# OSINT Certificates

Signed, verifiable certificates for OSINT courses, CTFs, conferences, and communities. What a certificate is, who issues one, and how anyone checks it.

URL: https://osintverse.com/docs/certificates

OSINT Certificates is the credential issuer built into OSINTverse. A team sets up an issuer, defines a credential type, and issues certificates from a form, a CSV, or the [REST API](https://osintverse.com/docs/certificates/api). Each certificate is a signed record with a public verification page; recipients claim it and decide whether the page shows their name, their handle, or both.

## What a certificate is

Every certificate is three things, in this order of importance:

1. **A signed record.** A canonical JSON document naming the issuer, the credential type, the recipient (as salted commitments, not plain text), the issue and expiry dates, per-recipient fields, skill tags, and an evidence link. It is hashed with SHA-256 and signed with Ed25519 at issue time and never edited afterwards.
2. **A public id.** `OVC-XXXX-XXXX-XXXX` by default, or an issuer-chosen prefix and eight digits such as `OSINTCOL1-48213967` when the credential type sets one. Printable and unguessable, on the PDF, the PNG, the email, and the page.
3. **A page.** `/certificates/verify/{id}` shows the live status (valid, revoked, expired, superseded), the issuer and its trust level, what was awarded, downloads, and a verify-it-yourself block. The same content is at `/certificates/verify/{id}.json` and `.md`, or by sending `Accept: text/markdown`.

Status lives outside the signature. A revoked certificate keeps its record and its page and says it was revoked, with the date and the issuer's reason when the issuer made it public. A corrected certificate is reissued as a new record; the old one is marked superseded and links forward.

## Who does what

| Actor          | What they do                                                                                                                                                                                                        |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Issuer**     | A team workspace with an issuer profile. Owners and admins manage the profile, logo, types, and verification; owners, admins, members, and analysts issue, resend, reissue, and revoke.                             |
| **Recipient**  | An email address. Claiming attaches the certificate to an OSINTverse account and unlocks the privacy controls on [Dashboard → Certificates](https://osintverse.com/dashboard/certificates). An unclaimed certificate is still verifiable. |
| **Verifier**   | Anyone, with no account: a hiring manager, a conference, a browser agent, or an MCP client using `verify_credential`.                                                                                               |
| **OSINTverse** | Signs records, publishes the keys, reviews issuer verification requests, and can suspend an issuer or revoke a certificate on abuse.                                                                                |

## Trust levels

An issuer starts **unverified**: it can issue from day one, one certificate at a time, under a small monthly cap, and every page says the issuer is not verified by OSINTverse. Requesting verification means giving a proof that you control the issuer's domain (a page, a DNS record, or an email on the domain); a person reviews it. A **verified** issuer gets CSV and API batches, a higher cap, and the Verified mark. A **suspended** issuer cannot issue or email, and its existing certificates keep their real status.

| Issuer trust | Certificates a month | Recipients per batch |
| --- | --- | --- |
| Not verified | 25 | 1 (single send only) |
| Verification in review | 25 | 1 (single send only) |
| Verified issuer | 2000 | 500 |
| Verification declined | 25 | 1 (single send only) |
| Suspended | cannot issue | cannot issue |

| Limit | Value |
| --- | --- |
| Active credential types per issuer | 50 |
| Per-recipient fields per type | 6 |
| Skill tags per type | 8 |
| Signatories per type | 2 |
| CSV file size | 1 MB |
| Recipient name | 120 characters |
| Recipient handle | 60 characters |
| Personal message | 300 characters |
| Issuer logo | 2 MB, PNG or JPEG |
| Public verification reads | 60 per minute per IP |
| Claim attempts | 10 per minute per IP |
| Issued-certificates list page | 100 rows |
| Certificates listed on a profile | 50 |

## Pages in this section

* [How verification works](https://osintverse.com/docs/certificates/verification): the canonical record, the hash, the Ed25519 signature, the salted recipient commitments, the keys endpoint, and a worked example with `curl` and `openssl`.
* [Issuing](https://osintverse.com/docs/certificates/issuing): credential types, layouts, CSV columns, caps, the claim flow, and what resend, reissue, and revoke do.
* [API](https://osintverse.com/docs/certificates/api): the public verify endpoint, the REST issuing API for `ov_` team keys, and the MCP tool.
* [Privacy](https://osintverse.com/docs/certificates/privacy): display modes, unlisted pages, the public profile, and what account deletion does.

## Public records

* [Transparency log](https://osintverse.com/certificates/log): every certificate issued through OSINTverse, in issue order, as a hash chain with a signed head (`/api/certificates/log` and `/api/certificates/log/head`). Ids, issuers, hashes, and status only, never recipients.
* [Public keys](https://osintverse.com/api/certificates/keys): every Ed25519 key that ever signed a certificate.
* [Verified issuers](https://osintverse.com/certificates/issuers): the directory of issuers OSINTverse reviewed, each with its credential types and certificate count. Never recipients.

Marketing overview: [osintverse.com/certificates](https://osintverse.com/certificates).