How to verify an AI agent before you trust it

Each question has an answer you can check yourself. If the only proof is the operator's word, nothing has been verified.

• Who is it? Look for a signed identity: a credential signed with a private key whose public half is published where you can fetch it. The W3C Verifiable Credentials Data Model is a standard shape for the credential, and a did:web DID publishes the key at a web address the issuer controls (did:web:apir.ai resolves to apir.ai/.well-known/did.json). Check that the signature verifies against that key, that the credential has not expired or been revoked, and that it names this agent.
• What may it do? Look for a mandate: what the agent may do, what it may never do, and its limits (actions, targets, a value cap, an expiry), written by its owner and signed, so it cannot be widened later without it showing. Identity is not permission. A genuine agent can still be acting outside its authority.
• What has it done? Look for a tamper-evident work history: each entry carries the hash of the entry before it, so a changed or deleted entry breaks every hash after it, and an outside timestamp, held where you can check it, shows if entries were backdated. Recompute the chain, or have someone other than the operator recompute it; do not just read it. What an AI agent black box should record covers the log itself.

A "verified" tick on the vendor's own site answers none of these. Neither does a PDF the vendor sends you: anyone can type one. The test is simple. Could the operator change the answer without you noticing? If yes, it is a claim, not a check.

APIR gives every AI agent signed papers and a tamper-evident work history that buyers, auditors and insurers can check without trusting you. Every check below is free, needs no account and is never paywalled.

1. 1. Look the agent up

   Paste its name, its agent id or its passport id at apir.ai/check-agent. A DID or a domain is not looked up. The answer is one of seven: verified, expired, revoked, superseded, unsigned, unchecked or no record. No record is an honest answer, not an accusation: it means APIR has no passport to show for that agent (a passport is issued at a score of 70 or more, and is found by name only once its owner makes it public), and it is not evidence of wrongdoing.

2. 2. Read who it is and what it may do

   A verified answer shows the agent, its Trust Passport (grade, risk tier, issue and expiry dates, and the id of the key that signed it), its mandate (the actions it is allowed, its value cap, its expiry and whether the mandate is signed), and a count of its log book's events with the time of the last one. The mandate's signature bytes and its earlier versions are not yet published, and an owner can replace a mandate. Every answer is stamped with the moment it was checked. It is verified as of that time, never forever.

3. 3. Open the passport and its log book

   If the owner made the passport public, apir.ai/verify-passport opens it by its passport id. On every open it re-checks the Ed25519 signature against the published key and recomputes the agent's Black Box chain on APIR's side: links, content and sequence. A private passport gets no chain check for outsiders. The registry lists the agents whose owners chose to list them publicly, which is not every public passport.

4. 4. Fetch the keys yourself

   APIR's public signing keys are at apir.ai/.well-known/jwks.json, and its DID document is at apir.ai/.well-known/did.json. Retired keys stay published, so an older passport still checks. The same check for software is GET https://apir.ai/api/verify-passport?id=<passport id>; send Accept: application/vc+ld+json to get it in the Verifiable Credential shape, with APIR's own proof scheme (see the caveat below).

AI assistants can ask the same question. APIR's read-only MCP server (ai.apir/verify, at https://apir.ai/api/mcp) answers whether an agent carries a signed credential, with the same seven verdicts.

You do not have to trust APIR's check of the signature. A public passport is signed with Ed25519 (RFC 8032), the public key is published, and the signed bytes are set out in the specification, so any Ed25519 library can check it.

1. 1. Get the passport and the key

   Fetch the passport's public envelope from https://apir.ai/api/verify-passport?id=<passport id> and the key set from apir.ai/.well-known/jwks.json. Use the key whose kid matches the passport's key_id. Save both, and the check itself needs no network.

2. 2. Rebuild the signed message

   APIR signs eleven fields as compact JSON, in the fixed order the specification sets out: passport_id, agent_id, org_id, trust_score (as a number), trust_grade, risk_tier, frameworks_passed (sorted), genome_hash, issued_at and expires_at (ISO 8601, UTC, to the millisecond) and methodology_version. All eleven are in the public envelope.

3. 3. Verify the signature

   Check the base64url signature against those bytes with the public key. Change one character of the score, the grade or a date and it fails. This script does all three steps:

   // verify-passport.mjs   Node 18 or later, no packages.
   // node verify-passport.mjs <passport id>
   import { createPublicKey, verify } from 'node:crypto';
   
   const [id] = process.argv.slice(2);
   const { passport: p } = await (await fetch(`https://apir.ai/api/verify-passport?id=${id}`)).json();
   if (!p) throw new Error('No public passport with that id');
   const { keys } = await (await fetch('https://apir.ai/.well-known/jwks.json')).json();
   const jwk = keys.find((k) => k.kid === p.cryptography.key_id);
   
   // The exact bytes APIR signs: these eleven fields, in this order, dates in UTC to the millisecond.
   const iso = (v) => (v ? new Date(v).toISOString() : null);
   const message = JSON.stringify({
     passport_id: p.passport_id,
     agent_id: p.agent_id,
     org_id: p.org_id,
     trust_score: p.trust_score == null ? null : Number(p.trust_score),
     trust_grade: p.trust_grade ?? null,
     risk_tier: p.risk_tier ?? null,
     frameworks_passed: [...(p.frameworks_passed || [])].map(String).sort(),
     genome_hash: p.cryptography.genome_hash ?? null,
     issued_at: iso(p.issued_at),
     expires_at: iso(p.expires_at),
     methodology_version: p.methodology_version ?? null,
   });
   
   const ok = verify(null, Buffer.from(message), createPublicKey({ key: jwk, format: 'jwk' }),
     Buffer.from(p.cryptography.passport_signature, 'base64url'));
   console.log(ok ? 'Signature valid: signed by the published key, unchanged since issue.' : 'Signature does NOT verify.');

One honest caveat on the format. Ask for the passport with Accept: application/vc+ld+json and it comes in the Verifiable Credential shape, but its proof is APIR's own scheme (type ApirPassportProof2026, cryptosuite apir-eddsa-fixed-order-2026: Ed25519 over the fixed-order JSON above), not a VC 2.0 securing mechanism, and it is not canonicalised with RFC 8785. Its dates also use the VC 1.1 names issuanceDate and expirationDate, which the VC 2.0 context does not define (2.0 uses validFrom and validUntil), and VC 2.0's own media type is application/vc. A general-purpose VC library will not verify it out of the box. The script above will.

Know Your Agent (KYA) products mostly answer the first question, and the access question that comes with it: who is this agent, who does it act for, and may it in?

That is Vouched, describing KYA-OS on its KYA page. KnowThat.ai, powered by Vouched, works on reputation instead: "Operators report agent behavior. The registry aggregates trust." More agent identity products are compared, each from its own pages, in AI agent audit and compliance tools compared.

Pick a KYA product when you run the website or API an agent is calling and need to let it in, or keep it out, as it arrives. Identity and a work history are different questions: a genuine agent with a genuine owner can still have done the wrong thing. APIR answers the record question, and the two can sit side by side.

Verification proves the papers are genuine and the record is intact. It never proves the agent is competent, safe or right.

• A valid signature proves the passport was signed by the key APIR publishes and that nothing in it has changed since. It does not prove the agent behaves well.
• A passport reflects the agent as of its last assessment and says when that was. It is first issued when the Trust Genome scores the agent 70 or more; an agent without one returns no record at the check. An agent with no evidence reads Unrated, never a made-up score.
• The mandate is written by the agent's owner. The record lets you compare what the agent did with what it was allowed; it does not tell you the mandate was wise. The mandate's signature bytes and its earlier versions are not yet published, and an owner can replace a mandate.
• The log book's entries are what the agent and its owner put on the record, whether the agent runs on APIR or anywhere else. It proves what was recorded and shows any later change, not that the record is complete.
• APIR operates the writer of the log book. Every night the chain heads are combined into a Merkle root that an outside RFC 3161 authority (freeTSA) timestamps, so a later rewrite of anything before a stamp would no longer match it. For an agent with a public passport, anyone can fetch the token from the verify-black-box endpoint and check the stamp themselves, and an owner's free export carries the tokens too. The passport, the check, the resolve answer and the Evidence Pack do not carry them yet.
• The log book's recompute runs on APIR's side, for public passports only. An agent's events are not public: to recompute them offline, an outsider needs the free export from its owner. The free check's answer carries no signature bytes.
• APIR is not an insurer, a broker or an auditor, and certifies no one. It holds no SOC 2, ISO 27001 or penetration test report.

We don't promise results. We prove whatever happens.

Checking is free, for anyone, forever.

• The check at apir.ai/check-agent, the passport page, the registry and the published keys: free, no account.
• Papering your own agent so buyers can check it: the first agent is free, and each further agent's papers are AUD 49, once.
• An Evidence Pack, sealing one agent's record for a deal, a security review or a claim: AUD 499, one-time.

Prices are read from the rate card at apir.ai/pricing when this page is built.

How do I know an AI agent is who it says it is?

Check a signed credential against a key you fetch yourself, not one the agent hands you. With APIR, look the agent up at apir.ai/check-agent, or, for a public passport, verify its Ed25519 signature offline against apir.ai/.well-known/jwks.json, the key published under did:web:apir.ai, with the owner's organisation ID. A name, a logo or a badge on the vendor's site proves nothing on its own.

What is Know Your Agent?

Know Your Agent (KYA) is the agent version of Know Your Customer: checking who an AI agent is, who it acts for and what it is permitted to do before you let it in. Identity vendors such as Vouched sell KYA products. Most answer who the agent is and whether it may act; some, such as KnowThat.ai, also keep a history. A tamper-evident work history answers what the agent has done, in a form where any later change shows.

What is an AI agent passport?

A signed credential for an AI agent. APIR's Trust Passport is Ed25519-signed and can be fetched in the Verifiable Credential shape, with APIR's own proof scheme (ApirPassportProof2026) rather than a VC 2.0 securing mechanism, so a general VC library will not verify it out of the box. It carries the agent's id, its grade, its risk tier, its issue and expiry dates and the hash of the Trust Genome it was graded from. It is first issued when the Trust Genome scores the agent 70 or more. Anyone checks a public passport free at apir.ai/verify-passport, or offline against the published key with the owner's organisation ID.

Can I verify an AI agent offline?

The signature on a public APIR passport, yes. Save its public envelope and the key set from apir.ai/.well-known/jwks.json, rebuild the eleven signed fields in the order the specification at apir.ai/agent-record-specification sets out, and check the Ed25519 signature with any library. Once you hold those, the check needs no network. The log book can be recomputed offline only from an export the agent's owner hands you: there is no public file of its events, and the recompute behind a public passport's page runs on APIR's side.

What does a verified agent prove?

That its passport was signed by the key APIR publishes and has not changed since, that it was not expired or revoked when you checked, and, on a public passport's page, that APIR's recompute of its log book holds. It does not prove the agent is competent, safe or right, or that its owner's mandate was wise.

Is the check free?

Yes. The check at apir.ai/check-agent, the passport page, the registry and the published keys are free, need no account and are never paywalled. Papering your own agent: the first is free, each further agent's papers are AUD 49, once.