identity:attest

identity family

An issuer writes one soulbound verification claim for an address: method, rung, issuer, salted commitment, expiry. Authorised by an on-chain IssuerCap (ONE's attester holds rung 3; KYC is delegated and ONE deliberately does not carry it), bound to the challenge's subject and method, and single-use — the nonce is spent only once every other check has passed.

Effect: ask; Awaits an outcome — the call returns the response below.
Caller: mint_capability; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: free; What one call costs, so you can budget before acting.
Reversible: no; This cannot be undone. Dry-run it first where the contract allows.
Settles: onchain; Moves real, permanent value on chain.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/ask/identity:attest \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "subject": <string>, "method": <key | passkey | google | …>, "commitment": <string>, "challenge": <string> }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

subject string required
method key | passkey | google | … required
commitment string required blake2b-256 hex. A raw identifier fails this pattern at the edge — which is the point
challenge string required the nonce from identity:verify; replay is refused
expiresAt number optional epoch ms; 0 or absent = never

Response

What comes back from the call.

ok boolean
claimId string
subject string
method string
level number
issuer string the attesting ADDRESS — the signing key stays server-side and is never returned, logged or thrown
state number 0 active · 1 revoked
error string

Traffic

Every call to identity:attest, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names identity:attest, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

No caller in this repo. It is reached from outside — an agent, your code, or an MCP client.

→

Answered by

identity:attest Resolved outside this repo — the pay, channels or api worker answers it. Dispatched through POST /api/ask/identity:attest, after the envelope validates the payload.

identity family · 3 more

identity:address identity:proofs identity:verify

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "subject": {
      "type": "string",
      "minLength": 1
    },
    "method": {
      "type": "string",
      "enum": [
        "key",
        "passkey",
        "google",
        "phone",
        "domain",
        "kyc",
        "owner-of"
      ]
    },
    "commitment": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$",
      "description": "blake2b-256 hex. A raw identifier fails this pattern at the edge — which is the point"
    },
    "challenge": {
      "type": "string",
      "minLength": 1,
      "description": "the nonce from identity:verify; replay is refused"
    },
    "expiresAt": {
      "description": "epoch ms; 0 or absent = never",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    }
  },
  "required": [
    "subject",
    "method",
    "commitment",
    "challenge"
  ],
  "additionalProperties": false
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "claimId": {
      "type": "string"
    },
    "subject": {
      "type": "string"
    },
    "method": {
      "type": "string"
    },
    "level": {
      "type": "number"
    },
    "issuer": {
      "description": "the attesting ADDRESS — the signing key stays server-side and is never returned, logged or thrown",
      "type": "string"
    },
    "state": {
      "description": "0 active · 1 revoked",
      "type": "number"
    },
    "error": {
      "type": "string"
    }
  },
  "required": [
    "ok"
  ]
}