JIAOZIA Cornerstone of Mutual Trust for AI · International

Developer Docs

Copy-paste quick starts (badge / verify snippet / SDK / Validator) live on the Integrate page

  1. Install the Validator (published on PyPI): python -m pip install jiaozi-validator View on PyPI →
  2. Generate your owner key (private key stays with you — command in the Integrate page's Validator section; --demo-owner-key is for demos only)
  3. Run a local attestation:jiaozi-validator --agent-name MyAgent --path ./my-agent --owner-pubkey-file owner.pub
  4. Submit the digest and receive a credential ID + did:web identity
  5. Public resolution:GET /api/resolve?q=JIAOZI-… or a DID; credential page at /certs/:certId

SDKs are published: npm @jiaozi-protocol/sdk, PyPI jiaozi-gdid — usage on the Integrate page.

API contract

  • POST /api/verify — submit for issuance (X-Jiaozi-Key required); 201 + issuedBy: sg-core on success, 202 pending during link outages — poll /api/verify/pending/:requestId
  • attestationDegraded — boolean hint in issuance responses. true means the server-side attestation chain tried higher-trust evidence plugins (TPM / TEE / cloud remote attestation) but none was available, so the credential was issued at the level the evidence actually supports (the trustLevel in the response). Requesting a higher level is never rejected — it is issued downgraded. Relying parties: base trust decisions on the actual trustLevel value; attestationDegraded is informational only and does not affect credential validity.
  • GET /api/resolve?q= — public resolution by credential ID or DID
  • GET /agents/:certId/did.json — did:web standard path (issuing host: jiaozi.io)

Independent verification (no JIAOZI tooling required)

Credentials and status use open standards end to end. Anyone can verify independently with generic open-source libraries — no JIAOZI SDK, no permission needed, works even if our site goes down. There is a single trust root: https://www.jiaozi.io/.well-known/did.json (the did:web issuer document, listing both the issuance key and the status key).

  • GET /api/certs/:certId/vc — W3C VC 2.0 with DataIntegrityProof (eddsa-rdfc-2022). Verify with @digitalbazaar/vc or any Data Integrity verifier.
  • GET /api/status-list/revocation · /api/status-list/suspension — W3C Bitstring Status Lists: revocation (permanent) and suspension (reversible) as signed bitmaps, minute-level freshness; each VC's credentialStatus points at its slot.
  • GET /api/status/:certId?format=jwt — the 60-second live status in standard form: a VC 2.0 vc+jwt compact JWS (EdDSA). Any JOSE library verifies it in two lines; the kid points at the status key in did.json. Without ?format the endpoint still returns the jiaozi.status.v1 envelope — same state, same key.
  • GET /api/status-key — convenience view of the status key (standard Multikey z6Mk… encoding); did.json remains the authoritative source.

Develop from source

Only for contributors hacking on the Validator itself: clone the repo, then cd packages/validator && pip install -e .. Regular users should just use the PyPI package above.

DID method: did:web (host jiaozi.io). The checkup runs locally and only submits digest hashes — source code is never uploaded.