Getting started

In this tutorial you will sign in to Prosopia with your ORCID, claim the profile that already carries your ORCID iD, make your first edit to it, and then publish it to the open web. Prosopia keeps two acts separate: claiming (taking ownership) and publishing (agreeing to be seen). By the end you will have done both, and you will have seen a profile stay off the open web until you publish it, even after you own it.

This tutorial assumes you have an ORCID iD and that a profile carrying that iD already exists in Prosopia (the build pipeline creates these). If no profile matches your iD yet, follow Create a profile instead, then return here to publish it.

Everything below happens in the web UI at prosopia.databio.org. Each step calls an HTTP endpoint under the hood. The endpoints are named here so you can find them in the API reference.

Step 1: Sign in with ORCID

Open prosopia.databio.org and choose to sign in. Prosopia redirects you to ORCID’s authorization page (GET /auth/orcid). After you approve, ORCID sends you back and Prosopia mints a session cookie (GET /auth/orcid/callback).

Where a deployment has it enabled, a Sign in with Google button appears beside ORCID’s — one link per installed provider. This tutorial uses ORCID because claiming the profile below needs an authenticated ORCID iD (or an ORCID identity linked to your account); a Google-only account is a first-class person but has no ORCID iD to self-claim with.

You should now see your name in the interface. Behind the page, the app has read GET /api/v1/manage/session, which reports:

{
  "authenticated": true,
  "user": {
    "orcid": "0000-0002-1825-0097",
    "name": "Jane Doe",
    "login_provider": { "name": "orcid", "label": "ORCID" }
  },
  "owned": [],
  "claimable": ["jane-doe"],
  "creatable": false
}

The profile whose rid equals your ORCID iD appears under claimable. You do not own it yet, but Prosopia can see it is yours to claim.

Step 2: Claim your profile

On your account screen (/me), find the profile listed as claimable and claim it. This sends POST /api/v1/manage/claims with the profile’s slug.

Prosopia verifies the claim entirely on the server. It checks that your session’s authenticated ORCID iD equals the profile’s rid, and that nobody owns it yet. Because the rid is the ORCID, the match is self-verifying. There is no separate “prove you own this” step and no operator approval.

The response seeds your owner grant and returns your owned profiles:

{
  "slug": "jane-doe",
  "rid": "0000-0002-1825-0097",
  "owned": [
    { "slug": "jane-doe", "rid": "0000-0002-1825-0097",
      "visibility": "public", "published": false }
  ]
}

Note the published: false field. You now own the profile, and it is still not published. Claiming and publishing are two different acts; you have done only the first.

Step 3: Confirm it is still unpublished

Before editing, see what a stranger sees. Open the profile’s public URL in a private browser window (no session cookie), or ask for its publication state on your owner screen (GET /api/v1/manage/profiles/jane-doe/publication):

{
  "slug": "jane-doe",
  "published": false,
  "profile_visibility": "public",
  "floor": "limited",
  "floor_reason": "You have not published this profile, so the public sees none of it. Claiming a profile does not publish it; publishing is a separate decision you make, and can undo. Apps and API keys you allow on the Privacy page can still read what you let them.",
  "visible_to_anonymous": false
}

The document itself declares visibility: public, but the profile is held back because you have not published it. visible_to_anonymous is false, so a stranger sees nothing. This is the point: owning a profile does not put it on the open web.

Step 4: Make your first edit

Open the editing screen (#/edit) and change something, such as your one-line summary. Saving it sends PATCH /api/v1/profiles/jane-doe/metadata, one of the SDK’s edit endpoints. The owner grant you hold authorizes the request, not an operator token.

The change is live immediately for you and anyone you have granted access. It is still invisible to strangers, because you still have not published.

Step 5: Publish

Now agree to be seen. Open Privacy from the menu under your avatar (/privacy; the Privacy tab of your profile opens the same page). Under Public, click Edit next to The public. In Permissions for: The public, each part of your profile (Summary, Expertise, CV, …) is set to None or Read. Click Basics to show your summary, expertise, research focus, and publication list, then Save and confirm. This sends:

PUT /api/v1/manage/profiles/jane-doe/public-access
{
  "parts": { "summary": "read", "expertise": "read", "focus": "read", "works": "read" },
  "confirm": "jane-doe"
}

The public reading anything is what publishing means, so this one call sets the parts and publishes the profile. The confirm value must equal the profile’s slug. Prosopia refuses an accidental publish the same way a delete flow asks you to type a name. Only you (or a co-owner), signed in, can do this. An editor you invited cannot publish, and neither can an application holding a key.

The response shows "published": true and which parts the public reads. Click Preview as Public to see exactly what a stranger gets, or reopen the public URL in a private window. Your profile is now served to anonymous readers.

Step 6: See that you can take it back

Publishing is revocable. On the Privacy page, edit The public, click Nothing and Save. The public now reads no part, so the profile is unpublished. No confirm is required, because nothing may obstruct withdrawing consent. A stranger stops seeing the profile on the next request. Every publish and unpublish you have done is kept in an append-only history on your owner screen.

Summary

• Signing in with ORCID mints a session cookie; your authenticated ORCID iD is your identity.
• Claiming a profile whose rid equals your ORCID iD is self-verifying and gives you the owner grant, but it does not publish anything.
• A profile you own shows a stranger nothing until you publish it, whatever its document declares.
• Publishing means choosing, part by part, what the public may read. It is a separate, deliberate, revocable act that only the owner (or a co-owner) can perform.

Next steps

• Core concepts: identity, ownership, and visibility in depth.
• Share ownership: grant an editor or viewer role to a colleague.
• Build a profile: fill in a shell profile with papers and an expertise narrative, using the researcher-profile skill.