Operaciones de red

Cada panel de esta página es una medición que acaba de tomar su navegador.

La cadena de confianza resuelta en vivo, el campo de revocación decodificado desde la lista firmada, la cadena de hashes de auditoría recalculada eslabón a eslabón y la latencia de esta celda medida desde donde usted está sentado. Aquí no hay nada simulado, y los paneles que no pueden medir lo dicen en su sitio, incluido el que informa de que esta celda no sabe nombrar el código que está ejecutando.

Esto es el instrumento, no la consola. Todo lo que hay debajo se mide contra la celda que ha servido esta página, en el plano público, sin clave y sin cuenta. La consola del operador que hay detrás de /admin es otra cosa: rechaza a todo el mundo en esta celda, y la página del operador explica exactamente por qué. Esta página no la necesita: cada lectura de aquí es una que un desconocido tiene derecho a tomar.
Cuente usted mismo la superficieLa puerta del operador

.well-known/did.json RECORDED

120 ms

the trust anchor — recorded, not yours.

t/root/status/1 RECORDED

82 ms

the signed revocation list — recorded, not yours.

readyz RECORDED

190 ms

readiness, per capability — recorded, not yours.

healthz RECORDED

192 ms

liveness — recorded, not yours.

build RECORDED

498 ms

build provenance — recorded, not yours.

Recorded 2026-08-19 from a single machine. Press Measure from here and every figure above is replaced by 5 readings your own browser takes against this cell.

Servidos por la celda que ha generado esta página. Ábralos todos si quiere.

LIVE/.well-known/did.jsonLIVE/t/root/status/1LIVE/buildLIVE/openapi.json
Esta página está traducida solo en parte. La navegación, el titular, el resumen y todos los avisos de arriba están traducidos. Las secciones extensas que siguen continúan en inglés y no se traducen automáticamente de fondo: está leyendo el original y no una aproximación. Leer la página entera en inglés.

01 · The trust chainORBIS — The Trust Fabric

The chain that draws itself as it proves itself.

Five links, each a real network call or a real computation run by your browser against this cell: fetch the signed status list, inflate it and count the bits, fetch the trust anchor, recompute its key thumbprint per RFC 7638, and verify the signature with WebCrypto — in the curve the fetched key declares and the algorithm the token names, never an assumed one. The field beside it is the decoded list itself, one mark per credential slot.

RECORDED Revocation field

65,536

slots on this cell’s status list — 0 revoked.

Your browser has not checked yet.

SIMULATED The button changes only what your browser drew. The signed list this cell serves is unchanged, and still says zero.

Checked in your browser

  • · Fetch the signed status list
  • · Inflate it and count the bits
  • · Fetch the trust anchor
  • · Recompute its key thumbprint (RFC 7638)
  • · Verify the signature

Nothing here is taken on trust: each line is a real call or a real computation, run by you, against the cell that served this page.

02 · The audit chainORBIS — The Trust Fabric

Tamper-evident, and you are welcome to try.

Every privileged action on this platform is appended to a per-tenant hash chain: each link’s digest is taken over the previous link’s digest plus the canonical form of the event, so altering any record breaks every record after it. Break one below and watch it happen.

The chain, recomputed in your browser SAMPLE

  • · 01 tenant.provisioned system

    prev genesis — no predecessor 4a52c7a7e4809d282a00b85d…

  • · 02 type.published operator

    prev 4a52c7a7e4809d282a00b85d… 00a29e45687ac98c6072a611…

  • · 03 status-list.write system

    prev 00a29e45687ac98c6072a611… aa610d7440646ff40d938e02…

  • · 04 approval.raised operator

    prev aa610d7440646ff40d938e02… 277c197cf545b249e11a8e17…

  • · 05 erasure.fulfilled holder

    prev 277c197cf545b249e11a8e17… ef93143597c83abcd86039dd…

SAMPLE Five synthetic events. Every actor is a role and every id is invented — there is no person in this data. The hashes are real: computed on the server by the same canonicalJson and sha256Hex the platform’s audit writer uses, then recomputed independently in your browser with WebCrypto. The ticks appear when the two agree.

verifyAuditChain SAMPLE

—

Your browser has not recomputed the chain yet.

hash = sha256(prevHash + canonicalJson(event))

Press tamper on any link. That link’s hash changes, so the next link’s recorded prevHash no longer matches — and the chain goes red from there onward. That is exactly what verifyAuditChain returns: {ok:false, brokenAt}. It cannot tell you what was changed, only that something was; that is what tamper-evident means, and it is a weaker and more honest claim than tamper-proof.

Why this is a sample and not the live chain NOT BUILT

The real chain is operator-authenticated, and correctly so: details can carry personal data, so the log a tenant reads is not a log a stranger may read. The design answer is a periodic redacted anchor — {id, prevHash, hash, occurredAt} and nothing else, published on the public plane, which would let anyone verify chain integrity without exposing a single subject. It is not built. No endpoint serves it today, and this panel would be the thing that rendered it if one did.

03 · ProvenanceORBIS — The Trust Fabric

The finding this page would rather report than hide.

A network operations centre earns its name by surfacing what is wrong, not by rendering everything green. This cell answers every question on this page correctly except one: which source is it running?

Build provenance RECORDED

UNPROVEN

This cell answers /build with {"commit":null,"builtAt":null,"attested":false} — it cannot name the commit it is running or the moment it was built.

  • commit null
  • builtAt null
  • attested false

Why this is a finding and not a footnote

A deployment that cannot say which source it came from cannot be audited against that source, and “we checked the code” stops meaning anything the moment nobody can prove which code is answering. Every other panel on this page verifies the cell against itself; this is the one property that needs the pipeline to speak.

The remedy already exists in the handler. /build reads GIT_SHA and BUILD_AT from its environment and reports attested:true once the deploy pipeline stamps them. Nothing needs to be designed — a dev process answers honestly as unstamped rather than inventing provenance, which is the right failure and the reason this reads null instead of a plausible-looking hash.

04 · The operator planeORBIS — The Trust Fabric

What an operator commands, counted from the wire.

The back office is not one screen; it is a set of desks, each a group of routes with an auth class on every one. The counts below are taken by your browser out of this cell’s own published census — this page holds no copy of them, so it cannot quietly drift from the routes it describes.

The desks RECORDED

Eleven desks. Your browser has not counted them yet — press nothing; this counts itself from /openapi.json on load.

  • Operations — Issuance, revocation, the status list and the signing keys — the desk that makes and unmakes credentials.

    operations —

  • Compliance — Subject-access lookups, the erasure queue, retention and the record of processing. A recorded “we hold nothing” is itself an auditable act.

    compliance —

  • Integration — Tokens, webhooks and the surface a partner's own systems call. Where the platform stops being a website.

    integration —

  • Organizations — Tenants and their identities — provisioning, suspension and restore. Suspension is reversible on purpose.

    organizations —

  • People — Operators, roles and members. A role grant can never exceed the granter's own privilege.

    people —

  • Approvals — Privileged changes raised as proposals and decided separately, rather than executed by whoever holds a token.

    approvals —

  • Partners — Admission, the partner register and what each admitted partner is scoped to do.

    partners —

  • Audit — The hash-chained record of privileged action, and the walk that verifies it.

    audit —

  • Support — One credential, one timeline. The narrowest desk on the plane, and deliberately so.

    support —

  • Today — The day's operational summary — what moved, what is pending, what failed.

    today —

  • Analytics — Counts over the tenant's own data. Never across tenants.

    analytics —

Operator-authenticated RECORDED

195

operations behind an operator identity — 144 on the role-gated back-office plane and 51 on the older operator-bearer plane. The largest surface this platform has, and the one nobody can sign in to on this cell.

Why that door will not open — it is a security posture, not an outage, and it has its own page.

Every plane on the wire

    Counted in your browser from the census this cell publishes. PUB needs no key, ever.

    05 · The gapsORBIS — The Trust Fabric

    Stated here rather than found later.

    Four things a complete operations centre would show that this one does not. Each is a real gap in the system, not a missing panel.

    The live audit chain

    Operator-authenticated, because details can carry personal data. A periodic redacted anchor would make integrity publicly checkable without exposing anyone. NOT BUILT

    The second key

    The approvals table records requestedBy and decidedBy separately and a decision is single-use — but nothing compares them, so an operator can currently decide their own proposal. The schema is ready for two-person control; the check is not written. NOT ENFORCED

    Issuance and verification counters

    Real throughput lives behind the operator plane, and this page will not invent a number to fill the tile. Zero credentials have been issued on this cell by design. OPERATOR ONLY

    Kill-switch state

    Issuance ships inert behind a switch, but the switch’s position is not published on the public plane, so this page cannot read it and does not claim to. NOT PUBLISHED

    Every panel above is a measurement, and every gap here is a sentence we could have left out. A console that only renders green is not an instrument — it is a screensaver.

    Ask this site

    This is a search, not a language model. There is no AI on this cell: nothing here is generated, your question never leaves your browser, and no request is made when you ask. It searches this site’s own 27 pages and a glossary of 11 terms. You can open and read both below: what this search can see is exactly what you can see. When nothing answers, it says so rather than writing something that sounds like an answer.

    Try:

    Everything this search can see — all 27 pages, and what each one claims
    • ORBIS.IDYour identity belongs to you. Right now, it belongs to everyone else.Every time you sign up for something, you hand over a copy of yourself — a photo of your passport, a scan of your face, your date of birth. Those copies pile upSections: The grievance, the Article, and the proof · The problem, in one sentence you already know · Five promises — and what each one actually means · Three people, one seal, no copies · The screen where you decide · What we can see, and what we cannot
    • Declaration of Digital IndependenceUniversal Declaration of Digital Independence and Human Digital RightsThe founding document of this estate, written by Jonatan Schmidt and published here unedited. Next to each Article is what the running system actually does abouSections: Universal Grievances Against Digital Oppression · Universal Principles of Digital Sovereignty · A Universal Call to Unified Action · In Witness Whereof · The honest case against this whole idea
    • The Trust FabricTrust, woven in.The trust fabric for the real economy — it turns everyday life into proof you own . An issuer signs a statement, a holder keeps it and decides who sees it, and Sections: Split trust into three roles — never merge them. · A bill becomes proof. Proof becomes credit. · Honesty is the architecture. · The fabric cannot be retrofitted. · Three converging markets — one regulatory clock. · The lines the product already says for itself.
    • Demo consoleThe only demo here is the real thing.There is no recorded walkthrough on this page, no simulated data and no screenshot of a product. There is a running trust plane and the commands that talk to itSections: 01 · The trust anchor · 02 · What this issuer issues · 03 · Is it healthy right now · 04 · Revocation, signed · 05 · Prove it against the published conformance vectors · Two lists, same page, same weight
    • DocumentationGenerated from the route table, so it cannot drift.The wire contract is derived from the live routing table on every request. The document and the server cannot disagree, because one is made out of the other.Sections: Start here · The full contract
    • DevelopersEverything below is a live response.Not documentation of an intended one. Five commands, no account, no API key, no sales call. Run them before you decide whether to keep reading.Sections: 01 · The trust anchor · 02 · Issuer metadata · 03 · The credential shape · 04 · Conformance vectors — check your implementation, not ours · 05 · Revocation, signed · Readiness that reports the hardware
    • CapabilitiesEvery claim, its real state, and the proof.25 entries: 14 live · 1 partial · 1 planned · 9 not yet. Each one was checked against the cell serving this page. Almost nobody in this industry publishes the rSections: What the four words mean · Identity · Issuance · Operations · Verification · Standards
    • StandardsOne row per standard. Including the ones we fail.5 live · 4 partial · 0 planned · 3 not yet. Every row states what the standard demands , what this cell actually does, and the artefact that settles it. Two rowSections: What the four words mean · Credential formats, as their own register · Why every row carries a state
    • RegulationsThe posture, in the same discipline.Conformant where it is true, planned where it is not yet, and never silent about the difference. Data minimisation here is a property of the credential format, Sections: Data minimisation, enforced by cryptography · What the four words mean · Compliance and security capabilities · Security · Compliance · Certification status, stated once and plainly
    • For peopleThe answer is smaller than the question.You photographed your passport again this month. Someone needed to know one thing about you. They now hold your name, your face, your address and your date of bSections: Prove the fact. Keep everything else. · What changes for you · What is real today, and what is not · If you are here for someone else
    • For businessYour own issuer. Your own domain.You mint your own credential types under your own domain. Your members hold them. Your counterparties check them offline, against a public key, with nothing to Sections: You are not early. The deadlines already exist. · The live example is not a mock · What a buyer actually asks · Two lists, same page, same weight · Getting started
    • For citiesA city is a tenant, with its own key.Resident credentials a city issues under its own did:web , checked by services across the city with no shared resident database in the middle — because the checSections: Why the architecture is not city-specific · What a city actually gets from this · Two lists, same page, same weight
    • For governmentTwo questions, both answered with endpoints.What does it conform to, and what is provable without taking our word for it. Everything below links the artefact that settles it — a document you fetch, a fileSections: The property that comes before everything else · Conformance, one row per standard · Accountability · Two lists, same page, same weight
    • PartnersFour roles, and what each one runs.Issuer partners mint their own types under their own tenant. Relying parties verify against the trust anchor. Wallet partners hold on a person's behalf. Data paSections: A page each, with its own evidence · How intake works, and what it costs you · Two lists, same page, same weight
    • Apply as a partnerApply, and here is exactly what happens next.The intake is a public, rate-limited endpoint you can call right now. What happens after it is a person, not a pipeline, and this page says which steps are whicSections: Step 1 · Call the intake · Do it here · What each step actually is · What we do with what you send
    • Application statusWhere your application is, without asking us.A public endpoint answers with the state of an application you hold the id for. No account, no sign-in, no email thread.Sections: Ask it directly · Check it here · What the states mean
    • Issuer partnersYour own key, your own domain, your own exit.An issuer partner runs a tenant with its own did:web , its own signing key, its own status list and its own credential types. The credentials you mint are verifSections: What you actually get, and you can look at all of it now · The formats, as a register · The exit, stated before you sign anything · Two lists, same page, same weight
    • Relying-party partnersVerification takes no key. Count the routes.There is nothing to buy and nothing to sign up for on the verifying side. The verification plane takes no authentication at all, and that is a structural properSections: Count it yourself · What you integrate: three fetches · Test your verifier against ours, offline · What is not proved yet, on the record
    • Wallet partnersWhat a wallet has to speak to interoperate.The protocols, the format, and the key custody we expect. And the thing no other page in this industry will tell you: nothing has ever completed this flow againSections: The discovery surface, live now · What we expect of you, and what you can expect of us · Aligned with HAIP 1.0
    • Data partnersA signed contract, an audit chain, and a short list.A data partner exchanges verified attributes under a signed agreement, with every exchange recorded in a tamper-evident chain. It is also the least built of theSections: What is real underneath · Compliance · What a data partner would get and give · If you want to be first
    • Verify with ORBISThe plane designed to survive everything else being down.Verification needs no signing key, no issuer identity and no vault — a cell can be configured for verification alone. It also needs no permission: 107 of this cSections: Three fetches, no account · The honest line between implemented and witnessed · Two lists, same page, same weight
    • The clock — the deadlines, counted liveEvery date on this page was set by a parliament, not by us.This is not a roadmap. It is a list of legal instruments with dates attached, and the first one has already gone. Nothing below is written down and left to rot:Sections: The instruments, in the order they bite · Switzerland, and what it actually tells you · What “certified” currently means in this field · To a government reading this · To the people building the same thing · To the person these deadlines are actually about
    • How ORBIS compares — and where it loses6 axes. 2 no established vendor holds. 3 we do not hold ourselves.Dozens of vendors sell pieces of this. The founding brief compared fourteen of them across six capabilities and concluded that no competitor held more than threSections: The matrix · Every axis, and how to check it · The discovery probe · What can be proved right now · What we withdrew · The honest gaps
    • Your accountAn account with no password to steal.Not a row in our database with your email on it. An ORBIS.ID account is a key , and the half that matters is designed to be born on your own device and never seSections: What an account actually is · How you get one · What the account can do · How to leave with everything · If you are not here as a person
    • For your organizationYour own issuer identity — and your own way out.An organization on ORBIS is not an account on our platform. It is a tenant with its own web identity, its own signing key, its own revocation list and its own cSections: What your organization becomes · What onboarding actually involves · What it does not require · Three pages, one for each question · The other two doors
    • The operator back officeThe operator console, and the door that will not open yet.Issuance, revocation, the trust registry, the approvals plane, the audit chain and the compliance desk — 195 operator-authenticated operations , the largest surSections: What the back office does · The door, and why it is shut · How an operator signs in · Count it yourself · The other two doors
    • Network operations centreEvery panel on this page is a reading your own browser just took.The trust chain resolved live, the revocation field decoded from the signed list, the audit hash chain recomputed link by link, and this cell’s latency measuredSections: The chain that draws itself as it proves itself. · Tamper-evident, and you are welcome to try. · The finding this page would rather report than hide. · What an operator commands, counted from the wire. · Stated here rather than found later.
    The words, in plain language — 11 terms, each naming the specification it glosses
    Verifiable credential
    Also searched as: verifiable credential, vc, credential, digital credential, what is a credential, certificate
    A set of claims about someone, signed by whoever issued them. The signature is what makes it verifiable: whoever receives it can prove it has not been altered and can name the key that signed it, without calling the issuer to ask. It is not a login and not a row in somebody’s database — it is a document the subject holds and presents.
    Gloss of W3C Verifiable Credentials Data Model 2.0. The concrete format on this cell is SD-JWT VC (IETF). This site’s own claim: /capabilities · served by this cell: /manifest
    Issuer, holder, verifier
    Also searched as: issuer, holder, verifier, roles, who is the issuer, difference between issuer and verifier, three roles, relying party
    Three roles, separated on purpose. The ISSUER signs a claim about you. The HOLDER — you — keeps it and decides who sees it. The VERIFIER checks the signature and the status. Because the verifier does not have to call the issuer to do that check, the issuer does not learn where you used the credential. That separation is the entire point of the model; collapse it and you have rebuilt a login provider.
    Gloss of W3C Verifiable Credentials Data Model 2.0, which defines these three roles. This site’s own claim: /trust-fabric
    The trust chain
    Also searched as: trust chain, how do i know, real, genuine, authentic, fake, forged, tampered, how is it verified, verification, verify, verified, signature, signed, trust anchor, check, checked, proof, prove
    Checking a credential is four steps, in order, and every one of them can be done by the party receiving it. Read the token and the key it names. Resolve the issuer’s key document. Recompute that key’s thumbprint and compare it to the name in the token. Verify the signature with the algorithm the token itself declares. Nothing in that sequence requires trusting the issuer’s word about the issuer.
    Gloss of RFC 7638 (JWK thumbprint), RFC 7515 (JWS), W3C DID Core for resolving the key. This site’s own claim: /trust-fabric · served by this cell: /.well-known/did.json · /conformance/vectors
    Selective disclosure
    Also searched as: selective disclosure, sd-jwt, sd jwt, withhold, hide claims, privacy, share less, minimum disclosure, only show my age, zero knowledge
    Handing over some claims and withholding others without invalidating the issuer’s signature. Each claim is committed to in the signed payload as a salted hash rather than as the value itself; you send only the disclosures you choose, and the receiver recomputes the digests of what you actually sent. Withholding a claim is therefore not an act of trust or of policy — the arithmetic simply does not contain it.
    Gloss of IETF SD-JWT and SD-JWT VC. This site’s own claim: /regulations
    Revocation and status
    Also searched as: revocation, revoked, status list, expired, cancel a credential, withdraw, still valid, status
    A credential can be withdrawn after it is issued, so a verifier needs a way to ask whether this one still stands. A status list answers that as one bit per credential in a single compressed, signed document: the verifier fetches the whole list and reads its own bit, so the issuer never learns which credential was being asked about. The privacy property comes from the shape of the answer, not from a promise.
    Gloss of IETF Token Status List. This site’s own claim: /trust-fabric · served by this cell: /t/root/status/1
    DID — decentralized identifier
    Also searched as: did, decentralized identifier, did:web, did web, identifier, who signed it, public key
    An identifier that resolves to a document containing public keys. The method decides how that resolution happens. did:web makes the identifier a domain name and serves the document at a well-known path, so resolving it is an ordinary HTTPS fetch anyone can perform and nobody needs a ledger, a token or a permissioned network to complete.
    Gloss of W3C DID Core 1.0; method did:web. This site’s own claim: /standards · served by this cell: /.well-known/did.json · /t/root/did.json
    How a credential reaches a wallet
    Also searched as: oid4vci, issuance, issue, get a credential, openid4vci, how do i receive, onboarding a credential
    The protocol a wallet uses to collect a credential from an issuer: the wallet discovers what the issuer offers from a well-known metadata document, obtains authorization, and requests the credential over an ordinary OAuth-shaped exchange. Being ordinary is the feature — it means an issuer does not need a bespoke wallet and a wallet does not need a bespoke issuer.
    Gloss of OpenID for Verifiable Credential Issuance (OpenID4VCI). This site’s own claim: /standards · served by this cell: /.well-known/openid-credential-issuer · /.well-known/oauth-authorization-server
    How a credential is presented
    Also searched as: oid4vp, presentation, present, show a credential, openid4vp, dcql, prove something, log in with a credential
    The protocol a verifier uses to ask for credentials and a wallet uses to answer. The verifier states what it needs as a query rather than naming a provider, and the wallet responds with a presentation bound to that specific request — so a captured answer cannot be replayed at a different verifier.
    Gloss of OpenID for Verifiable Presentations (OpenID4VP), with DCQL for the query. This site’s own claim: /standards
    Wallet
    Also searched as: wallet, where is it stored, app, phone, my credentials, hold
    The software the holder keeps credentials in, and the place the holder’s keys are created and stay. The property that matters is not the interface: it is that the private key is generated on the device and never leaves it, because a key held by the provider makes the provider the holder no matter what the screen says.
    Gloss of No single specification; the relevant ones are OpenID4VCI/VP for the protocols and the platform key stores for custody. This site’s own claim: /for-people
    What this site is
    Also searched as: orbis, what is orbis, what does this do, what is this, the platform, product, what do you do, help
    This surface will not summarise the product for you, because a summary is exactly the kind of claim this site refuses to make without a receipt. What it will do is hand you the register: the capability page states what is live, what is partial and what is not built, each one linked to the endpoint that proves it.
    Gloss of Not a specification — a register. This site’s own claim: /capabilities · served by this cell: /openapi.json · /build
    The standards
    Also searched as: standards, specifications, specs, interoperable, eidas, regulation, compliance, conformance
    Verifiable credentials are not one standard but a stack: a data model, a serialization, a protocol to issue, a protocol to present, a way to identify keys and a way to publish status. Interoperability claims are only meaningful per layer, which is why a page that claims the whole stack at once is telling you nothing.
    Gloss of W3C VC 2.0, IETF SD-JWT VC, OpenID4VCI/VP, W3C DID Core, IETF Token Status List. This site’s own claim: /standards · served by this cell: /conformance/vectors