Skip to content
Liorith_/Registry
DocsStatusAdmin

Docs · Reference

Status codes

Three states for a lookup, fourteen results for a proof. Every one of them arrives with HTTP 200 - the codes below it mean no result was produced.

Lookup states

Returned by /check in the status field, alongside the booleans registered and blocked.

registered - acceptedThe registry lists the domain under the entry in site. Check site.status before treating that entry as current.
not_registered - neutralNo entry. Says nothing about the domain itself - the registry lists Liorith properties and network members, not the web at large.
blocked - rejectedOn the blocklist. Evaluated before any registry entry, so it takes precedence over a registration.

Proof results

Returned by /verify in the result field. Exactly two of them mean the request is genuine.

verified_signed - acceptedSignature valid, timestamp fresh, nonce unused, host allowed, entry active. This is the full yes.
valid_deprecated - valid with caveatEverything checks out, but the entry is deprecated - recognised and on its way out. Accept it if you accept the site at all, and expect it to disappear.

Refused before the signature

These are decided before any cryptography runs, so they say nothing about whether the signature was good.

malformed - rejectedA parameter is missing or ts is not a number. The request never became a proof.
blacklisted - rejectedThe claimed host is on the blocklist. Checked first, before the site is even looked up.
unknown_site - rejectedNo site with that id. Usually a wrong or stale LIORITH_REGISTRY_SITE_ID.
site_suspended - rejectedRecognition is paused for this entry. Refused regardless of the signature.
site_inactive - rejectedThe entry is registered but not in operation.
site_archived - rejectedThe entry is former - the registry keeps it for the record but no longer recognises it.
no_secret - rejectedThe site has no credential on file, so nothing can be checked against. Register a public key in the admin panel.

Refused at or after the signature

invalid_signature - rejectedThe signature does not match the message. Wrong key, altered parameters, or a signature that was not produced for this exact proof.
expired - rejectedThe proof is older than 120 seconds. Sign a fresh one per visit rather than reusing a URL.
clock_skew - rejectedThe timestamp lies more than 30 seconds in the future. Your server clock is ahead - check NTP.
replay - rejectedThe nonce was already consumed. Each proof verifies exactly once; a second attempt with the same URL lands here.
host_mismatch - rejectedThe signature is valid, but the host is not among the site’s allowed domains. This is what an unauthorised embed looks like.
host_mismatch is a valid signature on the wrong host, not a broken one. It usually means the proof was copied onto a domain that is not registered for that site - treat it as a refusal, not as a configuration warning to ignore.

Handling them

Accept two values, refuse the rest. Do not build a list of failures to tolerate - a new result added later would then default to accepted.

ts
const ACCEPTED = new Set(['verified_signed', 'valid_deprecated']);

if (!ACCEPTED.has(result.result)) {
  // Alles andere ist eine Ablehnung, auch ein unbekannter neuer Wert.
  return refuse(result.result);
}

Transport codes

These are the complete set of non-200 responses. Each one says the request failed on the way and no registry outcome was produced - retry or fix the request, but never read one as an answer about a domain.

400 - neutralA required parameter is missing - domain on a lookup, for instance.
429 - neutralRate limited. Wait for Retry-After, in seconds.
502 - neutralOnly on /whois: the upstream server did not answer usefully.
503 - neutralOnly on /verify: replay protection is unavailable, so no result is issued at all.

The deprecated vocabulary

/check still returns a result field with the old names. They were retired because they were read as claims they never made: verified_registry sounded cryptographically checked when it only meant listed, and unknown sounded like the domain did not exist.

verified_registry → registered - neutralNothing was verified. The domain is on file.
unknown → not_registered - neutralThe registry has no entry. The domain is not unknown to the world.
blacklisted → blocked - neutralSame meaning, wording that does not read as an accusation.