Function require_self 

pub fn require_self(
    registry: &dyn Registry,
    headers: &HeaderMap,
    target: &str,
) -> Result<(), ApiError>

Resolves an agent’s own credential against the account a request names, for every account-lifecycle mutation this server serves.

target is the account the request names — the did field of the body. An agent token authenticates only when it names that same account, which is ApiError::account_mismatch otherwise: these routes are self-service and nothing else. Acting on another account over HTTP would need a credential proving this deployment’s operator, and there is no such credential — a server reads who operates it out of the operator’s own repository and never holds anything presentable back to it. See the module doc’s “There is no operator credential”, and Registry::hard_delete for the one lifecycle operation that consequently has no route at all.

Same failure shapes as require_agent_token for everything short of the account check: no header or an unrecognised scheme is authentication_required, a defined-but-disabled scheme is scheme_disabled, and a well-formed credential of the wrong kind or value is invalid_token.