BrainSAIT Provider Registry

Continuous credential monitoring for hospitals

Add the clinicians you credential to a roster. The registry re-checks their statuses every 10 minutes and tells your system — with a signed message — the moment anything changes: a signed credential revoked, a membership lapsed, a licence verified or expired.

What each status means

ORCID iD ownership	The clinician signed in with this ORCID iD. Not authorship, not licensure.
Signed credential	A W3C Verifiable Credential signed by the registry (Ed25519, did:web) is current, revoked or absent.
Membership	BPR membership (commercial). Never a professional status.
Professional licence	Checked with the issuer (SCFHS) by a reviewer; otherwise "not assessed".
Qualifications	Degrees and certificates checked by a reviewer; otherwise "not assessed".
Hospital privileges	Clinical privileges recorded by the granting organisation.

Public, tamper-evident history

Every status change for every provider is appended to a hash-chained log whose head is signed with the registry key. Anyone can replay it; a rewritten history no longer matches a head you saved earlier.

/transparency/trust.json · 3 events · chain intact · 0614669785e5ddb5…

Integrate

API keys are issued per organisation — write to hello@brainsait.de.

KEY=bprk_…   # your organisation's key
curl -X PUT  -H "Authorization: Bearer $KEY" -d '{"label":"Cardiology"}' https://registry.brainsait.de/network/v1/roster/SA-PHY-000003
curl         -H "Authorization: Bearer $KEY" https://registry.brainsait.de/network/v1/roster
curl         -H "Authorization: Bearer $KEY" 'https://registry.brainsait.de/network/v1/events?since=0&signed=1'
curl -X PUT  -H "Authorization: Bearer $KEY" -d '{"url":"https://your-hospital.example/bpr-events"}' https://registry.brainsait.de/network/v1/webhook
curl -X POST -H "Authorization: Bearer $KEY" https://registry.brainsait.de/network/v1/webhook/test

Webhooks arrive as a compact JWS (Content-Type: application/jwt, typ bpr-trust-event+jwt) — verify it with the public key; no shared secret is involved. Failed deliveries are retried for about 14 hours.

<?php // verify a BrainSAIT trust event (PHP 8, ext-sodium)
$jws = file_get_contents('php://input');
[$h, $p, $s] = explode('.', $jws);
$b = fn($x) => base64_decode(strtr($x, '-_', '+/') . str_repeat('=', (4 - strlen($x) % 4) % 4));
$hdr = json_decode($b($h), true);
$did = json_decode(file_get_contents('https://registry.brainsait.de/.well-known/did.json'), true);   // cache this
foreach ($did['verificationMethod'] as $vm) if ($vm['id'] === $hdr['kid']) $pub = $b($vm['publicKeyJwk']['x']);
if ($hdr['alg'] !== 'EdDSA' || empty($pub) || !sodium_crypto_sign_verify_detached($b($s), "$h.$p", $pub)) { http_response_code(400); exit; }
$event = json_decode($b($p), true)['event'];   // {seq, spid, event: change, changes: [{field, from, to}], state}

The network carries only public statuses — never licence numbers, documents or contact details. It is in pilot: see the capability register.

BrainSAIT Provider Registry · BPR workspace · GIVC · hello@brainsait.de · Privacy