Part 1: ID MANDAT's answer is now also available as a signed token

Current · 20 October 2026 · Part 1 · With sources

In short

Ask ID MANDAT who stands behind a domain and which AI agents act for it, and you get the answer as JSON with a digital signature, as before. Since 20 October 2026 the same answer is also available as a signed token in the JWT format. JWT is a widely used format that ready-made libraries can verify. It adds no new checks and no new data. It is the same answer in a format many systems already understand.

Who can use it

Ordinary visitors of this site will not notice it. It is meant for systems: the shop, platform or company an AI agent contacts. Their developers ask ID MANDAT: "Who stands behind this domain, and what may this company's agent do?" With the token they do not have to recompute the signature themselves. A common library checks it in a few lines.

What it looks like

The request gets the addition format=jwt:

curl -s "https://idmandat.com/api/v1/verify?domain=idmandat.com&format=jwt"

You get back a long string in three parts. The first names the algorithm (EdDSA, i.e. Ed25519) and the key identifier. The second holds the answer: domain, level of verification, company, agents with what they may and may not do, plus issuer, issue time and expiry time. The third is the signature. The public keys are available in the standard JWK format at https://idmandat.com/api/v1/verify?format=jwks. A ready-made Python example is in the API reference.

What the token is not

It is not a proof in the sense of x401 and not a "verifiable credential". It is the same ID MANDAT answer in a different format.
"May" and "may not" are declarations by the company. ID MANDAT does not check them and does not enforce them.
ID MANDAT confirms identity and authority, not creditworthiness, trustworthiness or quality.
The token is valid for 15 minutes. After that, ask again.
Errors and answers without a signature still come back as JSON and are not proof.
The interface is in beta (version 0.3.0-beta).

Why we built it

With x401, Proof has presented an open protocol that lets a server require proof of identity from an agent. In the current draft (version 0.2.0), each verifier decides for itself which issuers to trust, and the kind of agent identifier is left open. Which agents a company has deployed and what they may do is therefore a separate question. Our lookup answers exactly that question, publicly and without sign-in. The token makes it easier for developers to build that answer into their systems.

Try it yourself

Token: https://idmandat.com/api/v1/verify?domain=idmandat.com&format=jwt. Your browser may download it as a file. That is normal.
Keys: idmandat.com/api/v1/verify?format=jwks
All fields and the Python example: API reference

Sources

Continue: Part 2: What does your AI know about your company? · Part 3: Is ID MANDAT safe?
More: Who is the agent? Two answers in one week, and a gap