Check revocation, read a Status List

Task: find out whether a credential has been revoked, and understand why "how old is your answer" matters as much as the answer.

Where the pointer is

Every AID carries a credentialStatus entry: which list, which position.

"credentialStatus": {
"type": "BitstringStatusListEntry",
"statusPurpose": "revocation",
"statusListCredential": "https://api.aria.bar/v1/status/1",
"statusListIndex": "18"
}

Fetch the list

The list is itself a signed credential (BitstringStatusListCredential), one per list id. Not one per DID: GET /v1/status/<did> does not exist.

curl -s https://api.aria.bar/v1/status/1 | python3 -c '
import sys, json, base64
d = json.load(sys.stdin); d = d.get("data", d)
enc = d["credentialSubject"]["encodedList"]
raw = base64.urlsafe_b64decode(enc + "=" * (-len(enc) % 4))
if raw[:2] == b"\x1f\x8b":
  import gzip; raw = gzip.decompress(raw)
bit = lambda i: (raw[i // 8] >> (7 - i % 8)) & 1
print("index 18 revoked:", bool(bit(18)))'

You should see index 18 revoked: False for an active credential, True for a revoked one. The deployed list is currently served uncompressed; the snippet handles both forms.

Why the age matters

The registry sets the bit within 60 seconds of a revocation (COM-05, §7). Your answer is as old as your last fetch. ATP's fresh= parameter is the receiver-side bound: default one hour, floor 60 seconds (§8). A verifier that caches the list for a day will admit a credential revoked this morning. The SDK enforces the bound through maxOfflineAge; never set it to null (H1).

What revocation is not

Revocation is terminal for the credential, not for the identifier: the DID never returns to the pool, and it may be re-issued only to the same controller (§3.5.1, §3.5.4). To see the history of one identifier, walk the issuance chain.