---
title: "Mint a counterparty credential for a business's web domain"
method: POST
path: "/credentials/counterparty"
tags: ["Credentials"]
---

# Mint a counterparty credential for a business's web domain

`POST /credentials/counterparty`

Mints the domain-bound business entity credential a merchant hosts at /.well-known/baselayer-counterparty-credential so arriving agents can verify the business behind the site. No agent key: the credential binds to the domain, and TLS supplies the possession proof at fetch time.

## Request body

- V1CounterpartyCredentialMintRequest — Body for ``POST /credentials/counterparty``: mint the domain-bound business entity credential a merchant hosts for counterparty verification (ENG-6598). No agent key and no disclosure selection: the credential binds to the merchant's domain rather than a presenting key, and every claim is public-record fact, always disclosed.
  - `business_ref` string, required — Pairwise reference to the verified business the counterparty credential attests, as issued to the calling organization.
  - `domain` string, required — The domain the credential binds to — must match the business's verified website domain. A full URL is reduced to its hostname.

## Response `201`

Response

- V1CounterpartyCredentialMintResponse — Body for the counterparty mint route: the hostable wire credential and its issuance facts. ``credential`` is one plain EdDSA JWS (``typ: bl-counterparty+jwt``) — the merchant serves it verbatim at ``https://<domain>/.well-known/baselayer-counterparty-credential``.
  - `credential` string, required — The counterparty credential JWS wire string.
  - `credential_type` 'L2' | 'L3' | 'COUNTERPARTY', required — The KYA credential layer. L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key.
  - `jti` string, required — The credential's unique token id; the issuance-record handle.
  - `business_ref` string, required — The pairwise business reference minted for.
  - `subject` string, required — The credential's public business DID (the JWT sub claim), derived from the entity's registry coordinates.
  - `domain` string, required — The canonical domain the credential is bound to.
  - `issued_at` string, date-time, required — Issuance instant (the JWT's iat).
  - `expires_at` string, date-time, required — Expiry instant (the JWT's exp).
  - `disclosed_fields` string[] — The business.* claim paths the credential carries, in wire form.
  - `active_keys` string[] — The attestation-primitive keys backing the business_verification block.

## Other responses

- `404` — The business_ref is unknown or was issued to another organization — the two are indistinguishable.
- `409` — The domain does not match the business's verified website domain, the registration is not active and undissolved, or registry truth has lapsed.
- `422` — The mint payload failed validation, or the domain cannot be reduced to a canonical form.

---

[API](https://skmtc.net/baselayer/apis/baselayer-api-service.md) · [All operations](https://skmtc.net/baselayer/apis/baselayer-api-service/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/baselayer/baselayer-api-service/versions/0cc89938bc26/schema)