> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Who Can Act for a Business > Make sure only people verified to act for a business can get credentials for it. An operator link records that one verified person may act for one verified business. You need a `VERIFIED` link before you can mint a business credential for that person and business. Every business credential tells the site two things: who the business is, and that the person behind the agent is verified to act for it. The operator link is where that second statement comes from. Without it, a verified business and a verified person are just two unrelated records. **1. Verify the person and business together** The result records an operator link for that pair. **2. Baselayer checks the link** If the business's tax ID matched and its registry check passed, the link is verified on its own. Otherwise it waits for your review. **3. Your organization decides when needed** Approve or reject a link that is `UNDER_REVIEW`. **4. Mint once the link is verified** Baselayer mints a business credential only when the link is `VERIFIED`. ## How the link works A link is created when one of your own verifications covers a person and a business together: * a direct verification with `"type": "BUSINESS"` on `POST /issuance/identities/verifications`, which carries both `individual` and `business`, or * a [hosted enrollment session](https://docs.baselayer.com/hosted-enrollment/sessions.md) whose journey collects a business. The verification's result includes `individual_ref`, `business_ref` and `business_operator_link_status`. You cannot create a link any other way, and you can only decide on a pair after one of your own verifications has covered it. ### How automatic verification works A link becomes `VERIFIED` on its own when all three checks pass. Each check has a shortfall code that shows when it fails: * A tax ID (TIN) was provided for the business. Shortfall: `TIN_NOT_PROVIDED`. * The IRS matched that tax ID to the business name. Shortfall: `TIN_NOT_MATCHED`. * The business was verified against its state registry. Shortfall: `KYB_NOT_VERIFIED`. If any check falls short, the link is `UNDER_REVIEW` and its `shortfalls` list says which. > [!TIP] > > A business without a tax ID can still be verified, but its link cannot verify on its own. Send `tin` with the business to give the link a chance to verify automatically. ### Officer matching Baselayer also compares the person's name to the officers on the registry record. The result is `officer_match`: `EXACT`, `PARTIAL`, `NONE` or `NOT_EVALUATED`. This is supporting evidence for your review, separate from the three checks above. It never verifies or holds a link on its own, because many states do not list officers. ### Your links are yours Your status for a link never changes because of another organization's verification or decision, and yours never changes theirs. Sandbox and production links are also separate. ## Link statuses | Status | What it means | Can you mint a business credential? | | - | - | - | | `VERIFIED` | The person may act for the business. Either the three checks all passed, or your organization approved the link. | Yes | | `UNDER_REVIEW` | One or more checks fell short. The link waits for your decision. | No | | `REJECTED` | Your organization rejected the link. It stays rejected until you decide again, whatever later verifications find. | No | ## Review an operator link Find the links waiting on you: ```http theme={null} GET /issuance/identities/operator_links?status=UNDER_REVIEW ``` See the [API reference](https://docs.baselayer.com/api-reference/identities/list-your-organizations-operator-links.md). Each row names both sides by your own references and names, and shows where the link stands: | Row field | What it holds | | - | - | | `individual_ref`, `individual_display_name` | The person. | | `business_ref`, `business_legal_name` | The business. | | `status`, `shortfalls` | The link's status and any checks that fell short. | | `decided_at`, `decided_by`, `decision_reason` | Who decided it and when. | | `review_flagged_at` | When a later verification flagged the link for review. The link keeps its status. | See every filter and sort option in the [API Reference](https://docs.baselayer.com/api-reference/identities/list-your-organizations-operator-links.md). Then look up one link with its evidence: ```http theme={null} GET /issuance/identities/businesses/{business_ref}/operator_links/{individual_ref} ``` See the [API reference](https://docs.baselayer.com/api-reference/identities/get-one-operator-link-with-its-evidence.md). It returns the link with its `evidence`: the check results a business credential minted for this pair right now would rest on. | Evidence field | Meaning | | - | - | | `tin_provided` | Whether a tax ID was collected. | | `tin_matched` | Whether the IRS matched it. Null when no answer came back. | | `kyb_verified` | Whether the registry verified the business. Null when no answer came back. | | `officer_match` | How the person's name compared to the registry's officers. | | `matched_officer_name`, `matched_officer_title` | The officer who matched, if any. | | `evaluated_at` | When the checks finished. | You can also see links from either side: * A person's links: the `businesses` list on `GET /issuance/identities/individuals/{individual_ref}`. Rejected links are not listed there. * A business's people: `GET /issuance/identities/businesses/{business_ref}`. ## Approve or reject ```http theme={null} POST /issuance/identities/businesses/{business_ref}/operator_links/{individual_ref}/decide ``` See the [API reference](https://docs.baselayer.com/api-reference/identities/verify-or-reject-that-an-individual-operates-a-business.md). ```json theme={null} { "decision": "VERIFIED", "reason": "Confirmed by phone with the business owner." } ``` | Field | Notes | | - | - | | `decision` | `VERIFIED` to approve the link, `REJECTED` to refuse it. Required. | | `reason` | Optional. Up to 2000 characters, kept with the decision for your own records. | The response is the link, as the list shows it. | Decision | New business credentials for the pair | Credentials already minted | | - | - | - | | `VERIFIED` | Allowed. This approves the relationship only. | Not affected. | | `REJECTED` | Blocked until you decide again. | Stay valid until they expire or you revoke them, for example with the reason `operator_link_revoked`. | > [!NOTE] > > **Approving doesn't refresh verification** > > The credential still states, and is dated by, what your own verifications found. If that is more than a year old, the mint is refused with `6301`. > > * Re-verify the person if their verification lapsed. > * Send a new `type: BUSINESS` verification for the pair if the business evidence lapsed. > [!NOTE] > > A new decision replaces the earlier one, with its own decider, time and reason. Sending the link's current status again records a new decision without changing the status. A decision applies to your organization only. ## What a verified link allows Baselayer signs a business credential only when the link is `VERIFIED`. For any other status, a mint with `type: BUSINESS` (and its preview) is refused with `409` and the error code `6300`. See [Troubleshooting](#troubleshooting). ```http theme={null} POST /issuance/credentials ``` The site that receives the credential checks the same thing. A business credential whose person link is not verified is refused there too. A business credential records how its link was verified, in `actor.authorization.basis`: `evidence` when the checks passed, or `reviewer` when your organization decided it. Once a reviewer has decided a link, it stays `reviewer`. ## Troubleshooting | Problem | Fix | | - | - | | `409` with code `6300` (`business_credential_operator_link_not_verified`) when minting a business credential | Look up the link. If it is `UNDER_REVIEW`, fix the `shortfalls` or approve it. If it is `REJECTED`, only a new `VERIFIED` decision changes it. | | Link is `UNDER_REVIEW` with `TIN_NOT_PROVIDED` | The verification had no tax ID for the business. Send `tin` in the business details. | | `404` on lookup or decide | One of the references is not yours, belongs to the other environment, or your verifications never covered this pair. All three read the same. | | New business credentials are refused after a rejection | Expected. Rejecting a link blocks new mints for the pair. Credentials already minted stay valid until you revoke them. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.