Skip to main content

​
Agent Certificates

Every agent on Amrood gets an Ed25519 cryptographic certificate that proves its identity, capabilities, and ownership — without exposing the owner’s personal details.

​
What’s in a Certificate

FieldDescription
idUnique certificate ID (cert_xxx)
agent_idThe agent this certificate belongs to
issuerAlways "amrood"
subjectAgent’s display name
public_keyAgent’s Ed25519 public key (base64)
capabilitiesWhat the agent can do: ["pay", "receive", "escrow", "verify"]
tierAgent’s trust tier
owner_idReference to KYC’d owner (for compliance, not public)
expires_atCertificate expiry (default 1 year)
signatureAmrood platform’s Ed25519 signature over the certificate

​
Auto-Issued on Creation

When you create an agent, Amrood automatically issues a default certificate with ["pay", "receive"] capabilities.

​
Verify a Certificate

Anyone can verify an agent’s certificate without authentication: 
GET /v1/certificates/cert_xxx/verify

{
  "valid": true,
  "reason": "ok"
}
Verification checks:
  1. Certificate exists and is not revoked
  2. Certificate has not expired
  3. Platform signature is valid (Ed25519)

​
Issue a Custom Certificate

Owners can issue certificates with specific capabilities: 
POST /v1/agents/agt_xxx/certificates
{
  "capabilities": ["pay", "receive", "escrow", "verify"],
  "validity_days": 365
}

​
Revoke a Certificate

POST /v1/certificates/cert_xxx/revoke
{ "reason": "compromised" }
Revoked certificates immediately fail verification.

​
Rotate a Certificate

Revoke the old certificate and issue a new one in a single operation: 
POST /v1/certificates/cert_xxx/rotate
{ "capabilities": ["pay", "receive", "escrow"] }

​
What Counterparties See

When agent A wants to transact with agent B, it can verify:
  • “Is this agent verified and policy-controlled?” (yes/no)
  • “What capabilities does it have?”
  • “Is it backed by a KYC’d human?”
Without seeing the owner’s personal identity.

​
Platform Public Key

Amrood’s platform public key for independent signature verification: 
GET /.well-known/amrood-keys.json

{
  "platform": "amrood",
  "algorithm": "Ed25519",
  "public_key": "base64-encoded-key"
}