Evidence and review

After domain control, two checks are done by people: a reviewer confirms your organization identity and then your representative authority. Review is manual by design; nothing on this page is automated identity verification.

Submit evidence#

On the claim page in the console, or with POST /v1/claims/{id}/evidence. An owner or domain administrator submits it, in person (service tokens cannot). Identity evidence is accepted while identity review is the pending step; authority evidence while identity or authority review is.

Unknown detail fields are rejected. Each submission may declare up to 5 files, and a claim accepts up to 20 submissions.

Uploading files#

Declared files are uploaded one at a time with PUT /v1/evidence-uploads within 1 hour of the submission. The body is the raw file, not JSON:

• Allowed types: PDF, PNG and JPEG, at most 10 MiB each. Content-Type and Content-Length must equal what you declared.
• Authorization is both the one-time token in the x-art-upload-token header (never in the URL) and your own passkey session with CSRF and Origin. There is no Idempotency-Key: the single-use token makes a retry after success a 409.
• The bytes are checked against the declared type. A bad file uses up the token; submit again.

Evidence goes to private storage. It is never shown on public pages or returned by public APIs, and reviewers' downloads are audited.

Organization identity#

The reviewer compares your evidence with the organization record: legal name, jurisdiction and registration reference. Useful evidence:

• an OV or EV certificate issued to the organization (ca_certificate), or
• an entry in an official company registry (registry_record), or
• other documents the reviewer can check independently.

A DV certificate alone cannot complete this check: it says something about a domain, not about a legal entity.

Representative authority#

This check answers a different question: may this person authorize workload issuers for the organization? The reviewer must corroborate it through an independent contact: someone at the organization, reached through an organizational channel the reviewer sourced independently rather than one taken from your submission. The reviewer records that contact and its outcome themselves; the check passes only with a contact the reviewer recorded as confirmed.

• Company email is never enough. If every piece of authority evidence is a company_email, the approval is refused with "Company email alone cannot establish representative authority; record an independent contact."
• A delegated authority letter counts only together with an independent contact that confirms it.
• Uploaded documents and DNS access alone are never sufficient.

Your independent_contact submission suggests whom to call; it does not replace the reviewer's own contact.

What the reviewer decides#

An authority approval records:

• the permitted actions: authorize_issuer (register issuers), delegate (delegate subdomains) and manage_domain;
• an expiry at most one year ahead. When it passes, the claim is suspended and its issuers stop resolving until authority is reviewed again.

Reviewers can also ask for more information (needs_information), reject a claim, or suspend one. Rejections can be appealed.

Separation of duties#

• Reviewers use a separate reviewer console behind Cloudflare Access, and must also hold the reviewer role in the directory.
• A reviewer cannot approve their own claim, and a person who belongs to any organization cannot be granted the reviewer role.
• Conflict-of-interest checks cover every account that shares the reviewer's email address.
• Reviewer notes are never exposed through public APIs.