curl --request GET \
--url https://api.baselayer.com/issued_credentials/{jti} \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials/{jti}"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials/{jti}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials/{jti}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials/{jti}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issued_credentials/{jti}")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials/{jti}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"input": "<unknown>",
"ctx": {}
}
]
}Resolve one credential issuance record by its jti
Resolves a credential’s jti — the token id a relying party’s exchange log records — back to your organization’s issuance record: the dispute-evidence answer to “was this agent authorized, for whom, and had it been revoked?”. Only your organization’s own mints resolve; the credential string itself is never stored and never returned. Post-hoc detail therefore shows stored issuance metadata only — a decoded header/payload view of the credential can only be rendered at mint time, from the mint response itself.
curl --request GET \
--url https://api.baselayer.com/issued_credentials/{jti} \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials/{jti}"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials/{jti}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials/{jti}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials/{jti}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.baselayer.com/issued_credentials/{jti}")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials/{jti}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"input": "<unknown>",
"ctx": {}
}
]
}Authorizations
Path Parameters
The credential's unique token id, as returned by the mint and carried in the credential's jti claim.
Response
Response
One record from the organization's credential issuance log.
The dispute-evidence view of a mint: who was authorized, for which
counterparty, disclosing what, signed with which key, and whether the
credential has since been revoked. Deliberately carries no credential
material — credential strings are never stored; the row is the durable
evidence of the issuance, keyed by the jti a relying party's
exchange log records.
The credential's unique token id; the issuance-record handle.
The credential layer minted.
L2, L3, COUNTERPARTY The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list.
VALID, REVOKED The canonical counterparty domain the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).
The instant the credential was revoked; null while it remains valid.
The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists.
The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.
Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.
The dotted disclosure paths the credential carries; empty for L2 mints.
Dotted keys of the identity attributes the credential attests to.
Who initiated the mint, rendered as key: <api key name> for API mints or user: <email> for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed.
The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.
RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.
The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.
CLEARTEXT_AND_HASH, HASH_ONLY