Credential types
The seven credentials TrueVault issues, what each attests, and how long each lasts.
Seven credentials, each attesting one thing. Which are available to you depends on your ruleset.
| Credential | Attests | Valid for |
|---|---|---|
trueidentity | The person is who they say they are, verified against the issuing authority | The earliest expiry of its documents; one year if none expire |
acicncchc | A nationally coordinated criminal history check, via ACIC | Three months by default, as per ACIC guidelines |
vevortw | Work entitlements, checked against Home Affairs VEVO | The passport or visa's own expiry, fallback to 90 days |
sanctionscheck | A PEP and international sanctions screening | One day - ensures a fresh check next time |
courtcheck | A court records search by name | Fourteen days |
student | A current enrolment | End of next term, approximately |
phonenumber | The person answered on that number | Fourteen days |
Credential bodies shows what each of these looks like as JSON, including the difference between a check that found nothing and one that did.
Why the validity periods differ so much
They are not arbitrary. Each is the period over which the underlying statement stays true.
A criminal history check is a snapshot of a national database on the day it ran; three months is the convention the industry has settled on. A visa has its own expiry, so a right-to-work credential can never outlive it. An enrolment likewise.
A PEP and sanctions check lasts one day, and that is the one to plan around. Sanctions lists change daily, and a screening that was clean last week is not evidence of anything today. If your obligation is ongoing, you need repeat checks, not one credential held for a year.
A court check lasts fourteen days, which is longer than sanctions because court records are added far more slowly.
What "expired" means
Every credential carries date_expires, and most carry it as a disclosable claim so you can check it without holding anything else.
An expired credential is not revoked and not false. It says what it said, on the day it said it. Whether that is still good enough is your decision and depends on what you are relying on it for.
Revocation is different: a credential can be revoked before its expiry, and that is published in a status list attached to the credential. A verifier that cares about revocation checks the list; one that only cares whether the person passed on the day does not have to.
Getting more than one
A single identity request can require several. A ruleset such as acic_rtw asks for identity, a criminal history check and a right-to-work check together, and the person completes them in one journey. You receive them as separate credentials with separate expiries - which matters, because the sanctions one will expire long before the rest.