Verification
The authenticated endpoint for your own scanner, and the public one for everybody else.
POST/v1/verify
Takes what a scanner read and answers whether it may be honoured. Recorded on the credential's history.
Body
{ "code": "…", "location": "North gate" }code accepts the serial, the public code, or the whole verification URL a certificate's QR carries.
GET/public/credentials/{code}
Public. No key. Everything a third party needs to decide whether to believe a credential, and nothing else.
GET/public/verify?code=…
Public. The same answer for a code somebody typed off a printed certificate, or a whole URL pasted in.
A public verification response
{
"publicId": "…",
"status": "valid",
"issuer": {
"name": "…",
"domain": "…",
"verified": true,
"did": "did:web:…"
},
"recipient": { "name": "Alex Morgan" },
"achievement": { "name": "…", "type": "…", "skills": [] },
"issuedAt": "…",
"expiresAt": null,
"verificationUrl": "https://…"
}status is one of valid, expired, revoked, suspended, not_yet_issued. The issuer is the subject of that response — the organisation, its verified domain and its decentralised identifier. Nomi is the infrastructure behind it, not the issuer.