Skip to main content
Credentials are short-lived and minted on demand, but Baselayer keeps a record of every credential it mints for your organization. Use these records to answer “was this agent allowed, for whom, and was it revoked?”, and to stop a credential before it expires. Each record is keyed by credential_id, returned by the mint. It is the same value as the jti inside the credential. Sites that log the jti of credentials they accept can hand it to you in a dispute, and you can look it up here.

​
Find a credential

List the credentials your organization minted, newest first. The list never includes the credential itself. To find active credentials for a person, filter by individual_ref and state=ACTIVE:
See every filter in the API Reference. To read one record:
See the API reference. If your API key is allowed to mint credentials, the response also includes credential: the credential string the mint returned. It is stored encrypted, and it is bound to the agent’s key, so it cannot be presented without the agent’s private key. A credential_id your organization did not issue returns 404, the same as one that does not exist.

​
Read the credential record

See every record field in the API Reference.

​
List issuances and revocations

To see every issuance and revocation of your organization’s credentials as one stream, newest first by default:
See the API reference. Filter with event_type (ISSUED or REVOKED, repeat it for both) and a date range. GET /issuance/credentials/events/export returns every event the same filters match as a CSV file. See the API reference.

​
Revoke it

See the API reference. A credential Baselayer revoked shows the reason administrative_action. The response is the updated record, with status: REVOKED.

​
Revocation rules

  • It stops this one credential. The person or business can still be minted a new one right away.
  • It deletes nothing. The record stays readable with its reason, time and who revoked it.
  • It is idempotent. Revoking an already revoked credential changes nothing and keeps the first reason and revoker.
  • It cannot be undone. Mint a new credential instead.
Rejecting an operator link does not revoke anything. It blocks new business credentials for that person and business. To stop credentials already minted for the pair, revoke them with operator_link_revoked. See Who Can Act for a Business.

​
What the site sees

Revoking sets the credential’s bit on a status list that Baselayer publishes and signs. Sites check that list on every presentation, and may keep their copy until the list’s own refresh time, so sites see the revocation in near-real time. A revoked credential is refused as CREDENTIAL_REVOKED. The list is shared by many credentials, so fetching it doesn’t identify which credential or person a site is checking. The list lives at:
Sandbox credentials use https://sandbox.registry.baselayer.com. See the Credential Format Reference for how to read it.

​
Troubleshooting