Token Status List
Revocation for the EuPid uses an IETF Token Status List: a signed, compressed bit array hosted at a public URL. Each issued SD-JWT carries a status claim pointing at the list URI and an index in the array. Management schemas are in the Status List Management API reference; the public surface in the Status List Hosting API reference.
Create the list
The correlation id is the stable business identifier: issuance references it, and the hosted URL embeds it. Indexes are allocated randomly when credentials are issued, never sequentially, so the list does not leak issuance volume or order:
- Overview
- Request
- Response
Create token status list
Endpoint: POST /statuslists
Captured response: Response capture pending the next QA-gate run.
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The hosted token
Verifiers dereference the status list URI from the credential's status claim. The hosting surface is public, unauthenticated, and cacheable:
- Overview
- Request
- Response
Fetch hosted status list token
Endpoint: GET /public/statuslists/eupid-revocation
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Updating status
A status update sets the bit at an index. The read side exposes only the bit value: whether an index has been allocated to a credential is intentionally not observable, because an unallocated index is indistinguishable from a valid one:
- Overview
- Request
- Response
Revoke a status entry
Endpoint: POST /api/statuslist/v1/statuslists/00000000-0000-4000-8000-000000000000/status
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Reactivate the status entry
Endpoint: POST /api/statuslist/v1/statuslists/00000000-0000-4000-8000-000000000000/status
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
With designs and the status list in place, issue the credentials.