Verify API reference

The verify API is a public, unauthenticated endpoint that checks a credential's signature, revocation status, and validity.

POST https://vci.inflowra.com/verify/
Content-Type: application/json

Request

Field	Type	Description
credential	string	The credential to verify — a compact JWT string or a serialized JSON-LD document.

{ "credential": "eyJhbGciOiJFZERTQSIs..." }

Response — 200 OK

Returned for every recognizable credential, valid or not. The result is in data:

Field	Type	Description
data.valid	boolean	Overall verdict — signature, revocation, and validity window all pass.
data.reason	string	Human-readable explanation of the verdict.
data.signature.verification_method	string	DID URL of the key the signature was checked against (e.g. did:web:vci.inflowra.com#key-1).
data.revocation.checked	boolean	Whether the issuer's status list was consulted.
data.revocation.flagged	boolean	Whether the credential is revoked.
data.metadata.issuer	string	Issuer DID.
data.metadata.type	string | string[]	Credential type(s).
data.metadata.subject	object	Credential subject (DID and disclosed claims).
data.metadata.valid_from	string	ISO 8601 start of validity.
data.metadata.schema	string	Schema the credential was issued against.

Example — a revoked credential (note: still 200):

{
  "data": {
    "valid": false,
    "reason": "Credential has been revoked by the issuer.",
    "signature": { "verification_method": "did:web:vci.inflowra.com#key-1" },
    "revocation": { "checked": true, "flagged": true },
    "metadata": {
      "issuer": "did:web:vci.inflowra.com",
      "type": ["VerifiableCredential", "CertificationCredential"],
      "subject": { "id": "did:key:z6MktGy4b..." },
      "valid_from": "2025-06-01T00:00:00Z",
      "schema": "https://vci.inflowra.com/schemas/certification-v1"
    }
  }
}

Response — 400 Bad Request

Returned only when the input is not a recognizable credential at all (not parseable as a JWT or a JSON-LD document). An invalid signature or a revoked credential is not a 400 — those are 200 with data.valid: false.

CORS

Browser calls are restricted to allowlisted origins. If you are building a frontend against this API, its origin must be allowlisted first — otherwise the browser blocks the request before it reaches the API.

TODO: confirm — process for requesting an origin allowlist entry.

Rate limits

TODO: confirm — rate limits for unauthenticated verify calls.