# Get verification session.


Returns the current status and outcome of a session started via POST /b2b/v1/verification-sessions.

Endpoint: GET /b2b/v1/verification-sessions/{sessionId}
Version: 1.0.0
Security: BearerAuth

## Path parameters:

  - `sessionId` (string, required)

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Response 200 fields (application/json):

  - `accepted_issuer_dids` (array)
    Effective issuer allow-list for this session (may come from credential
definition locks).

  - `completed_at` (string)
    Set when the session leaves pending (success, failed, or expired).

  - `created_at` (string, required)
    When the session was created (RFC3339).

  - `credential_definition` (object, required)
    Credential definition reference.

  - `credential_definition.has_logo` (boolean, required)
    Whether the credential definition currently has an uploaded logo.

  - `credential_definition.id` (string, required)
    Credential definition UUID. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `credential_definition.name` (string, required)
    Human-readable credential definition name.

  - `credential_definition.vct` (string, required)
    Verifiable credential type (e.g. "urn:ietf:params:oauth:vct:PersonId").

  - `credential_status` (string)
    On success: the token-status-list state of the credential the holder presented — "valid", "suspended" (shown as "Locked" in the portal), or "revoked". Resolved when the holder presented and never recomputed.
A "suspended" or "revoked" value still accompanies a successful verification with its disclosed claims: the wallet can present such a credential and the holder can consent to sharing it, so the verifier is given the state and applies its own policy. Branch on this in addition to `status` if a locked credential should not be accepted.

  - `credential_subject_data` (object)
    On success: disclosed subject claims (structure depends on credential definition
and wallet).

  - `deeplink` (string)
    Only when status is pending: wallet deep link (e.g. openid4vp://...).

  - `environment` (string, required)
    Swiyu environment: "beta" or "production" (matches the credential binding).

  - `error_code` (string)
    Machine-readable failure reason when status is failed or expired.

  - `error_description` (string)
    Human-readable error detail when status is failed or expired.

  - `expires_at` (string, required)
    When a pending session expires if not completed (RFC3339).

  - `matched_vct` (string)
    On success: the vct of the credential the holder actually presented, relevant when the session accepts more than one credential type.

  - `purpose` (string)
    Purpose string from the create request, if any.

  - `qr_content_base64` (string)
    Only when status is pending: Base64 PNG QR code for the wallet.

  - `reference_id` (string)
    Your reference_id from the create request, if any.

  - `requested_fields` (array, required)
    Claim keys requested in the presentation definition.

  - `session_id` (string, required)
    Session id (matches the value returned at creation time). UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `status` (string, required)
    Current lifecycle state of the session.
    Enum: "pending", "success", "failed", "expired"

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.