Credentials API
Every endpoint on a credential: issue, read, update, suspend, resume, revoke, history and channels.
All of these are scoped to the organisation the key belongs to. An identifier from another organisation answers 404, not 403 — the honest answer, since it does not exist as far as this key is concerned.
GET/v1/credentials
Newest first. Filters: state, subjectId, surface (wallet or academic), and q over the serial and the holder's name, email and external id.
POST/v1/credentials
Issue one. See Issue a credential.
GET/v1/credentials/{id}
One credential, with its channels and the actions currently available on it.
PATCH/v1/credentials/{id}
Change fields or expiresAt without touching the lifecycle state. Wallets holding it are marked stale and re-pushed.
POST/v1/credentials/{id}/suspend
Pause it. Reversible.
POST/v1/credentials/{id}/resume
Put a suspended credential back.
POST/v1/credentials/{id}/revoke
End it permanently, with a reason.
POST/v1/credentials/bulk
suspend, resume, revoke or expire, applied to a list.
GET/v1/credentials/{id}/events
The append-only history for this credential, newest first.
GET/v1/credentials/{id}/devices
The devices registered for updates to this credential.
Channels
GET/v1/credentials/{id}/channels/{channel}/artifact
The rendered artefact for apple_wallet or google_wallet.
POST/v1/credentials/{id}/channels/{channel}/reprovision
Queue a re-render. Answers 202 with the channel id.
POST/v1/credentials/{id}/wallet-links
The Apple and Google links for a credential, created if missing. Idempotent; a credential that is no longer valid gets no new links.