Verify a credential

GET /credentials/verify/{credential_ref}

Verify the authenticity and validity of a previously issued (by you) credential. Returns the decoded credential data if valid.

Parameters

Name In Required Description

Name	In	Required	Description
`Authorization`	header	yes	Access key generated from the auth API Example: `Bearer 048c2a1c-0881-4dcc-bfca-ccccccccc51`
`credential_ref`	path	yes	The opaque reference returned in the `credential_ref` field of the submit response. Append it to the path exactly as it was returned, without percent-encoding it. Its internal structure is not part of the contract and may change, so do not parse it or construct one.

Authorization

header

yes

Access key generated from the auth API

Example: Bearer 048c2a1c-0881-4dcc-bfca-ccccccccc51

credential_ref

path

yes

The opaque reference returned in the credential_ref field of the submit response. Append it to the path exactly as it was returned, without percent-encoding it. Its internal structure is not part of the contract and may change, so do not parse it or construct one.

Responses

Status	Description
`200 OK`	Credential is valid
`400 Bad Request`	Invalid request parameters
`401 Unauthorized`	Unauthorized - Invalid or missing authentication
`404 Not Found`	Credential not found
`410 Gone`	Credential has been revoked
`412 Precondition Failed`	Credential verification failed

Content type application/json

Response fields (200)

Field	Type	Required	Description
`data`	object	no	The raw verifiable credential JSON
`correlation_id`	string	no	Unique identifier for tracking the verification request

Example 200 response

{
  "data": {
    "@context": [
      "https://www.w3.org/2018/credentials/v1"
    ],
    "type": [
      "VerifiableCredential"
    ],
    "issuer": "did:example:123456",
    "validFrom": "2025-05-27T19:00:00Z",
    "validUntil": "2028-01-01T00:00:00+11:00",
    "credentialSubject": {
      "id": "did:example:subject123"
    }
  },
  "correlation_id": "corr_abc123xyz"
}

Content type application/json

Error (400, 404, 410, 412)

Field	Type	Required	Description
`error`	object	no
`error.message`	string	yes	Human-readable error message
`error.code`	string	yes	Machine-readable error code One of: `E1001`, `E1002`, `E1003`, `E1004`, `E1005`, `E1006`, `E1007`, `E1008`, `E1009`, `E1010`, `E1011`, `E1012`, `E2001`, `E2002`, `E2003`, `E2004`, `E2005`
`error.type`	string	yes	Error type identifier One of: `VALIDATION_ERROR`, `INVALID_REQUEST`, `AUTHENTICATION_FAILED`, `UNAUTHORIZED`, `NOT_FOUND`, `CONFLICT`, `RATE_LIMIT_EXCEEDED`, `PRECONDITION_FAILED`, `CREDENTIAL_EXPIRED`, `CREDENTIAL_REVOKED`, `CREDENTIAL_PENDING_ACCEPTANCE`, `CREDENTIAL_VERIFICATION_FAILED`, `INTERNAL_ERROR`, `INTERNAL_ERROR_EMAIL`, `DATABASE_ERROR`, `EXTERNAL_SERVICE_ERROR`, `SERVICE_UNAVAILABLE`
`error.timestamp`	string	yes
`error.correlation_id`	string	no
`error.details`	object	no	Additional error context

Example 400 response

{
  "error": {
    "message": "Invalid phone number format",
    "code": "E1001",
    "type": "VALIDATION_ERROR",
    "timestamp": "2024-02-20T03:14:15Z",
    "correlation_id": "req_1234567890",
    "details": {
      "validation_errors": {
        "phone": "Must be in format +61423123456"
      }
    }
  }
}

Example request

curl --request GET \
  --url https://api.sandbox.truevault.com.au/api/v1/credentials/verify/{credential_ref} \
  --header 'Authorization: <value>'