Token Status List of Agent Passports
IETF Token Status List (draft-ietf-oauth-status-list) for Agent Passport credentials: 2 bits per index, registered values `0` VALID, `1` INVALID (revoked), `2` SUSPENDED. The index is the `status.status_list.idx` claim of the passport. Served bare (no envelope) as `application/statuslist+json`, `Cache-Control: public, max-age=300`, `ETag`.
IETF Token Status List (draft-ietf-oauth-status-list) for Agent Passport credentials:
2 bits per index, registered values 0 VALID, 1 INVALID (revoked), 2 SUSPENDED.
The index is the status.status_list.idx claim of the passport. Served bare (no envelope) as application/statuslist+json,
Cache-Control: public, max-age=300, ETag.
Response Body
application/statuslist+json
application/json
curl -X GET "https://example.com/identity/status-list"{ "status_list": "string", "bits": 2, "total": 0}Verify a Verifiable Credential (vc+jwt) POST
Verifies a credential issued by the AY platform or a listed issuer: signature (EdDSA, key resolved from the issuer DID), issuer allowlist, validity window and the Token Status List. Returns one verdict: `valid`, `expired`, `suspended`, `revoked`, `invalid` or `unknown` (`unknown` = a source was unreachable, no verdict). Use it for Agent Passports, BusinessVerificationCredentials and TwinMandateCredentials. No authentication, rate-limited. Never returns key material. TwinMandateCredential (AIOAY-5541): issued by the person, not the platform. `alg` is `ES256` (raw R||S, 64 bytes, RFC 7518 §3.4; DER is `invalid`), `kid` is `<user-did>#key-device` under `assertionMethod`. `iss` must equal the `controller` of the twin DID document (`sub`), otherwise `invalid` with reason `issuer_not_controller`. Status list: `/identity/status-list/mandates`.
Token Status List of BusinessVerificationCredentials GET
Same format and values as `/identity/status-list`, with its own indexes, for the verification credentials of business twins. Every issuance gets a new index; a superseded or expired credential stays `1` INVALID forever. Served bare, `application/statuslist+json`, `Cache-Control: public, max-age=300`, `ETag`.