# List credential definitions.


Returns the credential definitions of the calling service user's organization (X-Org-Id) in its environment (X-Environment), plus the official definitions every organization can verify against. Issue only from your own: an official definition is listed so you can find its id for a verification session, and creating an offer or an invitation from one returns 404. Available to any authenticated service user — no specific scope is required.

Endpoint: GET /b2b/v1/credential-definitions
Version: 1.0.0
Security: BearerAuth

## Security:

  - `BearerAuth` (unknown)
    http bearer JWT

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Response 200:

  - `200` (unknown)
    Success response

## Response 200 fields (application/json):

  - `credential_definitions` (array, required)
    Credential definitions available to the calling organization.

  - `credential_definitions.claims` (object, required)
    Claim schema: map of claim key to claim definition.

  - `credential_definitions.credential_definition_id` (string, required)
    Credential definition UUID (use as credential_definition_id in offer requests). UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `credential_definitions.default_validity_seconds` (integer | null, required)
    Default credential lifetime in seconds when an offer or invitation does not set one. null: credentials are issued without an expiry.

  - `credential_definitions.description` (array, required)
    The description per language, same shape; empty when the definition has none.

  - `credential_definitions.description.locale` (string, required)
    BCP-47 locale tag (e.g. "en", "de").

  - `credential_definitions.description.name` (string, required)
    Localized display name for this claim.

  - `credential_definitions.display` (array, required)
    The name per language, base language first, one entry per locale the organization wrote it in.

  - `credential_definitions.environments` (array, required)
    Swiyu environments this credential definition is available in: "beta" and/or
"production".

  - `credential_definitions.has_logo` (boolean, required)
    Whether this credential definition currently has an uploaded logo.

  - `credential_definitions.is_listed` (boolean, required)
    True when the owning organization lists the definition in the catalogue: shown in other organizations' pickers. Discoverability only: any definition is read and verified by its id, listed or not.

  - `credential_definitions.is_official` (boolean, required)
    Whether this is an official (government-issued) credential definition, such as the Swiss Beta-ID. You can verify against it but not issue it.

  - `credential_definitions.issuers` (array, required)
    Issuer DIDs whose credentials count as this type in your API key's environment. A verification session for this definition accepts exactly these issuers; they are pinned on the definition (your organization's own DID once the environment is enabled, the Confederation's for an official definition) and cannot be set per session.

  - `credential_definitions.issuers.did` (string, required)
    Issuer DID.

  - `credential_definitions.issuers.name` (string | null, required)
    Display name of the issuer; null for your organization's own DID.

  - `credential_definitions.issuers.source` (string, required)
    How the DID came to be pinned: "owner" (your organization enabled the
environment), "official" (seeded for an official definition) or "granted" (issuance granted by the definition's owner).

  - `credential_definitions.name` (string, required)
    Human-readable credential definition name, in its base language: the first entry of display.

  - `credential_definitions.own` (boolean, required)
    Whether this is your organization's own definition: the only kind you can issue (an offer from any other returns 404 not_found, an invitation 400 invalid_argument).

  - `credential_definitions.validity_claim` (string | null, required)
    Key of the date claim that mirrors the credential's expiry, or null. It is derived from the lifetime: omit it when issuing.

  - `credential_definitions.vct` (string, required)
    Verifiable credential type (vct).

  - `total` (integer, required)
    Total number of credential definitions returned.

## Response 400:

  - `400` (unknown)
    Invalid request. Common causes: missing or malformed X-Org-Id / X-Environment headers, or a missing required field in the request body.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401:

  - `401` (unknown)
    Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403:

  - `403` (unknown)
    Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429:

  - `429` (unknown)
    Rate limit exceeded.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500:

  - `500` (unknown)
    Internal server error.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.