Free. Forever. Structurally.

curl -s https://id.orbis.id/openapi.json | jq '[.paths[][]["x-auth"]] | group_by(.) | map({(.[0]): length}) | add'

Every route on the checking path answers without a credential. That is not a policy anybody here maintains — it is what the machine's own contract says, and the command under the bar produces the same two numbers on your terminal that it produced on ours. Run it before you believe the sentence above it.

The meter and the log are the same seam.

To bill you for checking, we would have to know it was you. That means a key, or an account, or a token — something on the path that separates one caller from another. The moment that exists, so does the ability to write down who checked what, and about whom. There is no version of the first without the second.

So the price and the privacy property are not two features. They are one architectural fact seen from two sides, and neither can be given up without the other going with it. This is the difference between a company being generous and a company being unable: we are not being generous.

What we do charge for, plainly.

Vouching. Issuing a credential is where the real cost sits — key custody, the organization's own name on the internet, the obligation to keep a status list serving for years, and a human to answer when it does not. That is metered per production credential, with test issuance unmetered, and the unit is defined where the price is, not buried in a footnote.

Where a figure has not been set, the page that carries it says so and says why. It will never say to get in touch for a number, because that is a price with the honesty removed.

What is real here.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers.

Is there a paid tier with a higher checking limit?

No. There is no tier, so there is nothing above it. Rate limits exist to keep the machine standing up, they apply to everyone equally, and they are not a price in disguise.

What stops you adding a charge later?

Adding one means putting an authenticated seam on the verification path — a key, an account, something to count against. The day that seam exists, we can also see who checked what, and that is the property we would be destroying to bill you. It would be visible in the route census on this page before it appeared on an invoice.

So what do you actually charge for?

Issuing. Vouching for something is where the operational cost, the key custody and the support obligation live, and it is metered per production credential with test issuance unmetered. That is a different page and a different argument, and we are not going to pretend it is free too.

Do you count how many checks I run?

There is nothing on the path that identifies you to count against. What the machine can see is the shape of its own traffic — request volume at the edge — which is how any server stays alive and is not a record of who verified what.

Can I self-host the checking so none of it touches you?

Yes. The verifier makes no network call, so checking has no dependency on us at all — only on what the organization that vouched published at its own domain. If we vanished on a Wednesday, credentials issued on these rails would still check on Thursday.