Credential lifecycle
The five states, every transition between them, and what the phone does about it.
Issuing is the easy part. What makes a credential worth trusting is that it stops being valid at the right moment, everywhere it has been shown.
| State | Means | Reversible |
|---|---|---|
draft | Created, not yet issued. | — |
issued | Live and honourable. | — |
suspended | Temporarily not valid. The pass stays on the phone and says so. | Yes — resume |
expired | Past its validity. Reached on its own, not by a call. | No |
revoked | Ended deliberately, with a reason and an actor on the record. | No |
The transitions
POST /v1/credentials/{id}/suspend— pauses it.POST /v1/credentials/{id}/resume— puts a suspended credential back.POST /v1/credentials/{id}/revoke— ends it permanently.PATCH /v1/credentials/{id}— changes what it says without touching its state.POST /v1/credentials/bulk— appliessuspend,resume,revokeorexpireto a list.
What the wallet does
A change marks every wallet holding the credential as stale and re-pushes it. The two wallets are not symmetric: an Apple pass is a file your device holds and is updated by a push, while a Google Wallet object is a record held by Google and updated in place. Nomi runs both sides; what you see is one credential and a list of channel states.
History
GET /v1/credentials/{id}/events returns the append-only trail for one credential, newest first — issued, updated, verified, refused, suspended, revoked, each with its actor and moment. It is the answer to “why was this person turned away on Tuesday”, which is the question that actually gets asked.