Skip to content
ECZ-IDAPI
Verify an ECZ-ID

At scale

Ownership across an API estate

Nobody has one API. They have a first-party estate, a set of partner-facing surfaces, a few inherited from an acquisition, and at least one nobody can name an owner for. One free Passport answers that question for one API. The estate view answers it for all of them at once.

The problem

Ownership decays faster than documentation

An API outlives the team that built it, the wiki page that described it and the person who knew why it exists. What is missing is rarely the endpoint; it is the name of whoever answers for it.

  • An estate is discovered, not designed

    Gateways, marketplaces, service catalogues and spreadsheets each hold part of the picture, and none of them agrees with the others about which entries are the same API.

  • A hostname is not an owner

    The thing a caller has is a base URL. Reaching an accountable organisation from it is, today, usually a matter of asking someone who might know.

  • Consolidation makes it worse

    After an acquisition the same logical API may appear under two organisations. One identity per logical API is how that resolves without renaming anything.

  • Agents will ask more often than people

    A machine caller has no colleague to ask. A public, machine-readable record is the only form of the answer it can use.

Optional

API Estate & Ownership

Ownership and identity across your whole API estate, rather than one API at a time.

The boundary

It records ownership. It is not a security test of any API and it never implies domain control.

Recording that your organisation owns an API is a declaration by your organisation. It is not evidence that you control the domain it answers on, and it is not the result of any test against it. The record is careful about that distinction so that a reader can be too.

Nothing here is required to hold a free API Passport, to publish its record or to have it resolved. An estate view is useful when you have an estate; one API needs one Passport and nothing else.

Read this before you assume

What an estate record is not

An ECZ-ID does not make anything safe, certified, approved or compliant, and holding one does not make you compliant with anything.
  • It is not an inventory scan. ECZ-ID discovers nothing about your network and reaches no endpoint of yours.
  • It is not a security assessment. No API on a record has been tested, and a record never says otherwise.
  • It is not proof of domain control. A declared origin is a declaration, and a reader should treat it as one.
  • It is not an authorisation decision. Whether a caller may reach an API is settled by your gateway and your tokens, not by a public record.

Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.