Credentials API Reference
The ISBE credential system exposes two distinct APIs:
| Service | Base URL (PRO) | Purpose |
|---|---|---|
| Credential Issuer | https://identity-credentials-issuer.pro.cloud-w.envs.redisbe.com | Issue, query, and revoke VCs for employees and representatives. |
| Credential IDP | https://identity-credentials-idp.pro.cloud-w.envs.redisbe.com | Authenticate users in ISBE portals via VC presentation (federated OIDC). |
Both services are implemented in Django and expose interactive Swagger/OpenAPI documentation at GET /swagger.
Service interaction diagram
The following diagram shows the complete issuance and use sequence of an IsbePortalLearCredential, from the initial request to portal authentication.
API authentication
Credential Issuer
Most Issuer endpoints require a Keycloak Bearer token:
Authorization: Bearer <access_token_keycloak>
The Issuer verifies the token signature against the Keycloak JWKS configured in KEYCLOAK_JWKS_URI.
Internal integration endpoints are protected with an API Key:
x-api-key: <INTERNAL_API_KEY>
Credential IDP
Internal integration endpoints are protected with an API Key:
x-api-key: <CONNECTOR_API_KEY>
The standard OIDC endpoints (/accounts/*, /.well-known/openid-configuration) are public or protected by the OAuth2 flow itself.
The admin panel (/admin/) requires Django admin user authentication.
Monitoring
Both services expose Prometheus metrics at:
GET /metrics
The /metrics endpoint is public (no authentication required). The metrics namespace is configurable via the PROMETHEUS_METRIC_NAMESPACE environment variable.
The health status of each service is available at:
GET /health