Skip to main content
POST
Revoke one credential

Authorizations

X-API-Key
string
header
required

Path Parameters

credential_id
string
required

The credential's unique id: the jti its token carries, as returned by the mint.

Body

Why a credential is being revoked.

reason
enum<string>
required

Why the credential is being revoked; recorded on the issuance record and its audit event.

Available options:
agent_key_compromise,
identity_superseded,
identity_withdrawn,
operator_link_revoked,
fraud_suspected

Response

Response

One record from the organization's credential issuance log.

The dispute-evidence view of a mint: who was authorized, for which counterparty, disclosing what, signed with which key, and whether the credential has since been revoked, keyed by the credential_id (the token's jti) a relying party's exchange log records. Carries no credential material; only IssuedCredentialDetailResponse does.

credential_id
string
required

The credential's unique id: exactly the jti its token carries.

environment
enum<string>
required

The environment the credential was minted in.

Available options:
sandbox,
production
level
enum<string>
required

The credential layer minted.

Available options:
L2,
L3
credential_format
enum<string>
required

The credential's wire format.

Available options:
dc+sd-jwt
iss
string
required

The token's iss claim: the issuer that signed it.

vct
string
required

The token's vct claim: the credential type identifier.

status_list
CredentialStatusListPointer (v1) · object
required

The token's status.status_list claim: where a verifier reads this credential's revocation bit.

status
enum<string>
required

The credential's persisted revocation standing: VALID, or REVOKED once its bit is set on the published status list. Expiry does not change it.

Available options:
VALID,
REVOKED
state
enum<string>
required

The credential's lifecycle as of this request: ACTIVE, EXPIRED once expires_at has passed, or REVOKED. The same value the state filter selects on.

Available options:
ACTIVE,
EXPIRED,
REVOKED
audience
string
required

The canonical audience the credential is scoped to.

issued_at
string<date-time>
required

Issuance instant (the issuer JWT's iat).

expires_at
string<date-time>
required

Expiry instant (the issuer JWT's exp).

signing_kid
string
required

The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).

source_environment
enum<string> | null

On a test credential for a person or business verified in another environment, that environment; the credential itself is signed in environment. Null otherwise.

Available options:
sandbox,
production
linked_credential_id
string | null

On a business L3 mint's actor credential, the credential_id of the business credential minted with it; null otherwise.

revoked_at
string<date-time> | null

The instant the credential was revoked; null while it remains valid.

revocation_reason
enum<string> | null

Why the credential was revoked. Null while it remains valid and on records revoked before the reason was recorded.

Available options:
agent_key_compromise,
identity_superseded,
identity_withdrawn,
operator_link_revoked,
fraud_suspected,
administrative_action
revoked_by
ActedBy (v1) · object | null

Who revoked the credential: the console user or the API key. Captured at revocation and never rewritten. Null while the credential remains valid and on records revoked before the actor was recorded.

individual_ref
string | null

The pairwise individual reference involved in the mint: the individual subject, or the acting individual who authorized a business mint. Null on counterparty mints and when that individual no longer exists.

individual_display_name
string | null

The first and last name of the individual individual_ref names, as the credential minted it. Null on counterparty mints and on records minted before names were recorded.

business_ref
string | null

The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.

The business's legal name as the credential minted it. Null on individual mints and on records minted before names were recorded.

subject
string | null

Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.

disclosed_fields
string[]

The dotted disclosure paths the credential carries; empty for L2 mints.

active_keys
string[]

Names of the verification checks that passed (e.g. phone_possession for an individual, tax_id_match for a business), from the token-exchange profile's key vocabulary; the verification level is derived from them.

minted_by
ActedBy (v1) · object | null

Who initiated the mint: the console user or the API key. Captured at mint time and never rewritten. Null on records minted before the actor's kind was recorded.

agent_key_kid
string | null

The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.

agent_key_thumbprint
string | null

RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.

disclosure_mode
enum<string> | null

The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.

Available options:
CLEARTEXT_AND_HASH,
HASH_ONLY
preset
string | null

The preset the mint disclosed by; null when it listed its own disclosed_fields, and on L2 and counterparty mints.

Maximum string length: 32
Pattern: ^[a-z][a-z0-9_]*$