curl --request POST \
--url https://api.baselayer.com/issuance/credentials/{credential_id}/revoke \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '{}'import requests
url = "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke"
payload = {}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://api.baselayer.com/issuance/credentials/{credential_id}/revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/issuance/credentials/{credential_id}/revoke")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issuance/credentials/{credential_id}/revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"credential_id": "<string>",
"environment": "sandbox",
"level": "L2",
"credential_format": "dc+sd-jwt",
"iss": "<string>",
"vct": "<string>",
"status_list": {
"uri": "<string>",
"idx": 123
},
"status": "VALID",
"state": "ACTIVE",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"source_environment": "sandbox",
"linked_credential_id": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"revocation_reason": "agent_key_compromise",
"revoked_by": {
"kind": "USER",
"label": "<string>"
},
"individual_ref": "<string>",
"individual_display_name": "<string>",
"business_ref": "<string>",
"business_legal_name": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": {
"kind": "USER",
"label": "<string>"
},
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH",
"preset": "<string>"
}{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"type": "validation_failed",
"code": 7112,
"message": "The request is invalid.",
"metadata": {}
}Revoke one credential
Flips this credential’s bit in the unified Token Status List, so verifiers refuse it from their next list fetch — for a leaked presentation or any single artifact that has to stop working before it expires. The revocation is scoped to this one credential: the subject keeps its authorization, so a replacement is a fresh mint away. Nothing is deleted — the record is evidence and stays readable at GET /issuance/credentials/{credential_id} with status: REVOKED; this action answers with that record. The reason and the revoking user or API key are recorded on the record and its audit event. Idempotent: revoking an already-revoked credential changes nothing, keeps the first reason and revoker, and returns the same record.
curl --request POST \
--url https://api.baselayer.com/issuance/credentials/{credential_id}/revoke \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '{}'import requests
url = "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke"
payload = {}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://api.baselayer.com/issuance/credentials/{credential_id}/revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issuance/credentials/{credential_id}/revoke"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/issuance/credentials/{credential_id}/revoke")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issuance/credentials/{credential_id}/revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"credential_id": "<string>",
"environment": "sandbox",
"level": "L2",
"credential_format": "dc+sd-jwt",
"iss": "<string>",
"vct": "<string>",
"status_list": {
"uri": "<string>",
"idx": 123
},
"status": "VALID",
"state": "ACTIVE",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"source_environment": "sandbox",
"linked_credential_id": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"revocation_reason": "agent_key_compromise",
"revoked_by": {
"kind": "USER",
"label": "<string>"
},
"individual_ref": "<string>",
"individual_display_name": "<string>",
"business_ref": "<string>",
"business_legal_name": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": {
"kind": "USER",
"label": "<string>"
},
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH",
"preset": "<string>"
}{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"type": "validation_failed",
"code": 7112,
"message": "The request is invalid.",
"metadata": {}
}Authorizations
Path Parameters
The credential's unique id: the jti its token carries, as returned by the mint.
Body
Why a credential is being revoked.
Why the credential is being revoked; recorded on the issuance record and its audit event.
agent_key_compromise, identity_superseded, identity_withdrawn, operator_link_revoked, fraud_suspected Response
Response
One record from the organization's credential issuance log.
The dispute-evidence view of a mint: who was authorized, for which
counterparty, disclosing what, signed with which key, and whether the
credential has since been revoked, keyed by the credential_id (the
token's jti) a relying party's exchange log records. Carries no
credential material; only IssuedCredentialDetailResponse does.
The credential's unique id: exactly the jti its token carries.
The environment the credential was minted in.
sandbox, production The credential layer minted.
L2, L3 The credential's wire format.
dc+sd-jwt The token's iss claim: the issuer that signed it.
The token's vct claim: the credential type identifier.
The token's status.status_list claim: where a verifier reads this credential's revocation bit.
Show child attributes
Show child attributes
The credential's persisted revocation standing: VALID, or REVOKED once its bit is set on the published status list. Expiry does not change it.
VALID, REVOKED The credential's lifecycle as of this request: ACTIVE, EXPIRED once expires_at has passed, or REVOKED. The same value the state filter selects on.
ACTIVE, EXPIRED, REVOKED The canonical audience the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).
On a test credential for a person or business verified in another environment, that environment; the credential itself is signed in environment. Null otherwise.
sandbox, production On a business L3 mint's actor credential, the credential_id of the business credential minted with it; null otherwise.
The instant the credential was revoked; null while it remains valid.
Why the credential was revoked. Null while it remains valid and on records revoked before the reason was recorded.
agent_key_compromise, identity_superseded, identity_withdrawn, operator_link_revoked, fraud_suspected, administrative_action Who revoked the credential: the console user or the API key. Captured at revocation and never rewritten. Null while the credential remains valid and on records revoked before the actor was recorded.
Show child attributes
Show child attributes
The pairwise individual reference involved in the mint: the individual subject, or the acting individual who authorized a business mint. Null on counterparty mints and when that individual no longer exists.
The first and last name of the individual individual_ref names, as the credential minted it. Null on counterparty mints and on records minted before names were recorded.
The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.
The business's legal name as the credential minted it. Null on individual mints and on records minted before names were recorded.
Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.
The dotted disclosure paths the credential carries; empty for L2 mints.
Names of the verification checks that passed (e.g. phone_possession for an individual, tax_id_match for a business), from the token-exchange profile's key vocabulary; the verification level is derived from them.
Who initiated the mint: the console user or the API key. Captured at mint time and never rewritten. Null on records minted before the actor's kind was recorded.
Show child attributes
Show child attributes
The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.
RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.
The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.
CLEARTEXT_AND_HASH, HASH_ONLY The preset the mint disclosed by; null when it listed its own disclosed_fields, and on L2 and counterparty mints.
32^[a-z][a-z0-9_]*$