# Update issued credential status (revoke, suspend, reactivate).


Endpoint: PATCH /b2b/v1/issued-credentials/{credentialId}/status
Version: 1.0.0
Security: BearerAuth

## Security:

  - `BearerAuth` (unknown)
    http bearer JWT

## Path parameters:

  - `credentialId` (string, required)

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Request fields (application/json):

  - `status` (string, required)
    New status for the credential. One of: "active", "suspended", "revoked".
Valid transitions: active ↔ suspended, active/suspended → revoked (terminal).
    Enum: "active", "suspended", "revoked"

## Response 200:

  - `200` (unknown)
    Success response

## Response 200 fields (application/json):

  - `archived_at` (string)
    When an operator put this credential away in the portal's archive, if they did. The archive is a filing decision in the portal's lists and changes nothing about the credential or what this API will do with it — only a revoked credential can be archived at all.

  - `claims` (object)
    Credential claim values.

  - `created_at` (string, required)
    When the credential record was created (RFC3339).

  - `credential_definition` (object, required)
    Credential definition reference.

  - `credential_definition.has_logo` (boolean, required)
    Whether the credential definition currently has an uploaded logo.

  - `credential_definition.id` (string, required)
    Credential definition UUID. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `credential_definition.name` (string, required)
    Human-readable credential definition name.

  - `credential_definition.vct` (string, required)
    Verifiable credential type (e.g. "urn:ietf:params:oauth:vct:PersonId").

  - `environment` (string, required)
    Swiyu environment: "beta" or "production".

  - `holder_did` (string)
    DID of the wallet holder, if known.

  - `id` (string, required)
    Issued credential id. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `offer_id` (string, required)
    ID of the offer that produced this credential. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `reference_id` (string)
    Your reference_id from the originating offer, if any.

  - `status` (string, required)
    Credential lifecycle status: "active", "suspended", or "revoked".
    Enum: "active", "suspended", "revoked"

  - `status_updated_at` (string)
    When the status was last changed (RFC3339).

  - `updated_at` (string, required)
    When the credential record was last updated (RFC3339).

  - `valid_from` (string, required)
    SD-JWT nbf — when the credential becomes valid (mirror of iat).

  - `valid_until` (string)
    SD-JWT exp — when the credential stops being valid. Absent when the credential was issued without an exp claim (never expires).

## Response 400:

  - `400` (unknown)
    Invalid request. Either the body or headers were malformed (`invalid_argument`), or the requested status change is not allowed (`failed_precondition`): the credential is already in the requested status, the transition is illegal (e.g. leaving the terminal `revoked` state), or the status was changed concurrently. Setting a credential to its current status is not idempotent — it returns this error.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401:

  - `401` (unknown)
    Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403:

  - `403` (unknown)
    Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404:

  - `404` (unknown)
    Resource not found. Either the resource ID is unknown, or the X-Org-Id you supplied is not an organization the authenticated service user is a member of.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429:

  - `429` (unknown)
    Rate limit exceeded.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500:

  - `500` (unknown)
    Internal server error.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 400 examples:

  - `Malformed request` (unknown)

  - `Illegal or no-op transition` (unknown)