§ Ayra TRQP Profile

This specification defines the Ayra TRQP Profile for the Ayra Trust Network. It profiles the Trust Registry Query Protocol (TRQP) v2.0 for use within the Ayra Trust Network.

• Implementers Guide – non-normative guidance, examples, and integration patterns
• Ayra TRQP Profile API – normative OpenAPI documentation for the Ayra TRQP Profile API surface (use tags to filter by trqp-core or ayra-extension)

§ Normative References and Source of Truth

For this profile:

1. TRQP v2.0 is authoritative for the core protocol model, HTTPS binding, and core field names.
2. W3C DID Core is authoritative for DID, DID URI, DID method, DID controller, and DID Document semantics.
3. The Ayra TRQP Profile API is authoritative for the Ayra API surface, request and response schemas, parameters, and status codes.
4. This document is authoritative for Ayra profile requirements and conformance policy.
5. The Implementers Guide is non-normative supporting material.

§ Profile at a Glance

Ayra-conformant Trust Registries:

• MUST implement both TRQP core endpoints: POST /authorization and POST /recognition.
• MUST use TRQP-compatible _id field names, including entity_id and authority_id; these fields MUST NOT be renamed to _did.
• MUST represent all Ayra _id values as DID URI strings.
• MUST return RFC 7807 Problem Details for error responses.
• MAY implement Ayra extension endpoints for metadata, entity discovery, ecosystem discovery, and lookups.
• MUST return HTTP 501 with Problem Details when an optional Ayra extension endpoint is not implemented.
• SHOULD sign responses with JWS where supported; the signing mechanism is still being finalized.

§ Profile Overview

§ Identifier Requirements

§ General Identifier Requirements

The approved TRQP v2.0 specification is the source of truth for core identifier semantics. W3C DID Core is the source of truth for DID, DID URI, DID method, DID controller, and DID Document semantics. The Ayra Profile uses the TRQP field names authority_id, entity_id, action, and resource for all core queries and uses _id, not _did, for Ayra extension parameters and properties.

All _id values in Ayra TRQP messages MUST be DIDs represented as DID URI strings, as defined by W3C DID Core. The supported DID methods are defined by the relevant authority or registry and should be exposed through GET /lookups/didMethods when that optional endpoint is implemented. did:webvh is preferred and may be required for higher assurance levels. did:web and other DID methods may be acceptable, subject to authority policy and any assurance-level limits advertised by the registry.

§ Ecosystem and Authority Identifiers

For Ayra, an ecosystem DID is normally used as the TRQP authority_id. The authority_id identifies the authority whose governance context is being queried.

The ecosystem governance framework MUST be discoverable via the authority_id, consistent with TRQP v2.0. This discovery may be expressed through DID Document service entries or another mechanism defined by the ecosystem’s governance and implementation profile.

Only valid ecosystem controllers are allowed to register the ecosystem with the Ayra Trust Network.

§ Trust Registry Identifiers

Trust Registry identifiers MUST be DIDs. The Trust Registry DID Document should make its TRQP service endpoint discoverable. A Trust Registry may serve authority statements for one or more ecosystems.

§ Protocol Requirements

§ TRQP v2.0 Compliance

All Trust Registries in the Ayra Trust Network MUST implement the TRQP v2.0 HTTPS Binding:

1. POST /authorization – accept authorization queries and return responses conforming to the TRQP v2.0 schema.
2. POST /recognition – accept recognition queries and return responses conforming to the TRQP v2.0 schema.

All queries use the PARC model with required fields: entity_id, authority_id, action, resource, and optional context, as defined by TRQP v2.0.

All core TRQP error responses MUST use RFC 7807 Problem Details format with appropriate HTTP status codes as defined by the Ayra TRQP Profile API. Core TRQP endpoints use the status codes defined for /authorization and /recognition in the OpenAPI specification and MUST NOT return HTTP 501 to indicate non-support.

§ Ayra Extension Endpoints

In addition to the TRQP v2.0 core endpoints, the Ayra Profile defines the following optional extension endpoints. If an extension endpoint is not implemented, a Trust Registry MUST return HTTP 501 with a Problem Details response. If an extension endpoint is implemented, it MUST conform to the Ayra TRQP Profile API.

See the Ayra TRQP Profile API for full endpoint details, request/response schemas, and error codes.

The /metadata response shape and minimum required fields are defined by the Ayra TRQP Profile API. This profile intentionally does not duplicate the metadata schema.

§ Security Requirements

§ Transport Security

All TRQP endpoints MUST be served over HTTPS (TLS 1.2 or later).

§ Response Signing

Trust Registries returning TRQP-compliant responses in the Ayra Trust Network SHOULD sign responses using JWS with keys controlled by the Trust Registry controller or operator.

§ Agent and Automation Notes

Automated agents, documentation tools, and conformance tools should apply these interpretation rules:

• Treat TRQP v2.0, W3C DID Core, the Ayra TRQP Profile API, and this profile in the source-of-truth order listed above.
• Do not rename TRQP fields to _did. Ayra uses TRQP-compatible _id field names and constrains the values to DID URI strings.
• Do not assume only did:webvh and did:web are supported. Supported DID methods are registry- or authority-specific and discoverable through GET /lookups/didMethods.
• Do not treat optional Ayra extension endpoints as mandatory. Unsupported extension endpoints return HTTP 501 with Problem Details.
• Do not treat JWS response signing as mandatory. Response signing is a SHOULD until the signing mechanism is finalized.
• JSON Schema files in this repository use the .schema.json extension.