Trust Registry Query Protocol

Identity Protocol

Lightweight, read-only protocol for making fast, efficient queries against authoritative trust registries to verify whether an entity is authorized to take an action under a specific governance framework. The fundamental query is: "Does entity X hold authorization Y under governance framework Z?" Includes additional query types for retrieving registry metadata, supported authorization namespaces, and registry-of-registries relationships. Designed as "DNS for trust domains" — a standard data model, query vocabulary, and transport binding any ecosystem can implement regardless of internal trust architecture (X.509, OpenID Federation, EBSI Trust Chains, TRAIN, blockchains, etc.)

Community
Links
Visit Community

Details

License Spec: open under ToIP IPR framework; multiple independent implementations including archetech/archon-trust-registry
Dev Status 🔍 Review
Dev Status Detail Public Review 02 of V2.0 (Dec 2025); core specification separated from transport bindings; initial REST/HTTPS binding
Owner Trust Over IP Foundation (project of Linux Foundation Decentralized Trust); developed by the Trust Registry Task Force (TRTF) within the Technology Stack Working Group
Country International (Linux Foundation; global membership)
Start Year 2021
Stack Specification only; reference implementations expected via OpenAPI 3.0 client/server code generation; HTTPS as initial transport binding; future bindings to DIDComm and TSP under consideration
Funding Trust Over IP Foundation member contributions
Last Investigated Jul 1, 2026

Use Case Domains

Identity & Trust

Identity Protocol Attributes

Origins ToIP TRTF — formed Summer 2021 in response to COVID-era cross-jurisdiction digital health credential verification needs
Database N/A — TRQP queries existing trust registry systems-of-record; storage is registry-side concern; bridges adapt diverse backends including X.509 PKI, OpenID Federations, EBSI Trust Chains, TRAIN, and EU Trusted Lists
Query Language TRQP query types (Authorization, Recognition, Description) expressed as OpenAPI-defined REST endpoints over HTTPS; not a general query language but a small fixed set of typed queries
Data Formats Authority statements as semantic triples (authority, entity, assertion); REST/HTTPS binding follows OpenAPI Specification 3.1.0; assertions in three categories (descriptions, authorizations, recognitions)
Mobile Support Yes — HTTPS-based; usable from any mobile client capable of HTTPS
Web Support Yes — primary transport binding is REST/HTTPS; future bindings to DIDComm and TSP planned
Native Apps Implementation-dependent — OpenAPI 3.0 specification enables code generation for clients in any major language; wallet integrations expected for credential verification flows
Terms Open standard, free to implement (under ToIP IPR framework)
Funds Unknown — ToIP/LF Decentralized Trust member-fee funded; specific TRTF (Trust Registry Task Force) budget not separately published
Based On W3C DIDs (for authority and entity identifiers); OpenAPI Specification 3.1.0 (for REST binding); ABNF for authorization assertion strings
Permissions Read-only protocol — no write permissions defined; create/update/delete reserved for future protocol versions if demand emerges
Authentication & Identity Authority and entity in authority statements identified by W3C DIDs (or KERI AIDs / HTTPS URLs); cryptographic verification of authority statements
Storage Model Read-only query protocol — does not specify storage; bridges adapt to existing systems of record (databases, X.509 hierarchies, OpenID Federations, blockchains)
Interoperability Designed for inter-ecosystem authority verification across heterogeneous trust architectures; bridge architecture allows existing infrastructure to be queried via uniform protocol
Data Portability Authority statements queryable across registries; recognition queries enable building federated trust graphs across registries; bridges enable cross-system queries
Governance & Decision Making ToIP TRTF governance — open meetings, consensus-driven, IPR-protected under LF Decentralized Trust; each trust registry's authority statements derive from its governance framework rather than from TRQP itself
Protocol Maturity / Standardization Public Review 02 of V2.0 (Dec 2025); Implementers Draft phase
Identity Standards W3C DIDs; W3C Verifiable Credentials (commonly the credentials whose issuers are verified via TRQP); ToIP Trust Registry data model
DID Methods Supported Any (method-agnostic)
Key Management Out of scope for TRQP itself — each system of record manages its own keys; TRQP queries verify against the trust root of the relying registry
Credential Types N/A — TRQP enables querying who is authorized to issue or verify credentials, but does not itself convey credentials
Verification Method Cryptographic verification of authority DID signatures on authority statements
Privacy Features Read-only by design (no PII required for queries); transport-binding-dependent metadata privacy (HTTPS for initial binding; future DIDComm and TSP bindings would offer enhanced privacy)
Authentication Methods Transport-binding-dependent — HTTPS TLS for initial binding; future DIDComm and TSP bindings would use those protocols' authentication mechanisms
Revocation Mechanism Authority-statement revocation handled by underlying systems-of-record — TRQP queries the current state of the registry; registry policies define how revocation is reflected in query responses
Agent Types Supported Software agents (issuers, holders, verifiers, relying parties), governing bodies (authorities), and any party making programmatic trust decisions
Wallet/Client Types Wallet integrations (verifiable credential wallets querying trust registries to validate issuers); ecosystem-specific clients; library generation via OpenAPI 3.0
Recovery Mechanisms Out of scope — recovery is a system-of-record concern at the underlying registry level
Compliance / Regulations EU eIDAS 2.0 (digital wallet verifier authorization); cross-jurisdiction credential verification (mDL, health credentials)
Credential Exchange Protocols TRQP composes with credential exchange protocols rather than being one — verifiers query TRQP during issuance/verification flows running over DIDComm, OpenID4VC, etc.
Trust Framework Layer 1 of ToIP four-layer stack — supports any ecosystem governance framework above it; specifically motivated by EU eIDAS 2.0 "verifying the verifier" requirements
Cost Model Free — open standard, royalty-free implementation under ToIP/LF Decentralized Trust IPR
Censorship Resistance Depends on backing trust registry deployment; protocol itself is read-only and does not prescribe registry resilience