> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataerai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Publish & cite a record

> Records are private by default. Publishing a DID makes it public and citable, gives it a resolvable did:web document, and lets you reference it as a verifiable input to downstream work.

A DID is **private by default**. When you're ready to cite a record — in a paper,
a dataset release, or a downstream pipeline — you **publish** it, which gives the
DID a public, resolvable web identity.

## Private by default

A new record's DID has **no public surface**. The identity exists and is
verifiable to **you and anyone the record is shared with**, but resolving it
**anonymously from the outside** reveals nothing about the content. Your data
stays gated until you decide otherwise.

You and the people the record is shared with can still **preview** its DID
document before publishing: **View DID document** shows the `did:web` document it
*would* publish for its current state, marked **"Preview · not published yet."**
The preview is computed on the spot — nothing is published or made public until
you choose to. To anyone without access (and to anonymous visitors), a private
DID's document stays hidden.

<Frame caption="Preview the document a record will publish from its **View DID document** modal.">
  <img src="https://mintcdn.com/dataerai/JYQfiA1164D5XDuO/images/identity-did-document.png?fit=max&auto=format&n=JYQfiA1164D5XDuO&q=85&s=50c665b4d43cc55b3e9bb52fd08a0dc4" alt="DID document preview" width="2560" height="1684" data-path="images/identity-did-document.png" />
</Frame>

<Note>
  **Sharing isn't publishing.** Sharing a record (or making it public to signed-in
  users) controls who can *read, verify, and preview* its DID document.
  **Publishing** is the separate, deliberate, one-way step that makes the `did:web`
  document **public** — resolvable and citable by *anonymous* readers from outside
  the app (below).
</Note>

## Publish a record

Publishing flips a DID from private to public. The web app shows and previews a
DID, but the publish step itself is currently available through the **REST API**
(and anything that calls it). Send an authenticated request as the record's
creator or an admin:

```bash theme={null}
curl -X POST $DATAERAI_SERVER/api/identity/{did}/publish/ \
  -H "Authorization: Bearer $DATAERAI_TOKEN"
```

Replace `$DATAERAI_SERVER` with your Dataerai host and `{did}` with the record's
DID. See [Authentication](/api-reference/authentication) for how to get a token.

Once public, the DID resolves for anyone and can be cited freely.

<Note>
  Publishing is computed from the record's **current state** at the moment you
  publish — the resulting `did:web` document is a snapshot. Later edits to the
  record don't change the already-published document, which keeps citations
  reproducible.
</Note>

<Warning>
  Publishing is **one-way and irreversible**. A published DID cannot be made
  private again — publishing is a deliberate, permanent decision to make the record
  citable. Publish when you're ready to stand behind the record in public.
</Warning>

## Cite with `did:web`

A published DID resolves to a **`did:web`** document — a standard, web-hosted
identity document at a stable URL. This is what you cite, and what others resolve
to verify your record. The URL follows the DID's kind and subject:

```
https://<your-server>/<kind>/<subject>/did.json
```

`<kind>` is `asset`, `dataset`, or `person`. The quickest way to find the exact
URL is **Open did.json** in the **View DID document** modal on a published
record.

Your organization's own identity document — the binding between your domain and
its signing key — lives at the well-known location:

```
https://<your-server>/.well-known/did.json
```

Because the document is plain web infrastructure, anyone can fetch and verify it
with ordinary tools — no special client required.

## Tombstones and supersedes

Deleting a record doesn't erase its DID. Instead, the DID is **tombstoned**: it
still resolves, now marked as tombstoned, so existing citations don't simply
break. When two person records are merged, the merged-away DID is **superseded**
and points to the surviving one.

## Reference it in downstream work

A published DID is a stable, verifiable handle you can reference elsewhere. A
dataset DID, for example, can be recorded as a **training input** so that an ML
run's [lineage graph](/organize/provenance-tokens) cites exactly which verified
data fed it — by DID, not by a fragile path or name.

<Note>
  Need to let **someone outside the record's access** verify it without publishing
  — say an external reviewer who isn't a member? As the record's creator or an
  admin, mint a time-boxed **read capability** for that DID through the API. The
  capability grants verifiable access to just that one record, to just that reader,
  without making the DID public. The reviewer passes the token when they resolve —
  see [Share a gated DID](/identity/verify#share-a-gated-did). (People who can
  already read the record don't need one — see
  [Private by default](#private-by-default).)
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Resolve & verify" icon="badge-check" href="/identity/verify">
    Confirm a published DID is authentic and unchanged.
  </Card>

  <Card title="Verifiable identifiers" icon="fingerprint" href="/identity/overview">
    What DIDs are and how the trust model works.
  </Card>
</CardGroup>