# Get a credential definition.


Returns one credential definition by id: one of your organization's own, an official one, or any other organization's (which the list does not show, and which a verification case may accept). A definition id is not a secret: it is the `vct` of every credential of its type. Use it to see a definition's claims before building a verification case: each claim's value_type decides which constraints an attribute bound to it can carry, and an enum claim's options are the values it can be restricted to. Available to any authenticated service user.

Endpoint: GET /b2b/v1/credential-definitions/{credentialDefinitionId}
Version: 1.0.0
Security: BearerAuth

## Security:

  - `BearerAuth` (unknown)
    http bearer JWT

## Path parameters:

  - `credentialDefinitionId` (string, required)

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Response 200:

  - `200` (unknown)
    Success response

## Response 200 fields (application/json):

  - `claims` (object, required)
    Claim schema: map of claim key to claim definition.

  - `credential_definition_id` (string, required)
    Credential definition UUID (use as credential_definition_id in offer requests). UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `default_validity_seconds` (integer | null, required)
    Default credential lifetime in seconds when an offer or invitation does not set one. null: credentials are issued without an expiry.

  - `description` (array, required)
    The description per language, same shape; empty when the definition has none.

  - `description.locale` (string, required)
    BCP-47 locale tag (e.g. "en", "de").

  - `description.name` (string, required)
    Localized display name for this claim.

  - `display` (array, required)
    The name per language, base language first, one entry per locale the organization wrote it in.

  - `environments` (array, required)
    Swiyu environments this credential definition is available in: "beta" and/or
"production".

  - `has_logo` (boolean, required)
    Whether this credential definition currently has an uploaded logo.

  - `is_listed` (boolean, required)
    True when the owning organization lists the definition in the catalogue: shown in other organizations' pickers. Discoverability only: any definition is read and verified by its id, listed or not.

  - `is_official` (boolean, required)
    Whether this is an official (government-issued) credential definition, such as the Swiss Beta-ID. You can verify against it but not issue it.

  - `issuers` (array, required)
    Issuer DIDs whose credentials count as this type in your API key's environment. A verification session for this definition accepts exactly these issuers; they are pinned on the definition (your organization's own DID once the environment is enabled, the Confederation's for an official definition) and cannot be set per session.

  - `issuers.did` (string, required)
    Issuer DID.

  - `issuers.name` (string | null, required)
    Display name of the issuer; null for your organization's own DID.

  - `issuers.source` (string, required)
    How the DID came to be pinned: "owner" (your organization enabled the
environment), "official" (seeded for an official definition) or "granted" (issuance granted by the definition's owner).

  - `name` (string, required)
    Human-readable credential definition name, in its base language: the first entry of display.

  - `own` (boolean, required)
    Whether this is your organization's own definition: the only kind you can issue (an offer from any other returns 404 not_found, an invitation 400 invalid_argument).

  - `validity_claim` (string | null, required)
    Key of the date claim that mirrors the credential's expiry, or null. It is derived from the lifetime: omit it when issuing.

  - `vct` (string, required)
    Verifiable credential type (vct).

## Response 400:

  - `400` (unknown)
    Invalid request. Common causes: missing or malformed X-Org-Id / X-Environment headers, or a missing required field in the request body.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401:

  - `401` (unknown)
    Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403:

  - `403` (unknown)
    Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404:

  - `404` (unknown)
    Resource not found. Either the resource ID is unknown, or the X-Org-Id you supplied is not an organization the authenticated service user is a member of.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429:

  - `429` (unknown)
    Rate limit exceeded.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500:

  - `500` (unknown)
    Internal server error.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.