Identity
Identity claims attach verified assertions to an operator and its agent Passports. A Passport carries the claim ID, provider, trust layer, claim type, assurance, and validity times. Passports do not carry raw identity attributes such as name, date of birth, address, or document number. They do carry claim and provider metadata that can be personal data or sensitive infrastructure data.
Trust levels
- L0: a registered agent with no external human or identity claim.
- L1: a provider returns a low-assurance humanity or bot-resistance signal. It does not identify the person.
- L2: a provider returns an identity assertion under that provider's policy. An OIDC subject can identify an account without proving a legal or government identity.
- Delegation: the operator grants named scopes to an agent. Delegation is authority, not a higher identity level.
Available providers
In the Console, open Connect to see the identity providers available to your account.
From an integration, call GET /v1/identity/providers to retrieve the same list through the API.
The API response includes each provider's verification method, assurance level, supported claim type, and price.
Verification lifecycle
- Initiate creates an operator-scoped provider session with a session reference and expiry.
- Sync reads current upstream state for an owned session.
- Complete accepts only a pending, unexpired session owned by the same operator and provider.
- Successful completion stores encrypted assertions and PII in an operator-scoped identity claim.
Starting verification sends data to the selected provider. The provider can retain it under its own terms. STACK stores encrypted provider session state and assertions. Layer 2 results can also store encrypted identity attributes. Expiry or revocation does not delete the claim, session, audit record, or provider record.
Claims and Passports
Successful verification creates an operator-scoped claim. Passport issue can attach selected identity_claim_ids. Service requirements can then demand a claim type, minimum assurance, accepted provider, or delegated scope.
Identity evidence answers what a provider verified about a subject. It does not itself authorize an action for another principal. An authority proof can reference an existing encrypted identity claim without copying its ciphertext, then a separate binding pins that proof to an exact agent key, receiver, purpose, scope, and validity period. See Authority.
In auto inheritance mode, a new Passport carries every valid claim reference unless issue supplies an explicit list. Opt-in mode carries none unless selected. An empty list carries none.
Service requirements are operator policy. Requirement mutations need an active service connection and an admin principal. Layer 2 policy writes require requires_pii: true and a non-empty lawful_basis declaration. STACK records this declaration. It does not validate the legal basis or send the stored identity payload to the connected service.
Revoking a claim revokes active Passports that carry it. Other claims remain separate.
Some Layer 2 flows can create a Wallet charge after completion. Check the current amount before starting the provider flow.
Identity documentation map
See Identity API, OAuth, OIDC, and SSO, PII policy, SPIFFE, SPIRE, WIMSE, and workload identity, claim revocation, and externally proved authority.