ORBIS.ID
Your accountDevelopersOrganisationAdmin Portal
You are on Anyone PUBorbis.id

HOLD · RECOVERY, STATED HONESTLY

One wallet, one device.

If you lose the phone today, you lose what is on it. Do not plan around a recovery path that does not exist yet. That sentence is the whole page; everything below it is the reason, and the measurements behind the reason.

The one thing this page is about.

The same property that stops anybody stealing your keys stops us handing them back to you. We will not pretend those are two separate facts.

Why it is hard, in one paragraph.

The key that makes your proofs work is created inside your phone's security chip. It cannot be copied out — not by a thief, not by a website, and not by us. That is the guarantee the whole product rests on. It also means that when the chip goes into a river, so does the key, and there is no copy anywhere for anyone to send you. A company that can restore your keys is a company that had them.

Custody is an operation we cannot perform, not a promise we make.

What you actually lose, and what you do not.

What is gone with the phone

  • The key on that device, permanently.
  • Every proof that was held against that key.
  • Any request that was waiting for your approval.

What is not gone

  • The fact itself. Your university still knows you graduated.
  • Your right to be given a new proof of it — by them, not by us.
  • Any proof you had already shown. It was checked and it stays checked.

So the practical loss is the errand, not the entitlement: you go back to whoever vouched and ask them to vouch again, onto a new device. That is tedious and it is honest, and it is what we would tell you to plan for.

What we would rather you did today.

  1. Treat the wallet as convenience, not as your only copy of anything that matters.
  2. Keep the original document or record wherever you kept it before.
  3. Take your export before you need it, not after — export and erase are one call each.
  4. Do not put a proof in the wallet that you cannot get issued a second time.

What was measured, and what was not.

"Not built" would be a tidier sentence than the truth, so here is the truth. These are recorded responses, not live ones — this page has no Run button, so run the commands yourself and you will have live ones in about five seconds.

Recorded — measured 2026-08-27, by these commands

The cell publishes routes under /v1/recovery/.

curl -s https://id.orbis.id/openapi.json | jq -r '.paths | keys[] | select(startswith("/v1/recovery"))'

/v1/recovery/pepper · /v1/recovery/vault/{locator} · /v1/recovery/succession/{personRef} (+ veto, complete)

The contract names them. That is not the same as a person having used one.

One of them parses a request rather than denying the route exists.

curl -s -o /dev/null -w '%{http_code}\n' https://id.orbis.id/v1/recovery/succession/test

400

A made-up reference gets "bad request", not "no such route". The handler is there.

There is no demonstrated path from a new phone back to your proofs.

— no command, because there is nothing to point one at —

not demonstrated

This is the row that governs your decision. Everything above it is machinery; none of it is a ceremony anyone has walked end to end and published.

The repository's own probe of the cell was last run on 2026-08-30, and the links in the footer of this page are gated on it. Nothing on this site links a machine that did not answer.

Before you go any further.

Recovery will carry the register slug account-recovery when it has a row. It does not have one yet, so this page prints no state for it — a state word here would be a typed claim, and typed claims are the one thing this site does not ship.

Getting back in, the wallet on a phone, the wallet on the web, and the account behind them.

  • PLANNED A wallet a person installs from an app store. wallet-native You cannot hold a credential on a phone you own. Everything a person would do with a proof waits behind this.

The register holds 17 live · 2 partial · 2 planned · 5 not yet.

3 of the 4 capabilities this page depends on have no row in the register yet, so this page will not print a state for them. They are named rather than dropped, because a slice that silently shortens itself is the same defect as a claim with no receipt.

  • account-recovery
  • wallet-web
  • holder-portal

The register route serves, but it carries no row for these yet. List what it does carry: 

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers.

Is there a recovery phrase I should write down?
No, and there will not be one. A phrase you can write down is a phrase somebody else can photograph, and the industry has spent a decade proving that people lose them. When recovery ships it will not be a secret you have to keep safe.
Can ORBIS restore my wallet if I ask nicely?
No. Not as a policy — as a capability we do not have. There is nothing on our side to restore from, which is the same fact as nobody being able to steal it from us.
The contract lists recovery routes. Does that mean it works?
No. It means the machinery is being built in the open, which is exactly what publishing a contract is for. Until somebody walks the ceremony from a new phone and publishes the receipt, this page will keep saying so.
What should I do the day I lose the phone?
Go back to whoever vouched — the university, the employer, the bank — and ask them to issue it again onto your new device. That is the supported path today, and it works because the thing they know about you did not live on the phone.
Will this page change when recovery ships?
On the same day, and the register changes state with it. That is the point of putting the commands on the page: you do not have to take our word for when it moves.