Free identity
The free API Passport
One API Passport covers one authorised logical API surface — not each version, not each environment, and not each gateway in front of it. This page is the whole of what the free identity establishes, and the four things it deliberately does not say.
Current availability
The API door is not open yet.
The API Passport is free — £0, permanently, and never sold. That is the price, and it is not what is missing. What is not ready is the door: ECZ-ID Core is not issuing API Passports yet, and the Resolver is not projecting API records yet.
So this site publishes no start link, no waiting list and no date. When both are live, the family is opened through one configuration value in the Website Factory and the control appears on every page here at once. No page on this site is rewritten to do it.
Nothing on this site can be bought in the meantime. Paid capabilities are described here and configured in TrustOps, which owns every purchase.
The subject
One API Passport is one API
What never becomes a second Passport
Versions, environments, base URLs and gateways of that API are not separate Passports.
The shape of the identifier
ECZ-XX-XXXXXX::API_PASSPORT-XXXXXX
A pattern, not a real record. The Parent identifier comes first and the child follows the :: separator.
Included
What the free Passport establishes
- A persistent ECZ-ID for the API.
- Your organisation on the record as its operator — a free DECLARED Parent is created if you do not already have one.
- A public Resolver record anyone can open, and the same record as machine-readable JSON.
- A badge, a QR code and a share link.
- Basic bindings to the public places your API already appears.
- Lifecycle and current public state, evaluated on demand.
- Claim and recovery.
- Basic participation in the Digital Entity Graph.
- Essential lifecycle evidence, kept in LedgerCore.
Publishing the record is your decision. Nothing becomes public until you consent, and you can withdraw publication later.
The flow
How you would get one
Create or claim the identity
Start in TrustOps with one sign-in. Your organisation's free DECLARED Parent is reused or created, and the API gets its ECZ-ID.
Configure and bind
Add the public places your API already appears — your published API documentation or an OpenAPI description you host. Each binding records where it was learned.
Prove it on the Resolver
Anyone can open the public record and its JSON, with no account and no API key — and re-check it before relying on it.
Operate
Publish the ECZ-ID where people and machines already look, and manage it from your ECZ-ID console.
Strengthen, only if useful
Parent verification, monitoring, evidence and authority are optional. None is needed to hold a Passport.
The boundary
What the Passport deliberately does not say
DECLARED ≠ VERIFIED
A DECLARED record states what your organisation says about itself, with the date it said it. It is not the outcome of an independent check.
Identity ≠ Binding
The Passport identifies the API. A binding records a public place it already appears. Adding a binding never creates a second identity.
Binding ≠ Authority
A binding shows that a relationship has been declared. It does not grant, prove or imply authority to act.
Parent verification ≠ API verification
A VERIFIED or ASSURED Parent verifies your organisation. It does not verify the API.
An ECZ-ID does not make anything safe, certified, approved or compliant, and holding one does not make you compliant with anything.
A Resolver record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read — is_proof is false and recheck_before_reliance is true. Re-check before you rely on it.