EQTY LabDocs

List agent certifications

List certifications, newest first, each with where it stands: active, expired once its term ends, or revoked. With agentUrn, one agent's across its assessments: whoever can see the agent in the agent registry may read them, as anyone with access to a project reads its compliance credentials; the agent is read with the caller's token, so another agent gets 404. Without it, a program administrator gets the organization's every certification, and anyone else those of the assessments they may read, by the rule that lists their assessments: ones they started or whose program they currently review. An API key bound to no project reads as its holder with full access. Otherwise it reads the certifications of the assessments its submit_agent_assessments or review_agent_assessments scope reads, and the agent it names is read from the agent registry, which shows agents to a key with submit_agent_assessments; a key with review_agent_assessments and neither of the other two scopes has the agent it names narrow those certifications instead. A key without it but with view_agent_certifications, as deploy automation pulls an agent's signed certifications, has the agent it names checked against the certifications the gateway lets its holder read, as an operator or viewer of the agent, and is told who certified them only for assessments it reads; it must name the agent unless it reads some assessments. Any other key that does not administer programs is listed none

gethttps://localhost:10001/api/v1/organizations/{orgId}/certifications
bash
curl --request GET \
  --url 'https://localhost:10001/api/v1/organizations/{orgId}/certifications' \
  --header 'Authorization: Bearer <token>'
javascript
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/certifications", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});

const data = await response.json();
typescript
interface AgentCertification {
  agentName?: string;
  agentUrn?: string;
  assessmentUuid?: string;
  canRevoke?: boolean;
  configurationCid?: string;
  credential?: Record<string, unknown>;
  credentialId?: string;
  expiresAt?: string;
  issuedAt?: string;
  issuedBy?: string;
  issuedByDid?: string;
  issuedByUserId?: string;
  profileCid?: string;
  programManifestCid?: string;
  programSlug?: string;
  programUuid?: string;
  provenance?: Record<string, unknown>;
  revoked?: boolean;
  revokedAt?: string;
  revokedBy?: string;
  revokedByDid?: string;
  revokedByUserId?: string;
  revokedReason?: string;
  sourceCid?: string;
  status?: "active" | "expired" | "revoked";
  submissionNumber?: number;
}

const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/certifications", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: AgentCertification[] = await response.json();
python
import requests

response = requests.get(
    "https://localhost:10001/api/v1/organizations/{orgId}/certifications",
    headers={
        "Authorization": "Bearer <token>",
    },
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://localhost:10001/api/v1/organizations/{orgId}/certifications", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/certifications"))
            .header("Authorization", "Bearer <token>")
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:10001/api/v1/organizations/{orgId}/certifications");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/certifications');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/certifications")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest, tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .get("https://localhost:10001/api/v1/organizations/{orgId}/certifications")
        .header("Authorization", "Bearer <token>")
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

NameTypeDescription
orgId
required
string

Organization ID or UUID (urn:uuid optional)

Query parameters

NameTypeDescription
agentUrnstring

The agent's ID in the agent registry; without it, every certification the caller may read. Required for a key that reads agents' certifications through the gateway and no assessment

Responses

200Certifications

application/json

Array of core.AgentCertification

  • agentNamestringread-only

    The agent's display name in the agent registry when its assessment last read it; a label only, never part of the credential

  • agentUrnstringread-only

    The credential's subject: the agent's registry ID

  • assessmentUuidstringread-only

    urn:uuid form

  • canRevokebooleanread-only

    Whether the caller may revoke it: it is not revoked, and they administer programs or are the reviewer who authorized it and still review its program; false for an API key that does not act as its holder

  • configurationCidstringread-only

    The configuration it certifies, pinned by the submission

  • credentialobjectread-only

    The signed credential, as issued

  • credentialIdstringread-only

    The credential's urn:uuid, which identifies the certification

  • expiresAtstring<date-time>read-only

    The credential's validUntil; absent when the program sets no term

  • issuedAtstring<date-time>read-only
  • issuedBystringread-only

    The program administrator who requested it

  • issuedByDidstringread-only

    Verifiable actor, the credential's authorizedBy; issuedBy is the label

  • issuedByUserIdstringread-only
  • profileCidstringread-only

    The operating profile it certifies the agent against, pinned by the submission; absent when none was

  • programManifestCidstringread-only

    The program version it certifies against

  • programSlugstringread-only

    The program the version belongs to

  • programUuidstringread-only

    urn:uuid form

  • provenanceobjectread-only

    Who certified what: the statements the credential's evidence names, read back from the submission it certifies. Only for a caller who may read its assessment: absent for one who only sees the agent, and for a key scoped to view_agent_certifications

    Show properties
    • declarationscore.CertificationDeclaration[]

      The declarations its evidence names, in the evidence's order

      Show properties

      Array of core.CertificationDeclaration

      • controlsstring[]

        The control codes it covers, in the program's order

      • documentCidstring

        urn:cid of the declaration document

      • statementIdstring

        urn:cid of the governance statement it registered as

      • submittedAtstring<date-time>
      • submittedBystring
      • submittedByDidstring
      • submittedByUserIdstring
      • uuidstring

        urn:uuid form

    • reviewscore.ControlReview[]

      The review of each control it rests on, in the evidence's order, which is the program's

      Show properties

      Array of core.ControlReview

      • controlCodestring
      • documentCidstring

        urn:cid of the review document the Integrity Service stored

      • evidenceCidstring

        urn:cid of the control's evidence the review judged; absent on reviews made before controls carried evidence

      • outcomeobject

        One ofsatisfiednot_satisfiednot_applicable

        Show properties

        object (enum) · one of satisfied, not_satisfied, not_applicable

      • reviewedAtstring<date-time>
      • reviewedBystring
      • reviewedByDidstring
      • reviewedByUserIdstring
      • statementstring
      • statementIdstring

        urn:cid of the governance statement it registered as

      • uuidstringread-only

        urn:uuid form

    • submissionobject

      The submission it certifies

      Show properties
      • documentCidstring

        urn:cid of the submission document

      • numberinteger
      • statementIdstring

        urn:cid of the governance statement it registered as

      • submittedAtstring<date-time>
      • submittedBystring
      • submittedByDidstring
      • submittedByUserIdstring
      • uuidstring

        urn:uuid form

    • unmatchedstring[]

      Statements its evidence names that are none of these, by urn:cid; never expected, and never hidden

  • revokedbooleanread-only

    Set via the revoke endpoint

  • revokedAtstring<date-time>read-only

    Set via the revoke endpoint

  • revokedBystringread-only

    Set via the revoke endpoint

  • revokedByDidstringread-only

    Verifiable actor; revokedBy is the label

  • revokedByUserIdstringread-only

    Set via the revoke endpoint

  • revokedReasonstringread-only

    Set via the revoke endpoint

  • sourceCidstringread-only

    Where the Integrity Service stored the signed credential

  • statusobjectread-only

    Computed on read: revoked, else expired once expiresAt passes, else active

    One ofactiveexpiredrevoked

    Show properties

    object (enum) — Computed on read: revoked, else expired once expiresAt passes, else active · one of active, expired, revoked

  • submissionNumberintegerread-only

    The submission it certifies

Examplejson
[
  {}
]

400Bad request - Invalid organization ID, or a key reading through the gateway and no assessment named no agent

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

403Forbidden - No organization access, or the agent registry refuses the caller

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

404Agent not found, or not visible to the caller

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

500Internal server error

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

503The agent registry is unavailable

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}