@attila The .json endpoint is pretty sucky. It's modeled to be compatible with the #Twitter API and that simply sucks and has no federation features in mind.

By specification the profile URI can't be designated to relate to any specific instance, since it can be any string of characters. But effectively in the current implementations at least, we rely on the URIs being HTTP accessible endpoints, so we can filter by domain there as a quick hack.