Verify a credential
Two ways to ask whether a credential is good: one for your own door, one for the world.
There are two verification endpoints and they answer different questions. Using the wrong one is the most common integration mistake on this platform.
POST/v1/verify
Your own scanner, with your key. Records the attempt on the credential's history.
GET/public/credentials/{code}
Anyone, with no key. What a third party checking a diploma uses.
At your own door
POST /v1/verify
curl -X POST https://api.nomi-tech.com/v1/verify \
-H "Authorization: Bearer nomi_sk_live_EXAMPLE" \
-H "Content-Type: application/json" \
-d '{ "code": "…", "location": "North gate" }'code is whatever the scanner read: the serial, the public code, or the whole verification URL that a certificate's QR carries. The three are printed in different places and a reader reads what is put in front of it.
200 OK
{
"valid": false,
"reason": "revoked",
"state": "revoked",
"credential": { "id": "cred_…", "serial": "…", "issuedAt": "…", "expiresAt": "…" },
"subject": { "externalId": "crm_example_001", "displayName": "Alex Morgan" }
}Public verification
GET /public/credentials/{code} returns everything a third party needs to decide whether to believe a credential and nothing else: the issuing organisation, whether its domain is verified, the status in words (valid, expired, revoked, suspended, not_yet_issued), the recipient's name and what was earned. No account, no key. GET /public/verify?code=… is the same answer for a code somebody typed off a printed certificate.