curl --request GET \
--url https://api.baselayer.com/issued_credentials \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issued_credentials")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body[
{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
]{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6304,
"message": "The audience cannot be reduced to a canonical counterparty domain.",
"metadata": {}
}List your organization's credential issuance records
Lists the issuance records of every credential your organization minted, newest first — the durable evidence log behind the short-lived credentials themselves. Filter by subject (principal_ref / business_ref), counterparty audience, credential_type, and issuance date range. Each record carries the credential’s current revocation status; the credential string itself is never stored and never returned.
curl --request GET \
--url https://api.baselayer.com/issued_credentials \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issued_credentials")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body[
{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
]{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6304,
"message": "The audience cannot be reduced to a canonical counterparty domain.",
"metadata": {}
}Authorizations
Query Parameters
Only credentials minted for this individual or by this acting principal for a business.
1 - 255Only credentials minted for this pairwise business reference.
1 - 255Only credentials scoped to this counterparty — a domain, or a URL reduced to its hostname.
1 - 512Only credentials of this layer. The KYA credential layer.
L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key.
L2, L3, COUNTERPARTY Only credentials in this derived state right now: ACTIVE (valid and unexpired), EXPIRED (valid but past expiry), or REVOKED. Distinct from each record's status field, which carries only the persisted revocation status (VALID or REVOKED) — an EXPIRED credential is still status: VALID.
A credential's effective state as an issuance-log reader sees it.
Derived, never stored: IssuedCredentialStatus deliberately keeps
expiry out of the persisted status (verifiers check exp), but the
console and API consumers filter the log by what a credential is
right now — still presentable, aged out, or killed.
ACTIVE, EXPIRED, REVOKED Only the credential with this token id.
1Maximum number of records to return in a single page. Must be between 1 and 1000.
1 <= x <= 1000Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor.
x >= 0Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset.
Filter records created on or after this date (format: YYYY-MM-DD).
Filter records created on or before this date (format: YYYY-MM-DD).
IANA timezone identifier used to interpret start_date and end_date (defaults to UTC).
"UTC"
"America/Los_Angeles"
"Europe/London"
Response
Paginated issuance records, newest first, scoped to the calling organization's own mints.
The credential's unique token id; the issuance-record handle.
The credential layer minted.
L2, L3, COUNTERPARTY The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list.
VALID, REVOKED The canonical counterparty domain the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).
The instant the credential was revoked; null while it remains valid.
The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists.
The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.
Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.
The dotted disclosure paths the credential carries; empty for L2 mints.
Dotted keys of the identity attributes the credential attests to.
Who initiated the mint, rendered as key: <api key name> for API mints or user: <email> for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed.
The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.
RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.
The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.
CLEARTEXT_AND_HASH, HASH_ONLY