credenco-cli Usage Examples

This page walks one credential, a Bank Account credential with the claims iban, account_name, currency and account_type, all the way from an empty wallet to a verified presentation. Each step shows the command and the output it produced.

Two wallets take part:

Wallet	Profile	Role
Tulip Trust Bank	`tulip-bank`	issues the credential, and later asks for it back
Ada Lovelace	`ada`	holds the credential

Both wallets already exist, and each has a stored login profile; see Profiles.

Where the output comes from

Every terminal screen below is a capture of a real run against a Credenco test environment. Commands, flags, field names, statuses and response bodies are verbatim. Three things are normalised for readability: the host name is written as wallet.acc.credenco.com, home directories are shown as ~, and secrets are redacted.

1. Which credentials are stored in my wallet?

A Business Wallet holds credentials of its own, and credential list-wallet-holder-credentials lists them. Ada's wallet is empty so far:

$ credenco-cli --profile ada credential list-wallet-holder-credentials
{
  "content": [],
  "page": {
    "number": 0,
    "size": 20,
    "totalElements": 0,
    "totalPages": 0
  }
}

The output is JSON here because it is piped; on a terminal the same command prints a table. See step 5 for the populated version.

2. Create the issuer template

An issuer template is the credential issuer itself: the public OpenID4VCI endpoint, its interoperability profile and the domain it is published on. In the web interface it is called a Credential Issuer definition.

$ credenco-cli --profile tulip-bank issuer-template create-issuer-template \
    --issuer-template-key bank-account-issuer \
    --name "Tulip Trust Bank" \
    --description "Issues Bank Account credentials" \
    --interop-profile DIIP_V4
{
  "createdAt": "2026-10-13T14:26:08",
  "createdBy": "Tulip Trust Bank",
  "credentialIssuer": "https://wallet.acc.credenco.com/public/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/bank-account-issuer",
  "credentialIssuerMetadataUrl": "https://wallet.acc.credenco.com/public/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/bank-account-issuer/.well-known/openid-credential-issuer",
  "description": "Issues Bank Account credentials",
  "displays": [],
  "domain": "wallet.acc.credenco.com",
  "interopProfile": "DIIP_V4",
  "issuerTemplateKey": "bank-account-issuer",
  "lastModifiedAt": "2026-10-13T14:26:09",
  "lastModifiedBy": "Tulip Trust Bank",
  "name": "Tulip Trust Bank"
}

issuerTemplateKey is part of the public credential issuer URL, so pick it once and keep it. --interop-profile is required and takes DIIP_V2, DIIP_V3, DIIP_V4, DIIP_V5 or HAIP; it decides the OpenID4VCI version and the shape of the metadata URL.

3. Define the Bank Account credential

The credential template says what is in the credential: its format, its type and its claims. The attributes and displays arrays are nested objects, so they go through --body rather than through a field flag. --body accepts inline JSON, @file, or @- for standard input.

bank-account.json
{
  "credentialTemplateKey": "bank-account-sd-jwt",
  "format": "SD_JWT",
  "credentialType": "BankAccountCredential",
  "validityPeriod": "P1Y",
  "storeCredential": true,
  "issuerIdentifierKey": "f8124ef0-bf81-46fe-9655-5a2b3864ade9",
  "displays": [
    {
      "locale": "en-US",
      "name": "Bank Account",
      "description": "Proof of a bank account at Tulip Trust Bank",
      "textColor": "#FFFFFF",
      "backgroundColor": "#03133D"
    }
  ],
  "attributes": [
    { "name": "iban",         "type": "STRING", "mandatory": true,  "selectivelyDisclosable": true, "displays": [{ "locale": "en-US", "name": "IBAN" }] },
    { "name": "account_name", "type": "STRING", "mandatory": true,  "selectivelyDisclosable": true, "displays": [{ "locale": "en-US", "name": "Account name" }] },
    { "name": "currency",     "type": "STRING", "mandatory": false, "selectivelyDisclosable": true, "displays": [{ "locale": "en-US", "name": "Currency" }] },
    { "name": "account_type", "type": "STRING", "mandatory": false, "selectivelyDisclosable": true, "displays": [{ "locale": "en-US", "name": "Account type" }] }
  ]
}

issuerIdentifierKey is the externalKey of the identifier that signs the credential. The wallet already has a default did:web identifier; read it with credenco-cli --profile tulip-bank identifier list-identifiers.

$ credenco-cli --profile tulip-bank credential-template create-credential-template \
    bank-account-issuer --body @bank-account.json
{
  "attributes": [
    {
      "array": false,
      "children": [],
      "displays": [
        {
          "locale": "en-US",
          "name": "IBAN"
        }
      ],
      "mandatory": true,
      "name": "iban",
      "selectivelyDisclosable": true,
      "type": "STRING"
    },
    ...
  ],
  "contexts": [],
  "credentialTemplateKey": "bank-account-sd-jwt",
  "credentialType": "BankAccountCredential",
  "displays": [
    {
      "backgroundColor": "#03133D",
      "description": "Proof of a bank account at Tulip Trust Bank",
      "locale": "en-US",
      "name": "Bank Account",
      "textColor": "#FFFFFF"
    }
  ],
  "format": "SD_JWT",
  "issuerIdentifierKey": "f8124ef0-bf81-46fe-9655-5a2b3864ade9",
  "issuerTemplateKey": "bank-account-issuer",
  "storeCredential": true,
  "validityPeriod": "P1Y"
}

The response also carries a defaultTemplate field, left out above, holding the credential template the format uses when customTemplate is not set.

Two details worth knowing:

credentialTemplateKey is the OpenID4VCI credential configuration id. It is the name you pass to credenco-cli issue, so changing it on a PUT renames the template and breaks every client still using the old key.
selectivelyDisclosable is what makes step 7 possible: the holder can present iban and account_name without revealing currency and account_type.

4. Test the issue of the Bank Account credential

credenco-cli issue creates the offer, prints the offer URI and a scannable QR code, and then polls the issuance status until it reaches a terminal value. The URI and the QR go to standard error, so a piped standard output stays valid JSON.

$ credenco-cli --profile tulip-bank issue bank-account-sd-jwt \
    --claims '{"iban":"NL91ABNA0417164300","account_name":"Ada Lovelace","currency":"EUR","account_type":"checking"}'

Scan or open:
openid-credential-offer://?credential_offer_uri=https%3A%2F%2Fwallet.acc.credenco.com%2Fpublic%2F2a0ae7d8-2b17-4d05-94ab-02a1cc74606f%2Fbank-account-issuer%2FcredentialOffer%3Fid%3Dbfbc0336-7f8c-49d6-9d4f-4d83f4abb1e4

█████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████ ▄▄▄▄▄ ██▄▀█ ▄▄█▄██▄▄█▀▀   ██▄ ██▄ ▀    ▄  ▀██ ▄▄▄▄▄ ████
████ █   █ █▄▄▀▀  ██ ▀█▀▄▄█  ▀ █▀ ▄██ ▄▄██ ▄██▀▄▀█ █   █ ████
████ █▄▄▄█ ██▄▀█▄█▀█▄ █  █▀  ▄▄▄ ▀     █▀▄  █  ███ █▄▄▄█ ████
████▄▄▄▄▄▄▄█ █ ▀ ▀ ▀▄▀ ▀▄█▄█ █▄█ █▄▀▄█▄▀ █ ▀ ▀ █ █▄▄▄▄▄▄▄████
████▄▄▄█  ▄▄▄▄█▀  ██   ███  ▄ ▄▄ ▄█  █▄▄▄█▄▄▄▀█ █▄▄▀█▀▄▀▀████
████▄ █ ▄█▄▀▀█▄▄█▄██▀▀ █▄▄█ █▄██ ██▀  ▀ ▀▄▄█▀▀▀▀███▄ ▀█  ████
████▄ █  ▀▄▄██ ▀▀█  █   █▀ █▄▄▀▀  ▄  ▄▄▄▄▄▄▄▄ ███▀█▀▄▀▀ ▀████
████ ▀▄▄▄▄▄▀▄▀▀█▄█▄▀█▀ ▄▄████ ▄█  █▄ ██▄ █▀▀▀█▀ ▄ ▀▄ ▄▄▄▄████
████▄▄▄█▀ ▄  ▄▄▀▄█▄ ▄█  █  █▀ ██ ▄▄█▄█▄█▄▄█ ▄ █▄█▄▄  █▀▀ ████
████▄▀▄ █▄▄▀▀▄█▀  ▄ ▄█▄██▄▄█████ ▀█ ▄ █▀▀██  █▀▄▄▀█▄▀ ▄▄▄████
██████▀▀▀▀▄█▄█▄█▄  ███ ▀██   ██▀ ▄█▄ ▄▄ ▄▄▄▄▄▄▄██▀▄█ ▄█  ████
████▀▀█ ▀▀▄▄█▀ ▀  ▀▀██▄ █ ▄▀█▄█▄ █ ▀ ▀█  ▄▀▄▀█▀▀█ █  ▀▄ ▄████
████▄ ▄  ▄▄▄ ▀██▄ ██   ███ ▄ ▄▄▄ █▄▀ █▄  ▄█   ██ ▄▄▄ ▀█  ████
█████▄   █▄█ ▄▄▀▄ ▄█▀▀▄ █▀ ▄ █▄█ ██▄ ▄▀▀ ▀█ ▀ █  █▄█ ▀▄ ▄████
█████▀ ▄▄ ▄  ▄▀ ▄█  █  ██ ▄▄▄   ▄█▄█▄█▄▄▄▀█▀▄▄▄█ ▄▄▄▄▄▀█ ████
████▄ ▄▀▀█▄█ ██ ██▄▄ ▄▄   ▄▀ ▄▄ ██▀ ▄▀▄▄ ██  █▀█   ▄▄▄▄█▄████
█████▀▄▄▄█▄█▄ ▄ ██▄ ▄█  █  █   ▀▄█▄   █▄▄██▄▄▄██    █▀██▀████
████ ▀  ▀▀▄▀██▀██▀▄ ▄█▄▀   ██  ██▀█▀ █▀  ██▄ ▀██    ███▄ ████
████▀██▄ ▀▄▄█▄██▄█ ▀█  ██▄ ███  ▄██▀ ▄█   ▄  ▄██  ███▀█▄▀████
████▄ ▄ █ ▄ ▄ █▄▄ ▀▀  ▄█   ▀▀ ▄ ████ ███ ▄█ ▀▀█▀ ▀ █▄▄██▄████
██████▄▀█▄▄  ▀▀   ██ ▀▄ █▀ ▄    █▄▄█▄ ▄▄ ██ ▄▄██▄  ██ █ ▀████
████▄ ▀▄▄▄▄  ▄ ▄ ███▀▄▄█▄▀▄█ ▀███▄█▄ ▄█▄▀▀█   ██ ▀  █ ▄▄▄████
███████▄██▄▄▀▄▄▄██▄ ██ ██▄   ▄▄▄ ██▄▄██▄ ██▄▄▄██ ▄▄▄  █▀▀████
████ ▄▄▄▄▄ █ ▀▀▀▄▄██▄ ▀▀█▄█  █▄█ ██  ▀██▄█▄  ▀█▄ █▄█ ███▄████
████ █   █ █▄▀▀█▄▀  ▄ ████ █ ▄▄  ▀▄█▄▄█  ▄▄▄▄██▄ ▄   ▀█▄▄████
████ █▄▄▄█ █ ▄ █▀▀▄ ▄▄ █▄▄▄▀ ██ ▀▀█▀ █▄▀ ▄█▄ █▀█▄▄▄▄▄▄▄ █████
████▄▄▄▄▄▄▄█▄██▄█████▄▄██▄▄▄▄▄▄▄▄██▄▄██▄▄██▄▄▄█▄▄██▄▄██▄▄████
█████████████████████████████████████████████████████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
status: issue_request_created
status: credential_offer_retrieved
status: issue_completed
{
  "correlation_id": "0a590152-d44a-4b5b-8745-b7eb93bf82bf",
  "last_updated": 1791894374805,
  "request_uri": "openid-credential-offer://?credential_offer_uri=https%3A%2F%2Fwallet.acc.credenco.com%2Fpublic%2F2a0ae7d8-2b17-4d05-94ab-02a1cc74606f%2Fbank-account-issuer%2FcredentialOffer%3Fid%3Dbfbc0336-7f8c-49d6-9d4f-4d83f4abb1e4",
  "status": "issue_completed",
  "status_uri": "https://wallet.acc.credenco.com/api/v2/credential/issue/0a590152-d44a-4b5b-8745-b7eb93bf82bf"
}

The statuses an issuance passes through are issue_request_created, credential_offer_retrieved, awaiting_confirmation, confirmed, issue_completed and error. issue treats issue_completed, error and awaiting_confirmation as terminal: awaiting_confirmation needs an out-of-band confirm call at a desk, so waiting longer cannot move it. Pass --wait=false to get the offer and exit immediately, --wait-timeout to change the three-minute default, and --correlation-id to track the issuance under your own business key.

Nothing moves until a holder accepts the offer

issue creates the offer and then waits; it cannot complete it on its own. In the capture above, Ada's wallet accepted the offer while the command was polling, which is why the status walks on to issue_completed within a few seconds. Run the same command with no holder and it sits at issue_request_created or credential_offer_retrieved until the three-minute timeout.

With a phone, scan the QR code. With a Business Wallet as the holder, as here, the wallet resolves and accepts the offer itself: it holds credentials of its own, which is what step 5 lists. Unattended, pass --wait=false, hand the request_uri on, and come back with credenco-cli issue-credential get-credential-issuance-status <correlation_id>.

A revocation UUID only appears at the end

revocation_uuid is only present in the status once the flow reaches issue_completed, and only when a status list is configured on the credential template. The template in step 3 sets no statusListKey, so the credentials it issues carry no status and the status above has no revocation_uuid. Add statusListKey to the template to be able to revoke what it issues, as in step 8. See Status lists and revocation.

5. Which credentials are stored in my wallet, again

Ada's wallet now holds the credential. On a terminal the output is a table:

$ credenco-cli --profile ada credential list-wallet-holder-credentials
EXTERNALKEY                           DISPLAYNAME            CREDENTIALFORMAT  CREDENTIALSTATUS  ISSUEDAT             ISSUER                                                                            ISSUERMETADATAURL                                                                                                                      TYPE
c4a44fe5-da89-47e8-831e-e178fecd64b8  BankAccountCredential  SD_JWT            VALID             2026-10-13T14:26:15  did:web:wallet.acc.credenco.com:public:did:fddcd738-826f-4702-ab02-f2a5bcd97b1a  https://wallet.acc.credenco.com/public/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/bank-account-issuer/.well-known/openid-credential-issuer  BankAccountCredential

Piping the same command gives the full credential, claims included:

$ credenco-cli --profile ada credential list-wallet-holder-credentials | jq '.content[0].payload | {iban, account_name, currency, account_type, vct}'
{
  "iban": "NL91ABNA0417164300",
  "account_name": "Ada Lovelace",
  "currency": "EUR",
  "account_type": "checking",
  "vct": "BankAccountCredential"
}

6. Configure the receive of a Bank Account credential

Asking for a credential back is a verifier template: a name, a purpose shown to the holder, an interoperability profile and a DCQL query naming the credential type and the claims you want. For the Bank Account credential, asking for iban and account_name and nothing else looks like this:

bank-account-check.json
{
  "verifierTemplateKey": "bank-account-check",
  "name": "Bank Account check",
  "description": "Asks for the IBAN and account name from a Bank Account credential",
  "purpose": "We need your IBAN and account name to set up the direct debit",
  "interopProfile": "DIIP_V5",
  "queryDefinition": {
    "credentials": [
      {
        "id": "bank_account",
        "format": "dc+sd-jwt",
        "meta": { "vct_values": ["BankAccountCredential"] },
        "claims": [
          { "path": ["iban"] },
          { "path": ["account_name"] }
        ]
      }
    ]
  }
}

The format in a DCQL query is the OpenID4VP format identifier, not the Business Wallet's SD_JWT enum: an SD-JWT VC is dc+sd-jwt under DIIP_V4, DIIP_V5 and HAIP, and vc+sd-jwt under DIIP_V2 and DIIP_V3.

--dry-run prints the exact request without sending it, which is the quickest way to check a hand-written queryDefinition before it reaches the wallet:

$ credenco-cli --profile tulip-bank verifier-template create-verifier-template \
    --body @bank-account-check.json --dry-run
{
  "dryRun": true,
  "method": "POST",
  "url": "https://wallet.acc.credenco.com/api/v1/wallets/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/verifier-templates",
  "headers": {
    "Accept": "application/json",
    "Content-Type": "application/json",
    "x-api-key": "[REDACTED]"
  },
  "requestBody": {
    "verifierTemplateKey": "bank-account-check",
    "name": "Bank Account check",
    "description": "Asks for the IBAN and account name from a Bank Account credential",
    "purpose": "We need your IBAN and account name to set up the direct debit",
    "interopProfile": "DIIP_V5",
    "queryDefinition": {
      "credentials": [
        {
          "id": "bank_account",
          "format": "dc+sd-jwt",
          "meta": {
            "vct_values": [
              "BankAccountCredential"
            ]
          },
          "claims": [
            {
              "path": [
                "iban"
              ]
            },
            {
              "path": [
                "account_name"
              ]
            }
          ]
        }
      ]
    }
  }
}

7. Test the receive of a Bank Account credential

credenco-cli verify <verifier-template-key> creates an OpenID4VP authorization request, prints the request URI and a QR code, waits for the holder's response to be verified, and prints the verified claims.

$ credenco-cli --profile tulip-bank verify bank-account-check

Scan or open:
openid4vp://authorize?client_id=decentralized_identifier%3Adid%3Aweb%3Awallet.acc.credenco.com%3Apublic%3Adid%3Afddcd738-826f-4702-ab02-f2a5bcd97b1a&request_uri=https%3A%2F%2Fwallet.acc.credenco.com%2Fpublic%2Foid4vp%2Frequest%2F08b44511-405c-4f3b-b57d-967b7fcd154c

█████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████
████ ▄▄▄▄▄ ██▄▄██ █▄▄█ ▄ ▀█ ▄▄ ▄▄  █▄  ▀█  ▄▀  █▄█▄ ██ ▄▄▄▄▄ ████
████ █   █ █▄█   ▀██▄ ▄█  █▄ ▀ ██  ███ ██▄███▄▄███▄ ██ █   █ ████
████ █▄▄▄█ ██▄█▄█▄██▄▄▀█▄ █▀ ▀ ▄▄▄ ▀█ ▄▄     ▄ ▀█ ▀▄██ █▄▄▄█ ████
████▄▄▄▄▄▄▄█ ▀▄▀ ▀ ▀▄█ ▀▄█ █▄█ █▄█ █ ▀▄█ ▀▄█ █▄█ ▀▄▀▄█▄▄▄▄▄▄▄████
████▄▄ ▀ ▄▄▄▄█▄▄█▄ █▄▀ ██▄ ██▄▄▄▄▄▄█▄ ▄█▄▀▄▀ ▄▄▄▄▀▄██▄▄▀██ ▀▀████
████▀█ ▄▄▄▄ █▀▄▄▀ ▀▀█▄▄ █▄ █▀█▄▀ ▄█ ████ ▄█▄ ▀▀▀ █▀ ▄▀█▄▀▄█ ▄████
████▀█▄▄▄▄▄▄█▄█▄▄ ████ ▀█   █▄▄▄▄█▄  █▄█▄▄▄█▄▄▄▄▄▄█▀█▄█▀▄▄█ ▀████
████▀▄ ▀█▀▄ ▄   ▀▀▄ ▄█▄████▄███  ▀█▀ █▀  █▀▀▀▄█  ▀█▄▀█▀   ▄▄▄████
████▄█▄▀█ ▄█ ▀█▀▀▄ █▄   █  ▄███▄▄▄▄▄▄█▄▄▄ ▄▄ ▄▄▄▄▄█▄█▄█  ▄█ ▀████
████   ▀▀ ▄▄▀█▄▄▄█▄ █ ▄▄▄▀██▀▀▄ ▀▀▀█ ▀█▄ ▀▀▀ ▀█▄ ▀█████  ▀█▀ ████
█████ ▀▄█▄▄▄█▀██▄█▄█ █  █▀  ███ ▄▄▄ ▄ ▄▀▄█▄ ▄▄█▄  ▄ ██▄   ▀▀ ████
█████▀█ █▀▄▄    ▀ ▄█▀ ▀█▄▀    ▄ ███  █▀▄  ▀ █▄█▄▀██▀█▄▀▀ ▄▄▄▄████
█████ ▀█▄▄▄██ █ █▀  █  ██  ▀█▄▀▄ ▄██  ▄█▄█▄  ▄▄▄▄ ▄███▄▄▄▀█▀▀████
████▀ ▀  ▄▄▄ ▀▄█   ▄▄ ▄█▀▀  █▄ ▄▄▄ █ ▄█  █▀▀  ▀▄  ██ ▄▄▄ █▄  ████
████▀▄▀█ █▄█ █ █   ██  ███  ██ █▄█ █▄▄▄█ ██  ██▄▄▄▄▄ █▄█ ▀█▀ ████
████  ▀   ▄▄▄█ ███ ▄  ▄██  █▄ ▄ ▄   ▄▀▀█ ▄█▀ █▀▀  ██▄   ▄▄█▀ ████
█████▀█ ▄▀▄▄█▀▀ ▄▄█ █  ▀█  ██▀███  ▄ ▄▄ ▄ ▄  ██   ██▄ ▄██▀▄▀ ████
████ ▀▀▄ ▄▄▄█ ▀ ▄▄▀▄▄▄ ▀█▄█▄▄▄█▀▀█ █ ██▀ ▄█ ▀██▀ ██▄▀█   ██▄▄████
████▄██▄██▄▄▀▀▄▀▀ █ ▄█ ███  █ █▀█ █   ▄▄▄█▄▄ █▄ ▄██▀ ███▄▀█ ▄████
████▄ ▄▄ █▄▄▄▄█ ▄▄█ ▄█  █▄▄▄  █▀█   ▀▄██▀ ██  ▄▀▀ ██   ▀█ ██▄████
████▄█▄▄▄▄▄▀█ ▀▀▀█▄▀█  ██  ██ ▀██ ▄▄▄▀▄▀▄▀██▄▄█  ███▀  ████▀ ████
████▀▄███▀▄ ▄ ▀▄▄▄ ▄ █ ▄▄▄  █▄██ ▀    █▄ ▄█▄ ▄██ █▄█▄▄ ▄▄▄▄▄▄████
████▀█▀ ▄▀▄█▀ ▄▀ ▀▄▀█▀▄ █  ██▀  ██▄▀ ▄█ ▄█▄▄▄ ▄▄▄▄▄▀ ▄▄██▀█▄ ████
████ ▀ ▀▀▄▄ ▀▀▄█   ▀███▀███ █ █▄▄  ▄ ▀██  ▄   █▄ ▄▀██▄ ▄█▄▄▀▄████
██████████▄█   ▄▄▀▀▀█  ▄█  ██  ▄▄▄ █▄ █▄▄▄██ ▄█▄ ██▀ ▄▄▄  █▀ ████
████ ▄▄▄▄▄ █ █ ▄  ▀█▄▀▄▄▄▀██▄▀ █▄█   ▀█▀ █▄ ▀█▀▀ ▀█▀ █▄█  ▄▄ ████
████ █   █ █▄  █▄▄ █ █ ███ ▀█  ▄  ▄▄▄██▄ █▄▄ ▄█ ▄███     ▄█ ▄████
████ █▄▄▄█ █  ▀▀  ▀█▀▄▀██ ▄█▄█▄▄▄▄█▄ ▀▄▄▀▄█ ▀▄█▄ ██▀▄ ▄   ▄▀▄████
████▄▄▄▄▄▄▄█▄▄█▄▄█▄██▄▄██▄▄██▄▄█████▄█▄█▄█▄█▄█▄▄▄██▄▄▄█▄█▄█▄▄████
█████████████████████████████████████████████████████████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
status: authorization_request_created
status: authorization_response_verified
{
  "correlation_id": "93b42470-0a64-4ef5-a96a-bc96eb19db8b",
  "query_id": "bank-account-check",
  "status": "authorization_response_verified",
  "verified_data": {
    "credential_claims": [
      {
        "claims": {
          "_sd_alg": "sha-256",
          "account_name": "Ada Lovelace",
          "cnf": {
            "kid": "did:web:wallet.acc.credenco.com:public:did:804f15a8-40e1-4c0c-b36b-693809f1bbdf#0"
          },
          "iban": "NL91ABNA0417164300",
          "id": "urn:uuid:ab1b4ba1-e6a1-48cb-ba10-50e532e499f7",
          "vct": "BankAccountCredential"
        },
        "id": "BankAccountCredential",
        "type": "BankAccountCredential"
      }
    ]
  }
}

currency and account_type are absent, even though the credential carries them: the DCQL query asked for iban and account_name, and selective disclosure kept the rest hidden. The verified_data object also contains the raw authorization_response, with the SD-JWT and its key binding JWT; that part is left out above.

The statuses a verification passes through are authorization_request_created, authorization_request_retrieved, authorization_response_received, authorization_response_verified and error. Only authorization_response_verified carries verified_data, so verify waits for exactly that one and treats the three earlier values as still in flight.

As with the issuance, the holder has to answer before anything happens: in the capture above Ada's wallet matched the request against the credential from step 4 and sent back only the two required claims while verify was polling. Without a holder the command stays at authorization_request_created until the three-minute timeout; --wait=false gives you the request_uri to hand on, and credenco-cli universal-oidc4-vp get-oid4vp-request-status <correlation_id> picks the result up later.

8. Revoke an issued credential

Revocation is irreversible, so revoke refuses to run without --yes. Use --dry-run first; it sends nothing, not even an OAuth token request.

credenco-cli --profile tulip-bank revoke <revocation_uuid> --dry-run
credenco-cli --profile tulip-bank revoke <revocation_uuid> --yes

The revocation_uuid comes from the issuance status, and only a credential template that names a statusListKey ever produces one. The Bank Account template in step 3 does not, so this step does not apply to the credential issued above; add statusListKey to the template first, then issue again, and the issue_completed status carries the UUID this command takes.

9. When something goes wrong

Errors print the API's own problem document, then a one-line summary, and the process exits with a code describing the kind of failure rather than just "it failed".

$ credenco-cli --profile tulip-bank issuer-template get-issuer-template no-such-template
{
  "detail": "Issuer template not found",
  "instance": "/api/v1/wallets/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/issuer-templates/no-such-template",
  "status": 404,
  "title": "Not Found"
}
error: GET https://wallet.acc.credenco.com/api/v1/wallets/2a0ae7d8-2b17-4d05-94ab-02a1cc74606f/issuer-templates/no-such-template returned 404: Issuer template not found
exit code: 4

The full table is in the introduction. The codes that matter most in a script are 2 for a usage or configuration mistake, 3 for bad credentials and 4 for a missing resource.

Driving credenco-cli from an AI agent runs this same walkthrough as a series of natural-language requests.

1. Which credentials are stored in my wallet?​

2. Create the issuer template​

3. Define the Bank Account credential​

4. Test the issue of the Bank Account credential​

5. Which credentials are stored in my wallet, again​

6. Configure the receive of a Bank Account credential​

7. Test the receive of a Bank Account credential​

8. Revoke an issued credential​

9. When something goes wrong​

Next​