How to create a credential configuration
Define a credential type: what it contains, in what format, under what rules.
Scope: credential-configurations.manage (or issuers.manage) ·
Reference: CredentialConfigurations_Create
curl -sS -X POST "$MGMT/credential-configurations?api-version=2026-08-30" \
-H "Authorization: ApiKey $DILIGENCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"issuerId": "'"$ISSUER"'",
"identifier": "membership-2026",
"displayName": "Membership 2026",
"credentialType": "Membership",
"format": "dc+sd-jwt",
"claims": [
{ "name": "member_number", "displayName": "Member number", "required": true },
{ "name": "tier", "displayName": "Tier", "required": false }
]
}'
One call creates the configuration, activates its first version and authorises the issuer to use it.
Claims are a contract
Issuance validates claims against this list and rejects anything not declared. That is deliberate: a typo in a claim name fails at issuance, loudly, rather than producing credentials silently missing a field.
Adding a claim later is possible. Removing one is a breaking change for anything already verifying against it.
Format and algorithm
dc+sd-jwt and ES256 are the platform's current limits, not defaults you can override. Sending something
else returns a validation error rather than being quietly ignored.
Environment
The configuration inherits its environment from the issuer. A Sandbox key cannot attach a configuration to a Production issuer — that request reports the issuer as not found.