Onboarding network participants

Adding or onboarding Network Participants

Once the network registry has been created, approved NPs can be added to the network. In this model, the NFO does not duplicate participant data manually. Instead, the NFO adds references to NP-owned registries or NP-owned records that are already published on DeDi Global. This preserves self-owned identity for participants while allowing the NFO to curate who belongs to the network.

Adding Registry entries

For each approved NP, create a subscriber reference record in the network registry. The NP details should already be published by the NP on the fabric and the steps for the same can be found here.

These records tell the network which NP-owned registry or record should be treated as part of the network.

Fields required in the network registry entry

Choosing between type Registry or Record

• Use Registry when the entire NP registry should be recognized as belonging to the network. This means all current and future records inside that NP registry are treated as part of the network.

• Use Record when only one specific NP record should belong to the network.

Getting the Lookup URL of the NP

To get the lookup URL of a record or a registry of an NP, you can go to the dedi explore page and find the namespace of the NP.

• Click on the NP namespace to see all their registries.

• Click on the registry that needs to be added. Please note it should have the registry tag as beckn_subscriber.

• Once inside the registry, if you need to reference the whole registry, click on Copy in the Registry Lookup API widget to copy the URL. If you are providing the registry lookup URL, then type should be Registry.

<figure><img src="../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>

• If you want to reference a single record in the registry as belonging to your network, click on the record from the list of records in the registry.

• Once inside the record, click on Copy in the Record Lookup API widget to copy the URL.

Please note the details of the NP will be visible on DeDi explore only if they have verified their namespace.

What the NFO should validate before adding an NP

Before creating the reference entry, confirm that:

• the NP has published its subscriber details under its own verified namespace

• the published callback URL is correct and reachable

• the published public key is valid for signing and verification

• the role and participant details are appropriate for the network

• the NP is being added to the correct environment-specific registry

Once this reference entry is added, that NP becomes part of the curated network represented by the NFO's networkId.

Network Participants registering on the fabric

This section is for Network Participants (NPs) such as consumer nodes and provider nodes that want to join an existing Fabric network. To participate, an NP must first publish its subscription and key details on the Fabric Registry infrastructure, and then configure its ONIX instance to transact on the network.

In this model, the NP owns and publishes its identity under its own verified domain, while the Network Facilitator Organization (NFO) decides whether to include that NP in a curated network.

4.1 Registering your subscription details on Fabric

To participate in a Fabric network, you must publish your subscriber details on DeDi Global so that other participants can discover your endpoint and verify your signatures. Your verified namespace and registry act as your root of trust on the Fabric.

What you are publishing

By registering your subscriber details, you make the following information available in a standard form:

• your subscriber identity

• your Fabric callback URL

• your role on the network, such as consumer node or provider node

• your signing public key

• any other subscriber metadata required by the schema

Once these details are published, the NFO can reference your registry or record in its own network registry to include you in a specific Fabric network.

Step 1 - Set up your DeDi account

Create an account on DeDi Global.

Step 2 - Create & verify your namespace

1. Create a namespace.

2. Request for whitelisting of a domain. This can be done here. The request will be processed within 5 minutes, provided no adverse signals are detected for the domain.

3. Enter the domain name. A TXT record will be generated (only for whitelisted domains).

4. Copy the generated TXT record as it needs to be updated in the DNS configuration file of your domain.

5. Click “Verify” after you have successfully updated the domain’s DNS file. The DNS text propagation will take from 15 min to up to 48 hours. Once this is done, your domain is verified.

After you claim your organization's namespace by proving domain ownership, this namespace becomes your root of trust.

Example: If you as an NP operate example-np.com, your namespace will be anchored to that domain.

Step 3 - Add a registry under your namespace

Under your verified namespace, create a registry using the Fabric subscriber schema. This registry will contain one or more subscriber records for your organization.

Step 4 - Publish your subscriber record

Create a subscriber record with the following details:

If you operate in multiple roles, publish separate records for each role.

Generating the signing keypair to be used in ONIX

You can use this utility script provided in ONIX to generate your keypair. You can use any other utility as well as long as it is an Ed25519 key pair and you provide the private key as the raw 32-byte Ed25519 seed and the public key as the raw 32-byte Ed25519 public key, both Base64-encoded using standard RFC 4648 Base64 with padding.

Once you click on publish the record will be published. Once published please make a note of the record ID. This will essentially be your key ID which you will configure in ONIX.

Step 5 - Verify your key lookup

Use the following URL to check if your key has been cached successfully by the service:

https://fabric.nfh.global/registry/dedi/lookup/<np_subscriber_id>/subscribers.beckn.one/<record_id_in_np_registry>

Please allow 5-10 minutes for the cache to be updated.

Why this matters

Other participants use your published subscriber details to:

• resolve your endpoint during transactions

• retrieve your public key during signature verification

• validate that the requests you send are authentic and untampered

After publishing these details, your next step is to configure and deploy ONIX so it uses the same subscriber identity, key ID, and private key that correspond to the published record.