Skip to main content
POST
Revoke one issued credential

Authorizations

X-API-Key
string
header
required

Path Parameters

jti
string
required

Response

Response

One record from the organization's credential issuance log.

The dispute-evidence view of a mint: who was authorized, for which counterparty, disclosing what, signed with which key, and whether the credential has since been revoked. Deliberately carries no credential material — credential strings are never stored; the row is the durable evidence of the issuance, keyed by the jti a relying party's exchange log records.

jti
string
required

The credential's unique token id; the issuance-record handle.

credential_type
enum<string>
required

The credential layer minted.

Available options:
L2,
L3,
COUNTERPARTY
status
enum<string>
required

The credential's current revocation status: VALID, or REVOKED once its bit is set on the published status list.

Available options:
VALID,
REVOKED
audience
string
required

The canonical counterparty domain the credential is scoped to.

issued_at
string<date-time>
required

Issuance instant (the issuer JWT's iat).

expires_at
string<date-time>
required

Expiry instant (the issuer JWT's exp).

signing_kid
string
required

The id of the issuer key that signed the credential (the RFC 7638 thumbprint published in the issuer's JWKS).

revoked_at
string<date-time> | null

The instant the credential was revoked; null while it remains valid.

principal_ref
string | null

The pairwise principal reference involved in the mint: the individual subject, or the acting principal who authorized a business mint. Null on counterparty mints and when that principal no longer exists.

business_ref
string | null

The pairwise business reference minted for, as issued to your organization; null on individual mints and when the subject no longer exists.

subject
string | null

Counterparty credentials only: the public business DID the credential's sub claim carries; null on agent credentials.

disclosed_fields
string[]

The dotted disclosure paths the credential carries; empty for L2 mints.

active_keys
string[]

Dotted keys of the identity attributes the credential attests to.

minted_by
string | null

Who initiated the mint, rendered as key: <api key name> for API mints or user: <email> for console mints. Captured at mint time and never rewritten, so it keeps naming the actor after a rename or a deletion — an issuance record describes what was true when the credential minted. Null only on records minted before actor attribution existed.

agent_key_kid
string | null

The caller-supplied kid of the agent key the credential was bound to, if one was provided. Null on counterparty credentials and on records minted before it was recorded.

agent_key_thumbprint
string | null

RFC 7638 thumbprint of the agent public key bound into the credential's cnf claim. Null on counterparty credentials and on records minted before it was recorded.

disclosure_mode
enum<string> | null

The selective-disclosure mode the mint requested. Null on L2 and counterparty mints, and on L3 records minted before it was recorded.

Available options:
CLEARTEXT_AND_HASH,
HASH_ONLY