OZozav
Customers

Issue a portable verification credential for an approved customer

Returns a portable credential signed by OZAV that attests what OZAV verified about this customer, when, and how - as an IETF SD-JWT (vc+sd-jwt, ES256). Hand it to the end user: they can present it to any third party and choose which attributes to disclose (for example over_18 without cpf). Any verifier checks it offline against the public key at jwks_url and confirms it is still in force at status_url.

Selectively disclosable claims: cpf, full_name, birth_date, over_18, kyc_level (3 = hosted session with document, liveness and face match; 2 = document-based identification), method, verified_at, screening. The JWT body itself carries no personal data - only salted digests - so the credential leaks nothing the holder does not disclose.

Each call issues a new credential (new id). Earlier ones stay in force until they expire or the customer's status changes: a credential is reported revoked at status_url as soon as the customer is no longer approved, is frozen, or is re-verified. There is no revocation step for you to call. Issuance is capped per customer per day (429 CREDENTIAL_ISSUANCE_LIMIT_REACHED past the cap): keep the credential you received rather than requesting one per use.

Individual customers identified by a Brazilian CPF only. Not issued in the sandbox environment. Availability is enabled per organization by OZAV; until then the call returns 422 FEATURE_NOT_AVAILABLE.

get/customers/{customer_id}/credential

Request

  • Base URL
    https://developers.ozav.io/v2
  • Auth
    • API key in header X-API-Key
    • or HTTP bearer

Response

A freshly issued credential.

idstring required

Opaque credential id (the JWT jti).

object'credential' required

Resource type discriminator; always the literal credential.

customer_idstring required

The customer this credential attests.

format'vc+sd-jwt' required

Always vc+sd-jwt - an IETF SD-JWT with selectively disclosable claims.

credentialstring required

The compact SD-JWT, <jwt>~<disclosure>~...~. Hand it to the end user; do not store it as personal data - the disclosures carry the CPF, name and birth date in clear.

kyc_level2 | 3 required

3 = hosted session (document, liveness, face match); 2 = document-based identification (reliance or manual review).

method'hosted_session' | 'reliance' | 'manual_review' required

How OZAV verified the customer.

issued_atstring date-time required

When this credential was issued (RFC 3339, UTC).

expires_atstring date-time required

When this credential stops being valid regardless of the customer's status.

jwks_urlstring uri required

Where OZAV publishes the signing keys (JWKS, kid-addressed). Public; no API key.

status_urlstring uri required

Public status of this credential, valid | revoked | expired | unknown. No API key; no personal data.

Example response

{
  "id": "ozav_vc_Q2xhdWRlRmFibGU1MQ"
}

Changes

No recorded changes to this operation across all 1 revision of this API.