curl --request POST \
--url https://api.baselayer.com/credentials/counterparty \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"business_ref": "<string>",
"domain": "<string>"
}
'import requests
url = "https://api.baselayer.com/credentials/counterparty"
payload = {
"business_ref": "<string>",
"domain": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({business_ref: '<string>', domain: '<string>'})
};
fetch('https://api.baselayer.com/credentials/counterparty', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/credentials/counterparty",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'business_ref' => '<string>',
'domain' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/credentials/counterparty"
payload := strings.NewReader("{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/credentials/counterparty")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/credentials/counterparty")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"credential": "<string>",
"credential_type": "L2",
"jti": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"domain": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
]
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6305,
"message": "The requested domain does not match the business's verified website domain; a counterparty credential binds only to a domain the business is known to operate.",
"metadata": {}
}{
"code": 6303,
"message": "The credential mint payload failed validation.",
"metadata": {}
}Mint a counterparty credential for a business's web domain
Mints the domain-bound business entity credential a merchant hosts at /.well-known/baselayer-counterparty-credential so arriving agents can verify the business behind the site. No agent key: the credential binds to the domain, and TLS supplies the possession proof at fetch time.
curl --request POST \
--url https://api.baselayer.com/credentials/counterparty \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"business_ref": "<string>",
"domain": "<string>"
}
'import requests
url = "https://api.baselayer.com/credentials/counterparty"
payload = {
"business_ref": "<string>",
"domain": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({business_ref: '<string>', domain: '<string>'})
};
fetch('https://api.baselayer.com/credentials/counterparty', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/credentials/counterparty",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'business_ref' => '<string>',
'domain' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/credentials/counterparty"
payload := strings.NewReader("{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/credentials/counterparty")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/credentials/counterparty")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"business_ref\": \"<string>\",\n \"domain\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"credential": "<string>",
"credential_type": "L2",
"jti": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"domain": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
]
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6305,
"message": "The requested domain does not match the business's verified website domain; a counterparty credential binds only to a domain the business is known to operate.",
"metadata": {}
}{
"code": 6303,
"message": "The credential mint payload failed validation.",
"metadata": {}
}Authorizations
Body
Body for POST /credentials/counterparty: mint the domain-bound
business entity credential a merchant hosts for counterparty
verification (ENG-6598).
No agent key and no disclosure selection: the credential binds to the merchant's domain rather than a presenting key, and every claim is public-record fact, always disclosed.
Pairwise reference to the verified business the counterparty credential attests, as issued to the calling organization.
1 - 255The domain the credential binds to — must match the business's verified website domain. A full URL is reduced to its hostname.
1 - 512Response
Response
Body for the counterparty mint route: the hostable wire credential and its issuance facts.
credential is one plain EdDSA JWS (typ: bl-counterparty+jwt) —
the merchant serves it verbatim at
https://<domain>/.well-known/baselayer-counterparty-credential.
The counterparty credential JWS wire string.
Always COUNTERPARTY for this route.
L2, L3, COUNTERPARTY The credential's unique token id; the issuance-record handle.
The pairwise business reference minted for.
The credential's public business DID (the JWT sub claim), derived from the entity's registry coordinates.
The canonical domain the credential is bound to.
Issuance instant (the JWT's iat).
Expiry instant (the JWT's exp).
The business.* claim paths the credential carries, in wire form.
The attestation-primitive keys backing the business_verification block.