Credential Issuer API

Base URL:

Environment	URL
Production	https://identity-credentials-issuer.pro.cloud-w.envs.redisbe.com
Pre-production	https://identity-credentials-issuer.pre.cloud-w.envs.redisbe.com

Interactive documentation (Swagger): GET <base-url>/swagger

Operation endpoints

GET /health

Returns the service health status.

Authentication: none.

Response 200 OK:

{
  "status": "ok"
}

---

POST /issuance/representative

Requests the issuance of an IsbePortalLearCredential for the authenticated representative themselves. Returns a QR code (PNG image) that the representative must scan with their wallet.

Authentication: Authorization: Bearer <keycloak_token>

The token must include the claims organization_identifier, organization, user_identifier, and email.

Body (JSON):

{
  "power": [
    {
      "type": "domain",
      "domain": "ISBE",
      "function": "onboarding",
      "action": ["execute"]
    }
  ]
}

Field	Type	Mandatory	Description
power	array	✅	List of powers to include in the credential. Each element must be authorized for the applicant's organization.
power[].type	string	✅	Power type (e.g. "domain").
power[].domain	string	✅	Domain to which the power applies (e.g. "ISBE").
power[].function	string	✅	Function within the domain (e.g. "onboarding").
power[].action	array of string	✅	Allowed actions (e.g. ["execute"]). At least one element.

Response 200 OK:

Content-Type: image/png
<binary PNG of the QR code>

Errors:

Code	Cause
401 Unauthorized	Invalid or expired Keycloak token.
400 Bad Request	Missing claims in the token, or requested powers not authorized for the organization.
500 Internal Server Error	Internal error (VC type not configured, Connector profile not configured, error contacting the Connector).

---

POST /issuance/employee

Requests the issuance of an IsbePortalLearCredential for an employee of the organization. The credential offer QR is sent by email to the employee; the HTTP response confirms the send.

Authentication: Authorization: Bearer <keycloak_token>

Body (JSON):

{
  "email": "empleado@empresa.es",
  "power": [
    {
      "type": "domain",
      "domain": "ISBE",
      "function": "onboarding",
      "action": ["execute"]
    }
  ]
}

Field	Type	Mandatory	Description
email	string	✅	Destination employee's email.
power	array	✅	List of powers to include in the employee's credential.

Response 200 OK:

{
  "message": "Email sent to empleado@empresa.es"
}

Errors: same as POST /issuance/representative.

---

POST /issuance/identifiers

Returns the vc_types for which the indicated subject_id has issuance permissions according to the Issuer configuration.

Authentication: Authorization: Bearer <keycloak_token>

Body (JSON):

{
  "subject_id": "ES-B12345678_20260115120000"
}

Response 200 OK:

{
  "vc_types": ["IsbePortalLearCredential"]
}

---

POST /issuance/credential

Retrieves the list of issued credentials for one or more organizations.

Authentication: Authorization: Bearer <keycloak_token>

Body (JSON):

{
  "organization_identifiers": ["ES-B12345678", "ES-A87654321"]
}

Response 200 OK: array of IssuedCredential objects with the fields: id, vc_type, subject_id, organization_identifier, status, credential_id, creation_at, update_at.

---

POST /issuance/credential/revoke

Revokes a previously issued credential. Revocation is permanent.

Authentication: Authorization: Bearer <keycloak_token>

Body (JSON):

{
  "credential_id": "urn:uuid:8d475485-1617-42f3-b402-9c95117ad72b"
}

Response 200 OK: revocation confirmation.

Errors:

Code	Cause
404 Not Found	The credential_id does not exist in the Issuer database.
400 Bad Request	The credential was already revoked.
500 Internal Server Error	Internal error processing the revocation.