The Universal Object & Resource Attestation (UORA) Protocol defines a complete, vendor-neutral framework for decentralized identity, state verification, and lifecycle tracking of physical assets across untrusted parties. Unlike data-format specifications that define only syntax, UORA defines a protocol: a set of rules for how attestations are issued, discovered, validated, and reconciled — with sufficient detail that a conformant implementation can be built from this document alone.

This specification addresses the four pillars of decentralized supply chain trust:

1. Governance & Authorization: A verifiable chain of authority ensuring that only certified entities may issue specific attestation types for specific product categories, through decoupled CertificationCredentials with a BitstringStatusList revocation mechanism.
2. Standardized Discovery: The UORA-Query-API, a uniform HTTP protocol mandating a single standardized endpoint structure and response format, with full normative detail sufficient for independent Resolver implementation.
3. Deterministic State Reconciliation: A cryptographically linked antecedent chain supporting both linear sequences and DAGs, with a conflict resolution cascade that uses governance authority as the primary arbiter — eliminating timestamp-race vulnerabilities — plus normative DAG depth and cycle-detection rules.
4. Conformance & Testability: 22 fully specified test vectors defining three conformance levels with independently verifiable, machine-executable criteria.

This is a Community Group Draft. It has been released for review and comment. Implementors are advised against deploying this material in production systems until it reaches Candidate Recommendation status. Please report issues at https://github.com/uora-wg/core/issues.

Terminology

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in [[RFC2119]].

Issuer

Entity that creates and cryptographically signs attestations. MUST possess a valid CertificationCredential for the specific attestation type and product category being asserted.

Holder

Entity possessing the physical object and its attestation chain. MAY present attestations to Verifiers for inspection. Does not sign attestations.

Verifier

Entity that validates attestations using the governance rules, antecedent chain integrity, linear custody chain enforcement, and conflict resolution cascade defined herein. The Verifier MAY be untrusted; the protocol is designed so that verifiers learn only public information.

Trust Anchor

Governance body that issues CertificationCredentials to legitimate Issuers according to a published Trust Framework. The Trust Anchor is the root of authority for a specific domain or industry.

Resolver

Service implementing the UORA-Query-API for standardized attestation discovery, history retrieval, and validation. A Resolver MAY be operated by any party.

Trust Framework

A published document defining governance rules for a specific domain: recognized Trust Anchors, required CertificationCredential schema, authority precedence table for conflict resolution cascade, and audit requirements.

Antecedent

The cryptographically referenced predecessor attestation(s) upon which a given attestation builds. SHALL be null for origin events, a single attestation ID for linear chains, or an ordered array for DAG-based transformations.

Antecedent Chain

The complete, cryptographically linked sequence of attestations from an object's origin to its current state, formed by traversing antecedent references.

Conflict Resolution Cascade

The deterministic, three-tier algorithm (authority → timestamp → attestation ID) that resolves competing attestations claiming the same antecedent without requiring external consensus. Authority is the primary tier; timestamp is secondary.

Linear Custody Chain Enforcement

The rule requiring Transfer and Disposition attestations to reference the most recent valid event, preventing custody gaps and ensuring a complete audit trail.

Authority Precedence

A numeric rank assigned to each recognized Issuer by the Trust Anchor in the applicable Trust Framework. Higher integers denote higher authority. Authority precedence is the primary discriminator in the Conflict Resolution Cascade.

DAG Depth

The maximum number of antecedent hops a Resolver MAY traverse when validating a Directed Acyclic Graph attestation chain. Defined normatively as 64 hops.

CertificationCredential

A W3C Verifiable Credential issued by a Trust Anchor to an Issuer, authorizing that Issuer to create specific attestation types for specific product categories within a defined validity window. Uses BitstringStatusList for revocation.

UORA-Query-API

The standardized HTTP API that every UORA-compliant Resolver MUST implement for attestation discovery, capture, validation, and chain inspection.

Architecture

Universal Object Addressing & Discovery

did:web:{domain}:object:{granularity}:{identifier}

{
  "@context": ["https://www.w3.org/ns/did/v1"],
  "id": "did:web:maker.example.com:object:serial:SN-001",
  "verificationMethod": [
    {
      "id": "#key-1",
      "type": "Ed25519VerificationKey2020",
      "controller": "did:web:maker.example.com:object:serial:SN-001",
      "publicKeyMultibase": "zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
    }
  ],
  "assertionMethod": ["#key-1"],
  "service": [
    {
      "id": "#attestation-history",
      "type": "UORAAttestationService",
      "serviceEndpoint": "https://maker.example.com/uora/v1"
    }
  ]
}
            

{
  "did": "did:web:maker.example.com:object:serial:SN-001",
  "attestations": [
    {
      "id": "urn:uuid:origin-attestation-id",
      "type": ["VerifiableCredential", "UORAAttestation", "UORAOriginAttestation"],
      "validFrom": "2026-01-15T08:00:00Z",
      "issuer": "did:web:maker.example.com",
      "eventType": "Origin",
      "antecedent": null,
      "status": "valid",
      "chainIntegrity": "intact",
      "supersededBy": null,
      "proof": { "type": "Ed25519Signature2020" },
      "credential": { /* full verifiable credential */ }
    }
  ],
  "total": 1
}
                

{
  "status": "accepted",
  "attestationId": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
  "chainIntegrity": "intact",
  "eventType": "Transfer",
  "antecedent": ["urn:uuid:origin-attestation-id"]
}
                

{
  "status": "valid",
  "error": null,
  "chainIntegrity": "intact",
  "details": {
    "attestationId": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
    "issuer": "did:web:shipper.example.com",
    "eventType": "Transfer",
    "antecedent": ["urn:uuid:origin-attestation-id"],
    "proofType": "Ed25519Signature2020",
    "phasesExecuted": [1, 2, 3, 4, 5, 6, 7]
  }
}
                

{
  "did": "did:web:maker.example.com:object:serial:SN-001",
  "chainLength": 3,
  "dagDepth": 1,
  "isComplete": true,
  "chain": [
    {
      "position": 1,
      "eventType": "Origin",
      "attestationId": "urn:uuid:origin-attestation-id",
      "timestamp": "2026-01-15T08:00:00Z",
      "issuer": "did:web:maker.example.com",
      "description": "Object created at https://id.gs1.org/414/9521321000010"
    }
  ]
}
                

{
  "status": "ok",
  "version": "1.0",
  "conformanceLevel": "UORA-Full-Compliant",
  "timestamp": "2026-05-01T00:00:00Z"
}
                

Governance & Authorization

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://w3id.org/uora/contexts/core.jsonld"
  ],
  "id": "urn:uuid:cert-credential-id",
  "type": ["VerifiableCredential", "UORACertificationCredential"],
  "issuer": {
    "id": "did:web:trust-anchor.example.com",
    "name": "Pharmaceutical Trust Anchor Consortium"
  },
  "validFrom": "2026-01-01T00:00:00Z",
  "validUntil": "2027-01-01T00:00:00Z",
  "credentialStatus": {
    "id": "https://trust-anchor.example.com/status/1#42",
    "type": "BitstringStatusListEntry",
    "statusPurpose": "revocation",
    "statusListIndex": "42",
    "statusListCredential": "https://trust-anchor.example.com/status/1"
  },
  "credentialSubject": {
    "id": "did:web:certified-issuer.example.com",
    "authorizedAttestations": [
      "UORAOriginAttestation",
      "UORATransferAttestation",
      "UORATransformationAttestation"
    ],
    "authorizedCategories": ["pharmaceuticals", "medical-devices"],
    "authorizedRegions": ["global"],
    "authorityPrecedence": 50,
    "trustFramework": "https://w3id.org/verifiable-supply-chain/trust-frameworks/pharma-v1"
  }
}
                

{
  "credentialSubject": {
    "authorizedBy": {
      "certificationId": "urn:uuid:cert-credential-id",
      "trustFramework": "https://w3id.org/verifiable-supply-chain/trust-frameworks/pharma-v1",
      "verifiedAt": "2026-04-28T10:30:00Z"
    }
  }
}
                

/* Revocation check algorithm */
1. Resolve credentialStatus.statusListCredential → StatusListCredential VC
2. Verify the StatusListCredential's proof
3. Decode the compressed bitstring (GZIP + base64url)
4. Check bit at index credentialStatus.statusListIndex
5. If bit = 1: reject with rejected_revoked_certification
6. If bit = 0: credential is valid (proceed with other checks)
                

Core Attestation Schemas

{ "credentialSubject": { "antecedent": "urn:uuid:previous-attestation-id" } }

{
  "credentialSubject": {
    "antecedent": [
      "urn:uuid:component-a-final-state",
      "urn:uuid:component-b-final-state",
      "urn:uuid:component-c-final-state"
    ]
  }
}
                

{
  "trustFramework": "https://w3id.org/verifiable-supply-chain/trust-frameworks/pharma-v1",
  "authorityPrecedenceTable": {
    "did:web:fda.example.gov":           100,
    "did:web:manufacturer.example.com":   50,
    "did:web:wholesaler.example.com":     30,
    "did:web:retailer.example.com":       10
  }
}
                

["VerifiableCredential", "UORAAttestation", ""]

{
  "evidence": [
    {
      "id": "urn:uuid:evidence-unique-id",
      "type": ["Evidence"],
      "name": "Human-readable evidence name",
      "description": "Description of the evidence"
    }
  ]
}
                

{
  "evidence": [
    {
      "id": "urn:uuid:evidence-unique-id",
      "type": ["Evidence", "EPCISObjectEvent"],
      "name": "EPCIS Shipping Event",
      "description": "Original EPCIS ObjectEvent with bizStep=shipping",
      "epcisEventID": "ni:///sha-256;abc123def456?ver=CBV2.0",
      "epcisEventType": "ObjectEvent",
      "epcisBizStep": "shipping"
    }
  ]
}
                

{
  "externalData": {
    "uri": "https://storage.example.com/report-001.pdf",
    "hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "size": 1048576,
    "accessPolicy": "holder-controlled",
    "encryptedFor": null
  }
}
                

{
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2026-04-28T10:30:00Z",
    "verificationMethod": "did:web:shipper.example.com#key-1",
    "proofPurpose": "assertionMethod",
    "proofValue": "z5LbLbR3qZ5Y6m8n9o0p1q2r3s4t5u6v7w8x9y0za1b2c3d4..."
  }
}
            

Validation Pipeline

The UORA Resolver implements a seven-phase validation pipeline. Each phase executes sequentially; a rejection in any phase terminates processing.

Complete Example

A complete, well-formed UORATransferAttestation that passes all seven validation phases.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://w3id.org/uora/contexts/core.jsonld",
    "https://w3id.org/verifiable-supply-chain/contexts/shipping.jsonld"
  ],
  "id": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
  "type": [
    "VerifiableCredential",
    "UORAAttestation",
    "UORATransferAttestation",
    "VerifiableShippingEvent"
  ],
  "issuer": {
    "id": "did:web:shipper.example.com",
    "name": "Global Logistics Co."
  },
  "validFrom": "2026-04-28T10:30:00.000Z",
  "credentialSubject": {
    "id": "did:web:maker.example.com:object:serial:SN-001",
    "eventType": "Transfer",
    "transferType": "custody",
    "fromParty": "did:web:shipper.example.com",
    "toParty": "did:web:receiver.example.com",
    "fromLocation": "https://id.gs1.org/414/9521321000010",
    "toLocation": "https://id.gs1.org/414/9521321000096",
    "antecedent": "urn:uuid:previous-origin-attestation-id",
    "authorizedBy": {
      "certificationId": "urn:uuid:shipper-cert-credential",
      "trustFramework": "https://w3id.org/verifiable-supply-chain/trust-frameworks/logistics-v1",
      "verifiedAt": "2026-04-28T10:30:00Z"
    }
  },
  "evidence": [
    {
      "id": "urn:uuid:evidence-001",
      "type": ["Evidence", "EPCISObjectEvent"],
      "name": "Custody Transfer Handover",
      "description": "Digital handover confirmation at dock door R1",
      "epcisEventID": "ni:///sha-256;abc123def456?ver=CBV2.0",
      "epcisEventType": "ObjectEvent",
      "epcisBizStep": "shipping"
    }
  ],
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2026-04-28T10:30:00Z",
    "verificationMethod": "did:web:shipper.example.com#key-1",
    "proofPurpose": "assertionMethod",
    "proofValue": "z5LbLbR3qZ5Y6m8n9o0p1q2r3s4t5u6v7w8x9y0za1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
  }
}
        

Conformance & Test Vectors

Relationship to Domain Profiles

Domain-specific profiles SHALL extend the appropriate UORA attestation subtype and add industry-specific claims. Profiles SHALL NOT modify or override governance validation rules, antecedent chaining, linear custody chain enforcement, DAG traversal limits, or conflict resolution cascade.

Privacy Considerations (Normative)

This section is normative. UORA attestations are designed for supply chain transparency, but the long-lived nature of object identifiers and immutable event histories creates significant privacy risks that implementations MUST address.

Security Considerations

References

Normative References

[[DID-CORE]]

Decentralized Identifiers (DIDs) v1.0. W3C Recommendation, 2022.

[[VC-DATA-MODEL-2.0]]

Verifiable Credentials Data Model v2.0. W3C Recommendation, 2024.

[[VC-DATA-INTEGRITY]]

Verifiable Credential Data Integrity 1.0. W3C Recommendation, 2024.

[[BITSTRING-STATUS-LIST]]

Bitstring Status List v1.0. W3C Recommendation, 2024.

[[BBS-2023]]

BBS Cryptosuite v2023. W3C Credentials Community Group Draft, 2023.

[[RFC2119]]

Key words for use in RFCs to Indicate Requirement Levels. Bradner, 1997.

[[RFC8259]]

The JavaScript Object Notation (JSON) Data Interchange Format. 2017.

[[ISO-8601]]

Date and time format. ISO 8601-1:2019.

[[NIST-SP800-57]]

Recommendation for Key Management. NIST SP 800-57 Part 1 Rev 5, 2020.

Informative References

[[EPCIS-2.0]]

GS1 EPCIS 2.0 Standard, 2022.

UORA Secure Physical Binding

UORA Secure Physical Binding Specification v1.0.