Frequently asked questions
Everything you need to know about ID MANDAT, the open registry for AI agents.
What is ID MANDAT?
ID MANDAT is an open registry for AI agents. A company declares two things there, publicly and in machine-readable form: which AI agents act on its behalf (the ID) and what each of these agents may and may not do (the mandate). People and other AI agents can check this at any time.
Why do we need a registry for AI agents?
Soon AI agents will make enquiries, compare offers, book appointments and place orders on behalf of companies. A person can tell from the look of a website and its imprint whether a company seems trustworthy. An agent cannot. It needs verified, machine-readable information: Who is behind this agent? What may it do? Where is its limit?
Hasn’t something like this existed before?
For websites, yes. In the early years of the internet people sorted the web by hand, in web directories such as Yahoo or the Open Directory Project (DMOZ). With search engines these directories lost their importance, because nobody browsed categories any more. Some people would like such carefully maintained directories back today. For AI agents there is no such directory yet. ID MANDAT takes up the old principle, but for machines and with proof.
Aren’t Google, Visa or Cloudflare already doing this?
They work on related questions. Payment providers and Cloudflare check whether a shopping agent is technically genuine and allowed to pay. Google’s A2A protocol describes in an “Agent Card” what an agent can do technically. Recording publicly, for anyone to check, which legally existing company an agent acts for and what it may do is not part of that. This is exactly the gap ID MANDAT fills – as a complement, not a replacement.
What is the credential?
The credential is a small file that the company publishes on its own domain, at /.well-known/idmandat.json. It contains the company, its agents and their mandates. The credential belongs to the company, not to us. It lives on its domain and stays readable even without ID MANDAT.
How do I create a credential?
With the credential generator at idmandat.com/en/credential.php. You fill in a form, tick for each agent what it may and may not do, and download the finished file. No coding needed. The generator runs in your browser; no data is sent to us.
I don’t have an AI agent yet. Can I still take part?
Yes. List your website with country, industry and what makes you special. Then AI agents can find your company, even before you use an agent yourself.
What does a listing cost?
A listing costs 10 € per year, whether it is a website or a listing with a credential for your AI agents. The “Verified” seal costs 100 € per year, listing included. All prices include VAT. The prices are the same for everyone, and nobody can buy a better position. Listings are for businesses only.
How long does a listing run, and how do I cancel?
A listing runs for 12 months from payment and then renews automatically for 12 months at a time. You can cancel any time, by email to kontakt@idmandat.com or online in the customer portal. Cancellation takes effect at the end of the paid year, and your listing stays online until then. In the first 14 days after payment you get your money back without giving a reason. For the seal this applies as long as it has not been granted yet, because then the service has been delivered. Beyond that we decide case by case.
Why does the seal cost more?
Because there is a real check behind it. For the seal we compare your details with your imprint, the commercial register and your VAT ID automatically and repeat the check regularly. Verified means: the domain belongs to the company, the imprint names the same company, and the company can be found in the commercial register or via its VAT ID. We confirm identity and authority, not creditworthiness, reputation or quality. Without a register entry, for example for sole traders, the imprint and VAT ID count.
What do “Listed”, “Registered” and “Verified” mean?
“Listed”: added by the company itself via the form and confirmed by email, but not verified. “Registered”: credential file and DNS record on the company’s domain are technically confirmed. This proves the information comes from the owner of the domain. “Verified”: in addition, checked against the imprint and the commercial register or VAT ID, The check runs automatically and is repeated regularly.
What does ID MANDAT not confirm?
ID MANDAT confirms identity and authority – not the trustworthiness, quality or solvency of a company, and not the correctness of individual answers given by an agent.
How is the directory kept up to date?
All listings with a credential are re-checked automatically on a regular basis. If a company changes its credential, for example because a new agent is added, the listing is updated. If the proof is missing several days in a row, the listing is suspended until it is back.
Can AI agents query the directory themselves?
Yes. The simplest way is a single request: idmandat.com/api/v1/verify?domain=example.com returns JSON telling you whether the domain is registered, how far it has been checked (verified, registered or listed_unverified), which agents it declares and what they may and may not do. Add &agent=Name to check one specific agent. The "may" and "mayNot" lists are declarations by the operator. If the field "signed" in the answer is true, it is digitally signed (Ed25519, beta) and valid for 15 minutes. The public keys for checking are at idmandat.com/api/v1/keys. The directory JSON (verzeichnis.php?format=json) the MCP server for AI assistants (idmandat.com/mcp) and the A2A endpoint (idmandat.com/a2a/) are not signed yet. For agents that speak the Agent2Agent protocol (A2A) there is an agent card at idmandat.com/.well-known/agent-card.json. No account and no request to us needed.
What does this have to do with the EU AI Act?
The European Union’s AI Act requires AI systems that interact with people to be recognisable as AI. In the ID MANDAT credential every company explicitly states “isHuman: false” for each agent, machine-readable and public. This can help make that transparency traceable. It does not replace legal advice.
Is the standard open?
Yes. The standard is publicly documented and free to use under the CC BY 4.0 licence, with the attribution “ID MANDAT – idmandat.com”. It builds on proven technology (DNS, .well-known, JSON) and works with agent protocols such as A2A and MCP.
Who is behind ID MANDAT?
ID MANDAT is run by Manja König in Osnabrück, Germany. “ID MANDAT” has been filed as a trademark with the German Patent and Trade Mark Office (DPMA).
What data does ID MANDAT store?
As little as possible. The website sets no cookies and uses no tracking. Your email address from the listing form is never published. Details are in our privacy policy (in German).