Update credential revocation status
PUT/v2/config/digital-wallet/openid/sdjwt/credential/history/:credentialExchangeId/revocation-status
Updates the revocation status of an issued credential using the IETF Token Status List.
Request
Path Parameters
Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle.
Header Parameters
Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.
The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.
X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.
The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.
- application/json
Body
required
New revocation status for the issued credential.
Possible values: [Operational, Revoked, Suspended]
New revocation status. Operational reactivates a suspended credential. Revoked permanently invalidates. Suspended temporarily invalidates (can be reactivated).
Responses
- 200
- 400
- 401
- 500
Credential revocation status updated successfully
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
- Array [
- ]
- Array [
- ]
credentialHistory object
Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except transactionData. A field that has no value is returned with its empty value: "" for a string, 0 for a number, false for a boolean and null for an object or an array.
Identifier of the credential exchange record. This field holds the same value as CredentialExchangeId.
Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.
Camel-case alias of CredentialExchangeId. The server sets both fields to the same value. Use this field in new integrations.
Identifier of the organisation that issues the credential.
Identifier of the OpenID wallet deployment that processes this exchange.
Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement.
dataAttributeValues object[]required
Attribute values supplied for a data agreement based issuance. The field is null when the issuance uses a credential definition.
Name of the data attribute, as defined in the data agreement.
Value of the data attribute for this holder.
When true, the issuer makes this attribute selectively disclosable.
Indicates whether the holder opened the credential offer.
Indicates whether the holder called the OID4VCI Token Endpoint for this exchange.
Possible values: [``, InTime, Deferred]
Issuance mode used for this exchange. InTime means the credential was issued immediately via the OID4VCI Credential Endpoint. Deferred means the credential is pending via the Deferred Credential Endpoint.
When true, the issuance used the OID4VCI Pre-Authorized Code Flow. When false, the Authorization Code Flow was used.
The OID4VCI Credential Offer URI sent to the holder to start the issuance flow.
Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance.
Possible values: [``, pending, ready]
Processing status of the credential. pending means the credential is being prepared. ready means it is available for the holder to retrieve.
Possible values: [``, offer_sent, offer_received, token_issued, credential_issued, credential_acked, credential_accepted, credential_deleted, issuance_denied]
Lifecycle status of the credential exchange in the OID4VCI protocol flow: offer_sent (Credential Offer sent to holder), offer_received (holder scanned or received the offer), token_issued (issuer released an access token), credential_issued (credential issued via Credential Endpoint), credential_acked (holder acknowledged receipt), credential_accepted (holder accepted credential), credential_deleted (holder deleted credential), issuance_denied (issuer denied issuance).
Value of the OID4VCI issuer_state parameter. The issuer uses it to bind the Authorization Request to this exchange.
State value of the OAuth 2.0 Authorization Request that the wallet sent.
State value of the ID Token Request that the issuer sent to the holder.
ID Token Request that the issuer sent to the holder as a signed request object.
State value that the issuer returns together with the authorisation code.
OAuth 2.0 authorisation code issued for the Authorization Code Flow.
Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow.
Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint.
PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.
PKCE code challenge method, for example S256.
Redirect URI that the wallet registered for the Authorization Code Flow.
Client identifier of the holder's wallet, typically a DID or URL. Provided during the OID4VCI Token Request.
Decentralized Identifier of the issuer that signs the credential.
Transaction code (tx_code) for the Pre-Authorized Code Flow.
Unix timestamp (in seconds) when this exchange record was created.
Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field.
When true, the issuer makes the data agreement attributes selectively disclosable in the issued credential.
credential objectrequired
The credential payload being issued. Contains type and credentialSubject for W3C VC (JWT) format, or vct/doctype and claims for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.
The credential payload being issued. Contains type and credentialSubject for W3C VC (JWT) format, or vct/doctype and claims for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.
disclosureMapping objectrequired
Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting.
Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting.
Label of the credential definition or data agreement that this issuance uses.
Identifier of the credential definition that this issuance uses.
URL of an external credential definition that this issuance uses.
Identifier of a presentation definition required for dynamic credential requests.
Identifier of the presentation exchange session linked to a dynamic credential request.
holder objectrequired
Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the name field. The default value before the holder starts the flow is Unknown.
Identifier of the holder, typically a DID or display name resolved from wallet client metadata.
Possible values: [``, vc+sd-jwt, vp+sd-jwt, dc+sd-jwt, jwt_vc_json, jwt_vc, mso_mdoc]
Credential format used for this issuance. jwt_vc_json is W3C VC (JWT). dc+sd-jwt is IETF SD-JWT VC. mso_mdoc is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values vc+sd-jwt, vp+sd-jwt and jwt_vc.
Indicates whether revocation is enabled for the issued credential.
Possible values: [``, Operational, Revoked, Suspended]
Current revocation status: Operational (valid), Revoked (permanently invalidated), Suspended (temporarily invalidated). The field is empty when the credential definition does not support revocation.
OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication.
Type of the client assertion token, for example urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
Indicates whether the holder's client assertion JWT was verified.
Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.
Proof of Possession for the Wallet Unit Attestation.
Indicates whether the Wallet Unit Attestation was verified.
walletUnitValidity object[]required
Array of wallet unit validity records containing attestation and proof of possession verification status.
attestation object
Wallet unit attestation verification status.
Indicates whether the attestation has expired.
Indicates whether the attestation has been revoked.
Indicates whether the attestation was verified.
proofOfPossession object
Proof of possession verification status.
Indicates whether the proof of possession has expired.
Indicates whether the proof of possession was verified.
Unix timestamp (in seconds) when the wallet unit validity was validated.
The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.
cnf objectrequired
Confirmation claim (cnf) containing the holder's public key JWK for key binding.
Confirmation claim (cnf) containing the holder's public key JWK for key binding.
JWT Token Identifier (jti), unique identifier for the issued credential token.
Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.
Type of the proof provided in the Credential Request (e.g. jwt).
Indicates whether the issuer verified the holder's proof of key possession.
decodedWalletUnitAttestation objectrequired
Decoded payload of the holder's Wallet Unit Attestation credential.
Decoded payload of the holder's Wallet Unit Attestation credential.
OpenID Connect ID Token shared by the holder during the issuance flow.
idTokenDecoded objectrequired
Decoded payload of the holder's OpenID Connect ID Token.
Decoded payload of the holder's OpenID Connect ID Token.
Indicates whether the holder's OpenID Connect ID Token was verified.
Human-readable reason why the issuer denied the credential issuance request.
Array of previously issued credential tokens that have expired.
Array of decoded expired credential payloads.
transactionData object
Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.
Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.
credentialResponseEncryption objectrequired
Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is null when the wallet asks for a plain response.
JWE key management algorithm, for example ECDH-ES.
JWE content encryption algorithm, for example A128GCM.
jwk object
Public JSON Web Key that the issuer uses to encrypt the Credential Response.
Public JSON Web Key that the issuer uses to encrypt the Credential Response.
Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is null when the wallet asks for a plain response.
issuerTrustServiceProvider objectrequired
Trust service provider record of the issuer, resolved from the trust list.
Trust service provider record of the issuer, resolved from the trust list.
holderTrustServiceProvider objectrequired
Trust service provider record of the holder, resolved from the trust list.
Trust service provider record of the holder, resolved from the trust list.
Identifier of the individual recipient the credential offer was sent to.
Mapper identifier linking the credential offer to an external individual record.
Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint.
When true, the issuer adds a visible signature stamp to the issued document.
Possible values: >= 4, <= 4
Position of the signature stamp on the document page, given as four pixel coordinates.
{
"credentialHistory": {
"id": "3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11",
"CredentialExchangeId": "3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11",
"credentialExchangeId": "3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11",
"organisationId": "string",
"openIdOrganisationId": "string",
"dataAgreementId": "string",
"dataAttributeValues": [
{
"name": "string",
"value": "string",
"limitedDisclosure": true
}
],
"isAccessed": true,
"isTokenAccessed": true,
"issuanceMode": "",
"isPreAuthorised": true,
"credentialOffer": "openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...",
"credentialOfferEndpoint": "string",
"credentialStatus": "",
"status": "",
"issuerState": "string",
"authorisationRequestState": "string",
"idTokenRequestState": "string",
"idTokenRequest": "string",
"authorisationCodeState": "string",
"authorisationCode": "string",
"preAuthorisedCode": "string",
"acceptanceToken": "string",
"codeChallenge": "string",
"codeChallengeMethod": "string",
"redirectUri": "string",
"clientId": "string",
"did": "string",
"userPin": "string",
"createdAt": 1750000000,
"updatedAt": 1750000600,
"limitedDisclosure": true,
"credential": {},
"disclosureMapping": {},
"credentialLabel": "string",
"credentialDefinitionId": "string",
"credentialDefinitionUri": "string",
"presentationDefinitionId": "string",
"presentationExchangeId": "string",
"holder": {
"name": "Unknown"
},
"credentialFormat": "dc+sd-jwt",
"supportRevocation": true,
"revocationStatus": "",
"clientAssertion": "string",
"clientAssertionType": "string",
"clientAssertionVerified": true,
"walletUnitAttestation": "string",
"walletUnitAttestationPoP": "string",
"walletUnitAttestationVerified": true,
"walletUnitValidity": [
{
"attestation": {
"isExpired": true,
"isRevoked": true,
"isVerified": true
},
"proofOfPossession": {
"isExpired": true,
"isVerified": true
},
"validatedAt": 0
}
],
"credentialToken": "string",
"cnf": {},
"jti": "string",
"proof": "string",
"proofType": "string",
"proofVerified": true,
"decodedWalletUnitAttestation": {},
"idToken": "string",
"idTokenDecoded": {},
"idTokenVerified": true,
"issuanceDeniedReason": "string",
"expiredCredentialTokens": [
"string"
],
"expiredCredentials": [
{}
],
"transactionData": {},
"credentialResponseEncryption": {
"alg": "string",
"enc": "string",
"jwk": {}
},
"issuerTrustServiceProvider": {},
"holderTrustServiceProvider": {},
"individualId": "string",
"mapperId": "string",
"credentialResponseInterval": 0,
"signatureStamp": true,
"signatureCoordinate": [
0
]
}
}
The request is invalid. The issuer returns this status when no record matches credentialExchangeId, when revocationStatus is missing, or when the credential definition does not support revocation.
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Unauthorized
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Internal server error
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}