API Overview

Base URL, authentication, error format, and endpoint summary.

The ATAP API is a REST API for entity management, credential issuance, revocation, and DIDComm messaging. Approvals themselves are transported via DIDComm — not via REST.

Base URL

Declared in /.well-known/atap.json. The reference implementation uses:

Production: https://api.atap.dev/v1
Sandbox: https://api.sandbox.atap.dev/v1

Authentication

Authenticated endpoints require OAuth 2.1 + DPoP (RFC 9449). Each request includes:

A DPoP header with a proof JWT
An Authorization: DPoP <token> header

See OAuth & DPoP for token acquisition.

Scopes

Scope	Permits
`atap:inbox`	Read inbox, SSE stream
`atap:send`	Send DIDComm messages
`atap:revoke`	Submit approval revocations
`atap:manage`	Manage credentials, key rotation

Error format

Errors follow RFC 7807 (Problem Details):

{
  "type": "https://atap.dev/errors/trust-level-insufficient",
  "title": "Insufficient trust level",
  "status": 403,
  "detail": "This endpoint requires trust level 2.",
  "instance": "/v1/credentials/personhood"
}

Endpoints at a glance

Public (no auth)

POST/v1/entitiesNone

GET/v1/entities/{id}None

Get entity info.

GET/{type}/{id}/did.jsonNone

Resolve DID Document.

GET/.well-known/atap.jsonNone

Server discovery.

GET/v1/revocationsNone

Query revocations by entity DID.

GET/v1/credentials/status/{list-id}None

Bitstring Status List.

Authenticated (DPoP)

DELETE/v1/entities/{id}atap:manage

Crypto-shred entity.

POST/v1/revocationsatap:revoke

Submit signed revocation.

POST/v1/credentials/email/startatap:manage

Start email verification.

POST/v1/credentials/email/verifyatap:manage

Complete email verification.

GET/v1/credentialsatap:manage

List own credentials.

POST/v1/didcommDIDComm

DIDComm message endpoint.