---
title: "List issued credentials"
method: GET
path: "/v1/credentials"
tags: ["Credentials"]
---

# List issued credentials

`GET /v1/credentials`

List every credential issued by the authenticated tenant, newest first. Each item is a management-view of an issued credential — its type, issuer, lifecycle status, status-list index, validity timestamps, holder key-binding, and the source session it was bridged from. The raw SD-JWT is not included (it is delivered only once at issuance). Scoped to the tenant derived from the API key. Requires Authorization: Bearer <tenant API key>.

## Response `200`

Array of the tenant's issued credentials, ordered by issuance time descending.

- object
  - `items` object[] — The issued-credential management records owned by this tenant.
    - `uuid` string, uuid — Unique identifier of the issued credential (the credential_id returned at issuance). Use it with the detail and lifecycle endpoints.
    - `vct` string — Verifiable Credential Type of the issued credential.
    - `iss` string — Issuer identifier (the https iss URL) of the tenant that issued the credential.
    - `status` 'issued' | 'suspended' | 'revoked' | 'expired' — Lifecycle status of the credential. `issued` is valid and verifiable; `suspended` is temporarily disabled (reversible via reactivate); `revoked` is permanently invalidated; `expired` is past its expires_at.
    - `status_idx` integer, nullable — Index of this credential in the tenant's IETF Token Status List, where its revocation/suspension bit lives. Null for non-revocable credentials.
    - `issued_at` string, date-time — ISO 8601 timestamp when the credential was issued.
    - `expires_at` string, date-time, nullable — ISO 8601 timestamp when the credential expires (issuance time plus the template's validity_seconds). Null if the credential has no expiry.
    - `holder_cnf` object — The holder key-binding confirmation (cnf) object — typically the holder's public JWK under a `jwk` key — that binds the credential to its holder, derived from the holder_jwk supplied at issuance.
    - `source_session_id` string — Identifier of the Didit verification session this credential was bridged from, or an empty string if none was supplied at issuance.

## Changes

- **2026-06-30** `1ee4908e9af4` — 1 info
  - added the media type `application/json` for the response with the status `200`

[Change history](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/changes/v1/credentials/get.md)

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/1ee4908e9af4/schema)