curl --request POST \
--url https://api.baselayer.com/credentials/individual \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"principal_ref": "<string>",
"audience": "<string>",
"agent_key": {
"x": "<string>",
"kty": "OKP",
"crv": "Ed25519",
"kid": "<string>"
},
"disclosed_fields": [
"<string>"
],
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
'import requests
url = "https://api.baselayer.com/credentials/individual"
payload = {
"principal_ref": "<string>",
"audience": "<string>",
"agent_key": {
"x": "<string>",
"kty": "OKP",
"crv": "Ed25519",
"kid": "<string>"
},
"disclosed_fields": ["<string>"],
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
principal_ref: '<string>',
audience: '<string>',
agent_key: {x: '<string>', kty: 'OKP', crv: 'Ed25519', kid: '<string>'},
disclosed_fields: ['<string>'],
disclosure_mode: 'CLEARTEXT_AND_HASH'
})
};
fetch('https://api.baselayer.com/credentials/individual', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/credentials/individual",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'principal_ref' => '<string>',
'audience' => '<string>',
'agent_key' => [
'x' => '<string>',
'kty' => 'OKP',
'crv' => 'Ed25519',
'kid' => '<string>'
],
'disclosed_fields' => [
'<string>'
],
'disclosure_mode' => 'CLEARTEXT_AND_HASH'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/credentials/individual"
payload := strings.NewReader("{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/credentials/individual")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/credentials/individual")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}"
response = http.request(request)
puts response.read_body{
"credential": "<string>",
"credential_type": "L2",
"jti": "<string>",
"principal_ref": "<string>",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"business_ref": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
]
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6301,
"message": "The subject's verified-identity snapshot is superseded or expired; re-verify before minting.",
"metadata": {}
}{
"code": 6303,
"message": "The credential mint payload failed validation.",
"metadata": {}
}Mint a credential for a person as themselves
Mints an L2 or L3 SD-JWT-VC credential for a verified person, referenced by the principal_ref issued to your organization, scoped to a counterparty audience, and bound to the presenting agent’s public key. Every credential is issuer-signed with sub (the person’s audience-scoped pairwise DID, stable across mints and levels) and aud (the canonical counterparty domain), so counterparties can verify audience binding and key returning customers offline. Credentials are short-lived projections of the person’s current verification — mint on demand rather than storing them long-term.
curl --request POST \
--url https://api.baselayer.com/credentials/individual \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"principal_ref": "<string>",
"audience": "<string>",
"agent_key": {
"x": "<string>",
"kty": "OKP",
"crv": "Ed25519",
"kid": "<string>"
},
"disclosed_fields": [
"<string>"
],
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
'import requests
url = "https://api.baselayer.com/credentials/individual"
payload = {
"principal_ref": "<string>",
"audience": "<string>",
"agent_key": {
"x": "<string>",
"kty": "OKP",
"crv": "Ed25519",
"kid": "<string>"
},
"disclosed_fields": ["<string>"],
"disclosure_mode": "CLEARTEXT_AND_HASH"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
principal_ref: '<string>',
audience: '<string>',
agent_key: {x: '<string>', kty: 'OKP', crv: 'Ed25519', kid: '<string>'},
disclosed_fields: ['<string>'],
disclosure_mode: 'CLEARTEXT_AND_HASH'
})
};
fetch('https://api.baselayer.com/credentials/individual', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/credentials/individual",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'principal_ref' => '<string>',
'audience' => '<string>',
'agent_key' => [
'x' => '<string>',
'kty' => 'OKP',
'crv' => 'Ed25519',
'kid' => '<string>'
],
'disclosed_fields' => [
'<string>'
],
'disclosure_mode' => 'CLEARTEXT_AND_HASH'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/credentials/individual"
payload := strings.NewReader("{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/credentials/individual")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/credentials/individual")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"principal_ref\": \"<string>\",\n \"audience\": \"<string>\",\n \"agent_key\": {\n \"x\": \"<string>\",\n \"kty\": \"OKP\",\n \"crv\": \"Ed25519\",\n \"kid\": \"<string>\"\n },\n \"disclosed_fields\": [\n \"<string>\"\n ],\n \"disclosure_mode\": \"CLEARTEXT_AND_HASH\"\n}"
response = http.request(request)
puts response.read_body{
"credential": "<string>",
"credential_type": "L2",
"jti": "<string>",
"principal_ref": "<string>",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"business_ref": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
]
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"code": 6301,
"message": "The subject's verified-identity snapshot is superseded or expired; re-verify before minting.",
"metadata": {}
}{
"code": 6303,
"message": "The credential mint payload failed validation.",
"metadata": {}
}Authorizations
Body
Body for POST /credentials/individual: mint an L2 or L3
credential for a verified person as themselves.
Pairwise reference to the verified principal, as issued to the calling organization at verification completion.
1 - 255Credential layer to mint: L2 (audience-scoped pairwise DID) or L3 (selectively disclosed verified identity).
L2, L3 The counterparty the credential is scoped to — a domain, or a URL reduced to its hostname.
1 - 512Public JWK of the agent that will present the credential; becomes the credential's cnf binding.
Show child attributes
Show child attributes
L3 only: the dotted disclosure paths the credential should carry, e.g. user.email.hash. Individual mints take user.* paths; business mints take business.* and actor.user.* paths.
64L3 disclosure mode: CLEARTEXT_AND_HASH (default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes.
CLEARTEXT_AND_HASH, HASH_ONLY Response
Response
Body for the mint routes: the wire credential and its issuance facts.
credential is the SD-JWT presentation without a Key Binding JWT —
the presenting agent appends the KB-JWT at request time.
The SD-JWT-VC wire string.
The minted credential layer (L2 or L3).
L2, L3, COUNTERPARTY The credential's unique token id; the issuance-record handle.
The pairwise principal reference minted for.
The canonical counterparty domain the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The pairwise business reference minted for; null on individual mints.
The dotted disclosure paths the credential carries.
Dotted keys of the identity attributes the credential attests to (on business mints, the union of the business and actor scopes).