> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Resolve one credential issuance record by its jti > Resolves a credential's `jti` — the token id a relying party's exchange log records — back to your organization's issuance record: the dispute-evidence answer to "was this agent authorized, for whom, and had it been revoked?". Only your organization's own mints resolve; the credential string itself is never stored and never returned. Post-hoc detail therefore shows stored issuance metadata only — a decoded header/payload view of the credential can only be rendered at mint time, from the mint response itself. ## OpenAPI ````yaml /api-reference/openapi.json get /issued_credentials/{jti} openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /issued_credentials/{jti}: get: tags: - Credentials summary: Resolve one credential issuance record by its jti description: >- Resolves a credential's `jti` — the token id a relying party's exchange log records — back to your organization's issuance record: the dispute-evidence answer to "was this agent authorized, for whom, and had it been revoked?". Only your organization's own mints resolve; the credential string itself is never stored and never returned. Post-hoc detail therefore shows stored issuance metadata only — a decoded header/payload view of the credential can only be rendered at mint time, from the mint response itself. operationId: get_issued_credential parameters: - name: jti in: path required: true schema: type: string title: Credential token id description: >- The credential's unique token id, as returned by the mint and carried in the credential's jti claim. description: >- The credential's unique token id, as returned by the mint and carried in the credential's jti claim. responses: '200': description: Response content: application/json: schema: $ref: '#/components/schemas/v1.IssuedCredentialResponse' application/vnd.baselayer.v1+json: schema: $ref: '#/components/schemas/v1.IssuedCredentialResponse' '404': description: >- The jti is unknown or names another organization's credential — the two are indistinguishable. content: application/json: schema: $ref: '#/components/schemas/APIError' title: ResourceNotFound description: Could not locate the resource for the given URI. examples: - code: 1 message: Could not locate the resource for the given URI. metadata: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] components: schemas: v1.IssuedCredentialResponse: description: |- One record from the organization's credential issuance log. The dispute-evidence view of a mint: who was authorized, for which counterparty, disclosing what, signed with which key, and whether the credential has since been revoked. Deliberately carries no credential material — credential strings are never stored; the row is the durable evidence of the issuance, keyed by the ``jti`` a relying party's exchange log records. properties: jti: description: The credential's unique token id; the issuance-record handle. title: Jti type: string credential_type: $ref: '#/components/schemas/v1.IssuedCredentialType' description: The credential layer minted. status: $ref: '#/components/schemas/v1.IssuedCredentialStatus' description: >- The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list. revoked_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The instant the credential was revoked; null while it remains valid. title: Revoked At principal_ref: anyOf: - type: string - type: 'null' default: null description: >- The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists. title: Principal Ref business_ref: anyOf: - type: string - type: 'null' default: null description: >- The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists. title: Business Ref audience: description: The canonical counterparty domain the credential is scoped to. title: Audience type: string subject: anyOf: - type: string - type: 'null' default: null description: >- Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials. title: Subject issued_at: description: Issuance instant (the issuer JWT's iat). format: date-time title: Issued At type: string expires_at: description: Expiry instant (the issuer JWT's exp). format: date-time title: Expires At type: string disclosed_fields: description: >- The dotted disclosure paths the credential carries; empty for L2 mints. items: type: string title: Disclosed Fields type: array active_keys: description: Dotted keys of the identity attributes the credential attests to. items: type: string title: Active Keys type: array signing_kid: description: >- The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS). title: Signing Kid type: string minted_by: anyOf: - type: string - type: 'null' default: null description: >- Who initiated the mint, rendered as `key: ` for API mints or `user: ` for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed. title: Minted By agent_key_kid: anyOf: - type: string - type: 'null' default: null description: >- The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded. title: Agent Key Kid agent_key_thumbprint: anyOf: - type: string - type: 'null' default: null description: >- RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded. title: Agent Key Thumbprint disclosure_mode: anyOf: - $ref: '#/components/schemas/v1.DisclosureMode' - type: 'null' default: null description: >- The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded. required: - jti - credential_type - status - audience - issued_at - expires_at - signing_kid title: IssuedCredentialResponse (v1) type: object APIError: properties: code: type: integer title: Code message: type: string title: Message uri: anyOf: - type: string - type: 'null' title: Uri metadata: additionalProperties: true type: object title: Metadata type: object required: - code - message title: APIError description: >- APIError is a Pydantic model for standardizing error responses from the API. This class is used internally by APIException for JSON serialization. Users should typically work with APIException directly in exception catalogs. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError v1.IssuedCredentialType: description: |- The KYA credential layer. L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key. enum: - L2 - L3 - COUNTERPARTY title: IssuedCredentialType type: string v1.IssuedCredentialStatus: description: |- The credential's state on the published Token Status List. Valid is the mint-time state; Revoked is terminal — an operator link rejected, the organization pulling this one credential, or our own compromise response. Expiry is deliberately not a status: verifiers already check ``exp``, and the bit must keep meaning "revoked before expiry" for the issuance log. enum: - VALID - REVOKED title: IssuedCredentialStatus type: string v1.DisclosureMode: description: |- Per-mint selective-disclosure mode for L3 credentials. CLEARTEXT_AND_HASH (the default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes, giving counterparties recognition without plaintext. Lives here rather than beside the L3 payload shapes because it is a stored column vocabulary as of ENG-7140 (``issued_credentials.disclosure_mode``), and ``models.py`` cannot import ``osiris.identity.l3_payloads`` (circular through ``active_keys``). enum: - CLEARTEXT_AND_HASH - HASH_ONLY title: DisclosureMode type: string ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ````