Quickstart · ECZ-ID API Passport™

API quickstart

Give an API surface you operate a free ECZ-ID API Passport, declare it in your OpenAPI description, and let callers check it before they send consequential requests.

Live · public

The free API Passport journey, the public record and the relying-party check are live. Commands were measured read-only on 2026-10-10. Availability is read live in TrustOps.

This quickstart gets the machine its identity. To carry it through the whole Accountability Chain (authority, Intent, decision, Receipt and re-verify), follow the API guided flow.

01Know what one Passport covers

You operate an API that agents and applications call. One Passport is one authorised API surface operated by the Parent.

Law: one logical API -> one Passport; versions, environments, regional aliases and gateways are bindings; a second distinct API surface is a second Passport.

Never a new Passport: version, environment, regional_alias, gateway.

02Get the free Passport

Open the API door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

api_base_url: the API base URL; a trailing /vN version segment is a binding, not the subject
openapi_url: the URL of the OpenAPI document
repository: host/owner/repo of the source repository

Start the API Passport in TrustOps (opens in a new tab)

03Declare it where your ecosystem looks

The families contract names the place: OpenAPI info: x-ecz-id + x-ecz-resolver-backlink. A declaration is a pointer, not proof.

yamlIllustrative OpenAPI declaration: one x-ecz-id object, fields as in the OpenAPI x-ecz-id reference. Take the identifiers from your TrustOps console.

openapi: 3.1.0
info:
  title: Example Payments API
  version: "2.3.0"
  x-ecz-id:
    operator_ecz_id: ECZ-GB-EXAMPL
    api_passport_id: ECZ-GB-EXAMPL::API_PASSPORT-AB12CD
    api_origin: https://api.example.com
    spec_hash: sha256:<hash-of-canonical-spec>
    resolver_url: https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::API_PASSPORT-AB12CD

04Prove a binding

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: API_ORIGIN, OPENAPI_SPEC, WEBHOOK_ENDPOINT, DOMAIN_DNS_TXT, jwks_uri.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

05Let relying parties check it

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

bashMeasured 2026-10-10: NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target https://api.ecocitizenz.com --target-type api_url

ECZ-ID’s own public API has not been issued an API Passport. Versions, environments and gateways of one API are bindings of one Passport; a second distinct API is a second Passport.

06Next: Intent, decision, Receipt

Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
No public retrievalPlan for Receipts in your records. Verify a Receipt

Go deeper

A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant, approved, certified or endorsed. Family facts come from the TrustOps families contract; current state is only ever the live Resolver record.