Four checks have names. There are five.

The five, in the order they run.

1. 01

   The signature is real

   Re-computed against the key the organization publishes at its own domain. Catches a proof invented from nothing, and a proof signed by a key that organization never claimed.

2. 02

   The organization behind it is trusted

   The key is the one that domain names as its own, fetched from the organization, not from us. Catches a genuine signature from an organization you never agreed to accept.

3. 03

   This is the right holder

   The presentation is signed by the key inside the holder’s device, over the exact challenge you issued. Catches a real credential captured from somebody else and replayed at you.

4. 04

   It has not been withdrawn

   One bit, read from a list the organization signs and publishes. Catches an employee card that was genuine on the day it was issued and was cancelled the week after.

5. 05

   The claims shown were the ones the issuer signed

   Every disclosed value is re-hashed and its digest looked for in the signed set. Catches a fabricated row spliced into a genuine proof, and a genuine row whose value was edited after signing. This is the check that is usually missing.

Nothing here asks anybody’s permission.

Every input the checking needs was published by the organization that vouched: its key at its own domain, its status list at its own address. Reading them is reading a page. That is why there is no account, no key and no bill — and it is also why the organization never learns where its credential was used, because it is never in the conversation.

The one thing the checking cannot do is decide which organizations you accept. That is a policy you hold and can change on a Tuesday, and no amount of cryptography will make it for you. Anybody who tells you their product settles it is selling you their opinion with a signature on it.

What is real here.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers.

If all five pass, is the credential true?

No. Five passes mean a named organization signed exactly these claims, that they have not been altered, that they have not been withdrawn, and that the device presenting them holds the key. Whether that organization was right about the person is the organization’s problem, and choosing which organizations to believe is yours.

What happens if one check fails?

The chain names the link that broke and gives the reason in plain language, and the seal stops where it stopped. There is no partial acceptance and no score. A proof either walked the whole chain or it did not.

What if the checker itself is broken?

It returns “could not tell”, never “no”. A verifier that turns its own confusion into an accusation about a person is the worst failure mode available to it, so the outcome for an internal error is indeterminate and is labelled as such.

Do any of the checks make a network call to ORBIS?

No. The verifier makes no network call at all — the key document, the status list and the presentation are handed to it as bytes. Fetching those bytes is the caller’s business, and the organization they come from is not ours.

Can I run these checks without your code?

Yes, and that is the intent. The set of failing proofs below is the contract. Point your own verifier at it in whatever language you write, and if it accepts one of them, the fault is found before it ships rather than after.