Revocation

Revocation allows you to invalidate previously issued credentials so they can no longer be used. Paradym supports credential revocation for SD-JWT VC, mDoc, and AnonCreds credentials.

Overview

Revocation in Paradym works in two steps:

1. Enable revocation on a credential template — set the revocable flag to true when creating the template. This cannot be changed after the template is created.
2. Revoke issued credentials — use the batch revoke API to revoke one or more issued credentials by their issued credential ID.

Paradym hosts the revocation status lists so that any verifier, including third-party verifiers outside of Paradym, can check whether a credential has been revoked. When using Paradym as your verifier, revocation status is checked automatically during verification for all supported credential formats, with no additional setup required.

Enable Revocation on a Credential Template

To issue revocable credentials, you must enable the revocable flag when creating the credential template.

Revocation is supported for the following formats:

• SD-JWT VC — uses the OAuth Status List standard (JWT-based)
• mDoc — uses the OAuth Status List standard (CWT-based)
• AnonCreds — uses Hyperledger AnonCreds revocation registries

See Standards and Protocols for links to the underlying specifications.

{
  "name": "My Revocable SD-JWT VC Template",
  "type": "UniversityCard",
  "revocable": true,
  "attributes": {
    "first_name": {
      "type": "string",
      "name": "First Name",
      "required": true
    }
  }
}

{
  "name": "My Revocable mDoc Template",
  "type": "org.example.UniversityDoc",
  "revocable": true,
  "attributes": {
    "org.example.UniversityDoc": {
      "first_name": {
        "type": "string",
        "name": "First Name",
        "required": true
      }
    }
  }
}

{
  "name": "My Revocable AnonCreds Template",
  "revocable": true,
  "attributes": {
    "first_name": {
      "type": "string",
      "name": "First Name"
    }
  }
}

Revoke Credentials

Use the batch revoke endpoint to revoke one or more issued credentials. You can revoke credentials from different templates and formats in a single request, with a limit of 100 credentials per call.

Each revocation uses one transaction.

{
  "issuedCredentialIds": [
    "clu921ps300047eghxvhz33m4",
    "clv168twg000227kynam8v96w"
  ],
  "notifyWallet": false
}

{
  "revokedCredentials": [
    {
      "id": "clu921ps300047eghxvhz33m4",
      "notifiedWallet": false
    },
    {
      "id": "clv168twg000227kynam8v96w",
      "notifiedWallet": false
    }
  ]
}

Revocation During Verification

Paradym hosts the revocation status lists publicly, so any standards-compliant verifier can check revocation status independently. When using Paradym as your verifier, revocation status is checked automatically for all supported credential formats — no extra configuration is needed:

• SD-JWT VC — revocation status is checked against the OAuth Status List referenced in the credential.
• mDoc — revocation status is checked against the OAuth Status List referenced in the credential.
• AnonCreds — revocation status is checked against the AnonCreds revocation registry.

If a revoked credential is presented during a Paradym verification, the verification will fail and the event openid4vc.verification.failed or didcomm.verification.failed will be emitted. Learn more about handling verification results in verify credentials.

Important Notes

• Only credentials issued from a template with revocable: true can be revoked. Attempting to revoke a non-revocable credential returns an error.
• A credential that has already been revoked cannot be revoked again.
• The revocable flag on a credential template cannot be changed after the template is created.