Get started
Records, credentials and verification
How records, digital credentials, holders, issuers, verifiers and evidence relate in Arrota, and which identifiers the API uses.
Updated
On this page
The parties
- Issuer: the organisation that creates a record and stands behind it, such as a university, training provider or employer. API keys and webhooks belong to an issuer's workspace.
- Holder: the person a record is about. Holders keep their records in their Arrota Vault and decide who can see or verify them.
- Verifier: an organisation that checks a claim about a person, such as an employer screening a candidate. Verifier organisations use the Verification API.
Records and digital credentials
A record is the structured fact: a qualification awarded, a course completed, a role held. It has a record_id.
A digital credential is an issued document attached to a record: the certificate or letter itself, signed and delivered to the holder. It has its own ID, returned as document_id when you issue and as id when you list credentials.
| Identifier | Identifies | Where you meet it |
|---|---|---|
document_id (id in lists) | One issued digital credential | Issuing and listing credentials; credential.* webhook events |
record_id | The record a credential belongs to | Issuing responses; verification requests; verification.* events; Open Badges |
Evidence
Evidence is whatever supports a record: an issued credential, or a document the holder uploaded. Arrota always says who stands behind a record. A credential issued through the API is Issuer issued, the strongest label, because your organisation created it.
Lifecycle
A credential is issued, then claimed by its holder into their Vault, and may later expire or be revoked. The Credentials API reports each credential as active, revoked or expired, and webhooks tell you when a credential is issued, claimed or revoked.
Verification
A verification request compares claims a verifier submits with a record. The holder must authorise it, the issuing organisation's disclosure policy applies, and the verifier receives a result for each claim, never the record's stored values. See the Verification API.
Open Badges and verifiable credentials
Holders can download a signed credential as a W3C Verifiable Credential file from their Vault. When a holder publishes a credential on their public profile, it is also available as Open Badges 3.0 JSON. See Open Badges 3.0.
What the API does not expose
The API does not return holders' personal details beyond a credential's recipient name, and it does not expose skills or workforce insights. Those remain in the issuer workspace. For how Arrota handles data, see the Privacy Notice and the Trust Center.