Vetting & Verification Authority · GSMA OVC

Trust information

What a terminating operator, messaging platform, API gateway or Trust Registry needs to rely on an Attestia Token: who signs it, with which keys, under which accreditations, when new tokens are issued, and how to check one.

Issuer

attestia.captila.com

Tokens are signed with ES256 (elliptic curve P-256). 1 published signing key.

Next token issuance

1 December 2026 at 00:00 UTC

Monthly, on day 1 at 00:00 UTC. Tokens issued then are valid until 2 January 2027 at 00:00 UTC: the following issuance plus 24 hours of grace.

Scoring policy

Interim policy

Each score states a level (High 75 to 100, Substantial 50 to 74, Basic 25 to 49), the depth of evidence behind it (D1 to D4) and a state; a company without enough evidence gets no number. You set your own threshold. Scores are labelled interim until the GSMA OVC scoring policy is published; each token and score states the policy version used.

Accreditations

No accreditations are published yet. They appear here as soon as they are granted.

Trust Anchors

No Trust Anchors are configured yet.

Trust Registries

Attestia delivers tokens and scores directly over authenticated API connections. Where a Trust Registry is enabled, the same signed tokens, score statements and status changes are also submitted to it for enterprises that allow publication (publication terms); relying parties may fetch from either.

No Trust Registry is connected yet.

Signing keys

How to verify an Attestia Token

  1. Fetch the public keys from attestia.captila.com/api/v1/issuer/jwks (cache them; they change rarely).
  2. Check the token is a JWS with type attestia-token+jwt, signed ES256 by the key named in its kid, issued by https://attestia.captila.com, and not past its expiry.
  3. Check its current status at /api/v1/tokens/{token_id}/status: a token can be suspended or revoked before it expires.
  4. Apply your own threshold to the score the token carries. For the live score, use your Attestia API connection; it comes with a signed score statement (type attestia-score+jwt) verified with the same keys.

Machine-readable: /.well-known/attestia-issuer · keys: /api/v1/issuer/jwks