USERNAME.md gives every handle a machine-resolvable, cryptographically verifiable
identity — profiles, did:web
documents, signed claims, and agent handshake surfaces. When your product needs to
resolve, verify, or provision identity at scale, you talk to the API directly.
/api/reserved-handles.json?
The public bulk-roster endpoint has been retired — enumerating reserved handles
exposed customer data, so it no longer ships a list. To check a single handle,
use GET /api/availability/{handle} (public, no key). To resolve,
verify, or provision identity programmatically at volume, that's what this page is
about: supported, metered, signed API access with a contract behind it.
Every surface below is live today and documented in the OpenAPI spec. All of it is programmable.
One handle, many representations — HTML, Markdown, JSON, JSON-LD, or a signed JWS bundle, selected by Accept header. Resolve a person or an agent by name.
Each handle publishes a did:web document and the well-known documents agents use to discover and verify it — plain JSON over HTTPS, no proprietary resolver.
Statements about a handle ("owns this domain", "controls this GitHub account") issued as Verifiable Credentials (JWS, vc+jwt) under the handle's Ed25519 key.
Prove control of an external domain via a DNS TXT challenge, then mint a signed claim from it — a programmable trust primitive for your onboarding flows.
Bind a Bluesky DID so @you.username.md resolves natively across the ATProto network. Federated identity without running your own PDS.
Import an existing Keybase identity — profile, social proofs, PGP key — and re-verify the proofs under the platform's own signed claims. Migrate trust, don't rebuild it.
Every API response is signed with the platform Ed25519 key (RFC 9421). You can prove a response came from USERNAME.md without trusting the transport.
The public API is free to read per-handle. Enterprise is for teams doing this at volume, with a contract, an SLA, and a name to call.
Rate limits sized to your traffic, with usage-based pricing instead of per-handle friction. Resolve millions of lookups without tripping the public quotas.
Reserve and manage handles for your org, your users, or your fleet of agents programmatically — namespace allocation, not one-at-a-time checkout.
The platform runs multi-region and highly available on managed, RDS-backed infrastructure. Enterprise agreements attach uptime and support SLAs to it.
Delegate id.yourcompany.com to the platform via CNAME so identity resolves under your brand while we run the resolver, signing keys, and uptime.
Ed25519 signing on every response, published verification keys, and key-rotation notice — so your compliance story for "was this identity data authentic?" is cryptographic.
A direct line, onboarding help, and a Data Processing Agreement. Built and operated by The Holding Company.
Public reads need no credentials. Owner and provisioning operations use a Bearer API token. Full reference in the OpenAPI spec and developer guide.
| Endpoint | What it does | Auth |
|---|---|---|
| GET /api/availability/{handle} | Is a handle available / taken / reserved | Public |
| GET /v1/users/{handle}/profile | Content-negotiated public profile | Public |
| GET /v1/users/{handle}/preferences | Theme / accent presentation prefs | Public |
| GET /v1/users/{handle}/claims | Signed verifiable-claim bundle | Public |
| POST /v1/users/{handle}/claims | Issue a signed claim | Bearer |
| POST /v1/users/{handle}/verifications/dns-txt | Start a domain-ownership challenge | Bearer |
| POST /v1/users/{handle}/atproto | Bind a Bluesky/ATProto DID | Bearer |
| POST /v1/users/{handle}/import/keybase | Import + re-verify a Keybase identity | Bearer |
| GET /.well-known/… | did:web, handshake, JWKS signing keys | Public |
Tell us what you're building and the volume you expect. We'll scope access, limits, and an agreement — usually within a business day.