Revocation
The endpoints that end a credential, and how the answer reaches somebody who is not asking us.
Revocation is a state, not a deletion. The credential keeps existing, it keeps its history, and it answers every verification with the reason it is no longer good.
POST/v1/credentials/{id}/revoke
Permanent. Sets revokedAt and revocationReason.
POST/v1/credentials/{id}/suspend
Reversible. Use this when the relationship might resume.
POST/v1/credentials/bulk
The same four actions, applied to a list, with a per-row result.
Where the answer travels
- Verification —
/v1/verifyand the public endpoints refuse it immediately. - The wallets — the pass on the device is updated; Apple by push, Google in place.
- The public page — the bookmark a third party kept now says revoked.
- The status list — for academic credentials, a W3C Bitstring Status List at
GET /public/status/{slug}/revocation, which is what makes a file somebody downloaded months ago verify as revoked without calling us. - Your systems — a
credential.revokedwebhook.