OAI
Observed Actor Identifier · v1.0
An OAI is a permanent name for something that watches traffic, profiles users, or acts
against networks — a tracker, an ad network, a threat actor. Resolve any OAI at
tunnelmind.ai/id/{id} and the record tells you what it is, who runs it, and
whether it is still active. It is not a reputation score, a block list, or a payment rail —
it is the name an agent cites the way a CVE cites a vulnerability.
What an OAI looks like
- Canonical
OAI-YYYY-NNNNNNN— uppercase prefix, year, 7-digit sequence. Permanent.- Alias
oai:slug— lowercase. Redirects to the canonical form. Aliases may move; canonicals never do.- Sensor
OAI-SENSOR-{cc}-{seq}— lowercase ISO 3166-1 alpha-2 country code, 3-digit sequence. Carries the Ed25519 public key the resolver uses to verify signed observations.
How to resolve one
The resolver is a CVE-NA-style HTTP endpoint. No authentication, no rate limit,
no per-IP throttle. Content-negotiated — pass Accept: application/json
for the JSON-LD record, anything else for a human-readable HTML card.
# Canonical lookup
curl https://tunnelmind.ai/id/OAI-2026-0000201
# Alias — 301 to the canonical
curl -L https://tunnelmind.ai/id/oai:tunnelmind
# Sensor record (separate namespace)
curl https://tunnelmind.ai/id/OAI-SENSOR-us-001
# JSON-LD context
curl https://tunnelmind.ai/oai/context.jsonld
# Sitemap of all active records (currently 1)
curl https://tunnelmind.ai/oai/sitemap.xmlStatus semantics
Each lookup returns one of four states. The HTTP status is part of the contract — a client that handles only 200 is broken; a correct client handles all four.
| Status | HTTP | Meaning |
|---|---|---|
active | 200 | Currently observed entity. Record includes ≥1 signed attestation. |
deprecated | 410 + Sunset | Operator wound down. Last known record still returned for citation continuity. |
superseded | 303 → new ID | Rebrand / merge. The new canonical takes over; the old one redirects forever. |
reserved / unknown | 404 | Indistinguishable. Reservation state must not leak — §8.4 of the standard. |
A real record
The active record for OAI-2026-0000201 (TunnelMind AI, LLC, the
registry editor) at the time of writing:
{
"@context": "https://tunnelmind.ai/oai/context.jsonld",
"@type": "ObservedActor",
"id": "OAI-2026-0000201",
"name": "TunnelMind AI, LLC",
"aliases": ["oai:tunnelmind", "oai:tunnelmind-ai"],
"category": "witness.operator",
"domains": ["tunnelmind.ai", "data.tunnelmind.ai", "api.tunnelmind.ai", ...],
"status": "active",
"attestations": [
{
"sensor": "OAI-SENSOR-us-001",
"observed_at": "2026-05-25T01:04:15.866Z",
"signature": "ed25519:0xd8cfd5c4192aa884..."
}
],
"schema_version": "1.0"
}reserved → active
without at least one signed sensor attestation, and reserved records are
indistinguishable from unknown ones to the public resolver. Coverage grows as
sensors come online and witness real traffic. See
§10 of the standard.
Citing OAI in your work
A complete citation is the canonical identifier plus the resolver URL — the same shape as a CVE citation. Researchers, threat-intel publications, and tooling can cite an OAI without depending on TunnelMind to be the registry forever; the governance gate for handing the registry to a neutral body is in §12 of the standard.
OAI-2026-0000201 (TunnelMind AI, LLC; https://tunnelmind.ai/id/OAI-2026-0000201)