The OAuth Token Status List covering every credential this issuer has minted. Each credential's status claim names this URI and a bit index; bit set means revoked. Returned as a signed statuslist+jwt verifiable against the issuer's published JWKS. Unauthenticated; cacheable for at most the token's ttl claim, which this response's max-age mirrors.