> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amrood.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Certificates

> Cryptographic identity certificates for agents

# Agent Certificates

Every agent on Amrood gets an **Ed25519 cryptographic certificate** that proves its identity, capabilities, and ownership — without exposing the owner's personal details.

## What's in a Certificate

| Field | Description |
| - | - |
| `id` | Unique certificate ID (`cert_xxx`) |
| `agent_id` | The agent this certificate belongs to |
| `issuer` | Always `"amrood"` |
| `subject` | Agent's display name |
| `public_key` | Agent's Ed25519 public key (base64) |
| `capabilities` | What the agent can do: `["pay", "receive", "escrow", "verify"]` |
| `tier` | Agent's trust tier |
| `owner_id` | Reference to KYC'd owner (for compliance, not public) |
| `expires_at` | Certificate expiry (default 1 year) |
| `signature` | Amrood platform's Ed25519 signature over the certificate |

## Auto-Issued on Creation

When you create an agent, Amrood automatically issues a default certificate with `["pay", "receive"]` capabilities.

## Verify a Certificate

Anyone can verify an agent's certificate without authentication:

```bash theme={null}
GET /v1/certificates/cert_xxx/verify
```

```json theme={null}
{
  "valid": true,
  "reason": "ok"
}
```

Verification checks:

1. Certificate exists and is not revoked
2. Certificate has not expired
3. Platform signature is valid (Ed25519)

## Issue a Custom Certificate

Owners can issue certificates with specific capabilities:

```bash theme={null}
POST /v1/agents/agt_xxx/certificates
{
  "capabilities": ["pay", "receive", "escrow", "verify"],
  "validity_days": 365
}
```

## Revoke a Certificate

```bash theme={null}
POST /v1/certificates/cert_xxx/revoke
{ "reason": "compromised" }
```

Revoked certificates immediately fail verification.

## Rotate a Certificate

Revoke the old certificate and issue a new one in a single operation:

```bash theme={null}
POST /v1/certificates/cert_xxx/rotate
{ "capabilities": ["pay", "receive", "escrow"] }
```

## What Counterparties See

When agent A wants to transact with agent B, it can verify:

* "Is this agent verified and policy-controlled?" (yes/no)
* "What capabilities does it have?"
* "Is it backed by a KYC'd human?"

Without seeing the owner's personal identity.

## Platform Public Key

Amrood's platform public key for independent signature verification:

```bash theme={null}
GET /.well-known/amrood-keys.json
```

```json theme={null}
{
  "platform": "amrood",
  "algorithm": "Ed25519",
  "public_key": "base64-encoded-key"
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.