Credentials

W3C Verifiable Credentials that determine entity trust levels.

All verified properties of an entity are expressed as W3C Verifiable Credentials 2.0. Credentials raise an entity's trust level and are used by systems to make authorization decisions.

Credential types

Credential	Proves	Issued by
`ATAPEmailVerification`	Entity controls an email address	ATAP server
`ATAPPhoneVerification`	Entity controls a phone number	ATAP server
`ATAPPersonhood`	Entity is a unique human	Personhood provider
`ATAPIdentity`	Entity is a specific identified person	Government / eIDAS provider
`ATAPPrincipal`	Entity acts on behalf of another entity	ATAP server
`ATAPOrgMembership`	Entity belongs to an organization	Org's ATAP server

Trust levels

An entity's trust level is derived from its highest credential:

Level	Required credential
0	None
1	`ATAPEmailVerification` or `ATAPPhoneVerification`
2	`ATAPPersonhood`
3	`ATAPIdentity`

The effective trust is bounded by the hosting server's trust level:

effective_trust(entity) = min(trust_level(entity), server_trust(entity.server))

Credential format

ATAP uses the VC-JOSE-COSE proof format (JWT and SD-JWT) to avoid JSON-LD processing overhead.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://atap.dev/ns/v1"
  ],
  "type": ["VerifiableCredential", "ATAPPrincipal"],
  "issuer": "did:web:example.com:machine:platform",
  "validFrom": "2026-03-12T14:30:00Z",
  "credentialSubject": {
    "id": "did:web:example.com:agent:01jd7xk3m9",
    "principal": "did:web:example.com:human:x7k9m2w4p3n8j5q2"
  },
  "credentialStatus": {
    "type": "BitstringStatusListEntry",
    "statusPurpose": "revocation",
    "statusListIndex": "42",
    "statusListCredential": "https://example.com/credentials/status/1"
  }
}

Selective disclosure

Credentials containing personal information should use SD-JWT (RFC 9901) for selective disclosure, in compliance with GDPR data minimization requirements.

Revocation

Credential revocation uses W3C Bitstring Status List v1.0. Each ATAP server publishes a status list endpoint. Verifiers must check the credentialStatus field before accepting a credential.