A signed JSON Web Token, defined in RFC 8225, that asserts the calling and called numbers and other call details for STIR/SHAKEN verification.
A PASSporT is a compact, signed data structure built on the JSON Web Token format. Its header names the algorithm (ES256 for SHAKEN), the token type, the extension, and the "x5u" URL of the signing certificate. Its payload carries claims such as "orig" (the calling number), "dest" (the called number), and "iat" (the time the token was issued).
RFC 8588 defines the SHAKEN extension, which adds two claims: "attest", holding the A, B, or C attestation level, and "origid", a unique identifier the originating provider can use to trace the call back to its point of entry. Other extensions build on the same structure, including "div" for diverted calls and "rcd" for Rich Call Data such as a display name or logo.
Verifiers check that the signature is valid, that the certificate chains to a trusted authority, that the token is fresh (stale "iat" values suggest replay), and that the numbers in the token match the numbers in the SIP signaling. A mismatch on any of these should cause verification to fail.
Why it matters to carriers
Understanding the PASSporT is essential when troubleshooting failed verifications or disputed attestations. The origid gives you a way to locate the exact customer and session behind a call during a traceback, and timestamp or number-format mismatches are among the most common reasons a correctly signed call still fails verification at the far end.