---
title: "Read Open Badge Assertion"
method: GET
path: "/v1/badge_assertion/{badge_assertion_id}/open_badges"
tags: ["Badge Assertion"]
---

# Read Open Badge Assertion

`GET /v1/badge_assertion/{badge_assertion_id}/open_badges`

Retrieve a badge assertion using the Open Badges Schema.

Imported wallet assertions (`source == Imported`) are returned as a verbatim
passthrough of the original `raw_payload` so the recipient identity hash, salt,
and source URLs match the original assertion bit-for-bit. Re-building the wrapper
from the local database would roll a fresh salt and re-hash the user's primary
email, breaking the cryptographic tie back to the source issuer. (Imports are
served in their original version regardless of the `version` param.)

`version=3.0` emits a signed OB 3.0 OpenBadgeCredential for Navigatr-issued
assertions: a JSON-LD credential with an embedded Data Integrity proof (`format=json`,
`application/ld+json`) or a VC-JWT (`format=jwt`, `application/jwt`). A **revoked**
assertion is NOT refused: the credential is emitted (200) with a `credentialStatus`
entry pointing at the hosted BitstringStatusList, where the assertion's bit is set — the
cryptographic-revocation mechanism OB 3.0 expects (a verifier dereferences the list and
sees the revocation). Returns 400 for an unknown `format` and 422 when OB 3.0 emission is
not enabled / keys are not provisioned / the assertion is not provider-issued. (410 still
applies to deleted or otherwise unavailable assertions, as for `2.0`.)

All other (`2.0`) assertions are built fresh from the database — `raw_payload` is NULL
for those rows by design.

## Path parameters

- `badge_assertion_id` integer, required

## Query parameters

- `version` string — Open Badges version: '2.0' (default) or '3.0'
- `format` string — For version=3.0 only: 'json' (JSON-LD with an eddsa-rdfc-2022 Data Integrity proof) or 'jwt' (VC-JWT Compact JWS)

## Headers

- `X-Access-Token` string, nullable

## Response `200`

Successful Response

- OpenBadgeAssertion
  - `id` string, required
  - `@context` string
  - `type` string
  - `recipient` OpenBadgeRecipient, required
    - `type` string
    - `hashed` boolean
    - `salt` string, nullable
    - `identity` string, required
  - `badge` OpenBadge, required
    - `@context` string
    - `type` string
    - `id` string
    - `name` string
    - `description` string
    - `image` OpenBadgeImage
      - `id` string, required
    - `criteria` OpenBadgeCriteria
      - `id` string, required
      - `narrative` string, required
    - `tags` string[], nullable
    - `issuer` OpenBadgeIssuer, required
      - `id` string, required
      - `@context` string
      - `type` string
      - `name` string, required
      - `url` string, required
      - `email` string, required
      - `description` string, nullable
      - `image` string, nullable
    - `alignment` OpenBadgeAlignment[], nullable
      - `targetName` string, required
      - `targetUrl` string, required
      - `targetDescription` string, required
      - `targetFramework` string, nullable
      - `targetCode` string, nullable
  - `verification` OpenBadgeVerification, required — OB 2.0 hosted-verification block — must accompany every issued assertion. `type` is `"hosted"` (lowercase) per the IMS Global spec text. The OB 2.0 JSON-LD context (`https://purl.imsglobal.org/spec/ob/v2p0/context/context.json`) accepts both `"hosted"` and `"HostedBadge"` as aliases for `obi:HostedBadge`, but every major real-world issuer (Accredible, Credly, Open Badge Factory, Moodle, Canvas Badges) uses the lowercase form, and third-party importers (notably Credly) reject the capitalised form even though it's valid JSON-LD. `url` is REQUIRED for hosted verification per spec: third-party verifiers fetch it to retrieve the assertion JSON and confirm the badge is genuinely hosted by the claimed issuer. Same URL as the assertion's `id` field — the assertion's hosted JSON endpoint.
    - `type` string
    - `url` string, required
  - `issuedOn` string, date-time, required
  - `image` OpenBadgeImage
    - `id` string, required
  - `evidence` OpenBadgeAssertionEvidence[], nullable
    - `type` 'UrlEvidence' | 'PlainTextEvidence' | 'IdEvidence' | 'KeyValueGroupEvidence', required
    - `id` string, nullable, required
    - `narrative` string, nullable, required
    - `name` string, nullable, required
    - `description` string, nullable, required
    - `genre` string, nullable, required
    - `audience` string, nullable, required
  - `narrative` string, nullable
  - `expires` string, date-time, nullable
  - `revoked` boolean
  - `revocationReason` string, nullable

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `410` — Gone
- `422` — Unprocessable Content

---

[API](https://skmtc.net/navigatr/apis/navigatr-api.md) · [All operations](https://skmtc.net/navigatr/apis/navigatr-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/navigatr/navigatr-api/revisions/4039d06e340b/schema)