tExtended — UNTP Identity Resolver Demonstrator

What this demonstrator shows

This system is a working implementation of the UN Transparency Protocol (UNTP) Identity Resolver specification, built to explore how digital product passports, traceability events, and conformity credentials can be created, managed, and accessed across a textile supply chain.

The central question it addresses: given a physical product — a garment, a fibre batch, a recycled material — how can different stakeholders access the right information about it, in a standardised way, regardless of which system originally created that information? The UNTP Identity Resolver is the discovery layer that makes this possible.

The UNTP Identity Resolver

The Identity Resolver (IDR) implements the Discover–Resolve–Verify (D-R-V) workflow defined in the UNTP specification: given an identifier on a physical product, a client discovers what verifiable data exists about it, resolves the links to that data, and verifies the authenticity of the credentials retrieved.

This demonstrator implements some of the features from the IDR specification and related UNTP best practices:

Variant-based disclosure and access roles

A core focus of this demonstrator is the variant-based disclosure pattern defined in the UNTP best practices. Rather than using cryptographic selective disclosure mechanisms such as BBS+ signatures or SD-JWT — which enable selective disclosure within a single credential — UNTP takes a simpler approach: multiple complete credential variants are pre-computed and stored, each containing the claims appropriate for a given access role. The Identity Resolver routes requests to the correct variant based on the accessRole query parameter.

Each credential variant contains full claims for the requesting role, plus claim stubs — entries without a declaredValue but with an accessRole property — indicating that additional data exists for other roles. This satisfies UNTP requirement VD-03 (claim discovery): a recipient can see what data exists without being able to access it.

This demonstrator uses four access roles:

Primary and secondary resolvers

The UNTP IDR specification defines a delegation pattern for cases where identifier schemes operate at a coarser granularity than the data that needs to be linked. A scheme register such as GS1 manages product class identifiers (GTINs) but has no knowledge of individual serialised items. Manufacturers manage serialised item data independently.

When a client queries a serialised item identifier, a conformant primary resolver returns a multi-anchor linkset: links about the specific serialised item at item level, and links about the product class at class level, in a single response. This demonstrator implements this pattern — querying a serialised battery identifier returns both unit-specific data (individual cell test results, component serial numbers, manufacturing batch) and product-class data (material composition, disassembly guide, emissions assessment) in one linkset response, with item-specific claims visually distinguished in the scanner interface.

If a serialised item has no registered entry, the resolver falls through gracefully to the product class — reflecting the real-world situation where not all physical units have item-level digital passports attached.

Try it

The scanner at /scan/ accepts QR codes, 1D barcodes via GS1 element string normalisation, and manual identifier input. Selecting a role before scanning demonstrates variant-based disclosure. Also automatic language negotiation is demonstrated.

The raw resolver API is accessible directly:

Implementation

The demonstrator is built with a standard Python web stack. Credentials are signed using Ed25519 keys via the Python cryptography library and encoded as vc+jwt per the W3C Verifiable Credentials Data Model 2.0. The did:web DID method is used for issuer identity, with the DID document served at /.well-known/did.json. No external wallet infrastructure, DID registry, or ledger is required.

Future work