--- title: World API Integration on Truto slug: world category: SSO canonical: "https://truto.one/integrations/detail/world/" --- # World API Integration on Truto **Category:** SSO **Status:** Generally available ## MCP-ready AI tools Truto exposes 31 tools for World that AI agents can call directly. - **create_a_world_verify** — Verify a World ID proof for a Cloud action in World. Returns: success, action, nullifier_hash, created_at. Required: verify_id. - **world_verifies_create_legacy** — Verify a World ID proof for a Cloud action using the legacy v2 verify endpoint in World. Returns: success, action, nullifier_hash, created_at. Required: verify_id. - **list_all_world_verifies** — List World ID verifications in World. Returns records with: success, action, nullifier, created_at, environment, session_id, results, message. - **create_a_world_minikit_send_notification** — Send notifications to users of your World mini app by wallet address. Returns per-recipient results with walletAddress, sent, and reason. Required: app_id, wallet_addresses, mini_app_path. Either title and message (legacy) or localisations (localized) must also be provided; if both are given, localisations is used. Max 1000 wallet addresses per call. - **get_single_world_minikit_transaction_by_id** — Get a World MiniKit transaction by id to query its current on-chain status. Returns the transaction object including reference, transaction_hash, transaction_status, from, to, token_amount, token, chain, timestamp, and app_id. Required: id, app_id. - **get_single_world_minikit_userop_by_id** — Get a single MiniKit user operation in World by id and resolve the final on-chain transaction hash when it becomes available. Returns: status, userOpHash, sender, transaction_hash, nonce. Required: id. - **list_all_world_transaction_debugs** — Debug transactions that failed during the prepare stage in World. Returns a list of debug entries with debugUrl, createdAt, block, simulationRequestId, simulationError, and walletAddress. Required: app_id. - **list_all_world_miniapps_prices** — Get latest token prices in various fiat currencies from World. Returns: prices. Required: fiatCurrencies, cryptoCurrencies. - **list_all_world_minikit_user_grant_cycles** — Get the next grant claim cycle date for a user of your World mini app. Returns the user's humanity (orb-verified) grant cycle date if available, otherwise falls back to their document (passport-verified) grant cycle date. Returns: nextGrantClaimUTCDate. Required: wallet_address, app_id. The wallet_address must be exactly 42 characters long. - **create_a_world_create_action** — Create an incognito action for an app in World. Returns the created action object with its id and content-type-specific attributes. Required: create_action_id. - **create_a_world_precheck** — Fetch action metadata for a World ID app to determine a user's eligibility for verification. Returns: id, is_staging, is_verified, name, verified_app_logo, engine, __typename, sign_in_with_world_id, can_user_verify, action. Required: precheck_id, action. - **list_all_world_jwks** — List JWK public keys used to verify World JWT signatures for verification requests. Returns: kid, kty, e, n. - **create_a_world_graphql** — Execute GraphQL queries and mutations against the World Developer Portal via the GraphQL proxy. Returns: data (query results whose shape depends on the operation), errors (array of GraphQL error objects if any occurred). Required: query. - **update_a_world_cancel_recovery_agent_update_by_id** — Cancel a pending recovery agent update in the World ID gateway. Returns: request_id, kind, status. Requires a JSON request body conforming to the CancelRecoveryAgentUpdateRequest schema. - **create_a_world_create_account** — Create a new World ID account via the World registry gateway. Returns a 202 gateway status response including request_id, kind, and status for tracking the async on-chain request. Required: recovery_address, authenticator_addresses, authenticator_pubkeys, offchain_signer_commitment. Numeric string fields accept decimal or 0x/0X-prefixed hex. - **update_a_world_execute_recovery_agent_update_by_id** — Execute a pending recovery agent update for a World ID account in the World gateway. Returns: request_id, kind, status (with state and optional tx_hash). Required: leaf_index, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. Returns 400 if leaf_index is zero or no pending update exists. - **list_all_world_healths** — Check the health status of the World gateway server. Returns a general server status check response indicating server availability. - **update_a_world_initiate_recovery_agent_update_by_id** — Initiate a recovery agent update for a World ID account through the World gateway. Returns a gateway status object including request_id, kind, and status for polling the on-chain request. A JSON request body (UpdateRecoveryAgentRequest) is required. - **create_a_world_insert_authenticator** — Insert a new authenticator for a World account via the registry gateway. Returns a 202 status response with request_id, kind, and status. Required: leaf_index, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce, pubkey_id, new_authenticator_pubkey. Numeric string fields accept decimal or 0x-prefixed hex. - **list_all_world_is_valid_roots** — Check whether a given merkle root is currently valid on-chain in World. Returns: valid. Required: root. - **create_a_world_recover_account** — Recover a World account by submitting a recovery request to the registry gateway. Returns: request_id, kind, status. Required: leaf_index, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. The request is processed asynchronously and returns 202 Accepted. - **create_a_world_remove_authenticator** — Remove an authenticator from a World ID account via the World gateway. Returns: request_id, kind, status. Required: leaf_index, authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. Numeric string fields accept decimal or 0x/0X-prefixed hex; returns 202 Accepted with a request_id for polling status. - **get_single_world_status_by_id** — Get the status of a World registry gateway request by id. Returns the request_id, kind (the operation type), and status (current state with optional tx_hash and error details). Required: id. - **create_a_world_update_authenticator** — Update an authenticator in the World ID registry gateway. Returns: request_id, kind, status. Required: leaf_index, old_authenticator_address, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce, pubkey_id, new_authenticator_pubkey. Numeric string fields accept decimal or 0x-prefixed hex. Response is asynchronous (HTTP 202) — poll request_id… - **create_a_world_authenticator_pubkey** — Get the compressed authenticator public keys for a World ID account by leaf index from the World ID Indexer. Returns: authenticator_pubkeys, offchain_signer_commitment. Required: leaf_index. - **create_a_world_inclusion_proof** — Get a Merkle inclusion proof for a World ID account by leaf index from the current WorldIDRegistry tree, including the full authenticator public key slot list with null entries for removed authenticators. Returns: authenticator_pubkeys, leaf_index, root, siblings. Required: leaf_index. - **create_a_world_packed_account** — Get packed account data for a given authenticator address from the WorldIDRegistry contract in World. Returns: packed_account_data. Required: authenticator_address. - **create_a_world_pending_recovery_agent** — Get the pending recovery agent update for a particular World ID given its leaf index in World. Returns: execute_after, pending_recovery_agent, recovery_agent_address. If no recovery agent update is pending, the zero address and zero execute-after timestamp are returned. Required: leaf_index. - **create_a_world_recovery_agent** — Get the recovery agent address for a particular World ID given its leaf index from the World ID Indexer. Returns: recovery_agent. Required: leaf_index. - **create_a_world_signature_nonce** — Get the current signature nonce for a World ID by its leaf index from the World ID Indexer. The nonce is used to perform on-chain operations for the World ID. Returns: signature_nonce. Required: leaf_index. - **get_single_world_credit_by_id** — Get credit data for a World borrower by id (wallet address or World username). Returns: state, score. Required: id. ## How it works 1. **Link your customer's World account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach World.** The Proxy API is a 1-to-1 mapping of the World API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Add Proof-of-Personhood to Customer Onboarding** — CIAM and identity SaaS platforms can offer World ID as a 'verified human' signal alongside traditional SSO. Their customers instantly reduce fake signups, multi-accounting, and bot-driven fraud without collecting additional PII. - **Bot-Proof Promotions and Ticketing** — E-commerce, loyalty, and ticketing SaaS platforms can gate coupon redemptions, drops, and checkout flows behind World ID verification. The nullifier hash guarantees one-human-one-claim, even across proxies and disposable emails. - **Sybil-Resistant Governance and Polling** — Voting, governance, and community SaaS products can offer 'one human, one vote' as a native option. Communities get provably fair outcomes without weighting by token holdings or relying on brittle email verification. - **MiniKit-Powered Re-Engagement for Web3 SaaS** — Marketing automation and CRM platforms serving World App builders can trigger push notifications and orchestrate campaigns timed to users' WLD grant cycles, reaching them precisely when liquidity and intent are highest. - **Identity-Linked Credit and Wallet Workflows for Fintech** — Fintech and DeFi SaaS platforms can pull World ID credit scores and manage on-chain recovery agents for their end users, unlocking undercollateralized lending and enterprise-grade account recovery without building the primitives in-house. ## What you can build - **Incognito Action Verification Flow** — Ship a drop-in 'Verify with World ID' step that calls create_a_world_verify and stores the nullifier_hash to enforce one-time actions like coupon claims, votes, or airdrop redemptions. - **MiniKit Push Notification Campaigns** — Trigger targeted notifications to World App users via create_a_world_minikit_send_notification, orchestrated inside your existing campaign builder. - **Grant-Cycle Timed Engagement** — Query list_all_world_minikit_user_grant_cycles to schedule marketing, offers, or transactions around each user's nextGrantClaimUTCDate for maximum conversion. - **On-Chain Transaction Reconciliation** — Use get_single_world_minikit_transaction_by_id and get_single_world_minikit_userop_by_id to confirm settlement status of in-app payments and user operations inside your billing or order systems. - **Account Recovery and Authenticator Management** — Expose flows for adding, updating, and removing authenticators plus initiating, executing, or cancelling recovery agent updates — all without your team writing on-chain logic. - **World ID Credit Score Lookups** — Pull a user's World credit state and score via get_single_world_credit_by_id to power lending decisions, tiered access, or risk-based UX in your fintech product. ## FAQs ### How do end users connect their World account through our product? Truto handles the connection flow so your users authenticate with World ID (via QR code or deep link into the World App) and grant your application access. You receive a connection you can use to call any of the supported World endpoints on their behalf. ### Which World workflows are supported today? Truto supports World ID verification (create_a_world_verify, legacy verify, list verifies), MiniKit operations (send notifications, look up transactions and user operations, list prices and grant cycles), identity primitives (JWKs, inclusion proofs, signature nonces, authenticator management, packed accounts), account recovery flows (initiate/execute/cancel recovery agent updates, recover account, create account), credit lookups, and health/status/GraphQL utilities. ### How does nullifier-based deduplication work in practice? When you call create_a_world_verify for a specific action, World returns a nullifier_hash unique to that user-action pair. You store the hash on your side; if the same human tries the action again, the identical hash is returned and you can reject the duplicate — no PII involved. ### Can we manage authenticators and recovery agents for our end users? Yes. Truto exposes create_a_world_insert_authenticator, create_a_world_update_authenticator, create_a_world_remove_authenticator, create_a_world_authenticator_pubkey, plus the full recovery agent lifecycle (pending, initiate, execute, cancel) so you can build enterprise-grade identity management flows. ### How do we verify that a MiniKit in-app transaction actually settled? Use get_single_world_minikit_transaction_by_id (or get_single_world_minikit_userop_by_id for user operations) to fetch the current status, transaction hash, and chain metadata. Poll or trigger on your webhook pipeline to reconcile with your internal ledger. ### Are there Unified APIs for World, or is this a direct integration? World is currently exposed as a direct integration through Truto's tool inventory rather than mapped into a Unified API. You get one consistent auth, request, and error-handling layer via Truto, while calls map 1:1 to World's native endpoints so no capabilities are abstracted away.