Canonical did:web agent URL returns 502; resolver accepts a mismatched DID

[EricGilerson]

Summary

Observer Protocol registers and displays this agent identity:

did:web:observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5

However, its canonical did:web document URL returns HTTP 502:

https://observerprotocol.org/agents/f4eee9e41e5b08c22cb9319136bc40f5/did.json

The document is available through Observer-specific API routes, but that does not repair standard did:web resolution: the published DID hostname is observerprotocol.org, not api.observerprotocol.org.

Additionally, the API resolver accepts a DID with the wrong hostname and returns a DID document whose id does not match the requested DID.

Reproduction

For agent ID f4eee9e41e5b08c22cb9319136bc40f5:

1. Request https://observerprotocol.org/agents/f4eee9e41e5b08c22cb9319136bc40f5/did.json.

   • Actual: HTTP 502.
   • Expected: HTTP 200 with a DID document whose id is did:web:observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5.

2. Request https://api.observerprotocol.org/agents/f4eee9e41e5b08c22cb9319136bc40f5/did.json.

   • Actual: HTTP 200 and a document whose id is correctly did:web:observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5.
   • This confirms the document exists but is not being served at the canonical did:web location.

3. Request the resolver with did:web:api.observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5.

   • Actual: HTTP 200, but the returned document identifies itself as did:web:observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5.
   • Expected: reject the request, or only return a document whose id exactly matches the requested DID.

Expected behavior

• Serve each agent document at https://observerprotocol.org/agents/{agent_id}/did.json.
• Preserve an exact match between the requested DID and document.id.

Impact

Observer-specific API consumers can use /resolve/{did} as a workaround, but independent standard did:web resolvers cannot resolve the published identity. The resolver hostname-mismatch behavior may also let clients that fail to validate document.id accept an incorrect identity.

[LeoBchuk]

Hello @EricGilerson ,
@BTCBoyd has fixed our domain host issue. The server holding the DID documents is online now and both URLs return the same document:

https://observerprotocol.org/agents/f4eee9e41e5b08c22cb9319136bc40f5/did.json
https://api.observerprotocol.org/agents/f4eee9e41e5b08c22cb9319136bc40f5/did.json

The universal DID resolver successfully resolves
did:web:observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5

But not:
did:web:api.observerprotocol.org:agents:f4eee9e41e5b08c22cb9319136bc40f5

This is the expected behavior.
Let me know if you are getting a wrong DID, did:web:api.oberverprotocol... and from where, and we can look further.