Skip to main content
POST
Mint a credential for a person as a business operator

Authorizations

X-API-Key
string
header
required

Body

Body for POST /credentials/business: mint an L2 or L3 credential for a verified person acting as the operator of a specific business.

Which hat the mint assumes is explicit: minting for business A vs business B is the same request with a different business_ref.

principal_ref
string
required

Pairwise reference to the verified principal, as issued to the calling organization at verification completion.

Required string length: 1 - 255
level
enum<string>
required

Credential layer to mint: L2 (audience-scoped pairwise DID) or L3 (selectively disclosed verified identity).

Available options:
L2,
L3
audience
string
required

The counterparty the credential is scoped to — a domain, or a URL reduced to its hostname.

Required string length: 1 - 512
agent_key
CredentialAgentKey (v1) · object
required

Public JWK of the agent that will present the credential; becomes the credential's cnf binding.

business_ref
string
required

Pairwise reference to the verified business whose identity the principal assumes, as issued to the calling organization.

Required string length: 1 - 255
disclosed_fields
string[]

L3 only: the dotted disclosure paths the credential should carry, e.g. user.email.hash. Individual mints take user.* paths; business mints take business.* and actor.user.* paths.

Maximum array length: 64
disclosure_mode
enum<string>
default:CLEARTEXT_AND_HASH

L3 disclosure mode: CLEARTEXT_AND_HASH (default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes.

Available options:
CLEARTEXT_AND_HASH,
HASH_ONLY

Response

Response

Body for the mint routes: the wire credential and its issuance facts.

credential is the SD-JWT presentation without a Key Binding JWT — the presenting agent appends the KB-JWT at request time.

credential
string
required

The SD-JWT-VC wire string.

credential_type
enum<string>
required

The minted credential layer (L2 or L3).

Available options:
L2,
L3,
COUNTERPARTY
jti
string
required

The credential's unique token id; the issuance-record handle.

principal_ref
string
required

The pairwise principal reference minted for.

audience
string
required

The canonical counterparty domain the credential is scoped to.

issued_at
string<date-time>
required

Issuance instant (the issuer JWT's iat).

expires_at
string<date-time>
required

Expiry instant (the issuer JWT's exp).

business_ref
string | null

The pairwise business reference minted for; null on individual mints.

disclosed_fields
string[]

The dotted disclosure paths the credential carries.

active_keys
string[]

Dotted keys of the identity attributes the credential attests to (on business mints, the union of the business and actor scopes).