Admin API
Verification Methods
Manage DID verification methods (P-256 keypairs) used for attestation signing and PLC operations.
const TOKEN = "hv_..."; // your API key
const headers = { Authorization: `Bearer ${TOKEN}` };List verification methods
GET /admin/verification-methodsRequires settings:manage permission.
interface VerificationMethod {
id: string;
fragment_id: string;
key_type: string;
public_key_multibase: string;
created_at: string;
}
const response = await fetch("http://127.0.0.1:3000/admin/verification-methods", {
headers,
});
const data: VerificationMethod[] = await response.json();Response: 200 OK
[
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"fragment_id": "#attestation",
"key_type": "Multikey",
"public_key_multibase": "zDnae...",
"created_at": "2026-06-27T00:00:00Z"
}
]Create a verification method
POST /admin/verification-methodsRequires settings:manage permission. Generates a new P-256 keypair. The private key is encrypted at rest with AES-256-GCM using TOKEN_ENCRYPTION_KEY.
const response = await fetch("http://127.0.0.1:3000/admin/verification-methods", {
method: "POST",
headers: {
...headers,
"Content-Type": "application/json",
},
body: JSON.stringify({
fragment_id: "#attestation",
}),
});
const data: VerificationMethod = await response.json();| Field | Type | Required | Description |
|---|---|---|---|
fragment_id | string | yes | DID document fragment identifier, must start with # followed by alphanumerics or underscores |
Response: 201 Created
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"fragment_id": "#attestation",
"key_type": "Multikey",
"public_key_multibase": "zDnae...",
"created_at": "2026-06-27T00:00:00Z"
}Delete a verification method
DELETE /admin/verification-methods/{fragment_id}Requires settings:manage permission.
const response = await fetch(
"http://127.0.0.1:3000/admin/verification-methods/attestation",
{ method: "DELETE", headers },
);The fragment_id path parameter is the identifier without the leading # (e.g. attestation for #attestation).
Response: 204 No Content. Returns 404 Not Found if no method with that fragment ID exists.