Trust Chain

For a credential issued in ISBE to be considered trustworthy, its issuer must be registered in the network's Trusted Issuers Registry (TIR) with a valid accreditation of the correct type. The trust chain defines who can accredit whom and for which VC types.

Roles in the chain

ISBE adopts the EBSI trust model with three levels:

Role	Acronym	Description
Root Trusted Accreditation Organisation	RTAO	Trust anchor of the network. In ISBE this is the network itself (Alastria/Comunidad de Madrid).
Trusted Accreditation Organisation	TAO	Entity authorized by the RTAO to accredit trusted issuers (TI).
Trusted Issuer	TI	Final issuer authorized to issue credentials of a specific type to users.

In the current phase of ISBE, the RTAO and the TAO are the same DID (did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV). No external organization acts as an independent TAO.

The Trusted Issuers Registry (TIR)

The TIR is the on-chain component of ISBE where issuer accreditations are registered. It exposes a REST API that allows querying whether a DID is accredited for a specific VC type.

Environment	TIR URL
Production	`https://tir.portal.redisbe.com/trusted-issuers-registry`
Pre-production	Available through the pre-production portal

Structure of an accreditation in the TIR

Each accreditation registered in the TIR is itself a VC of type IsbeAccreditation. It is stored as a JWT signed with the TAO/RTAO key. The JWT hash is the attribute identifier in the TIR.

The isbe-identity-accreditations-chains repository contains the accreditation files for each environment, organized by the accredited issuer's DID:

isbe-identity-accreditations-chains/
├── pro/
│   └── did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV/
│       ├── 53a6ba68d836...    ← JWT accreditation (hash as filename)
│       ├── abfc5a265e1b...
│       └── fad7068b8f89...
├── pre/
│   └── did:isbe:uc-pre:z1N1q5h8vcuHaic1fZjpZiQaSDHt/

The content of each file is a JSON object with the following structure:

{
  "attribute": {
    "body": "<JWT of the IsbeAccreditation VC>",
    "hash": "<SHA-256 of the body>",
    "issuerType": "TI",
    "rootTao": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV",
    "tao": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV"
  },
  "did": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV"
}

The issuerType field indicates the level in the trust chain. In the current state of ISBE the only value observed in production is TI (Trusted Issuer), given that RTAO and TAO are the same DID.

Decoding an accreditation

The attribute.body field is a JWT signed by the RTAO. When decoded (without verifying the signature, for reading), the payload has the structure of an IsbeAccreditation:

{
  "iss": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV",
  "sub": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV",
  "vc": {
    "id": "urn:uuid:8d475485-1617-42f3-b402-9c95117ad72b",
    "@context": ["https://www.w3.org/ns/credentials/v2"],
    "type": [
      "IsbeAccreditation",
      "IsbeAttestation",
      "VerifiableAccreditationToAttest",
      "VerifiableCredential"
    ],
    "issuer": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV",
    "credentialSchema": {
      "type": "FullJsonSchemaValidator2021",
      "id": "https://raw.githubusercontent.com/alastria/isbe-identity-schemas-repository/main/commons/isbe-accreditation-schema.json"
    },
    "validFrom": "2026-03-27T10:12:31.000Z",
    "validUntil": "2036-03-27T09:20:42.000Z",
    "credentialSubject": {
      "id": "did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV",
      "domain": "ISBE",
      "accreditedFor": [
        {
          "types": [
            "VerifiableCredential",
            "IsbeAttestation",
            "IsbeDomainCredential",
            "ISBE",
            "IsbePortalLearCredential"
          ],
          "schemaId": "https://raw.githubusercontent.com/alastria/isbe-identity-schemas-repository/main/use-cases/isbe/portal/lear/portalLear-schema.json"
        }
      ],
      "reservedAttributeId": "53a6ba68d8361d97e234d761fe91e6d71c811a1b9c79912caa358595a6632d2c"
    },
    "termsOfUse": {
      "type": "IsbeIssuanceCertificate",
      "id": "https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV/attributes/abfc5a265e1b3aa60718619c0041e3c051686fd05d0f0954679eaa756136b343"
    },
    "credentialStatus": {
      "type": "IsbeAccreditationEntry",
      "id": "https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV/attributes/53a6ba68d8361d97e234d761fe91e6d71c811a1b9c79912caa358595a6632d2c"
    }
  }
}

Notes:

iss and sub are the same DID because in ISBE the RTAO self-accredits.
accreditedFor[0].schemaId points to the JSON Schema of IsbePortalLearCredential.
credentialStatus.type is IsbeAccreditationEntry, which is the on-chain revocation type for accreditations.
reservedAttributeId is the hash of the attribute registered in the TIR for this specific accreditation.

Process to register a new issuer

For an organization to issue VCs in ISBE, it must go through the network's accreditation process:

The organization registers its DID in the ISBE DID Registry (see DID section) and adds at least one assertionMethod with its credential signing key.
The organization requests ISBE to be accredited as a TI for the VC types it needs to issue.
The ISBE RTAO/TAO creates an IsbeAccreditation VC signed with its key and registers it in the TIR.
From that point, the organization can issue VCs of the accredited type, referencing in the termsOfUse field the TIR URL where its accreditation is stored.

No self-service accreditation process currently

Registering new issuers in the TIR requires the ISBE team's intervention. There is no self-service flow to request accreditation directly from the portal.

Querying the TIR

To check whether a DID is accredited for a VC type:

# List the attributes (accreditations) of a DID in the production TIR
GET https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/<DID>/attributes

The response includes the array of attributes registered for that issuer. Each attribute is an accreditation whose body is the signed JWT containing the IsbeAccreditation.

Roles in the chain​

The Trusted Issuers Registry (TIR)​

Structure of an accreditation in the TIR​

Decoding an accreditation​

Process to register a new issuer​

Querying the TIR​