VC Platform API (0.2.0)

Creates the org and adds the caller as its first admin member, in one transaction. No RLS exemption needed: the org id is generated app-side and the tenant context is set to it before the insert.

Pre-tenant lookup via the list_user_memberships() database function — runs before any org context exists.

Any member may list. A non-member gets the same 403 as a nonexistent org id — the membership check doubles as the tenant-existence check.

Admin-only. Upserts the invited user by email, then adds the membership.

Admin-only. Refuses to demote the last remaining admin.

Admin-only. Refuses to remove the last remaining admin.

Admin-only. The plaintext secret is returned exactly once in this response — only its SHA-256 hash is persisted. There is no way to retrieve it again after this call.

Any member may list. Never includes the secret or its hash.

Admin-only. Idempotent — revoking an already-revoked key returns 204 without recording a second audit event.

Admin-only. claimsSchema is stored but not yet enforced against subjectClaims at issuance time. formats declares which wire formats this template may be rendered in — declaring an unimplemented format (e.g. mso_mdoc) is allowed as intent, but requesting it at issuance fails with 400, not at creation time. The same applies to statusMechanism: bitstring-status-list is implemented, token-status-list is declarable but rejected at issuance.

Any member may list.

Any member may read. A nonexistent or foreign-org template id gets 404 — same no-leak pattern as everywhere else org-scoped.

API-key-authenticated (issue scope), not DevUserAuth — there is deliberately no {orgId} in this path; the API key itself is the tenant selector, the same way a Stripe key implies your account.

The org's Ed25519 signing key is provisioned lazily on first issuance (one key per org for Phase 0) and reused after. The platform constructs and encodes the JWS header/payload itself and sends only opaque signing-input bytes to the isolated signing service — it never sees credential content, and the platform never sees the private key (Architecture §5).

API-key-authenticated (verify scope). Signature verification never calls the signing service — the issuer identifier is a did:jwk, which embeds the public key directly, so resolving it is pure decoding, not a network round trip. Always returns 201 with a verified boolean and an errors array, whether the credential is valid or not — a malformed or invalid credential is a successful API call that reports failure, not an HTTP error. Audited either way (PRD §5.8's "pass/fail + reason").

Credentials carrying a credentialStatus entry additionally get a revocation check after signature verification, and it fails closed: a flipped bit yields revoked, and a status list that cannot be fetched or signature-verified yields status_unavailable — both are verification failures, since "could not determine revocation state" must not read as "valid". The platform's own lists are read locally; third-party lists are fetched over HTTP and signature-verified before a single bit is trusted.

API-key-authenticated (issue scope — the key that may create an org's credentials is the one that may end them; a verify-only key can do neither). Flips the credential's bit on its status list and stamps revokedAt, in one transaction, audited as credential.revoked. Idempotent: revoking an already-revoked credential returns the original revocation without a second audit event. Only credentials whose template declared a statusMechanism can be revoked — anything else can only expire.

Readable by admin and auditor members — the auditor role is the PRD §4 compliance persona, and this endpoint is what it exists for. Newest-first, offset-paginated; hasMore is computed by fetching one extra row, not by counting an append-only table. Rows are immutable at the database layer (the app role has no UPDATE/DELETE grants on audit_events).

Starts the OpenID4VCI pre-authorized code flow: the org's backend (API key, issue scope) states what to issue; the response's credentialOffer URI goes to the holder as a QR code / deep link, and their wallet drives the rest against the wallet-facing endpoints (see the OpenID4VCI tag). The offer expires after expiresIn seconds, the pre-authorized code is single-use, and the credential is bound to the wallet's proof-of-possession key (cnf) at the credential endpoint — subject claims are fixed here, at offer time.

Starts an OpenID4VP exchange (API key, verify scope): names the credential type being asked for (by template) and optionally which claims the wallet should disclose. Poll the returned id for the outcome; the request expires after expiresIn seconds.