> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openpayload.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get authorization nonces

> Read the counters required to build replay-resistant DID updates

A nonce is a number used once. It prevents somebody from capturing a valid signed update and submitting it repeatedly.

Call this endpoint immediately before constructing a signed DID-document mutation. If another mutation is accepted first, fetch the nonces again and rebuild the payload.

## Request

<ParamField path="did" type="string" required>
  The complete OpenPayload DID whose authorization counters you need.
</ParamField>

<RequestExample>
  ```bash Request theme={null}
  curl --request GET \
    --url "https://directory.example.com/dids/did%3Aopenpayload%3A1111111111111111111111/nonces"
  ```
</RequestExample>

## Response

<ResponseField name="did" type="string" required>
  The DID associated with the returned counters.
</ResponseField>

<ResponseField name="document_nonce" type="string" required>
  The unsigned 64-bit nonce for DID-document component authorization.
</ResponseField>

<ResponseField name="alias_nonce" type="string">
  The nonce for alias authorization when that runtime contract is available.
</ResponseField>

<ResponseField name="root_pubkey_nonce" type="string" required>
  The unsigned 64-bit nonce used for root-public-key rotation authorization.
</ResponseField>

<ResponseField name="control_nonce" type="string" required>
  The nonce for device changes and DID deactivation.
</ResponseField>

<ResponseField name="policy_nonce" type="string" required>
  The Policy V2 nonce for creating, replacing, or deleting this DID's delivery policy and changing its delivery constraints.
</ResponseField>

<ResponseExample>
  ```json 200 Response theme={null}
  {
    "did": "did:openpayload:1111111111111111111111",
    "document_nonce": "7",
    "alias_nonce": "3",
    "root_pubkey_nonce": "1",
    "control_nonce": "4",
    "policy_nonce": "2"
  }
  ```
</ResponseExample>

<Note>
  Treat nonce values as unsigned integer strings. JavaScript numbers cannot represent every `u64` value safely.
</Note>

## Straight to the point

```http theme={null}
GET /dids/{url-encoded-did}/nonces
```

* Authentication: none
* Use the returned nonce in the next authorization payload
* Fetch again after a `409 nonce_mismatch`
* Persona counters use `GET /personas/{persona}/nonces`

<Card title="Authorization explained" icon="signature" href="/guides/authorization">
  Learn how the nonce, canonical payload, expiration, and signature fit together.
</Card>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.