ISSUE · CITIES & MUNICIPAL SERVICES

The city already knows you live here. You should not have to photocopy it again.

Almost every municipal errand is the same errand: prove a fact the city itself is the authority on. Residency, entitlement, a concession, a permit. The city knows the answer already — and still asks the resident to carry paper to a counter so that a photocopy can be filed somewhere neither of them will ever look again.

How it works What it costs

One thing to hold on to: the point is not to digitise the counter. It is to remove the trip. A proof the resident already carries can be checked by a library, a transport operator, a landlord or a neighbouring authority without any of them integrating with the city — and without the city hearing about it.

The errand, before and after

What happens today

A resident applies for a parking permit. They are asked for proof of address, so they find a utility bill, photograph it or bring it in, and hand over a document carrying their full name, their exact street address, their account number and how much electricity they used last quarter.

The council needed one fact: this person lives in this zone. It received a household's consumption history and now has to store it, secure it, and eventually delete it. So does the next department that asks.

What happens with a credential

The resident holds a proof the city itself signed. The permit desk asks one question — does this person live in this zone — and receives one answer, signed, checkable, and bound to the resident's own device.

The street address is not redacted from the message. It was never in the message. There is nothing for the permit desk to store, secure, or forget to delete, because it was never given anything to hold.

One row travels. The rest of the resident stays home.

This is the mechanism behind the right-hand column, and it is worth being exact about it, because "we only share what is necessary" is what every system says while sending everything.

Illustration · a credential, drawn

resident_of_this_city shared
street_address never sent
date_of_birth never sent
household_size never sent
benefit_status never sent

What the permit desk received: 0 bytes of you.

One row travels. Four stay — and the signature still verifies without them.

You do not have to trust the desk to discard the extra fields, and the desk does not have to be competent enough to. The extra fields are not in the message.

Why a city must not be able to watch its own residents

A city that issues residency proofs and can see where they are presented has built something nobody asked it to build: a movement record of its own population, at street granularity, covering exactly the residents who have the least ability to object to it.

A policy against looking is not enough, because policies survive one administration and data survives all of them. So the check does not come back to the city at all. Whoever is asking reads two public documents and does the arithmetic themselves. There is no request arriving at the town hall, which means there is no log, and no log to inherit.

This is the same property that makes checking free, and it is not a coincidence: there is nothing on the verification path to meter for exactly the same reason there is nothing on it to record.

Small enough for a municipal budget, and here is the whole footprint

A city is the smallest organisation that can genuinely run one of these, and the reason is that the permanent technical footprint is three static files under a domain the city already owns. Not a platform, not a datacentre, not a programme.

The keys

/.well-known/did.json — 669 bytes, measured 2026-08-27
The same keys, second path

/.well-known/jwt-vc-issuer — 408 bytes, measured 2026-08-27
The withdrawal list

/status/1 — 452 bytes covering 65,536 positions
The words residents read

/manifest — 410 bytes of claim labels, in the issuer's own wording

Under two kilobytes of static files carries every credential the city ever issues, for as long as it wants them to keep verifying — including after it stops being our customer. The exit, in full.

Check a live issuer the way a permit desk would

A city's IT team can test the whole verification path this afternoon, against a real issuer, without an account, a key, a sales conversation, or our knowledge that they did.

Is the signature real? — resolve the keys

curl -s https://id.orbis.id/.well-known/did.json | jq .

Has it been withdrawn? — read the list

curl -s -D- -o /dev/null https://id.orbis.id/status/1 | grep -i content-type

What will a resident actually see? — read the labels
```
curl -s https://id.orbis.id/manifest | jq .
```

All three answered on 2026-08-27. Notice which command is missing from that list: there is no command that asks the issuer whether a particular resident's credential was checked, because there is no endpoint that would answer it.

What a city would actually be adopting today.

Issuance, selective disclosure and withdrawal are live on the cell and every command above answers. The gap between that and a working permit desk is real, and it is printed below rather than left for the pilot to discover.

PLANNED A wallet a person installs from an app store. wallet-native You cannot hold a credential on a phone you own. Everything a person would do with a proof waits behind this.

The register holds 17 live · 2 partial · 2 planned · 5 not yet.

5 of the 6 capabilities this page depends on have no row in the register yet, so this page will not print a state for them. They are named rather than dropped, because a slice that silently shortens itself is the same defect as a claim with no receipt.

vc-issuance
selective-disclosure
revocation
branding
self-service-onboarding

The register route serves, but it carries no row for these yet. List what it does carry:

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

No city is using this. Not a pilot, not a letter of intent, not a named authority. Measured on 2026-08-27 the cell serves exactly one issuer and it is ours. There is no case study on this page because there is no case.

The resident's half is the unfinished half. A credential has to land somewhere, and the wallet a person would install from an app store is not shipped. That row is above, in the register's own words, and it is the single largest thing standing between this page and a working service.

No compliance certification is claimed anywhere on this site, and self-service sign-up is not built — the first steps are a person on our side, on human timescales. Aligned with is not certified under, and the difference is not decorative.

Straight answers

Can a city run a pilot today?: Partly, and the honest boundary is worth knowing before anybody writes a project plan. The issuing and checking halves are live and testable this afternoon. The resident-facing half depends on a wallet that is not shipped, so a pilot today tests the rails and not the experience.
What about residents without a smartphone?: They are not served by this, and we are not going to pretend otherwise. A municipal service has to work for everyone who is entitled to it, which means the counter does not close — this removes trips for the people it can and leaves the existing route intact for everyone else. Any vendor telling a city otherwise is selling an exclusion.
Does a neighbouring authority have to integrate with us?: No, and that is most of the value. Checking reads two public documents under the issuing city's domain — no agreement, no API key, no data-sharing arrangement, no joint project. A credential your city signs is checkable by anyone who decides to trust your city.
What if a resident moves away?: You withdraw the credential: one bit in the published list, no notification to anybody, and it stops checking out. Worth knowing before you design around it — a verifier holding a cached list can be up to five minutes behind. The freshness window, measured.
Who is accountable if this breaks?: Named people, on the company page. There is no SLA today and we will not blur alerting into one. For a service residents depend on, that is a genuine gap and it belongs in this list rather than in a footnote.

Do not trust us. Check us.