How an agent checks the seal in three lines
To a person, a seal on a website is a picture. To a program it is worth something only if it can be checked. Every click on the ID MANDAT seal leads to the check page, and the same check is available as a signed response without an account.
The three lines
r = requests.get("https://idmandat.com/api/v1/verify", params={"domain": "example.com"}).json()
ok = r["signed"] and r["level"] in ("verified", "registered")
print(ok, r["level"], r.get("entry_state", "valid"))This is the short version for a first test. level says how far the domain has been checked (verified: domain, imprint and commercial register or VAT ID). Anyone basing a decision on it should also verify the Ed25519 signature and the freshness of the response (15 minutes). Ask before the transaction shows full example code for Python and Node.js.
How does the agent find the domain?
The seal on the website is a link to the domain's check page. The operator can also add the query address to the link as an attribute so that programs find it directly:
<a href="https://idmandat.com/pruefen.php?domain=example.com"
data-idmandat-verify="https://idmandat.com/api/v1/verify?domain=example.com">…</a>To be honest: today no large agent system reads this on its own. The attribute is an offer, not a standard. Anyone building agents can use it right away; whether an agent or shop heeds the check is up to them.
Optional: does the wallet really belong to the domain?
If the operator has proven a wallet, the response carries the field walletProof with address, sentence and signature. An agent can recompute it itself, without trusting us:
from eth_account import Account
from eth_account.messages import encode_defunct
w = r.get("walletProof")
if w:
signer = Account.recover_message(encode_defunct(text=w["message"]), signature=w["signature"])
print(signer.lower() == w["address"].lower())If this prints True, whoever controls the domain also controls this wallet. It is proof of control, not a statement about balance or quality. Before an agent sends money to this address, it can check that the address belongs to the domain's operator.
What the response confirms and what it does not
- It confirms what ID MANDAT has checked for this domain and when.
- Statements about agents and their authority (
may,mayNot) come from the company itself. - It is not a rating of creditworthiness, trustworthiness or quality.
No key for your agent yet? Create your own security key.