> ## Documentation Index > Fetch the complete documentation index at: https://docs.air3.com/llms.txt > Use this file to discover all available pages before exploring further. # Verify a credential > Runs a verification program against the holder's credentials. Requires an agent JWT with `credentials.verify`; user JWTs are rejected. Verification always runs offchain, without a zero-knowledge proof. `status` is `Compliant`, `Non-Compliant`, or `NotFound`. `verifiablePresentation` is present only when the status is `Compliant`. A storage outage returns `502 CREDENTIAL_STORAGE_UNAVAILABLE`, not `NotFound`. ## OpenAPI ````yaml api-reference/agent-openapi.json POST /v2/credentials/verify-by-agent openapi: 3.0.3 info: title: AIR Agent APIs version: 1.1.0 description: > Partner-facing agent APIs for binding a holder's agent, minting a short-lived agent JWT, listing the holder's credentials, verifying them offchain, and minting a merchant checkout JWT. **Hosts:** AIR API (bind, keys, session, checkout) and Credential API (list, verify). The partner must have agent keys enabled. The AIR Kit partner access token is a **user-bound** holder session. **Typical flow** 1. Bind once (`POST /v2/auth/agent/keys/partner`). Save `agentApiKey` — it is returned only on bind and rotate. 2. Create a session per operation (`POST /v2/auth/agent/session`). The agent JWT lasts **15 minutes** and has no refresh token. 3. List (`GET /v2/credentials`) and/or verify (`POST /v2/credentials/verify-by-agent`) with `Authorization: Bearer`. 4. Optional: mint a checkout JWT (`POST /v2/auth/agent/checkout-session`) when the bound key includes `commerce.checkout`. Partner bind cannot include `wallet.sign`. `openid` is added automatically on bind. Partner scopes: `credentials.read`, `credentials.verify`, `commerce.checkout`. Mutating key routes (bind, rotate, revoke) require `x-partner-jwt`. Listing keys and updating a nickname use the AIR Kit session only. contact: name: Moca Network url: https://moca.network servers: - url: '{AIR_API}' description: AIR API (bind, keys, session, checkout) variables: AIR_API: description: Sandbox or Production default: https://air.api.sandbox.air3.com enum: - https://air.api.sandbox.air3.com - https://air.api.air3.com security: [] tags: - name: Agent keys description: Bind and manage partner-bound agent keys (AIR API). - name: Agent session description: Mint a short-lived agent JWT (AIR API). - name: Agent checkout description: Mint a merchant checkout JWT (AIR API). - name: Credentials description: List and verify the holder's credentials (Credential API). paths: /v2/credentials/verify-by-agent: servers: - url: '{CREDENTIAL_API}' description: Credential API variables: CREDENTIAL_API: description: Sandbox or Production default: https://credential-testnet.api.sandbox.air3.com enum: - https://credential-testnet.api.sandbox.air3.com - https://credential-mainnet.api.air3.com post: tags: - Credentials summary: Verify a credential description: > Runs a verification program against the holder's credentials. Requires an agent JWT with `credentials.verify`; user JWTs are rejected. Verification always runs offchain, without a zero-knowledge proof. `status` is `Compliant`, `Non-Compliant`, or `NotFound`. `verifiablePresentation` is present only when the status is `Compliant`. A storage outage returns `502 CREDENTIAL_STORAGE_UNAVAILABLE`, not `NotFound`. operationId: verifyCredentialByAgent requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyByAgentRequest' example: programId: fieldsToDisclose: '*' responses: '200': description: Verification result content: application/json: schema: $ref: '#/components/schemas/VerifyByAgentResponse' example: verificationResult: status: Compliant verifiablePresentation: '@context': - https://www.w3.org/2018/credentials/v1 type: - VerifiablePresentation holder: did:… verifiableCredential: - ~~ '400': $ref: '#/components/responses/CredentialBadRequest' '401': $ref: '#/components/responses/CredentialUnauthorized' '403': $ref: '#/components/responses/CredentialForbidden' '502': $ref: '#/components/responses/CredentialStorageUnavailable' security: - AgentBearer: [] components: schemas: VerifyByAgentRequest: type: object required: - programId additionalProperties: false properties: programId: type: string description: Verification program to run. fieldsToDisclose: description: > Omit, `"*"`, or a non-empty list of field names. - Iden3: omit to return an empty `verifiableCredential` (queries still run on the full credential); `"*"` keeps every subject field except `id`. - SD-JWT: omit to disclose the claims the program queries; `"*"` attaches every presentable disclosure. oneOf: - type: string enum: - '*' - type: array minItems: 1 items: type: string minLength: 1 example: '*' nonce: type: string description: > SD-JWT programs only. Verifier challenge bound into the key-binding JWT. Required when the credential was issued with `cnf.jwk`. VerifyByAgentResponse: type: object required: - verificationResult properties: verificationResult: $ref: '#/components/schemas/AgentVerificationResult' AgentVerificationResult: type: object required: - status properties: status: type: string enum: - Compliant - Non-Compliant - NotFound verifiablePresentation: allOf: - $ref: '#/components/schemas/AgentVerifiablePresentation' description: Present only when `status` is `Compliant`. CredentialError: type: object required: - code - message properties: code: type: string description: Machine-readable Credential API error code. enum: - INVALID_PARAMETER - UNAUTHORIZED - FORBIDDEN - CREDENTIAL_STORAGE_UNAVAILABLE - VERIFICATION_PROGRAM_NOT_FOUND message: type: string AgentVerifiablePresentation: type: object required: - '@context' - type - holder - verifiableCredential properties: '@context': type: array items: type: string example: - https://www.w3.org/2018/credentials/v1 type: type: array items: type: string example: - VerifiablePresentation holder: type: string description: Holder DID. verifiableCredential: type: array description: > Iden3: W3C credential objects. BJJ credentials embed the issuer proof. SD-JWT: compact presentation strings (`~~[]`). items: oneOf: - type: object additionalProperties: true - type: string responses: CredentialBadRequest: description: Invalid query or body content: application/json: schema: $ref: '#/components/schemas/CredentialError' example: code: INVALID_PARAMETER message: limit must be between 1 and 100 CredentialUnauthorized: description: Missing or invalid bearer token content: application/json: schema: $ref: '#/components/schemas/CredentialError' CredentialForbidden: description: User JWT on verify-by-agent, or agent JWT missing the required scope content: application/json: schema: $ref: '#/components/schemas/CredentialError' example: code: FORBIDDEN message: This endpoint requires an agent JWT CredentialStorageUnavailable: description: Credential storage temporarily unavailable content: application/json: schema: $ref: '#/components/schemas/CredentialError' example: code: CREDENTIAL_STORAGE_UNAVAILABLE message: Failed to read credential envelope securitySchemes: AgentBearer: type: http scheme: bearer bearerFormat: JWT description: Agent JWT from `POST /v2/auth/agent/session`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.