DRAFT: CN credential standard #3416

meiersi-da · 2025-12-16T11:37:54Z

Draft code for a CN credential standard built in a similar fashion to how the CN token standard is built. The CIP text for it has not yet been written. The high-level idea is that:

The standard defines APIs for
- creating and updating credentials in a registry (see the CredentialRegistry interface)
- querying the credentials using an off-ledger API, which also supports filtering (see the OpenAPI spec)
- fetching credential in Daml code (see the CredentialRecord interface)
The SVs run a credential registry as part of their Amulet Name Service (see the AnsCredentialRegistry implementation of the interface)
- SVs protect their resources by requiring a refresh of the credential records every 90 days. Thus the traffic for the refresh protects them from somebody spamming the ACS of the DSO party
- That registry is also used to solve the off-ledger API discovery problem in token standard.
Third-parties are welcome to run registries as well. Their off-ledger APIs can be discovered in the ANS registry from a self-published credential by their party with a well-known key.
Concrete sets of claims for specific use-cases are defined as part of additional CIPs, as outlined in https://docs.google.com/presentation/d/1PXVwQU98dPo4hhIrXt1U5pAutWa4YUlvS61xIiBMhgc/edit?slide=id.g328343e708d_0_468#slide=id.g328343e708d_0_468

Pull Request Checklist

Cluster Testing

If a cluster test is required, comment /cluster_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.
If a hard-migration test is required (from the latest release), comment /hdm_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.

PR Guidelines

Include any change that might be observable by our partners or affect their deployment in the release notes.
Specify fixed issues with Fixes #n, and mention issues worked on using #n
Include a screenshot for frontend-related PRs - see README or use your favorite screenshot tool

Merge Guidelines

Make the git commit message look sensible when squash-merging on GitHub (most likely: just copy your PR description).

meiersi-da · 2026-01-08T15:30:30Z

daml/splice-api-credential-registry-v1/daml/Splice/Api/Credential/RegistryV1.daml

+  deriving (Eq, Show)
+
+-- | A view of a credential record stored in a credential registry.
+data CredentialRecordView = CredentialRecordView with


TODO: make this a CredentialView and remove the usage of Record in this file.

moritzkiefer-da · 2026-01-09T16:07:58Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+            format: date-time
+          required: false
+          description: |
+            If provided, only return credential records that are valid at the given time.


What are the semantics if I don't specify a time? is it validAsOf=now or is it all credentials even ones no longer active? If so, I assume I wonder if you should jus tbe able to specify a range in the query as well.

assuming you can query stuff that is no longer active what guarantees are registries expected to provide? Probably up to them to decide how long they want to store historic data?

good point on range. Will adjust.

I would expect that the queries should return contracts in their ACS.

moritzkiefer-da · 2026-01-09T16:11:17Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+        - in: query
+          name: holder
+          schema:
+            type: string


what's the motivation for not supporting an array here? Bulk queries across multiple holders seem potentially useful

good point. I was worried that the query plans would not be good enough. However it should be OK. will adjust.

meiersi-da

add notes from self-review

meiersi-da · 2026-01-09T10:18:15Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+    and querying credential records.
+  version: 1.0.0
+paths:
+


TODO: add bulk retrieval APIs for explorers

meiersi-da · 2026-01-09T10:18:37Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+            $ref: "#/components/schemas/CredentialRegistryLimits"
+      required:
+        - adminId
+        - supportedVersions


TODO: switch to the supportedApis construction used in the token standard for increased flexibility

meiersi-da · 2026-01-12T09:40:19Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+        - in: query
+          name: holder
+          schema:
+            type: string


good point. I was worried that the query plans would not be good enough. However it should be OK. will adjust.

meiersi-da · 2026-01-12T09:41:43Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+            format: date-time
+          required: false
+          description: |
+            If provided, only return credential records that are valid at the given time.


good point on range. Will adjust.

I would expect that the queries should return contracts in their ACS.

meiersi-da · 2026-01-12T09:53:27Z

daml/splice-api-credential-registry-v1/daml/Splice/Api/Credential/RegistryV1.daml

+      -- ^ The time from which this credential is valid.
+    validUntil : Optional Time
+      -- ^ The time until which this credential is valid.
+    meta : Metadata


TODO: also limit maximal size of metadata

meiersi-da · 2026-01-12T10:15:26Z

daml/splice-api-credential-registry-v1/openapi/credential-registry-v1.yaml

+          explode: true
+          required: false
+          description: |
+            Only return credential records issued by one of the specified issuers.


TODO: allow filtering for self-published tokens; e.g., using self as an issuer, or by adding a separate flag that allows self-published tokens.

[no ci]

meiersi-da changed the title ~~DRAFT: credential registry standard API~~ DRAFT: CN credential standard Dec 16, 2025

meiersi-da commented Jan 8, 2026

View reviewed changes

meiersi-da added 9 commits January 9, 2026 07:21

store partial draft

424e103

before renaming

58990f1

registry interface specced

abfbcae

strawan registry implementation

bfbc70f

create separate library for interfaces

54dc01a

add sketch of OpenAPI spec

e276b4e

self-review

dd0d4f2

better naming for registry api

901ca94

Polish DSO credential registry that is part of ANS

8d02ed0

meiersi-da force-pushed the meiersi/std/credential-registry branch from e87590c to 8d02ed0 Compare January 9, 2026 08:47

meiersi-da added 3 commits January 9, 2026 09:30

polish existing endpoints in OpenAPI spec

5a1f533

add info endpoint

4eafd9f

add public-fetch and archive-as-holder

4567493

moritzkiefer-da reviewed Jan 9, 2026

View reviewed changes

meiersi-da commented Jan 12, 2026

View reviewed changes

meiersi-da added 2 commits January 12, 2026 12:29

add credentials for featured app rights

286070e

switch to using ! as the property!subject separator

ea216e5

[no ci]

DRAFT: CN credential standard #3416

Are you sure you want to change the base?

DRAFT: CN credential standard #3416

Uh oh!

Conversation

meiersi-da commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Checklist

Cluster Testing

PR Guidelines

Merge Guidelines

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

meiersi-da left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

meiersi-da commented Dec 16, 2025 •

edited

Loading