Status Lists: Lists
Catalog id: resource.statuslists.lists
A status list is how a credential is revoked after it has been issued. The credential carries a pointer to a public URI and an index within it, and a verifier reads the bit at that index to decide whether the credential still counts. The list itself is a signed token, so a verifier can trust what it reads without calling your API.
That split matters when you use this page. Managing lists and entries needs a tenant token, while the hosted token verifiers actually fetch is public and unauthenticated. Both appear below.
Audience: tenant administrator.
Guide: Status lists and revocation.
Sizing and signing are decided once
length is the number of entries the list can ever hold and bitsPerStatus is how many bits each
entry gets. One bit expresses revoked or not revoked, and suspension needs more, so a list created
with one bit cannot later carry suspension. Neither value can change afterwards because both are
baked into the signed token's encoding, so size for the issuance volume you expect rather than for
today.
signingKeyMode decides how a verifier finds the key that signed the token. With did:web the
issuer is a DID and the token names a verification method. With x5c the issuer is an HTTPS origin
and the certificate chain travels inside the token. Both work, and the choice usually follows
whatever the credentials referencing this list already use.
correlationId is the durable business key. It appears in the public URI, so anyone reading a
credential can see it, and reusing one within a tenant is refused with
STATUSLIST_DUPLICATE_CORRELATION_ID.
Working with a list
- Admin Console
- Request
- Response
- Try it
Resources > Status Lists > Lists shows every list with its specification, purposes, proof format, hosting mode and remaining capacity. Provisioning seeds a list for a newly onboarded tenant, so expect at least one to exist before you create anything.
- Admin Console
- Request
- Response
- Try it
Creating returns the list together with its first signed token, which is why the response carries
both statusListUri and signedToken. Copy statusListUri into the credential configuration that
will reference it, because that URI is what ends up inside issued credentials.
This example uses x5c signing with an HTTPS issuer. A did:web list differs only in
signingKeyMode and in naming a verification method instead of carrying a chain.
- Admin Console
- Request
- Response
- Try it
The detail view carries identity, capacity, public URI and publisher metadata, plus the current signed token and its content type. Operators use the token here for debugging. Verifiers should fetch the public URI instead, since that is the copy with caching and availability behind it.
- Admin Console
- Request
- Response
- Try it
This request carries no authentication, which is the point. Any verifier holding a credential can resolve its status without an account on your system, and what you see here is exactly what a verifier parses.
Revoke an entry
POST/api/statuslist/v1/statuslists/00000000-0000-4000-8000-000000000000/status200 OK- Admin Console
- Request
- Response
- Try it
Revocation writes a value at an index. The request names statusListIndex and the value to set,
and the response echoes the entry with its purpose. Nothing about the credential itself changes:
it still exists and still verifies cryptographically, and only the bit it points at has moved.
Read the entry back
GET/api/statuslist/v1/statuslists/00000000-0000-4000-8000-000000000000/entries/42200 OK- Admin Console
- Request
- Response
- Try it
Reading an entry returns its current value and purpose. Use it to confirm a change landed before
telling anyone a credential is revoked, remembering that verifiers read the published token rather
than this endpoint.
- Admin Console
- Request
- Response
- Try it
Setting the value back clears the revocation. Whether that is appropriate is a policy question rather than a technical one, because a verifier that cached the earlier token may keep treating the credential as revoked until that cache expires.
Full schema: Status list management, hosting.