scopes it will request in the three-segment form namespace:resource:action — the registry's namespaces are listed at GET /v1/scopes.
Screen 1 · Sign in and open "New agent"
Sign in at registry.aria.bar. From the dashboard, open Agents → New agent (the direct URL is /aria/agents/new).
Screen 2 · Generate the holder key in the browser
The portal's key generator runs in your browser and produces an Ed25519 keypair. Save the private key where the agent will run; the portal never receives it. Only the public key goes into the manifest. If you lose the private key you re-issue with a new one (#holder-key-2); the DID does not change.
Screen 3 · Fill the manifest
Agent name, version, requested scopes, and the principal (your organization as registered). At L0 the organization name is self-declared and the AID will say so (verificationStatus: "self-declared").
Screen 4 · Issue
The registry reserves the identifier, redeems the reservation and signs the credential with the composite suite. You get the DID and a link to the credential.
You should see
curl -s https://api.aria.bar/v1/aids/<your-did> | head -c 400A JSON document whose credentialSubject.id is your DID, credentialSubject.trustLevel is "L0", and proof.cryptosuite is "mldsa65-ed25519-2026". Your agent now has a resolvable identity. Verify it offline with H1.
An enrollment SDK, so this flow runs from code instead of the portal, is planned: /planned#enrollment-sdk. L1 and above, which add the person verification and the domain anchor, are specified and not yet issued: /planned#l1-l3.