| device_name required | string Example: device_name=device-001 The name of the device to retrieve the associated DID |
{- "did": "did:webvh:QmAbc123DefGhi456JklMno789PqrStu012VwxYz345AbcDef:example.com"
}Resolves the given DID and returns its DID document. Returns null when the
identifier cannot be resolved. The document follows the DID WebVH layout
(P-384 / Ed25519 keys, JsonWebKey2020 / Ed25519VerificationKey2018).
| did required | string Example: did:webvh:QmAbc123DefGhi456JklMno789PqrStu012VwxYz345AbcDef:example.com The DID to resolve |
nullEncrypts the given plaintext message for the destination DID using P-384
ECDH-1PU key agreement with AES-256-GCM content encryption (FIPS 140-3
compliant). Returns the resulting DIDComm JSON envelope as a JSON-encoded
string with alg: "ECDH-1PU+A256KW" and enc: "A256GCM".
The destination DID must be authorized to communicate with this agent.
Unauthorized destinations are rejected with 403 (code 2005).
Authorization decisions are cached for up to 60 seconds per
destination DID, so rule changes may take up to a minute to be
reflected.
| destination_did required | string DID of the recipient |
| message required | string Plaintext message body to encrypt for the recipient. |
{- "destination_did": "did:webvh:QmAbc123DefGhi456JklMno789PqrStu012VwxYz345AbcDef:example.com",
- "message": "{\"hello\":\"world\"}"
}"{\"ciphertext\":\"...\",\"iv\":\"...\",\"protected\":\"...\",\"recipients\":[{\"encrypted_key\":\"...\",\"header\":{\"alg\":\"ECDH-1PU+A256KW\",\"epk\":{\"crv\":\"P-384\",\"kty\":\"EC\",\"x\":\"...\",\"y\":\"...\"},\"iv\":\"...\",\"key_ops\":[],\"kid\":\"\",\"tag\":\"...\"}}],\"tag\":\"...\"}"Verifies and decrypts a DIDComm message. The request body wraps the DIDComm
envelope as a JSON-encoded string under the message field (matching the
output of /create-didcomm-message). The envelope must use
alg: "ECDH-1PU+A256KW" with enc: "A256GCM" over P-384.
The sender DID must be authorized to communicate with this agent.
Messages from unauthorized senders are rejected with 403 (code
2006). Authorization decisions are cached for up to 60 seconds
per sender DID, so rule changes may take up to a minute to be
reflected.
| message required | string JSON-encoded string of the DIDComm v2 envelope to verify. After
parsing it has the shape
|
{- "message": "{\"ciphertext\":\"...\",\"iv\":\"...\",\"protected\":\"...\",\"recipients\":[],\"tag\":\"...\"}"
}{- "message_id": "12345678-abcd-ef01-2345-6789abcdef01",
- "payload": "{\"message\":\"hello\"}",
- "created_at": "2025-05-29T12:34:56.789012345+00:00",
- "sender_did": "did:webvh:QmAbc123DefGhi456JklMno789PqrStu012VwxYz345AbcDef:example.com"
}| key required | string (Key) |
| detail required | string (Detail) |
| occurred_at required | integer <int64> (Occurred At (epoch milliseconds)) Unix epoch time in milliseconds |
[- {
- "key": "test-key",
- "detail": "test-detail",
- "occurred_at": 1732714444204
}
]{- "code": 1050,
- "message": "invalid key"
}| key required | string (Key) |
| value required | number <float> (Value) |
| occurred_at required | integer <int64> (Occurred At (epoch milliseconds)) Unix epoch time in milliseconds |
[- {
- "key": "test-key",
- "value": 12.34,
- "occurred_at": 1732714444204
}
]{- "code": 1040,
- "message": "invalid key"
}| key required | string (Key) |
| message required | string (Message) |
| occurred_at required | integer <int64> (Occurred At (epoch milliseconds)) Unix epoch time in milliseconds |
[- {
- "key": "test-key",
- "message": "test-message",
- "occurred_at": 1732714444204
}
]{- "code": 1060,
- "message": "message is required"
}| key_name required | string (Key name) |
| value required | string (Value) |
{- "key_name": "test-key-name",
- "value": "test-value"
}{- "code": 1030,
- "message": "key_name is required"
}Triggers execution of any pending device operations that have been reserved for this device. Use this to manually trigger an operation instead of waiting for the automatic polling mechanism.
{- "status": "executed",
- "message": "Device operation executed successfully"
}