The words, in plain language.

Every term this site uses

18 terms in this build. 10 of them name an endpoint you can fetch.

Conformance vector

A fixed input with a known correct answer, published so that anyone can point their own implementation at it and see whether it behaves.

Also searched as test vector · conformance suite · prove it yourself

Gloss of The cell's own published vector set

This site says Point any verifier, in any language, at these vectors and prove it correct. Using our code is optional. The set is the contract.

Check it yourself https://id.orbis.id/conformance/vectors

DID

An identifier an organization controls itself, which publishes the public keys it signs with. did:web resolves to a document served under the organization's own domain.

Also searched as decentralized identifier · did:web · issuer identifier

Gloss of W3C Decentralized Identifiers (DIDs) 1.0

This site says Because the identifier lives under a domain the organization owns, leaving costs one DNS record and everything already issued keeps checking.

Check it yourself https://id.orbis.id/.well-known/did.json

Holder

The person who carries the proof and decides, every single time, what to show and to whom.

Also searched as the person · the wallet holder · you

Gloss of W3C Verifiable Credentials Data Model 2.0 — roles

This site says The word holder appears on specification pages. On plain pages the site says you, because that is who it means.

Check it yourself No single endpoint serves this one. It is a word, not a route.

Issuer

The organization that signs a statement it already knew to be true: a bank, an employer, a university, a city.

Also searched as the organization behind it · who vouched

Gloss of W3C Verifiable Credentials Data Model 2.0 — roles

This site says An issuer never learns where a proof it signed was later used. There is no message from the checker back to the issuer, and that absence is the shape of the design.

Check it yourself https://id.orbis.id/.well-known/openid-credential-issuer

OpenID4VCI

The wire protocol a wallet uses to collect a credential from an issuer, and the metadata document that tells the wallet how.

Also searched as OID4VCI · credential issuance protocol · how a proof gets into a wallet

Gloss of OpenID Foundation — OpenID for Verifiable Credential Issuance

This site says The issuer metadata this protocol requires is served on the permissionless plane and needs no key to read.

Check it yourself https://id.orbis.id/.well-known/openid-credential-issuer

OpenID4VP

The wire protocol a checker uses to ask for one specific fact, and a wallet uses to answer with a proof of exactly that fact.

Also searched as OID4VP · presentation protocol · how a proof gets checked

Gloss of OpenID Foundation — OpenID for Verifiable Presentations

This site says The request names what it wants. The consent screen shows the person the same words before anything is sent.

Check it yourself https://id.orbis.id/.well-known/oauth-authorization-server

Proof

A signed statement about a person, made by an organization that already knew the answer. The person carries it; anyone can check it; nobody can forge it.

Also searched as credential · verifiable credential · VC · digital credential

Gloss of W3C Verifiable Credentials Data Model 2.0

This site says This site says proof in plain pages and verifiable credential on specification pages. They are the same object under two vocabularies.

Check it yourself No single endpoint serves this one. It is a word, not a route.

Revocation

The mechanism by which an organization withdraws a proof it issued, and by which any checker can find out that it did.

Also searched as taking it back · withdrawal · status list · token status list

Gloss of IETF Token Status List

This site says The status list this cell publishes is itself signed, and it is fetchable by anyone. Taking something back is a public act, not a private one.

Check it yourself https://id.orbis.id/status/1

SD-JWT VC

The credential format this cell issues: a signed token whose individual claims can each be withheld or revealed by the person holding it.

Also searched as SD-JWT · selectively disclosable JWT credential

Gloss of IETF OAuth WG — SD-JWT-based Verifiable Credentials

This site says The issuer metadata for this format is served from the machine origin and can be fetched without an account.

Check it yourself https://id.orbis.id/.well-known/jwt-vc-issuer

Selective disclosure

Sending one field out of a signed document and leaving the rest behind, without breaking the signature on what you sent.

Also searched as partial disclosure · one row travels · SD

Gloss of IETF SD-JWT — Selective Disclosure for JWTs

This site says The fields that stay are not hidden and not greyed out. They were never sent, and the signature still checks without them. That is arithmetic, not policy.

Check it yourself No single endpoint serves this one. It is a word, not a route.

Tamper-evident

A change to a signed document can be detected by anyone who checks it. It does not mean the document cannot be changed.

Also searched as tamper-proof · was this altered

Gloss of Cryptographic signature semantics

This site says That is what tamper-evident means, and it is a weaker and more honest claim than tamper-proof.

Check it yourself No single endpoint serves this one. It is a word, not a route.

The cell

The machine that issues, checks and publishes receipts. This site is the human origin; the cell is the machine one, and this site never copies a receipt from it.

Also searched as machine origin · id.orbis.id · the machine that serves it

Gloss of This site's origin split

This site says A proxied receipt is not a receipt. Every receipt on this site is a link to the cell, so you can fetch the same bytes we did.

Check it yourself https://id.orbis.id/readyz

The consent screen

The screen a person sees before anything leaves their phone. It answers five questions: who is asking, what for, exactly what will be sent, what stays, and for how long.

Also searched as approval screen · what will be sent · who is asking

Gloss of This site's component C-21

This site says The screen is shown as an illustration on this site until a real captured frame has been cleared, and it says so on the frame.

Check it yourself No single endpoint serves this one. It is a word, not a route.

The permissionless plane

The set of endpoints on this machine that answer without an account, a key or a bill. Checking a proof lives entirely inside it.

Also searched as public plane · no key needed · free forever · unmetered routes

Gloss of The cell's route census, published in its OpenAPI document

This site says It is free because there is nowhere to charge you. There is no authenticated seam on the verification path to meter — which is why we also cannot build a record of where you verified.

Check it yourself https://id.orbis.id/openapi.json

The phone's security chip

A separate piece of hardware inside a phone that can create a signing key and use it, but cannot hand the key out — not to an app, not to the manufacturer, not to us.

Also searched as secure enclave · hardware-backed key · StrongBox · TEE · device key

Gloss of Platform key-custody documentation (Apple Secure Enclave, Android StrongBox)

This site says Custody is an operation we cannot perform, not a promise we make. We are not being generous; the arithmetic does not contain the key.

Check it yourself No single endpoint serves this one. It is a word, not a route.

The register

One row per capability: the claim, the state, the thing that proves it, how it was checked, when, and what a capability that does not work yet costs the reader today.

Also searched as capability register · what is real here · state chip · the rows that say no

Gloss of This site's own data contract, orbis-register/1

This site says Every state word on this site is generated from the register and never typed into a page. A claim with no register row cannot ship, and the build refuses it.

Check it yourself No single endpoint serves this one. It is a word, not a route.

Trust anchor

The step where a checker decides whether the organization that signed a proof is one it is prepared to believe. A valid signature by an unknown party is still a valid signature by an unknown party.

Also searched as issuer trust anchor · root of trust · is this issuer real

Gloss of W3C Verifiable Credentials Data Model 2.0 — trust model

This site says The signature being real and the signer being trusted are two separate checks on this site, and they are always named separately.

Check it yourself No single endpoint serves this one. It is a word, not a route.

Verifier

Anyone who needs to know one thing and checks the signed answer instead of collecting the underlying documents.

Also searched as the checker · relying party · who is asking

Gloss of W3C Verifiable Credentials Data Model 2.0 — roles

This site says Checking needs no account and no key on this cell, and the route census that shows how many endpoints take no key is published as machine-readable data.

Check it yourself https://id.orbis.id/openapi.json

Nothing in the glossary matches that. That is the whole answer — try the site search, which also covers pages and register rows.

Two words this site keeps apart on purpose.

Tamper-evident is not tamper-proof. One says an alteration can be detected by anyone. The other says an alteration cannot happen. Only the first is true of a signature, and it is the weaker and more honest claim.

Unmeasured is not no. Where this site compares itself to anything else, a cell that says unmeasured means we have not seen it with our own eyes — not that the other party lacks it. Collapsing those two would be the most attackable thing on the page.