> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # List your organization's credential issuance records > Lists the issuance records of every credential your organization minted, newest first — the durable evidence log behind the short-lived credentials themselves. Filter by subject (`principal_ref` / `business_ref`), counterparty `audience`, `credential_type`, and issuance date range. Each record carries the credential's current revocation status; the credential string itself is never stored and never returned. ## OpenAPI ````yaml /api-reference/openapi.json get /issued_credentials openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /issued_credentials: get: tags: - Credentials summary: List your organization's credential issuance records description: >- Lists the issuance records of every credential your organization minted, newest first — the durable evidence log behind the short-lived credentials themselves. Filter by subject (`principal_ref` / `business_ref`), counterparty `audience`, `credential_type`, and issuance date range. Each record carries the credential's current revocation status; the credential string itself is never stored and never returned. operationId: list_issued_credentials parameters: - name: principal_ref in: query required: false schema: anyOf: - type: string maxLength: 255 minLength: 1 - type: 'null' description: >- Only credentials minted for this individual or by this acting principal for a business. title: Principal Ref description: >- Only credentials minted for this individual or by this acting principal for a business. - name: business_ref in: query required: false schema: anyOf: - type: string maxLength: 255 minLength: 1 - type: 'null' description: Only credentials minted for this pairwise business reference. title: Business Ref description: Only credentials minted for this pairwise business reference. - name: audience in: query required: false schema: anyOf: - type: string minLength: 1 maxLength: 512 - type: 'null' description: >- Only credentials scoped to this counterparty — a domain, or a URL reduced to its hostname. title: Audience description: >- Only credentials scoped to this counterparty — a domain, or a URL reduced to its hostname. - name: credential_type in: query required: false schema: anyOf: - $ref: '#/components/schemas/IssuedCredentialType' - type: 'null' description: Only credentials of this layer. title: Credential Type description: Only credentials of this layer. - name: lifecycle_state in: query required: false schema: anyOf: - $ref: '#/components/schemas/IssuedCredentialLifecycleState' - type: 'null' description: >- Only credentials in this derived state right now: ACTIVE (valid and unexpired), EXPIRED (valid but past expiry), or REVOKED. Distinct from each record's `status` field, which carries only the persisted revocation status (VALID or REVOKED) — an EXPIRED credential is still `status: VALID`. title: Lifecycle State description: >- Only credentials in this derived state right now: ACTIVE (valid and unexpired), EXPIRED (valid but past expiry), or REVOKED. Distinct from each record's `status` field, which carries only the persisted revocation status (VALID or REVOKED) — an EXPIRED credential is still `status: VALID`. - name: jti in: query required: false schema: anyOf: - type: string minLength: 1 - type: 'null' description: Only the credential with this token id. title: Jti description: Only the credential with this token id. - name: limit in: query required: false schema: type: integer maximum: 1000 minimum: 1 description: >- Maximum number of records to return in a single page. Must be between 1 and 1000. default: 10 title: Limit description: >- Maximum number of records to return in a single page. Must be between 1 and 1000. - name: offset in: query required: false schema: anyOf: - type: integer minimum: 0 - type: 'null' description: >- Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor. title: Offset description: >- Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor. - name: cursor in: query required: false schema: anyOf: - type: string - type: 'null' description: >- Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset. title: Cursor description: >- Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset. - name: start_date in: query required: false schema: anyOf: - type: string format: date - type: 'null' description: 'Filter records created on or after this date (format: YYYY-MM-DD).' title: Start Date description: 'Filter records created on or after this date (format: YYYY-MM-DD).' - name: end_date in: query required: false schema: anyOf: - type: string format: date - type: 'null' description: >- Filter records created on or before this date (format: YYYY-MM-DD). title: End Date description: 'Filter records created on or before this date (format: YYYY-MM-DD).' - name: tz in: query required: false schema: type: string description: >- IANA timezone identifier used to interpret start_date and end_date (defaults to UTC). examples: - UTC - America/Los_Angeles - Europe/London default: UTC title: Tz description: >- IANA timezone identifier used to interpret start_date and end_date (defaults to UTC). responses: '200': description: >- Paginated issuance records, newest first, scoped to the calling organization's own mints. content: application/json: schema: type: array items: $ref: '#/components/schemas/v1.IssuedCredentialResponse' application/vnd.baselayer.v1+json: schema: type: array items: $ref: '#/components/schemas/v1.IssuedCredentialResponse' headers: X-Total-Count: description: Total number of records matching the query. schema: type: integer X-Total-Pages: description: Total number of pages available based on the current limit. schema: type: integer X-Next-Cursor: description: >- Cursor for the next page (only present when using the keyset pagination and if `has_more` is true. schema: type: string '404': description: >- A subject-reference filter is unknown or was issued to another organization — the two are indistinguishable. content: application/json: schema: $ref: '#/components/schemas/APIError' title: ResourceNotFound description: Could not locate the resource for the given URI. examples: - code: 1 message: Could not locate the resource for the given URI. metadata: {} '422': description: >- The audience filter cannot be reduced to a canonical counterparty domain. content: application/json: schema: $ref: '#/components/schemas/APIError' title: CredentialAudienceInvalid description: >- The audience cannot be reduced to a canonical counterparty domain. examples: - code: 6304 message: >- The audience cannot be reduced to a canonical counterparty domain. metadata: {} security: - APIKeyHeader: [] components: schemas: IssuedCredentialType: description: |- The KYA credential layer. L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key. enum: - L2 - L3 - COUNTERPARTY title: IssuedCredentialType type: string IssuedCredentialLifecycleState: type: string enum: - ACTIVE - EXPIRED - REVOKED title: IssuedCredentialLifecycleState description: |- A credential's effective state as an issuance-log reader sees it. Derived, never stored: ``IssuedCredentialStatus`` deliberately keeps expiry out of the persisted status (verifiers check ``exp``), but the console and API consumers filter the log by what a credential *is* right now — still presentable, aged out, or killed. v1.IssuedCredentialResponse: description: |- One record from the organization's credential issuance log. The dispute-evidence view of a mint: who was authorized, for which counterparty, disclosing what, signed with which key, and whether the credential has since been revoked. Deliberately carries no credential material — credential strings are never stored; the row is the durable evidence of the issuance, keyed by the ``jti`` a relying party's exchange log records. properties: jti: description: The credential's unique token id; the issuance-record handle. title: Jti type: string credential_type: $ref: '#/components/schemas/v1.IssuedCredentialType' description: The credential layer minted. status: $ref: '#/components/schemas/v1.IssuedCredentialStatus' description: >- The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list. revoked_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The instant the credential was revoked; null while it remains valid. title: Revoked At principal_ref: anyOf: - type: string - type: 'null' default: null description: >- The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists. title: Principal Ref business_ref: anyOf: - type: string - type: 'null' default: null description: >- The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists. title: Business Ref audience: description: The canonical counterparty domain the credential is scoped to. title: Audience type: string subject: anyOf: - type: string - type: 'null' default: null description: >- Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials. title: Subject issued_at: description: Issuance instant (the issuer JWT's iat). format: date-time title: Issued At type: string expires_at: description: Expiry instant (the issuer JWT's exp). format: date-time title: Expires At type: string disclosed_fields: description: >- The dotted disclosure paths the credential carries; empty for L2 mints. items: type: string title: Disclosed Fields type: array active_keys: description: Dotted keys of the identity attributes the credential attests to. items: type: string title: Active Keys type: array signing_kid: description: >- The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS). title: Signing Kid type: string minted_by: anyOf: - type: string - type: 'null' default: null description: >- Who initiated the mint, rendered as `key: ` for API mints or `user: ` for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed. title: Minted By agent_key_kid: anyOf: - type: string - type: 'null' default: null description: >- The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded. title: Agent Key Kid agent_key_thumbprint: anyOf: - type: string - type: 'null' default: null description: >- RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded. title: Agent Key Thumbprint disclosure_mode: anyOf: - $ref: '#/components/schemas/v1.DisclosureMode' - type: 'null' default: null description: >- The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded. required: - jti - credential_type - status - audience - issued_at - expires_at - signing_kid title: IssuedCredentialResponse (v1) type: object APIError: properties: code: type: integer title: Code message: type: string title: Message uri: anyOf: - type: string - type: 'null' title: Uri metadata: additionalProperties: true type: object title: Metadata type: object required: - code - message title: APIError description: >- APIError is a Pydantic model for standardizing error responses from the API. This class is used internally by APIException for JSON serialization. Users should typically work with APIException directly in exception catalogs. v1.IssuedCredentialType: description: |- The KYA credential layer. L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key. enum: - L2 - L3 - COUNTERPARTY title: IssuedCredentialType type: string v1.IssuedCredentialStatus: description: |- The credential's state on the published Token Status List. Valid is the mint-time state; Revoked is terminal — an operator link rejected, the organization pulling this one credential, or our own compromise response. Expiry is deliberately not a status: verifiers already check ``exp``, and the bit must keep meaning "revoked before expiry" for the issuance log. enum: - VALID - REVOKED title: IssuedCredentialStatus type: string v1.DisclosureMode: description: |- Per-mint selective-disclosure mode for L3 credentials. CLEARTEXT_AND_HASH (the default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes, giving counterparties recognition without plaintext. Lives here rather than beside the L3 payload shapes because it is a stored column vocabulary as of ENG-7140 (``issued_credentials.disclosure_mode``), and ``models.py`` cannot import ``osiris.identity.l3_payloads`` (circular through ``active_keys``). enum: - CLEARTEXT_AND_HASH - HASH_ONLY title: DisclosureMode type: string securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ````