Status

GET /v1/status/{credentialId}

This endpoint answers "is this credential currently valid," from a bare credential hash, and returns the answer as a signed attestation rather than a plain boolean.

Two things to know before using it. First, ?chain=ethr always returns 404. On Ethereum, status travels inside the credential itself rather than living in separate oracle-queryable state, so it is checked through Verify (which dispatches on the credential's declared credentialStatus.type) or through Credential status for a W3C status list. A 404 from this endpoint on Ethereum is not a report of a missing credential; the lookup itself is not supported for that chain. Second, the attestation this endpoint returns always has an empty DID. See below.

Parameters

The type parameter is unusual and worth understanding. This endpoint does not read the credential's type from the chain: whatever you pass in type is copied straight into the CredType field of the attestation and is then covered by the signature. Omit it and CredType is signed as an empty string.

So type is a label you are asserting, not a fact the oracle checked. Do not treat CredType on a /v1/status response as evidence of anything. When the type must come from the chain, use Verify, which reads it from the on-chain record.

Request

curl "https://<host>/v1/status/0xfb898d4079eed14603bbca2a245278b45af1d2acad278c6c690e067bc9eaae2c?chain=eid&type=KYCVerified" \
  -H "Authorization: Bearer idc_live_..."

Response

{
  "attestation": {
    "DID": "",
    "CredentialID": "0xfb898d4079eed14603bbca2a245278b45af1d2acad278c6c690e067bc9eaae2c",
    "CredType": "KYCVerified",
    "Issuer": "0xe81fa0ecbf9c77cd095fbeb4687d78cbd98bd51092a2cc12d4276e1ade4a8e78",
    "Status": "valid",
    "SourceChain": "eid",
    "IssuedAt": 1751360400,
    "ExpiresAt": 1751360700,
    "Nonce": [0, 17, 34, 51, 68, 85, 102, 119, 136, 153, 170, 187, 204, 221, 238, 255, 0, 17, 34, 51, 68, 85, 102, 119, 136, 153, 170, 187, 204, 221, 238, 255]
  },
  "signature": "0xf4793f2e134d1dcc4884967bba64ef22433cbb63006c4c1aeefc580e151f82ec3c266201648bbf018c32136f7d2c44ab4b666c54e20f22d4cc075ce66d2d2c8e00"
}

The attestation object has no JSON tags on the source struct, so its keys are the exact Go field names in PascalCase: DID, CredentialID, CredType, Issuer, Status, SourceChain, IssuedAt, ExpiresAt, Nonce. Nonce is a fixed 32-byte array and is rendered as 32 numbers, not as base64 or hex.

DID is empty on every response from this endpoint. The caller supplied only a credential hash, so there is no subject for the oracle to name, and an attestation with no subject is not bound to any particular holder: it states that a credential with this hash is valid, not that any given holder presented it. When the attestation must name a subject, use Verify, which reads the subject DID out of the presentation itself. This is not an omission; it is why /v1/verify exists alongside /v1/status.

Status codes