Credential revocation invalidates a credential before its expiration date. It closes the exposure window between a changed fact and the authorization decision that reflects it. section 12.3.3 section 12.4.3
An authorization engine must check current credential status before using its claims. Issuers may provide a real-time status endpoint or publish a signed revocation list for local checks. section 16.4 section 16.2
Revocation supports several operational goals:
- React to unexpected changes, such as employment ending, certification loss, or issuer accreditation being withdrawn. section 16.4 section 16.9.2
- Balance low-latency decisions against trustworthy context through token invalidation, introspection, or proactively updated cached signals. section 12.4.3 section 12.8
- Support high-assurance authorization when the revocation information comes from a trusted issuer or governance authority. section 16.4
A still-valid credential that no longer grants access
Brian presents an employment credential after leaving AuditsRUs. Its signature and expiration date remain valid, but ACME checks the issuer’s revocation information and denies access. If status checks are unavailable, a tightly controlled temporary permit, break-glass procedure, or manual review can provide an audited fallback. section 16.4 section 16.9.2
{
"type": ["VerifiableCredential", "EmploymentCredential"],
"issuer": "did:web:auditsrus.example",
"validFrom": "2026-01-10T00:00:00Z",
"validUntil": "2027-01-10T00:00:00Z",
"credentialSubject": {
"id": "did:example:angela",
"employer": "AuditsRUs",
"role": "Security Auditor",
"employmentStatus": "active"
},
"credentialStatus": {
"id": "https://auditsrus.example/status/2026#24519",
"type": "StatusList2021Entry",
"statusPurpose": "revocation",
"statusListIndex": "24519",
"statusListCredential": "https://auditsrus.example/status/2026"
},
"proof": {
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-rdfc-2022",
"created": "2026-01-10T15:22:04Z",
"verificationMethod": "did:web:auditsrus.example#key-1",
"proofPurpose": "assertionMethod",
"proofValue": "z3FXQjC7nYq9...abbreviated..."
}
}
The credentialStatus fields identify a revocation registry, its purpose, and the entry the verifier must check before relying on the claims. section 16.2
