Public verification API

Verify VeriCert credentials from your own systems, or resolve issuer keys and revocation lists to verify them independently. Base URL: https://vericert.demodomain.site

Try it in the browser

No API key

The verification endpoints are public and need no sign-in. Most send CORS headers for any origin.

Rate limited

30 requests per minute per IP across the verification endpoints. Above that, 429 with a Retry-After header.

Private by design

The registry never returns holder data. Verifications are counted with only the credential ID and outcome.

Endpoints

GET/api/v1/verify/{credentialId}

Look a credential up by its ID: status, issuer and metadata from the registry.

Returns a verification result with mode: "lookup". The signature is not checked, because no signed document is sent.
Responds 404 when the ID is unknown. The body still has status: "not_found".
Never returns holder data.

curl https://vericert.demodomain.site/api/v1/verify/<credential-id>

POST/api/v1/verify

Full verification of a signed credential (compact vc+jwt).

JSON body { "jwt": "<compact JWT>" }, up to 64 KB. Responds 400 for a malformed body and 413 for one that is too large.
Checks the issuer DID, the ES256 signature, the issuer's approval, the registered fingerprint, revocation and expiry.
The result includes the holder's name and date of birth from the JWT you sent, and only when the signature is valid.

curl -X POST https://vericert.demodomain.site/api/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"jwt":"<compact JWT>"}'

POST/api/v1/verify/receipt

Re-verifies a credential on the server and returns a PDF verification receipt.

Body { "jwt": "…" } includes the holder on the receipt. Body { "credentialId": "…", "sha256": "<hex>" } checks the registered fingerprint and leaves the holder off.
Responds with application/pdf. No CORS headers, so call it from a server, not from another site's browser code.

curl -X POST https://vericert.demodomain.site/api/v1/verify/receipt \
  -H "Content-Type: application/json" \
  -d '{"jwt":"<compact JWT>"}' -o receipt.pdf

GET/api/v1/registry?credentialId=&did=&sha256=

What an in-browser verifier needs: the registry record and the issuer record.

The record holds metadata and the registered SHA-256 of the signed credential, never holder data.
With sha256 (of the JWT you hold), the server judges the outcome from the registry and counts it as a verification. This is how the PDF and JWT checks on this site work without uploading the document.

curl "https://vericert.demodomain.site/api/v1/registry?credentialId=<credential-id>"

GET/issuers/{slug}/did.json

The issuer's did:web DID document with its public signing keys.

The DID did:web:<host>:issuers:<slug> resolves to this URL. Content type application/did+json, cached for 5 minutes.

curl https://vericert.demodomain.site/issuers/<issuer-slug>/did.json

GET/issuers/{slug}/status/{list}

The issuer's signed revocation list (BitstringStatusListCredential).

Returned as application/vc+jwt, cached for 60 seconds. A credential's credentialStatus names the list and its index.

curl https://vericert.demodomain.site/issuers/<issuer-slug>/status/1

Result status

Verification endpoints return status, a boolean valid and the individual checks.

valid: Every check passed.
invalid: The DID, signature, fingerprint or issuer check failed (for example, the document was altered).
revoked: The issuer revoked the credential in its signed status list.
expired: The credential is past its validity period.
issuer_suspended: The issuing institution is suspended on the platform.
not_found: No credential with this ID is registered.

Checks

Each check has an id, a state (pass, fail or skipped) and a human-readable detail.

did: Issuer DID resolved to a public key
signature: Digital signature (ES256) is valid
issuer: Issuer is an approved institution
hash: Credential matches the issuer's registered record
revocation: Credential has not been revoked
expiry: Credential is within its validity period
seal: Holder name sealed by the issuer
document: The PDF shows exactly what the issuer signed