Seven credentials, each attesting one thing. Which are available to you depends
on your [ruleset](/rest-api-reference/identity/request-a-new-trueidentity).

| Credential | Attests | Valid for |
|---|---|---|
| `trueidentity` | The person is who they say they are, verified against the issuing authority | The earliest expiry of its documents; one year if none expire |
| `acicncchc` | A nationally coordinated criminal history check, via ACIC | Three months by default, as per ACIC guidelines |
| `vevortw` | Work entitlements, checked against Home Affairs VEVO | The passport or visa's own expiry, fallback to 90 days |
| `sanctionscheck` | A PEP and international sanctions screening | One day - ensures a fresh check next time |
| `courtcheck` | A court records search by name | Fourteen days |
| `student` | A current enrolment | End of next term, approximately |
| `phonenumber` | The person answered on that number | Fourteen days |

[Credential bodies](/claims-and-credentials/credential-bodies) shows what each of
these looks like as JSON, including the difference between a check that found
nothing and one that did.

## Why the validity periods differ so much

They are not arbitrary. Each is the period over which the underlying statement
stays true.

A **criminal history check** is a snapshot of a national database on the day it
ran; three months is the convention the industry has settled on. A **visa** has
its own expiry, so a right-to-work credential can never outlive it. An
**enrolment** likewise.

A **PEP and sanctions check lasts one day**, and that is the one to plan around.
Sanctions lists change daily, and a screening that was clean last week is not
evidence of anything today. If your obligation is ongoing, you need repeat
checks, not one credential held for a year.

A **court check** lasts fourteen days, which is longer than sanctions because
court records are added far more slowly.

{% callout type="warning" %}
Do not cache a `sanctionscheck` result and treat it as current. If you need
continuous screening, that is a different product shape - talk to us rather than
re-reading an expired credential.
{% /callout %}

## What "expired" means

Every credential carries `date_expires`, and most carry it as a disclosable
claim so you can check it without holding anything else.

An expired credential is not revoked and not false. It says what it said, on the
day it said it. Whether that is still good enough is your decision and depends on
what you are relying on it for.

Revocation is different: a credential can be revoked before its expiry, and that
is published in a status list attached to the credential. A verifier that cares
about revocation checks the list; one that only cares whether the person passed
on the day does not have to.

## Getting more than one

A single identity request can require several. A ruleset such as `acic_rtw` asks
for identity, a criminal history check and a right-to-work check together, and
the person completes them in one journey. You receive them as separate
credentials with separate expiries - which matters, because the sanctions one
will expire long before the rest.