API Reference

OCME Registry exposes a small public API for DID verification and resolution, plus an authenticated service-binding API used by trusted internal partners.

Base URLs: https://prod.ocmeregistry.com (production) · https://dev.ocmeregistry.com (development)

Public Endpoints

No authentication required. All public endpoints send Access-Control-Allow-Origin: * and answer CORS preflight (OPTIONS).

POST /api/verify/did

Verifies a DID document's authenticity and integrity. The document is resolved from canonical D1 storage and its cryptographic signature (RSASSA-PKCS1-v1_5 with SHA-256) is verified internally against the full document before any redaction is applied to the response.

Request body

{
  "did": "did:webvh:prod.ocmeregistry.com:creator:example-creator"
}

Supported DID formats

• did:webvh:{domain}:creator:{id}
• did:webvh:{domain}:content:{id}
• did:webvh:{domain}:media:{id}
• did:webvh:{domain}:splitsheet:{id}
• did:webvh:{domain}:showrunner:{slug}
• did:webvh:{domain}:member:{hash}
• did:webvh:{domain}:cube:{id}

{domain} is prod.ocmeregistry.com in production and dev.ocmeregistry.com in development.

Response (200)

{
  "success": true,
  "data": {
    "verified": true,
    "didType": "creator",
    "document": { /* DID document — redacted public view, see below */ },
    "publicRedaction": {            /* present only when fields were redacted */
      "redacted": ["creatorData.paymentInfo", "proof"],
      "reason": "pii-minimization",
      "policy": "payment-and-legal-identity-fields-are-not-public"
    },
    "verificationDetails": {
      "signatureValid": true,
      "documentIntegrity": true,
      "timestampValid": true,
      "controllerValid": true,
      "cryptographicProof": { /* algorithm, key type, proof purpose */ },
      "timestampAnalysis": { /* created/proof ages, consistency */ },
      "structuralValidation": { /* required fields, DID format, context */ }
    },
    "metadata": { "resolvedAt": "...", "resolutionMethod": "...", "verificationMethod": "..." }
  },
  "requestId": "...",
  "timestamp": "...",
  "processingTime": "123ms"
}

Redaction boundary. This route is unauthenticated, so the embedded document is a redacted public view: payment/legal-identity fields (creatorData.paymentInfo, #payment/#compliance services, staff audit-trail emails) are stripped, and when anything was stripped the document proof is removed too and a publicRedaction disclosure is included. The verified result is computed against the full document internally and remains trustworthy. Documents with no sensitive material are returned untouched, proof included.

Errors

• 400 — invalid JSON, missing/non-string did, or unsupported DID type
• 404 — DID not found
• 500 — verification process failed

GET /api/health

Liveness probe for the registry service.

Response (200)

{
  "status": "ok",
  "timestamp": "2026-09-10T12:00:00.000Z",
  "service": "ocmeregistry-com",
  "environment": "production",
  "version": "0.0.1"
}

GET

/creator/{id}/did.json · /member/{hash}/did.json ·
				/showrunner/{slug}/did.json

Public DID document resolution over HTTPS, per the did:webvh method. Returns the DID document as application/did+json (cached 5 minutes). The same redaction boundary as /api/verify/did applies: when fields are redacted the proof is removed and a publicRedaction block is added to the document body.

• 400 — missing id/hash/slug parameter, or entity not publicly routable
• 404 — no active DID document for that entity

Service Binding API (Authenticated)

Not a public API. /service-binding/* routes are restricted at the ingress layer to the trusted internal binding contract (The RIC gateway). Callers authenticate with a JWT issued by the OCMECO app (validated server-side via Sentinel) and must hold one of the roles creator, broadcaster, or admin; each endpoint enforces per-method role requirements. These endpoints are documented for integration partners, not for general use.

Material endpoints

Method	Path	Purpose
GET, POST	/service-binding/content	List content (creators see their own; broadcaster/admin see all) and create content records
GET, PUT, PATCH, DELETE	/service-binding/content/{id}	Read, update, or delete a single content record
PATCH	/service-binding/content/{id}/status	Transition content lifecycle status
GET	/service-binding/content/by-hash/{hash}	Look up content by its SHA-256 file hash
GET	/service-binding/creators	List creators (broadcaster/admin)
GET	/service-binding/creators/search	Full-text creator search (FTS5)
GET, PUT	/service-binding/creators/{id}	Read or update a creator profile
POST	/service-binding/did/create-upload-dids	Mint the DID set for a new upload (content, media, splitsheet)
POST	/service-binding/did/member · /did/showrunner · /did/broadcaster	Mint member, showrunner, or broadcaster DIDs
GET	/service-binding/did/cube/{id}	Read a cube DID record
GET	/service-binding/media/by-dids	Batch-resolve media records by DID
GET, POST	/service-binding/playlists	List and create playlists
GET, PUT, DELETE	/service-binding/playlists/{id}	Read, update, or delete a playlist
GET	/service-binding/showrunners	List showrunners
GET	/service-binding/showrunners/{slug}/sites	List the sites belonging to a showrunner
GET, POST	/service-binding/sites	List and register broadcast sites
GET, PATCH, DELETE	/service-binding/sites/{site_did}	Read, update, or remove a site by its DID
GET	/service-binding/notifications	List notifications for the authenticated principal
GET, POST	/service-binding/play-records	Query and record content play events (revenue input)
GET, POST, DELETE	/service-binding/featured	Manage featured content placements
GET	/service-binding/publish-targets	List available publish targets
GET	/service-binding/revenue/dashboard/current	Current revenue dashboard for the authenticated creator
GET	/service-binding/revenue/earnings/balance	Current earnings balance
POST	/service-binding/collab/claim-splitsheet-invites	Claim pending splitsheet collaboration invites

Admin-only operations (governance, revenue settlement, D1 maintenance and repair) live under /service-binding/admin/* and require the admin role. A scheduled settlement trigger exists at /api/cron/settle (cron-authenticated, not publicly callable).

Learn More

DID Method Guide Verification & Redaction

Next: System Overview