Sign in

v1

latestOpenAPI 3.1.02026-07-241695611.0 MB
Credentials

Mint a counterparty credential for a business's web domain

Mints the domain-bound business entity credential a merchant hosts at /.well-known/baselayer-counterparty-credential so arriving agents can verify the business behind the site. No agent key: the credential binds to the domain, and TLS supplies the possession proof at fetch time.

post/credentials/counterparty

Request body

business_refstring required

Pairwise reference to the verified business the counterparty credential attests, as issued to the calling organization.

domainstring required

The domain the credential binds to — must match the business's verified website domain. A full URL is reduced to its hostname.

Response

Response

credentialstring required

The counterparty credential JWS wire string.

credential_type'L2' | 'L3' | 'COUNTERPARTY' required

The KYA credential layer.

L2 is the audience-scoped pairwise DID ("same customer returning"); L3 is the selectively disclosed verified-identity credential. Both ride the same SD-JWT-VC wire format; the layer decides what the issuer JWT carries. Counterparty is the counterparty-verification credential (ENG-6598): a domain-bound business entity attestation a merchant hosts for arriving agents — plain JWS, no selective disclosure, no agent key.

jtistring required

The credential's unique token id; the issuance-record handle.

business_refstring required

The pairwise business reference minted for.

subjectstring required

The credential's public business DID (the JWT sub claim), derived from the entity's registry coordinates.

domainstring required

The canonical domain the credential is bound to.

issued_atstring date-time required

Issuance instant (the JWT's iat).

expires_atstring date-time required

Expiry instant (the JWT's exp).

disclosed_fieldsstring[]

The business.* claim paths the credential carries, in wire form.

active_keysstring[]

The attestation-primitive keys backing the business_verification block.