After sign-up

Renewal, suspension and revocation

A Customer account credential lasts while the person is your customer. Its signed copy is renewed on its own, weeks before it would run out, so sign-in keeps working with nothing for you to do. Each renewal carries a new document_number; the sub never changes.

A credential a collaborator shared with you works the same way: sub is your own name for the person, stable across reissues and never the issuer’s. The person is asked before each such sign-in, so prompt=none gets consent_required.

To pause or end someone’s access, suspend or revoke their credential from Customers → Issued in the hub. Their next sign-in is refused with “no longer active”, and anyone who checks the credential sees it no longer holds. Reinstating a suspension lets them straight back in.

Reading what you issued

Two reads, each with a token that has issued:read, for reconciliation and support tooling. Neither is on the sign-up path.

Your credential types

Every live type of your organization, with its claims and validity: the names you pass as type when you offer. Types are shared by all of your apps.

GET /o/<your-org-id>/api/credentials/types HTTP/1.1
Host: id.trustaige.com
Authorization: Bearer <access_token>

{
  "items": [
    {
      "name": "Customer",
      "kind": "standing",
      "claims": [{ "name": "tier", "label": "Tier", "values": ["standard", "plus"] }],
      "validity": { "days": 365, "renews": true },
      "display": { "title": "Customer", "background": "#0f766e", "text": "#ffffff" }
    }
  ]
}

Your subjects

GET /o/<your-org-id>/api/credentials/subjects lists every subject this app created, newest first, with ?claimed=true|false and the usual limit and next_page_token: what you need to reconcile your customer table against the hub.

GET /o/<your-org-id>/api/credentials/subjects/{subject} reads one: whether the person has claimed yet, and every credential you issued them with its status and dates.

{
  "subject": "7f0c9a2e-…",
  "claimed": true,
  "credentials": [
    {
      "id": "…",
      "credentialType": "Customer",
      "status": "issued",
      "issuedAt": "2026-10-01T09:12:00Z",
      "expiresAt": "2027-10-01T09:12:00Z",
      "revocable": true
    }
  ]
}

A subject this app didn’t create answers 404 unknown_subject, the same as one that never existed. Likewise an offer for a credential your app doesn’t admit is refused (403 type_not_admitted): an app issues only what it signs people in with.

GET /o/<your-org-id>/api/credentials/types HTTP/1.1
Host: id.trustaige.com
Authorization: Bearer <access_token>

{
  "items": [
    {
      "name": "Customer",
      "kind": "standing",
      "claims": [{ "name": "tier", "label": "Tier", "values": ["standard", "plus"] }],
      "validity": { "days": 365, "renews": true },
      "display": { "title": "Customer", "background": "#0f766e", "text": "#ffffff" }
    }
  ]
}

{
  "subject": "7f0c9a2e-…",
  "claimed": true,
  "credentials": [
    {
      "id": "…",
      "credentialType": "Customer",
      "status": "issued",
      "issuedAt": "2026-10-01T09:12:00Z",
      "expiresAt": "2027-10-01T09:12:00Z",
      "revocable": true
    }
  ]
}

When a customer leaves

When a customer closes their account with you, delete your records and erase their subject at Trustaige, with a token that has issued:manage:

DELETE /o/<your-org-id>/api/credentials/subjects/{subject} HTTP/1.1
Host: id.trustaige.com
Authorization: Bearer <access_token>

curl -s -X DELETE "$TRUSTAIGE_ISSUER/api/credentials/subjects/$SUBJECT" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

204 No Content, or 404 if it was already gone: treat both as done. Trustaige forgets the person as your organization knew them, and every credential you issued them reads as revoked from then on, wherever a copy is. The person keeps their own Trustaige identity; only their relationship with you ends.

Next: before you go live.

DELETE /o/<your-org-id>/api/credentials/subjects/{subject} HTTP/1.1
Host: id.trustaige.com
Authorization: Bearer <access_token>

curl -s -X DELETE "$TRUSTAIGE_ISSUER/api/credentials/subjects/$SUBJECT" \
  -H "Authorization: Bearer $ACCESS_TOKEN"