# WBA Thumbprint Validator

> WBA Thumbprint Validator is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).

Validates that a given keyid matches the RFC 7638 thumbprint of a key published in an agent's JWKS key directory

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/wba-thumbprint
- Price: $0.01/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/wba-thumbprint-validator-80fb9b8b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_f7SzMcyU7JsMDoR4VOGUI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability wba-thumbprint-validator-80fb9b8b -d '<json body>'
```

Example prompt: Check whether my keyid 'abc123' actually matches one of the keys published at https://myagent.example.com/.well-known/http-message-signatures-directory — I want to confirm the RFC 7638 thumbprint lines up before I send signed requests.

## When to prefer this

Use this endpoint when you need to confirm that a keyid used in HTTP message signatures (RFC 9421 / WBA) actually corresponds to a key the agent has published in its JWKS directory. This is specifically useful before initiating signed API calls, when debugging signature rejections, or when onboarding a new agent identity and verifying that key material is consistent. Prefer this over full signature verification when you only need to validate key identity, not an actual signature.

## Known failure modes

- Key directory URL is unreachable or returns non-200 — validation cannot proceed
- No key in the JWKS matches the provided keyid thumbprint — returns mismatch
- Malformed keyid or JWKS document — parsing error returned
- key_directory is not a valid HTTPS URI — rejected at input validation
- Neither keyid nor signature_input provided — required field missing error

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

Returns whether the provided keyid matches the RFC 7638 thumbprint of any key found at the specified JWKS key directory, allowing the caller to confirm key identity consistency before or during HTTP message signature workflows.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "fail",
   "endpoint": "wba-thumbprint",
   "evidence": {
    "keys_found": 1,
    "published_thumbprints": [
     "poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"
    ]
   },
   "findings": [
    {
     "code": "KEYID_IS_KID_NOT_THUMBPRINT",
     "detail": "keyid matches the kid of key 0 but NOT its RFC 7638 thumbprint.",
     "severity": "blocking"
    }
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/wba-thumbprint-validator-80fb9b8b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)