Learn
Reachability
Two questions, answered by two different parties, composed on the client. The one page to read if you only read one.
Reaching someone is not one question. It is two, and they have different answerers.
- 01SonarWhich member holds this?The network answers.
- 02ResolverWhat does this destination take?The holder answers.
Why they stay apart
The obvious simplification is to have the network answer both — one call, one round trip, done. It is also the one thing that would make the directory unacceptable to its own members.
A network that answers step 1 learns who is being looked for. A network that also answers step 2 learns what that destination can receive, which is commercially specific: which rails a competitor supports, which assets, what limits, and how those change over time. That is not routing information. It is a competitor's product roadmap, arriving daily.
So the composition happens on the caller's side. The SDK makes both calls; the integrator writes one. The cost is a round trip. What it buys is that no single party sees both halves.
A network may offer to relay step 2 — some will, for latency. If it does, it must say so in its discovery document rather than doing it silently. A member should be able to read what the directory sees before deciding to join it.
The step you can skip
If you already know where to ask, step 1 has nothing to tell you.
Two parties that already have a relationship — a platform and its payment provider, two institutions with an agreement — resolve directly. They implement addressing, resolution, requests and receipts, and they join nothing.
This is not a degraded mode. It is the proof that the open part of the protocol is genuinely open: there is a complete path from key to capability that requires no permission from anyone. Every claim on this site about openness rests on that path existing and being documented.
Answers are signed
Both steps return signed envelopes, and the SDK hands them back under proofs.
Keep them. Months later, when a payment went somewhere unexpected, the question is what you were told before you sent — and a signed answer turns that from one party's recollection into a document. This is also what makes a compromised resolver survivable: it can lie once, and the lie is on the record with its key against it.
Constant-shape answers
SONAR returns the same shape whether a key is unknown or known-but-not-visible to the caller.
That is not politeness. A route that distinguishes the two is an oracle: ask it enough times and it answers "is this person a customer of somebody", for any phone number you care to try. That answer alone is worth money to a scammer building a target list, before anyone learns which provider.
The same reasoning applies to timing and to status codes. A faster negative is still a signal.
Budgets, not rate limits
Directory searches are metered against what a member contributes to the index, not against a requests-per-second ceiling.
The distinction matters because the threat is not a burst. It is a member — or someone holding a member's credential — walking the number space slowly and patiently. A rate limit sets the pace of that walk. A budget ends it: an institution with ten thousand entries has no legitimate need for ten million lookups a month, and the number it does need is a function of its own size.
Email gets its own budget, because the threat there is different in kind. Nobody enumerates email addresses; they replay a breach list, hundreds of millions at a time, and a budget tuned for slow enumeration is the wrong shape entirely.
Searches are recorded
Every lookup is logged against the calling member, with the key, and never with the identifier in the clear.
The log is what makes the budget checkable and the rulebook enforceable. A credential without a log is a badge with no camera behind it — it identifies who walked in and notices nothing they did.
Retention is declared in the discovery document, so it is a published commitment rather than a sentence in a contract annex.
Which brings up the honest part
In the common configuration, the network sees the searches. Members accept that when they join, knowing it, and the counterparties are short retention, a rulebook prohibition on commercial use, and audit.
Those are commitments, not properties. A design in which the network could not know would be stronger, and PATH describes one. Until it ships, this page will not pretend otherwise. Privacy is where that is set out in full.
Next: Networks and members — who runs a directory, and on what terms.