curl --request GET \
--url https://api.baselayer.com/issuance/credentials \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issuance/credentials"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issuance/credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issuance/credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issuance/credentials"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issuance/credentials")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issuance/credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body[
{
"credential_id": "<string>",
"environment": "sandbox",
"level": "L2",
"credential_format": "dc+sd-jwt",
"iss": "<string>",
"vct": "<string>",
"status_list": {
"uri": "<string>",
"idx": 123
},
"status": "VALID",
"state": "ACTIVE",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"source_environment": "sandbox",
"linked_credential_id": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"revocation_reason": "agent_key_compromise",
"revoked_by": {
"kind": "USER",
"label": "<string>"
},
"individual_ref": "<string>",
"individual_display_name": "<string>",
"business_ref": "<string>",
"business_legal_name": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": {
"kind": "USER",
"label": "<string>"
},
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH",
"preset": "<string>"
}
]{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"type": "credential_audience_invalid",
"code": 6304,
"message": "The audience cannot be canonicalized: send a bare domain or, for an agent credential, an https authorization-server identifier with no path, query, fragment or non-default port.",
"metadata": {}
}List your organization's credential records
Lists the records of every credential your organization minted, newest first by default — the durable evidence log behind the short-lived credentials themselves. Filter by subject (individual_ref / business_ref), counterparty audience, level, state, credential_id and issuance date range. Each record carries the credential’s current revocation status. The credential string is never listed; GET /issuance/credentials/{credential_id} returns it.
curl --request GET \
--url https://api.baselayer.com/issuance/credentials \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issuance/credentials"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issuance/credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issuance/credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issuance/credentials"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issuance/credentials")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issuance/credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body[
{
"credential_id": "<string>",
"environment": "sandbox",
"level": "L2",
"credential_format": "dc+sd-jwt",
"iss": "<string>",
"vct": "<string>",
"status_list": {
"uri": "<string>",
"idx": 123
},
"status": "VALID",
"state": "ACTIVE",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"source_environment": "sandbox",
"linked_credential_id": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"revocation_reason": "agent_key_compromise",
"revoked_by": {
"kind": "USER",
"label": "<string>"
},
"individual_ref": "<string>",
"individual_display_name": "<string>",
"business_ref": "<string>",
"business_legal_name": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": {
"kind": "USER",
"label": "<string>"
},
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH",
"preset": "<string>"
}
]{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"type": "credential_audience_invalid",
"code": 6304,
"message": "The audience cannot be canonicalized: send a bare domain or, for an agent credential, an https authorization-server identifier with no path, query, fragment or non-default port.",
"metadata": {}
}Authorizations
Query Parameters
Only credentials minted for this individual or by this acting individual for a business.
1 - 255Only credentials minted for this pairwise business reference.
1 - 255Only credentials scoped to this audience, canonicalized as a mint's audience is.
1 - 512Only credentials of these levels; repeat for more than one.
The credential layer a subject mint request selects (KYA).
Deliberately narrower than IssuedCredentialType: the individual
and business mint routes issue only the two subject layers.
Counterparty credentials have their own route and request shape, so
a level of COUNTERPARTY must stay an edge-level payload refusal
— this enum is what keeps issuance-record vocabulary growth from
widening the mint requests.
L2, L3 Only credentials in this derived lifecycle, with expiry read against the time of the request: ACTIVE (valid and unexpired), EXPIRED (valid but past expiry), or REVOKED. It selects on each record's state; status keeps the persisted revocation standing, so an expired credential is status: VALID, state: EXPIRED.
A credential's effective state as an issuance-log reader sees it.
Derived, never stored: IssuedCredentialStatus deliberately keeps
expiry out of the persisted status (verifiers check exp), but the
console and API consumers filter the log by what a credential is
right now — still presentable, aged out, or killed.
ACTIVE, EXPIRED, REVOKED Only the credential with this id.
1Maximum number of records to return in a single page. Must be between 1 and 1000.
1 <= x <= 1000Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor.
x >= 0Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset.
issued_at (when the credential was issued) or expires_at; ties break on created_at, then the record's id. Defaults to issued_at desc.
What a credential list sorts by.
issued_at, expires_at asc or desc, for every key of the sort. Defaults to the field's own: issued_at desc, expires_at desc.
asc, desc Filter records created on or after this date (format: YYYY-MM-DD).
Filter records created on or before this date (format: YYYY-MM-DD).
IANA timezone identifier used to interpret start_date and end_date (defaults to UTC).
"UTC"
"America/Los_Angeles"
"Europe/London"
Response
Paginated credential records in the requested order, scoped to the calling organization's own mints.
The credential's unique id: exactly the jti its token carries.
The environment the credential was minted in.
sandbox, production The credential layer minted.
L2, L3 The credential's wire format.
dc+sd-jwt The token's iss claim: the issuer that signed it.
The token's vct claim: the credential type identifier.
The token's status.status_list claim: where a verifier reads this credential's revocation bit.
Show child attributes
Show child attributes
The credential's persisted revocation standing: VALID, or REVOKED once its bit is set on the published status list. Expiry does not change it.
VALID, REVOKED The credential's lifecycle as of this request: ACTIVE, EXPIRED once expires_at has passed, or REVOKED. The same value the state filter selects on.
ACTIVE, EXPIRED, REVOKED The canonical audience the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).
On a test credential for a person or business verified in another environment, that environment; the credential itself is signed in environment. Null otherwise.
sandbox, production On a business L3 mint's actor credential, the credential_id of the business credential minted with it; null otherwise.
The instant the credential was revoked; null while it remains valid.
Why the credential was revoked. Null while it remains valid and on records revoked before the reason was recorded.
agent_key_compromise, identity_superseded, identity_withdrawn, operator_link_revoked, fraud_suspected, administrative_action Who revoked the credential: the console user or the API key. Captured at revocation and never rewritten. Null while the credential remains valid and on records revoked before the actor was recorded.
Show child attributes
Show child attributes
The pairwise individual reference involved in the mint: the individual subject, or the acting individual who authorized a business mint. Null on counterparty mints and when that individual no longer exists.
The first and last name of the individual individual_ref names, as the credential minted it. Null on counterparty mints and on records minted before names were recorded.
The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.
The business's legal name as the credential minted it. Null on individual mints and on records minted before names were recorded.
Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.
The dotted disclosure paths the credential carries; empty for L2 mints.
Names of the verification checks that passed (e.g. phone_possession for an individual, tax_id_match for a business), from the token-exchange profile's key vocabulary; the verification level is derived from them.
Who initiated the mint: the console user or the API key. Captured at mint time and never rewritten. Null on records minted before the actor's kind was recorded.
Show child attributes
Show child attributes
The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.
RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.
The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.
CLEARTEXT_AND_HASH, HASH_ONLY The preset the mint disclosed by; null when it listed its own disclosed_fields, and on L2 and counterparty mints.
32^[a-z][a-z0-9_]*$