API definitions
Registration & transparency
Machine-readable OpenAPI definitions for the Registration Authority and Transparency Log, plus the V2 event schemas.
Registration API ↗Transparency Log API ↗
Event and response schemas ↗
Specs & docs
The specification is the source of truth.
ANS is defined in seven layers, with separate API contracts and worked examples. Use the canonical documents for normative requirements.
Seven layers, from identity to authentication.
- ANS-0Identity
Domain control, proof of key possession, and optional Verified Identities.
- ANS-1Registration
Registration, activation, renewal, deprecation, and revocation.
- ANS-2Versioned naming
ANS names and the certificates that bind an identity to a version.
- ANS-3DNS publication
Discovery profiles, badge records, and optional DANE bindings.
- ANS-4Transparency
Signed lifecycle events, SCITT receipts, and verifiable log history.
- ANS-5Integrity monitoring
Periodic verification and reports about changes to registered artifacts.
- ANS-6Agent authentication
Peer identity, current status, and possession through mTLS or DPoP.
The specifications are drafts under active development. The links above point to the current documents in the specification repository.
Implement the contract.
Transparency Log API ↗
Event and response schemas ↗
Worked examples
Follow the artifacts.
Read registration, transparency, integrity-monitoring, and authentication examples alongside their specifications.
Protocol examples ↗Runnable reference implementation ↗
Profiles
Discovery & identity
DNS publication profiles define discovery records. Optional identity profiles define additional proofs and their verification requirements.
Discovery profiles ↗Identity profiles ↗
Security
Review the assumptions.
The MAESTRO analysis maps threats and mitigations across the architecture. Each protocol layer also includes its security considerations.
Security analysis ↗Vulnerability reporting ↗