Skip to main content
GET
List your organization's credential records

Authorizations

X-API-Key
string
header
required

Query Parameters

individual_ref
string | null

Only credentials minted for this individual or by this acting individual for a business.

Required string length: 1 - 255
business_ref
string | null

Only credentials minted for this pairwise business reference.

Required string length: 1 - 255
audience
string | null

Only credentials scoped to this audience, canonicalized as a mint's audience is.

Required string length: 1 - 512
level
enum<string>[] | null

Only credentials of these levels; repeat for more than one.

The credential layer a subject mint request selects (KYA).

Deliberately narrower than IssuedCredentialType: the individual and business mint routes issue only the two subject layers. Counterparty credentials have their own route and request shape, so a level of COUNTERPARTY must stay an edge-level payload refusal — this enum is what keeps issuance-record vocabulary growth from widening the mint requests.

Available options:
L2,
L3
state
enum<string> | null

Only credentials in this derived lifecycle, with expiry read against the time of the request: ACTIVE (valid and unexpired), EXPIRED (valid but past expiry), or REVOKED. It selects on each record's state; status keeps the persisted revocation standing, so an expired credential is status: VALID, state: EXPIRED. A credential's effective state as an issuance-log reader sees it.

Derived, never stored: IssuedCredentialStatus deliberately keeps expiry out of the persisted status (verifiers check exp), but the console and API consumers filter the log by what a credential is right now — still presentable, aged out, or killed.

Available options:
ACTIVE,
EXPIRED,
REVOKED
credential_id
string | null

Only the credential with this id.

Minimum string length: 1
limit
integer
default:10

Maximum number of records to return in a single page. Must be between 1 and 1000.

Required range: 1 <= x <= 1000
offset
integer | null

Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor.

Required range: x >= 0
cursor
string | null

Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset.

sort
enum<string> | null

issued_at (when the credential was issued) or expires_at; ties break on created_at, then the record's id. Defaults to issued_at desc. What a credential list sorts by.

Available options:
issued_at,
expires_at
sort_direction
enum<string> | null

asc or desc, for every key of the sort. Defaults to the field's own: issued_at desc, expires_at desc.

Available options:
asc,
desc
start_date
string<date> | null

Filter records created on or after this date (format: YYYY-MM-DD).

end_date
string<date> | null

Filter records created on or before this date (format: YYYY-MM-DD).

tz
string
default:UTC

IANA timezone identifier used to interpret start_date and end_date (defaults to UTC).

Examples:

"UTC"

"America/Los_Angeles"

"Europe/London"

Response

Paginated credential records in the requested order, scoped to the calling organization's own mints.

credential_id
string
required

The credential's unique id: exactly the jti its token carries.

environment
enum<string>
required

The environment the credential was minted in.

Available options:
sandbox,
production
level
enum<string>
required

The credential layer minted.

Available options:
L2,
L3
credential_format
enum<string>
required

The credential's wire format.

Available options:
dc+sd-jwt
iss
string
required

The token's iss claim: the issuer that signed it.

vct
string
required

The token's vct claim: the credential type identifier.

status_list
CredentialStatusListPointer (v1) · object
required

The token's status.status_list claim: where a verifier reads this credential's revocation bit.

status
enum<string>
required

The credential's persisted revocation standing: VALID, or REVOKED once its bit is set on the published status list. Expiry does not change it.

Available options:
VALID,
REVOKED
state
enum<string>
required

The credential's lifecycle as of this request: ACTIVE, EXPIRED once expires_at has passed, or REVOKED. The same value the state filter selects on.

Available options:
ACTIVE,
EXPIRED,
REVOKED
audience
string
required

The canonical audience the credential is scoped to.

issued_at
string<date-time>
required

Issuance instant (the issuer JWT's iat).

expires_at
string<date-time>
required

Expiry instant (the issuer JWT's exp).

signing_kid
string
required

The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).

source_environment
enum<string> | null

On a test credential for a person or business verified in another environment, that environment; the credential itself is signed in environment. Null otherwise.

Available options:
sandbox,
production
linked_credential_id
string | null

On a business L3 mint's actor credential, the credential_id of the business credential minted with it; null otherwise.

revoked_at
string<date-time> | null

The instant the credential was revoked; null while it remains valid.

revocation_reason
enum<string> | null

Why the credential was revoked. Null while it remains valid and on records revoked before the reason was recorded.

Available options:
agent_key_compromise,
identity_superseded,
identity_withdrawn,
operator_link_revoked,
fraud_suspected,
administrative_action
revoked_by
ActedBy (v1) · object | null

Who revoked the credential: the console user or the API key. Captured at revocation and never rewritten. Null while the credential remains valid and on records revoked before the actor was recorded.

individual_ref
string | null

The pairwise individual reference involved in the mint: the individual subject, or the acting individual who authorized a business mint. Null on counterparty mints and when that individual no longer exists.

individual_display_name
string | null

The first and last name of the individual individual_ref names, as the credential minted it. Null on counterparty mints and on records minted before names were recorded.

business_ref
string | null

The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.

The business's legal name as the credential minted it. Null on individual mints and on records minted before names were recorded.

subject
string | null

Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.

disclosed_fields
string[]

The dotted disclosure paths the credential carries; empty for L2 mints.

active_keys
string[]

Names of the verification checks that passed (e.g. phone_possession for an individual, tax_id_match for a business), from the token-exchange profile's key vocabulary; the verification level is derived from them.

minted_by
ActedBy (v1) · object | null

Who initiated the mint: the console user or the API key. Captured at mint time and never rewritten. Null on records minted before the actor's kind was recorded.

agent_key_kid
string | null

The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.

agent_key_thumbprint
string | null

RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.

disclosure_mode
enum<string> | null

The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.

Available options:
CLEARTEXT_AND_HASH,
HASH_ONLY
preset
string | null

The preset the mint disclosed by; null when it listed its own disclosed_fields, and on L2 and counterparty mints.

Maximum string length: 32
Pattern: ^[a-z][a-z0-9_]*$