Issuers
An issuer is the configured, key-holding identity that signs credentials for an organisation.
List
curl -sS "$BASE/v1/issuers" -H "Authorization: ApiKey $KEY"
Scope: issuers.read.
Readiness
curl -sS "$BASE/v1/issuers/$ISSUER_ID/readiness" -H "Authorization: ApiKey $KEY"
Scope: issuers.read.
{
"data": {
"issuerId": "iss_example",
"readyForActivation": false,
"productionReady": false,
"required": [
{ "code": "identity-provider", "title": "Identity provider configured", "satisfied": true, "detail": null },
{ "code": "signing-key", "title": "Active signing key", "satisfied": false, "detail": "No active signing key." }
],
"recommended": [],
"checkedAtUtc": "2026-08-29T01:42:03.117Z"
}
}
The checklist is the point. readyForActivation alone tells you an issuer is not ready; required tells you
which requirement to act on. Use it in deployment pipelines so a failure names a specific cause.
productionReady is a stricter gate than readyForActivation and covers production-specific requirements.
Credential configurations
curl -sS "$BASE/v1/credential-configurations" -H "Authorization: ApiKey $KEY"
Scope: issuers.read. Returns the configurations you can issue against.
| Field | Notes |
|---|---|
configurationReference |
Stable internal reference |
identifier |
The value you pass as credentialConfiguration when issuing |
displayName |
Human-readable name |
credentialType |
The credential type |
status |
Only Active configurations can be issued against |
format |
e.g. dc+sd-jwt |
Not yet available
Creating issuers, managing signing keys and activating issuers are administrative operations today and are not
on /v1. Signing-key material is never exposed by any API, and a caller can never supply a key identifier
directly — that would let an API request point an issuer at a key it does not own.