Skip to main content
GET
Resolve one credential issuance record by its jti

Authorizations

X-API-Key
string
header
required

Path Parameters

jti
string
required

The credential's unique token id, as returned by the mint and carried in the credential's jti claim.

Response

Response

One record from the organization's credential issuance log.

The dispute-evidence view of a mint: who was authorized, for which counterparty, disclosing what, signed with which key, and whether the credential has since been revoked. Deliberately carries no credential material — credential strings are never stored; the row is the durable evidence of the issuance, keyed by the jti a relying party's exchange log records.

jti
string
required

The credential's unique token id; the issuance-record handle.

credential_type
enum<string>
required

The credential layer minted.

Available options:
L2,
L3,
COUNTERPARTY
status
enum<string>
required

The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list.

Available options:
VALID,
REVOKED
audience
string
required

The canonical counterparty domain the credential is scoped to.

issued_at
string<date-time>
required

Issuance instant (the issuer JWT's iat).

expires_at
string<date-time>
required

Expiry instant (the issuer JWT's exp).

signing_kid
string
required

The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).

revoked_at
string<date-time> | null

The instant the credential was revoked; null while it remains valid.

principal_ref
string | null

The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists.

business_ref
string | null

The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.

subject
string | null

Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.

disclosed_fields
string[]

The dotted disclosure paths the credential carries; empty for L2 mints.

active_keys
string[]

Dotted keys of the identity attributes the credential attests to.

minted_by
string | null

Who initiated the mint, rendered as key: <api key name> for API mints or user: <email> for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed.

agent_key_kid
string | null

The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.

agent_key_thumbprint
string | null

RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.

disclosure_mode
enum<string> | null

The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.

Available options:
CLEARTEXT_AND_HASH,
HASH_ONLY