Documentation | HUMΛN Docs

Overview

Verify a Passport and related proofs without a live HUMΛN API round-trip for the crypto check. Signatures and Merkle inclusion can be checked locally from cached public material. Revocation freshness still depends on periodically syncing public snapshots.

Why Offline Verification?

Low latency: Local crypto checks are milliseconds

Availability: Keep verifying when the API is unreachable (with a fresh enough cache)

Privacy: Fewer network calls means less metadata leakage

Edge: Useful for IoT, mobile, and air-gapped verifiers

Think of it like: Checking a driver's license hologram — you don't call the DMV for every glance, but you still refresh the stolen-license bulletin on a schedule.

How Offline Verification Works

Local signature check — @human/passport OfflinePassportVerifier verifies container signatures offline

Cached ledger root / Merkle proof — inclusion proofs verified against a previously synced root

Revocation snapshot — pull GET /v1/passports/:did/devices/revocation-snapshot while online; check cache offline

BBS issuer key — GET /v1/.well-known/bbs-public-key for credential verification key material

There is no fantasy HumanOS.Passport.verifyOffline() on @human/sdk, and no global /v1/crl CRL download endpoint.

SDK Examples

SDK:

REST helpers (sync while online)

GET /v1/.well-known/bbs-public-key

GET /v1/passports/{did}/devices/revocation-snapshot

POST /v1/passports/{did}/ledger-anchor/verify
Authorization: Bearer 
Content-Type: application/json{
  "merkle_proof": [],
  "leaf_hash": "…"
}

Honest limitations

Claim	Reality
Fully offline always	Only after you cache public keys + revocation snapshot
`HumanOS.Passport.verifyOffline`	Does not exist — use `OfflinePassportVerifier`
Global CRL download	No single `/v1/crl` — use per-DID revocation snapshots
Ledger verify without network	Inclusion check against cached root; live `ledger-anchor/verify` needs network

Security Considerations

DO

Refresh revocation snapshots on a schedule before going offline

Verify signatures with OfflinePassportVerifier against known public keys

Treat stale revocation caches as elevated risk

DON'T

Invent a server SDK method that pretends offline verify is a single HTTP call

Skip revocation freshness for high-risk decisions

Ship private keys to verifiers — only public material

Next Steps

Revoke Delegation

Multi-Device Sync

Verify Passport Offline