Core concepts

Every resolution from GET /v1/resolve/{did} (and the result page on did.is) has two layers: a short verdict and seven evidence dimensions. The same dimensions appear in the stream result, in history snapshots and in the compact fast-verify response.

Verdict

Field	Meaning
outcome	RESOLVED, RESOLVED_WITH_WARNINGS (a dimension FAILED, a key is invalid, or the document has warnings) or DEACTIVATED.
headline	One sentence about control, e.g. “Cryptographically controlled via Ed25519.”
statements	Short facts about origin, history and identity.

The verdict is a summary of the dimensions, not a score.

The seven dimensions

Always returned in this order:

id	Label	Question it answers
integrity	Document integrity	Is this the document the identifier or its origin actually commits to?
keys	Key material	Are the published keys well-formed and usable for their relationships?
control	Update authority	Who can change this identifier, and is that cryptographically enforced?
origin	Origin binding	Does the web origin link back to this DID (DIF Well-Known DID Configuration)?
transport	Transport security	Was the document fetched over TLS with a publicly trusted certificate?
history	Verifiable history	Is there a signed, hash-chained record of past versions?
organization	Real-world identity	Who operates the identifier? DID.is does not verify this.

States

State	Meaning
ESTABLISHED	The check ran and succeeded.
SELF_CERTIFYING	True by construction: the identifier itself encodes it (did:key, did:jwk).
NOT_ESTABLISHED	Nothing establishes it. Not a failure; the evidence does not exist.
FAILED	The check ran and the evidence is wrong, e.g. document id mismatch or invalid linkage proof.
INDETERMINATE	The check could not be completed, e.g. unsupported proof format or unreachable configuration.
NOT_APPLICABLE	The dimension does not apply to this method or result.

Live examples

Three identifiers resolved against the live API:

Dimension	did:key:z6Mkha…2doK	did:web:did.is	did:web:identity.foundation
integrityDocument integrity	SELF_CERTIFYINGThe document is derived deterministically from the identifier itself.	ESTABLISHEDRetrieved from did.is and its id equals the DID (SHA-256 08a92bc6643f…).	ESTABLISHEDRetrieved from identity.foundation and its id equals the DID (SHA-256 ed807e81aac6…).
keysKey material	ESTABLISHED1 verification method validated (Ed25519).	ESTABLISHED1 verification method validated (Ed25519).	ESTABLISHED1 verification method validated (P-256).
controlUpdate authority	SELF_CERTIFYINGControlled solely by the holder of the Ed25519 private key; the identifier cannot be updated or deactivated.	NOT_ESTABLISHEDWhoever controls the web server and DNS for did.is can replace this document.	NOT_ESTABLISHEDWhoever controls the web server and DNS for identity.foundation can replace this document.
originOrigin binding	NOT_APPLICABLEdid:key is not bound to a web origin.	ESTABLISHEDOrigin https://did.is verified via DIF Well-Known DID Configuration.	INDETERMINATELinkage proof format not supported: legacy Linked Data proof type 'JsonWebSignature2020' requires JSON-LD/RDF canonicalization, which DID.is does not implement
transportTransport security	NOT_APPLICABLENo network retrieval was needed.	ESTABLISHEDTLS certificate for did.is issued by Let's Encrypt, valid until 2027-01-01 (82 days).	ESTABLISHEDTLS certificate for identity.foundation issued by Google Trust Services, valid until 2026-12-27 (77 days).
historyVerifiable history	NOT_APPLICABLEThe identifier is immutable; there is no history.	NOT_ESTABLISHEDdid:web keeps no verifiable history; DID.is snapshots are observations, not proofs.	NOT_ESTABLISHEDdid:web keeps no verifiable history; DID.is snapshots are observations, not proofs.
organizationReal-world identity	NOT_ESTABLISHEDOrganization not established. DID.is does not verify legal identity or ownership claims.	NOT_ESTABLISHEDOrganization not established. DID.is does not verify legal identity or ownership claims.	NOT_ESTABLISHEDOrganization not established. DID.is does not verify legal identity or ownership claims.

Captured from GET /v1/resolve/{did} on 2026-10-11. Live results change when the identifier's document, certificate or configuration changes.

integrity · Document integrity

SELF_CERTIFYING

Proves: The document is exactly what the identifier encodes.

Does not prove: Who holds the private key.

ESTABLISHED

Proves: This is the document the origin served at resolution time.

Does not prove: That the document was not different before or will not change; did:web keeps no verifiable history.

keys · Key material

ESTABLISHED

Proves: The published keys are well-formed points usable for their declared relationships.

Does not prove: Who holds the corresponding private keys.

control · Update authority

SELF_CERTIFYING

Proves: Control is bound to one key by construction.

Does not prove: That the key has not been compromised (did:key cannot rotate).

NOT_ESTABLISHED

Proves: Nothing cryptographic: did:web has no signed update mechanism.

Does not prove: That the current keys were authorised by the previous ones.

origin · Origin binding

ESTABLISHED

Proves: The DID's key signed a statement linking it to this exact origin (bidirectional binding).

Does not prove: Who operates the origin.

INDETERMINATE

Proves: The DID's key signed a statement linking it to this exact origin (bidirectional binding).

Does not prove: Who operates the origin.

transport · Transport security

ESTABLISHED

Proves: The document came from a server holding a publicly-trusted certificate for the host.

Does not prove: That the server operator is the DID subject.

history · Verifiable history

NOT_ESTABLISHED

Does not prove: What the document contained before this resolution.

organization · Real-world identity

NOT_ESTABLISHED

Does not prove: Who operates this identifier.

Per-method behaviour

Dimension	did:key, did:jwk	did:web	did:webvh
integrity	SELF_CERTIFYING	ESTABLISHED if the document id equals the DID, else FAILED	ESTABLISHED: state anchored in the verified log
keys	From the encoded key	ESTABLISHED / FAILED / INDETERMINATE / NOT_ESTABLISHED depending on validated keys	Same as did:web
control	SELF_CERTIFYING; cannot rotate or deactivate	NOT_ESTABLISHED: whoever controls the server and DNS can replace the document	ESTABLISHED: every version signed by an authorised update key
origin	NOT_APPLICABLE	From the DID Configuration: verified, not configured, not linked, invalid, malformed, unsupported proof or unreachable	Same as did:web
transport	NOT_APPLICABLE	ESTABLISHED with certificate issuer and expiry	Same as did:web
history	NOT_APPLICABLE	NOT_ESTABLISHED: DID.is snapshots are observations, not proofs	ESTABLISHED: hash chain, SCID, signatures and witnesses verified
organization	NOT_ESTABLISHED	NOT_ESTABLISHED	NOT_ESTABLISHED

A deactivated did:webvh returns outcome DEACTIVATED, and integrity and keys become NOT_APPLICABLE.

Credential checks are separate

Verifying a credential produces its own checks[] (structure, issuer, proof, validity, status, audience) and an overall status such as VALID or REVOKED. These are described on Credentials, not as identifier dimensions.

Limitations in every result

Each resolution includes limitations[], for example: “DID.is reports evidence; it does not assign trust scores or verify legal identity.” Show these to users when you display a result.