Verify a Verifiable Credential (vc+jwt)
Verifies a credential issued by the AY platform or a listed issuer: signature (EdDSA, key resolved from the issuer DID), issuer allowlist, validity window and the Token Status List. Returns one verdict: `valid`, `expired`, `suspended`, `revoked`, `invalid` or `unknown` (`unknown` = a source was unreachable, no verdict). Use it for Agent Passports, BusinessVerificationCredentials and TwinMandateCredentials. No authentication, rate-limited. Never returns key material. TwinMandateCredential (AIOAY-5541): issued by the person, not the platform. `alg` is `ES256` (raw R||S, 64 bytes, RFC 7518 §3.4; DER is `invalid`), `kid` is `<user-did>#key-device` under `assertionMethod`. `iss` must equal the `controller` of the twin DID document (`sub`), otherwise `invalid` with reason `issuer_not_controller`. Status list: `/identity/status-list/mandates`.
Verifies a credential issued by the AY platform or a listed issuer: signature (EdDSA, key
resolved from the issuer DID), issuer allowlist, validity window and the Token Status List.
Returns one verdict: valid, expired, suspended, revoked, invalid or unknown
(unknown = a source was unreachable, no verdict). Use it for Agent Passports,
BusinessVerificationCredentials and TwinMandateCredentials. No authentication, rate-limited.
Never returns key material.
TwinMandateCredential (AIOAY-5541): issued by the person, not the platform. alg is ES256
(raw R||S, 64 bytes, RFC 7518 §3.4; DER is invalid), kid is <user-did>#key-device
under assertionMethod. iss must equal the controller of the twin DID document (sub),
otherwise invalid with reason issuer_not_controller. Status list:
/identity/status-list/mandates.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/identity/credentials/verify" \ -H "Content-Type: application/json" \ -d '{ "jwt": "stringstringstringst" }'{ "status": "valid", "reason": "string", "checked_at": "2019-08-24T14:15:22Z", "vct": "string", "sub": "string", "iss": "string", "iat": 0, "exp": 0, "status_list": { "uri": "http://example.com", "idx": 0 }}Verify an RFC 9421 signed request POST
Re-runs the receiver-side verification of the AY profile (`docs/identity/t2t-signature-contract.md` §4) and returns every step with its outcome, so you can see *why* a signature fails. Read-only: it does **not** consume nonces (the `nonce` step is reported as `skipped`). Accepts all three tags (`ay-t2t`, `ay-t2a`, `ay-agent`). No authentication, rate-limited. Never returns key material.
Token Status List of Agent Passports GET
IETF Token Status List (draft-ietf-oauth-status-list) for Agent Passport credentials: 2 bits per index, registered values `0` VALID, `1` INVALID (revoked), `2` SUSPENDED. The index is the `status.status_list.idx` claim of the passport. Served bare (no envelope) as `application/statuslist+json`, `Cache-Control: public, max-age=300`, `ETag`.