​

OTR-ID Lifecycle

​

11.1 What Is an OTR-ID

• Mode: C = COLD (public assessment), A = AUTH (merchant authorized)
• Fingerprint: 12 uppercase hex chars from SHA-256 of normalized domain
• Checksum: 2 Base36 chars (Luhn mod-36 + deterministic salt)

• Deterministic: same domain always produces the same fingerprint
• Irreversible: SHA-256 is one-way, original domain cannot be recovered
• Only issued to commerce sites (ecommerce/saas) with trust score greater than 0

​

11.2 Status Lifecycle

​

Status Transitions

First scan (commerce, score > 0) → ACTIVE
  ├── Merchant authorizes → UPGRADED
  ├── Anti-gaming triggered → SUSPENDED → score recovers → ACTIVE
  ├── Identity change / WebRisk / site dead → REVOKED (permanent)
  └── Reclassified as non-commerce → NOT_APPLICABLE → reclassified back → new ACTIVE

​

REVOKED vs NOT_APPLICABLE

• REVOKED: Domain identity changed, flagged as dangerous, or site died. The OTR-ID is permanently removed. A full SmartRescan must run before a new ID can be issued.
• NOT_APPLICABLE: Site is non-commercial. No OTR-ID was ever needed. If the site adds commerce features and is reclassified, a new OTR-ID is generated automatically.

​

11.3 Non-Commerce Sites

• Identity verification still runs (GLEIF, Wikidata, SSL)
• No trust score calculated
• No OTR-ID issued
• API returns identity signals and safety data
• If reclassified as commerce, a new OTR-ID is minted normally

​

11.4 Parked Domains

• Detected via 15+ registrar HTML patterns and fingerprint analysis
• No backfill, no scoring, no OTR-ID
• If the domain becomes active, SmartRescan detects the change and re-enters the pipeline

​

11.5 Using an OTR-ID

​

In agent.json

{
  "trust": {
    "otr_id": "OTR-1C-2265CBCC4D1E-R3"
  }
}

​

In API Responses

{
  "otrId": "OTR-1C-2265CBCC4D1E-R3",
  "otrIdStatus": "ACTIVE"
}

{
  "otrId": "",
  "otrIdStatus": "NOT_APPLICABLE"
}

​

In Commerce Protocols