---
title: "Mint a credential for a person as themselves"
method: POST
path: "/credentials/individual"
tags: ["Credentials"]
---

# Mint a credential for a person as themselves

`POST /credentials/individual`

Mints an L2 or L3 SD-JWT-VC credential for a verified person, referenced by the `principal_ref` issued to your organization, scoped to a counterparty `audience`, and bound to the presenting agent's public key. Credentials are short-lived projections of the person's current verification — mint on demand rather than storing them long-term.

## Request body

- V1IndividualCredentialMintRequest — Body for ``POST /credentials/individual``: mint an L2 or L3 credential for a verified person as themselves.
  - `principal_ref` string, required — Pairwise reference to the verified principal, as issued to the calling organization at verification completion.
  - `level` 'L2' | 'L3', required — The credential layer a subject mint request selects (KYA). Deliberately narrower than ``IssuedCredentialType``: the individual and business mint routes issue only the two subject layers. Counterparty credentials have their own route and request shape, so a ``level`` of COUNTERPARTY must stay an edge-level payload refusal — this enum is what keeps issuance-record vocabulary growth from widening the mint requests.
  - `audience` string, required — The counterparty the credential is scoped to — a domain, or a URL reduced to its hostname.
  - `agent_key` V1CredentialAgentKey, required — The presenting agent's public key, bound into the credential's ``cnf`` claim (RFC 7800). The customer is the retriever, but the credential is presentable only by the agent holding the matching private key. v1 pins the signature suite: Ed25519 OKP keys only. ``x`` must encode a well-formed Ed25519 public key, so malformed key material is rejected as a payload validation error, never a mint-time surprise.
    - `kty` 'OKP' — JWK key type; v1 accepts OKP only.
    - `crv` 'Ed25519' — JWK curve; v1 accepts Ed25519 only.
    - `x` string, required — Base64url-encoded Ed25519 public key bytes.
    - `kid` string, nullable — Optional key identifier.
  - `disclosed_fields` string[] — L3 only: the dotted disclosure paths the credential should carry, e.g. `user.email.hash`. Individual mints take `user.*` paths; business mints take `business.*` and `actor.user.*` paths.
  - `disclosure_mode` 'CLEARTEXT_AND_HASH' | 'HASH_ONLY' — Per-mint selective-disclosure mode for L3 credentials. CLEARTEXT_AND_HASH (the default) discloses requested fields as cleartext alongside their recognition hashes; HASH_ONLY discloses only the recognition hashes, giving counterparties recognition without plaintext.

## Response `201`

Response

- V1CredentialMintResponse — Body for the mint routes: the wire credential and its issuance facts. ``credential`` is the SD-JWT presentation without a Key Binding JWT — the presenting agent appends the KB-JWT at request time.
  - `credential` string, required — The SD-JWT-VC wire string.
  - `credential_type` 'L2' | 'L3' | 'COUNTERPARTY', required — The KYA credential layer. L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key.
  - `jti` string, required — The credential's unique token id; the issuance-record handle.
  - `principal_ref` string, required — The pairwise principal reference minted for.
  - `business_ref` string, nullable — The pairwise business reference minted for; null on individual mints.
  - `audience` string, required — The canonical counterparty domain the credential is scoped to.
  - `issued_at` string, date-time, required — Issuance instant (the issuer JWT's iat).
  - `expires_at` string, date-time, required — Expiry instant (the issuer JWT's exp).
  - `disclosed_fields` string[] — The dotted disclosure paths the credential carries.
  - `active_keys` string[] — Dotted keys of the identity attributes the credential attests to (on business mints, the union of the business and actor scopes).

## Other responses

- `404` — The principal_ref is unknown or was issued to another organization — the two are indistinguishable.
- `409` — The person's verified-identity snapshot is superseded or expired; re-verify before minting.
- `422` — The mint payload failed validation, the audience cannot be reduced to a canonical counterparty domain, or a requested disclosure field is outside the vault schema.

---

[API](https://skmtc.net/baselayer/apis/baselayer-api-service.md) · [All operations](https://skmtc.net/baselayer/apis/baselayer-api-service/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/baselayer/baselayer-api-service/versions/0cc89938bc26/schema)