Function resolve_did 

pub(crate) async fn resolve_did(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    query: Result<Query<ResolveDidQuery>, QueryRejection>,
) -> Response

GET /xrpc/com.atproto.identity.resolveDid?did=

A DID’s document. A DID on a name this deployment answers to is answered from the registry, as /.well-known/did.json answers it on that hostname, so this route is as public as that one. Such a DID that no account holds is DidNotFound with no lookup.

Every other did:web and did:plc is fetched as its method says. The fetch refuses private addresses, is bounded by crate::handles::LOOKUP_TIMEOUT, and spends one of the caller’s DID_LOOKUP_LIMIT lookups. A 404 is DidNotFound, and a 410, which the PLC directory answers for a deactivated DID, is DidDeactivated. Like the lexicon says, the handle in the document is not checked back.