Publish an Accreditation

Publishing an accreditation in the TIR is a two-phase process:

1. Generate the accreditation JWT — using the accreditation CLI.
2. Register it on the blockchain — sending the corresponding transactions to the TIR through the JSON-RPC API.

Registration is performed by an ISBE operator

In the current network operation, the blockchain registration step (phase 2) is executed by an ISBE operator. Generate the JWT with the CLI (phase 1) and send it to the ISBE team along with the domain, the subject's DID, and the credential types you want to accredit.

Prerequisites

Before generating an accreditation you need:

• A registered DID in the target environment with a P-256 key and the assertionMethod relationship. If you don't have one, first follow the guide in the DID section.
• The accreditation CLI installed: isbe-identity-accreditation-cli.
• The P-256 private key of the DID that will sign the accreditation, in JWK format.
• To accredit a TI: the URL of your TAO accreditation in the TIR (provided by ISBE).
• To accredit a TAO: the URL of your RTAO accreditation in the TIR (only applies if you are RTAO).

For initial CLI setup and the key file format, see the detailed guide in DID → Trust Chain.

Complete flow

[CLI] generate --type tao/ti  →  Accreditation JWT (eyJ...)
                                        │
                                        ▼
                               [Send to ISBE]
                                        │
                                        ▼
                          [ISBE Operator] setAttributeMetadata  →  unsigned tx
                          [ISBE Operator] setAttributeData      →  unsigned tx
                          [ISBE Operator] sign + sendSignedTransaction
                                        │
                                        ▼
                          [TIR] on-chain attribute registered
                                        │
                                        ▼
                    Public URL: <tir-url>/v1/issuers/{did}/attributes/{attributeId}

Phase 1: Generate the JWT with the CLI

RTAO accreditation

This operation is only executed by ISBE. It is documented here for completeness:

pnpm run cli generate \
  --sub did:isbe:uc:<ENTITY_DID> \
  --domain ISBE \
  --type rtao \
  --attribute "<64 RANDOM HEX CHARACTERS>" \
  --exp 2090222442

The --exp parameter is a Unix timestamp. 2090222442 corresponds to approximately January 2036.

TAO accreditation

./isbe-accreditation-cli.sh generate \
  --sub <SUBJECT_DID> \
  --domain <DOMAIN> \
  --type tao \
  --attribute "<64 RANDOM HEX CHARACTERS>" \
  --accreditedFor <CREDENTIAL_TYPE> [<CREDENTIAL_TYPE_2> ...] \
  --accreditedSchemas <SCHEMA_URL> [<SCHEMA_URL_2> ...] \
  --accreditedBy <PARENT_ACCREDITATION_URL_IN_TIR> \
  --exp <UNIX_TIMESTAMP>

Complete example:

pnpm run cli generate \
  --sub did:isbe:uc:zj4sk7oEMx1SGNAzibWxVAV \
  --domain ISBE \
  --type tao \
  --attribute "abfc5a265e1b3aa60718619c0041e3c051686fd05d0f0954679eaa756136b343" \
  --accreditedFor IsbePortalLearCredential \
  --accreditedSchemas https://raw.githubusercontent.com/alastria/isbe-identity-schemas-repository/main/use-cases/isbe/portal/lear/portalLear-schema.json \
  --accreditedBy "https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV/attributes/fad7068b8f890f20b86554be9f9d66d6b0ce08ec3b057a937e21f8a30ec545c7" \
  --exp 2090222442

TI accreditation

./isbe-accreditation-cli.sh generate \
  --sub <SUBJECT_DID> \
  --domain <DOMAIN> \
  --type ti \
  --attribute "<64 RANDOM HEX CHARACTERS>" \
  --accreditedFor <CREDENTIAL_TYPE> \
  --accreditedSchemas <SCHEMA_URL> \
  --accreditedBy <TAO_ACCREDITATION_URL_IN_TIR> \
  --exp <UNIX_TIMESTAMP>

Restrictions for a TI accreditation:

• The domain must match that of the parent TAO.
• The types and schemas in --accreditedFor / --accreditedSchemas must be a subset of those authorized by the parent TAO.

CLI parameters

Parameter	Description
--sub	DID of the accreditation subject (the entity receiving the role).
--domain	Accreditation domain (e.g. ISBE, ISBE-DEV).
--type	Type: rtao, tao, or ti.
--attribute	64 random hexadecimal characters. This value is the reservedAttributeId and the attributeId in the TIR.
--accreditedFor	One or more VC types that the accreditation enables (space-separated).
--accreditedSchemas	URLs of the schemas corresponding to --accreditedFor (1:1).
--accreditedBy	TIR URL of the parent accreditation. Not used for RTAO.
--exp	Expiry as a Unix timestamp.

CLI output

The CLI prints a JWT (starting with eyJ...). Save this JWT: it is what you must deliver to ISBE for publication on the blockchain.

Phase 2: Blockchain publication

The ISBE operator executes the three steps of the TIR JSON-RPC API:

1. Calls setAttributeMetadata with the subject's DID, the attributeId, the issuer type, and the reference to the parent accreditation.
2. Calls setAttributeData with the JWT encoded in hexadecimal.
3. Signs the resulting transactions with the operator's key and sends them with sendSignedTransaction.

Once the transactions are processed, the accreditation is accessible at:

<tir-base-url>/v1/issuers/<SUBJECT_DID>/attributes/<ATTRIBUTE_ID>

Verify the accreditation is published

Check that the accreditation is accessible via a direct GET call to the TIR:

curl "https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/did:isbe:uc:<SUBJECT_DID>/attributes/<ATTRIBUTE_ID>"

The response must include the accreditation JWT and the attribute.issuerType field with the value TI, TAO, or RTAO.

Subsequent use of the accreditation URL

Once published, your TIR accreditation URL is what must be used by:

• The accreditation CLI of entities you accredit (as --accreditedBy).
• Any verifier that needs to validate credentials you issue.