curl --request POST \
--url https://api.baselayer.com/issued_credentials/{jti}/revoke \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials/{jti}/revoke"
headers = {"X-API-Key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials/{jti}/revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials/{jti}/revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials/{jti}/revoke"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/issued_credentials/{jti}/revoke")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials/{jti}/revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"input": "<unknown>",
"ctx": {}
}
]
}Revoke one issued credential
Flips this credential’s bit in the unified Token Status List, so verifiers refuse it from their next list fetch — for a leaked presentation, a merchant that offboards, or any single artifact that has to stop working before it expires. Any credential type revokes here, addressed by the jti the issuance log records. The revocation is scoped to this one credential: the subject keeps its authorization, so a replacement is a fresh mint away. Nothing is deleted — the issuance record is evidence and stays readable at GET /issued_credentials/{jti} with status: REVOKED; this action answers with that record. Idempotent: revoking an already-revoked credential changes nothing and returns the same record.
curl --request POST \
--url https://api.baselayer.com/issued_credentials/{jti}/revoke \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.baselayer.com/issued_credentials/{jti}/revoke"
headers = {"X-API-Key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.baselayer.com/issued_credentials/{jti}/revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.baselayer.com/issued_credentials/{jti}/revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.baselayer.com/issued_credentials/{jti}/revoke"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.baselayer.com/issued_credentials/{jti}/revoke")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.baselayer.com/issued_credentials/{jti}/revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"jti": "<string>",
"credential_type": "L2",
"status": "VALID",
"audience": "<string>",
"issued_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"signing_kid": "<string>",
"revoked_at": "2023-11-07T05:31:56Z",
"principal_ref": "<string>",
"business_ref": "<string>",
"subject": "<string>",
"disclosed_fields": [
"<string>"
],
"active_keys": [
"<string>"
],
"minted_by": "<string>",
"agent_key_kid": "<string>",
"agent_key_thumbprint": "<string>",
"disclosure_mode": "CLEARTEXT_AND_HASH"
}{
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"input": "<unknown>",
"ctx": {}
}
]
}Authorizations
Path Parameters
Response
Response
One record from the organization's credential issuance log.
The dispute-evidence view of a mint: who was authorized, for which
counterparty, disclosing what, signed with which key, and whether the
credential has since been revoked. Deliberately carries no credential
material — credential strings are never stored; the row is the durable
evidence of the issuance, keyed by the jti a relying party's
exchange log records.
The credential's unique token id; the issuance-record handle.
The credential layer minted.
L2, L3, COUNTERPARTY The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list.
VALID, REVOKED The canonical counterparty domain the credential is scoped to.
Issuance instant (the issuer JWT's iat).
Expiry instant (the issuer JWT's exp).
The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).
The instant the credential was revoked; null while it remains valid.
The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists.
The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.
Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.
The dotted disclosure paths the credential carries; empty for L2 mints.
Dotted keys of the identity attributes the credential attests to.
Who initiated the mint, rendered as key: <api key name> for API mints or user: <email> for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed.
The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.
RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.
The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.
CLEARTEXT_AND_HASH, HASH_ONLY