> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Preview what an L3 test mint would disclose > `POST /issuance/credentials/preview` for `POST /issuance/credentials/test`: the same body and answer, with `environment` the Sandbox environment that would sign. Signs, stores and allocates nothing. ## OpenAPI ````yaml /api-reference/openapi.json post /issuance/credentials/test/preview openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /issuance/credentials/test/preview: post: tags: - Credentials summary: Preview what an L3 test mint would disclose description: >- `POST /issuance/credentials/preview` for `POST /issuance/credentials/test`: the same body and answer, with `environment` the Sandbox environment that would sign. Signs, stores and allocates nothing. operationId: issuance_credentials_test_preview requestBody: content: application/json: schema: $ref: '#/components/schemas/v1.CredentialPreviewRequest' application/vnd.baselayer.v1+json: schema: $ref: '#/components/schemas/v1.CredentialPreviewRequest' required: true responses: '200': description: Response content: application/json: schema: $ref: '#/components/schemas/v1.CredentialPreviewResponse' application/vnd.baselayer.v1+json: schema: $ref: '#/components/schemas/v1.CredentialPreviewResponse' '404': description: >- A reference is unknown, was issued to another organization or to your other environment — the cases are indistinguishable. content: application/json: schema: $ref: '#/components/schemas/Error' title: ResourceNotFound description: Could not locate the resource for the given URI. examples: - type: resource_not_found code: 1 message: Could not locate the resource for the given URI. metadata: {} '409': description: >- Your organization has no Sandbox environment, or the mint would be refused: the snapshot is not current, or (business) the operator link is not verified. content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: >- The body failed validation (including an L2 level), the audience cannot be canonicalized, or a path is outside the vault schema. content: application/json: schema: $ref: '#/components/schemas/Error' title: InvalidCredentialMintPayload description: The credential mint payload failed validation. examples: - type: invalid_credential_mint_payload code: 6303 message: The credential mint payload failed validation. metadata: {} security: - APIKeyHeader: [] components: schemas: v1.CredentialPreviewRequest: description: >- Body for ``POST /issuance/credentials/preview``: the mint body, previewed. discriminator: mapping: BUSINESS: '#/components/schemas/v1.BusinessCredentialPreviewRequest' INDIVIDUAL: '#/components/schemas/v1.IndividualCredentialPreviewRequest' propertyName: type oneOf: - $ref: '#/components/schemas/v1.IndividualCredentialPreviewRequest' - $ref: '#/components/schemas/v1.BusinessCredentialPreviewRequest' title: CredentialPreviewRequest v1.CredentialPreviewResponse: description: >- Body of ``POST /issuance/credentials/preview``: what a mint with the same body would disclose, without signing, storing or allocating anything. The mint response's shape, with leaves in place of the credential strings. properties: environment: $ref: '#/components/schemas/v1.ApplicationType' description: The environment the mint would run in. ttl_capped: description: >- Whether supporting evidence expiry would shorten the requested validity. title: Ttl Capped type: boolean credentials: description: The credentials a mint would produce, subject first. items: $ref: '#/components/schemas/v1.CredentialPreviewEntry' title: Credentials type: array required: - environment - ttl_capped - credentials title: CredentialPreviewResponse (v1) type: object Error: properties: type: type: string title: Type description: >- Stable snake_case name of the error. Branch on this, never on `message`. code: type: integer title: Code description: Integer catalog code of the error. message: type: string title: Message description: For a human reading a log; not stable and not localized. metadata: additionalProperties: true type: object title: Metadata description: Context documented per `type`. request_id: anyOf: - type: string - type: 'null' title: Request Id description: The `X-Request-ID` of the failed request. type: object required: - type - code - message title: Error description: The one body of every error a KYA route answers. v1.BusinessCredentialPreviewRequest: additionalProperties: false description: |- The business mint body, so one body previews and then mints. ``agent_key`` is optional and unused; a preview is L3 only. properties: format: $ref: '#/components/schemas/v1.CredentialWireFormat' default: dc+sd-jwt description: >- Credential wire format. `dc+sd-jwt` (media type `application/dc+sd-jwt`, draft-ietf-oauth-sd-jwt-vc-19 §2.1) is the only format issued. level: $ref: '#/components/schemas/v1.CredentialMintLevel' default: L3 description: >- Credential layer to mint (defaults to `L3`): `L2` (audience-scoped pairwise DID) or `L3` (selectively disclosed verified identity). ttl_seconds: anyOf: - exclusiveMinimum: 0 type: integer - type: 'null' default: null description: >- Maximum credential validity in seconds, capped at supporting evidence expiry. Omitted or null uses the server default (3600 seconds). Must not exceed the configured maximum (86400 seconds by default). Applies to L2 and L3. title: Ttl Seconds audience: description: >- The counterparty the credential is scoped to: a bare domain (`login.example.com`), or an https authorization-server identifier (`https://login.example.com`) kept whole, which derives a different pairwise subject than the bare host. Paths, queries, fragments and non-default ports are refused. maxLength: 512 minLength: 1 title: Audience type: string disclosed_fields: description: >- `L3` only: the dotted disclosure paths the subject credential should carry, e.g. `email` or `hashes.email`. A business mint lists business paths here and the actor credential's paths, e.g. `given_name`, in `actor_disclosed_fields`. items: type: string maxItems: 64 title: Disclosed Fields type: array preset: anyOf: - $ref: '#/components/schemas/v1.CredentialPreset' - type: 'null' default: null description: >- L3 only: disclose a use case's fields instead of listing `disclosed_fields`; never both. `GET /issuance/credentials/presets` lists each preset's paths. A preset always shares values in the clear, and B2B presets need a business mint. disclosure_mode: $ref: '#/components/schemas/v1.DisclosureMode' default: CLEARTEXT_AND_HASH description: >- L3 disclosure mode: CLEARTEXT_AND_HASH (default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes. agent_key: anyOf: - $ref: '#/components/schemas/v1.CredentialAgentKey' - type: 'null' default: null description: Accepted so a mint body previews unchanged; a preview binds no key. individual_ref: description: >- Pairwise reference to the verified individual, as issued to the calling organization at verification completion. maxLength: 255 minLength: 1 title: Individual Ref type: string type: const: BUSINESS description: >- `BUSINESS`: a person acting as the operator of the business `business_ref` names. title: Type type: string business_ref: description: >- Pairwise reference to the verified business whose identity the individual assumes, as issued to the calling organization. maxLength: 255 minLength: 1 title: Business Ref type: string actor_disclosed_fields: description: >- `L3` only: the dotted paths the separate actor credential should carry, unprefixed, e.g. `given_name` or `hashes.email` — the individual vocabulary `/vct/kya/individual/v1` lists. Never with `preset`. items: type: string maxItems: 64 title: Actor Disclosed Fields type: array required: - audience - individual_ref - type - business_ref title: BusinessCredentialPreviewRequest (v1) type: object v1.IndividualCredentialPreviewRequest: additionalProperties: false description: |- The individual mint body, so one body previews and then mints. ``agent_key`` is optional and unused; a preview is L3 only. properties: format: $ref: '#/components/schemas/v1.CredentialWireFormat' default: dc+sd-jwt description: >- Credential wire format. `dc+sd-jwt` (media type `application/dc+sd-jwt`, draft-ietf-oauth-sd-jwt-vc-19 §2.1) is the only format issued. level: $ref: '#/components/schemas/v1.CredentialMintLevel' default: L3 description: >- Credential layer to mint (defaults to `L3`): `L2` (audience-scoped pairwise DID) or `L3` (selectively disclosed verified identity). ttl_seconds: anyOf: - exclusiveMinimum: 0 type: integer - type: 'null' default: null description: >- Maximum credential validity in seconds, capped at supporting evidence expiry. Omitted or null uses the server default (3600 seconds). Must not exceed the configured maximum (86400 seconds by default). Applies to L2 and L3. title: Ttl Seconds audience: description: >- The counterparty the credential is scoped to: a bare domain (`login.example.com`), or an https authorization-server identifier (`https://login.example.com`) kept whole, which derives a different pairwise subject than the bare host. Paths, queries, fragments and non-default ports are refused. maxLength: 512 minLength: 1 title: Audience type: string disclosed_fields: description: >- `L3` only: the dotted disclosure paths the subject credential should carry, e.g. `email` or `hashes.email`. A business mint lists business paths here and the actor credential's paths, e.g. `given_name`, in `actor_disclosed_fields`. items: type: string maxItems: 64 title: Disclosed Fields type: array preset: anyOf: - $ref: '#/components/schemas/v1.CredentialPreset' - type: 'null' default: null description: >- L3 only: disclose a use case's fields instead of listing `disclosed_fields`; never both. `GET /issuance/credentials/presets` lists each preset's paths. A preset always shares values in the clear, and B2B presets need a business mint. disclosure_mode: $ref: '#/components/schemas/v1.DisclosureMode' default: CLEARTEXT_AND_HASH description: >- L3 disclosure mode: CLEARTEXT_AND_HASH (default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes. agent_key: anyOf: - $ref: '#/components/schemas/v1.CredentialAgentKey' - type: 'null' default: null description: Accepted so a mint body previews unchanged; a preview binds no key. individual_ref: description: >- Pairwise reference to the verified individual, as issued to the calling organization at verification completion. maxLength: 255 minLength: 1 title: Individual Ref type: string type: const: INDIVIDUAL description: '`INDIVIDUAL`: the person as themselves.' title: Type type: string required: - audience - individual_ref - type title: IndividualCredentialPreviewRequest (v1) type: object v1.ApplicationType: enum: - sandbox - production title: ApplicationType type: string v1.CredentialPreviewEntry: description: What one credential of a mint with the same body would carry. properties: role: $ref: '#/components/schemas/v1.CredentialRole' description: Whether this is the subject's or the actor's. disclosed: description: The leaves the credential would carry, in path order. items: $ref: '#/components/schemas/v1.CredentialPreviewDisclosure' title: Disclosed type: array missing_paths: description: >- Requested paths with nothing on file, which the mint would skip. Measured after HASH_ONLY collapses a family onto its hash. items: type: string title: Missing Paths type: array expires_at: description: When a mint now would expire. format: date-time title: Expires At type: string active_keys: description: >- Names of the verification checks that would pass (e.g. `phone_possession` for an individual, `tax_id_match` for a business), from the token-exchange profile's key vocabulary; the verification level is derived from them. items: type: string title: Active Keys type: array authorization: anyOf: - $ref: '#/components/schemas/v1.CredentialPreviewAuthorization' - type: 'null' default: null description: >- A business credential's subject entry only: the operator authorization it always carries. required: - role - disclosed - missing_paths - expires_at - active_keys title: CredentialPreviewEntry (v1) type: object v1.CredentialWireFormat: description: |- The credential formats issued. The value is the SD-JWT VC media-type subtype, a standard code kept verbatim. Validation accepts the stored ``SD_JWT_VC`` member, never that string. enum: - dc+sd-jwt title: CredentialWireFormat type: string v1.CredentialMintLevel: description: |- The credential layer a subject mint request selects (KYA). Deliberately narrower than ``IssuedCredentialType``: the individual and business mint routes issue only the two subject layers. Counterparty credentials have their own route and request shape, so a ``level`` of COUNTERPARTY must stay an edge-level payload refusal — this enum is what keeps issuance-record vocabulary growth from widening the mint requests. enum: - L2 - L3 title: CredentialMintLevel type: string v1.CredentialPreset: description: |- A named use case an L3 mint can disclose by instead of listing paths. The paths each preset shares live in ``osiris.identity.credential_presets``; this is the stored vocabulary (``issued_credentials.preset``). Retiring a preset is deleting its member: every read of a stored record types the key as text. enum: - consumer_ecommerce - age_gated - consumer_regulated - b2b_ecommerce - b2b_regulated title: CredentialPreset type: string v1.DisclosureMode: description: |- Per-mint selective-disclosure mode for L3 credentials. CLEARTEXT_AND_HASH (the default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes, giving counterparties recognition without plaintext. Lives here rather than beside the L3 payload shapes because it is a stored column vocabulary as of ENG-7140 (``issued_credentials.disclosure_mode``), and ``models.py`` cannot import ``osiris.identity.l3_payloads`` (circular through ``active_keys``). enum: - CLEARTEXT_AND_HASH - HASH_ONLY title: DisclosureMode type: string v1.CredentialAgentKey: additionalProperties: false description: |- The presenting agent's public key, bound into the credential's ``cnf`` claim (RFC 7800). The customer is the retriever, but the credential is presentable only by the agent holding the matching private key. v1 pins the signature suite: Ed25519 OKP keys only. ``x`` must encode a well-formed Ed25519 public key, so malformed key material is rejected as a payload validation error, never a mint-time surprise. properties: kty: const: OKP default: OKP description: JWK key type; v1 accepts OKP only. title: Kty type: string crv: const: Ed25519 default: Ed25519 description: JWK curve; v1 accepts Ed25519 only. title: Crv type: string x: description: Base64url-encoded Ed25519 public key bytes. minLength: 1 title: X type: string kid: anyOf: - maxLength: 255 type: string - type: 'null' default: null description: Optional key identifier. title: Kid required: - x title: CredentialAgentKey (v1) type: object v1.CredentialRole: description: |- What a credential in a mint or preview response is for: the subject it names, or the individual who acts for a business subject. enum: - subject - actor title: CredentialRole type: string v1.CredentialPreviewDisclosure: description: One leaf an L3 mint with the same body would disclose. properties: path: description: The wire-form disclosure path. title: Path type: string value: $ref: '#/components/schemas/v1.JsonValue' description: >- The exact value the credential would carry; for a recognition hash, the hash. hashed: description: Whether the leaf is a recognition hash. title: Hashed type: boolean required: - path - value - hashed title: CredentialPreviewDisclosure (v1) type: object v1.CredentialPreviewAuthorization: description: |- The always-disclosed operator authorization a business credential carries in its ``actor`` block. properties: status: $ref: '#/components/schemas/v1.L3OperatorLinkStatus' description: The operator link's status at mint. basis: $ref: '#/components/schemas/v1.L3OperatorAuthorizationBasis' description: >- Why the link is verified: the evidence recipe passed, or a reviewer decided it. confirmed_at: description: When the link was last confirmed. format: date-time title: Confirmed At type: string required: - status - basis - confirmed_at title: CredentialPreviewAuthorization (v1) type: object v1.JsonValue: {} v1.L3OperatorLinkStatus: description: |- The acting person's operator link status (spec wire form). Only a Verified link mints, so it is the only member. enum: - verified title: L3OperatorLinkStatus type: string v1.L3OperatorAuthorizationBasis: description: |- Why the operator link is Verified: the evidence recipe passed, or a reviewer at the organization decided it by hand. enum: - evidence - reviewer title: L3OperatorAuthorizationBasis type: string securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.