> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amrood.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Certificates

> Cryptographic identity certificates for agents

# Agent Certificates

Every agent on Amrood gets an **Ed25519 cryptographic certificate** that proves its identity, capabilities, and ownership — without exposing the owner's personal details.

## What's in a Certificate

| Field          | Description                                                     |
| -------------- | --------------------------------------------------------------- |
| `id`           | Unique certificate ID (`cert_xxx`)                              |
| `agent_id`     | The agent this certificate belongs to                           |
| `issuer`       | Always `"amrood"`                                               |
| `subject`      | Agent's display name                                            |
| `public_key`   | Agent's Ed25519 public key (base64)                             |
| `capabilities` | What the agent can do: `["pay", "receive", "escrow", "verify"]` |
| `tier`         | Agent's trust tier                                              |
| `owner_id`     | Reference to KYC'd owner (for compliance, not public)           |
| `expires_at`   | Certificate expiry (default 1 year)                             |
| `signature`    | Amrood platform's Ed25519 signature over the certificate        |

## Auto-Issued on Creation

When you create an agent, Amrood automatically issues a default certificate with `["pay", "receive"]` capabilities.

## Verify a Certificate

Anyone can verify an agent's certificate without authentication:

```bash theme={null}
GET /v1/certificates/cert_xxx/verify
```

```json theme={null}
{
  "valid": true,
  "reason": "ok"
}
```

Verification checks:

1. Certificate exists and is not revoked
2. Certificate has not expired
3. Platform signature is valid (Ed25519)

## Issue a Custom Certificate

Owners can issue certificates with specific capabilities:

```bash theme={null}
POST /v1/agents/agt_xxx/certificates
{
  "capabilities": ["pay", "receive", "escrow", "verify"],
  "validity_days": 365
}
```

## Revoke a Certificate

```bash theme={null}
POST /v1/certificates/cert_xxx/revoke
{ "reason": "compromised" }
```

Revoked certificates immediately fail verification.

## Rotate a Certificate

Revoke the old certificate and issue a new one in a single operation:

```bash theme={null}
POST /v1/certificates/cert_xxx/rotate
{ "capabilities": ["pay", "receive", "escrow"] }
```

## What Counterparties See

When agent A wants to transact with agent B, it can verify:

* "Is this agent verified and policy-controlled?" (yes/no)
* "What capabilities does it have?"
* "Is it backed by a KYC'd human?"

Without seeing the owner's personal identity.

## Platform Public Key

Amrood's platform public key for independent signature verification:

```bash theme={null}
GET /.well-known/amrood-keys.json
```

```json theme={null}
{
  "platform": "amrood",
  "algorithm": "Ed25519",
  "public_key": "base64-encoded-key"
}
```