Verify VP

Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.

POST /credential/verify

Verify VP

cURL

curl --request POST \
  --url https://api.example.com/credential/verify \
  --header 'Content-Type: application/json' \
  --data '
{
  "presentation": {
    "@context": [
      "https://www.w3.org/ns/credentials/v2",
      "https://via.humanos.dev/ns/v1"
    ],
    "type": [
      "VerifiablePresentation"
    ],
    "holder": "did:via:humanos:user-550e8400-e29b-41d4-a716-446655440000",
    "verifiableCredential": {
      "@context": [
        "https://www.w3.org/ns/credentials/v2",
        "https://via.humanos.dev/ns/v1"
      ],
      "id": "did:web:humanos.techcredential:uuid",
      "type": [
        "VerifiableCredential",
        "VIAMandate"
      ],
      "issuer": "did:web:humanos.tech",
      "validFrom": "2025-01-01T00:00:00Z",
      "validUntil": null,
      "credentialSubject": {
        "id": "did:web:humanostech:issuer-uuid",
        "mandate": {
          "grantor": [
            "did:web:humanos:contact:"
          ],
          "scope": "humanos.credential.request",
          "context": {
            "authorizedDIDs": [
              "did:web:humanos.tech:issuer-uuid",
              "did:web:humanos.tech:agent:uuid"
            ]
          }
        }
      },
      "evidences": [
        {
          "id": "did:web:humanos.tech::evidence:uuid",
          "digestSRI": "sha256-abc123",
          "location": "https://api.humanos.dev/evidences/did:web:humanos.tech::evidence:uuid"
        }
      ],
      "proofs": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "verificationMethod": "did:web:humanos.tech:platform:550e8400-e29b-41d4-a716-446655440000#key-1",
          "created": "2026-05-02T10:15:30.000Z",
          "proofPurpose": "assertionMethod",
          "proofValue": "z2pcVdSdoMTrkYP9rVdz..."
        }
      ]
    },
    "proof": {
      "type": "DataIntegrityProof",
      "cryptosuite": "eddsa-jcs-2022",
      "created": "2026-05-02T10:15:30.000Z",
      "verificationMethod": "did:web:humanos",
      "proofPurpose": "authentication",
      "proofValue": "z2pcVdSdoMTrkYP9rVdz..."
    }
  },
  "executionParams": {}
}
'

200

{
  "decision": "allow",
  "credentialId": "urn:via:credential:550e8400-e29b-41d4-a716-446655440000",
  "evaluations": [
    {
      "rule": "amount-cap",
      "result": "pass",
      "reason": "Expression evaluated to false"
    }
  ],
  "receipt": {
    "id": "urn:via:receipt:c4bb2c9d-9b37-448b-8f1a-4ac5793945be",
    "timestamp": "2026-05-02T10:15:30.000Z"
  }
}

Headers

API-Version · string

Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today's date.

Pattern: ^\d{4}-\d{2}-\d{2}$

Example:

"2026-03-03"

Body

application/json

presentation · object · required

Signed W3C Verifiable Presentation. Includes @context, type, holder, verifiableCredential[], and proof. Pass this object as presentation to POST /credential/verify.

Example:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://via.humanos.dev/ns/v1"
  ],
  "type": ["VerifiablePresentation"],
  "holder": "did:via:humanos:user-550e8400-e29b-41d4-a716-446655440000",
  "verifiableCredential": {
    "@context": [
      "https://www.w3.org/ns/credentials/v2",
      "https://via.humanos.dev/ns/v1"
    ],
    "id": "did:web:humanos.techcredential:uuid",
    "type": ["VerifiableCredential", "VIAMandate"],
    "issuer": "did:web:humanos.tech",
    "validFrom": "2025-01-01T00:00:00Z",
    "validUntil": null,
    "credentialSubject": {
      "id": "did:web:humanostech:issuer-uuid",
      "mandate": {
        "grantor": ["did:web:humanos:contact:"],
        "scope": "humanos.credential.request",
        "context": {
          "authorizedDIDs": [
            "did:web:humanos.tech:issuer-uuid",
            "did:web:humanos.tech:agent:uuid"
          ]
        }
      }
    },
    "evidences": [
      {
        "id": "did:web:humanos.tech::evidence:uuid",
        "digestSRI": "sha256-abc123",
        "location": "https://api.humanos.dev/evidences/did:web:humanos.tech::evidence:uuid"
      }
    ],
    "proofs": [
      {
        "type": "DataIntegrityProof",
        "cryptosuite": "eddsa-jcs-2022",
        "verificationMethod": "did:web:humanos.tech:platform:550e8400-e29b-41d4-a716-446655440000#key-1",
        "created": "2026-05-02T10:15:30.000Z",
        "proofPurpose": "assertionMethod",
        "proofValue": "z2pcVdSdoMTrkYP9rVdz..."
      }
    ]
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "created": "2026-05-02T10:15:30.000Z",
    "verificationMethod": "did:web:humanos",
    "proofPurpose": "authentication",
    "proofValue": "z2pcVdSdoMTrkYP9rVdz..."
  }
}

executionParams · object

Params the agent intends to supply when invoking the action. Validated against the action's declared executionParams shape and exposed to CEL rules as executionParams.<field>.

Response

200

application/json

Verification allowed — decision + receipt.

decision · enum<string> · required

Available options: allow

Example:

"allow"

credentialId · string · required

URN of the verified credential.

Example:

"urn:via:credential:550e8400-e29b-41d4-a716-446655440000"

evaluations · object[] · required

Per-rule evaluation results. Empty when the mandate has no action rules.

Show child attributes

receipt · object · required

VERIFICATION_APPROVED receipt issued for this verification.

Show child attributes