Trust Registry

ITrustRegistry

public interface ITrustRegistry
{
    Task<bool> IsTrustedIssuerAsync(
        string issuerDid,
        string credentialType,
        string tenantId,
        CancellationToken ct = default);

    Task<IReadOnlyList<TrustedIssuer>> GetTrustedIssuersAsync(
        string credentialType,
        string tenantId,
        CancellationToken ct = default);
}

public record TrustedIssuer
{
    public string IssuerDid { get; init; } = default!;
    public string[] CredentialTypes { get; init; } = [];
    public string DisplayName { get; init; } = default!;
    public DateTimeOffset AddedAt { get; init; }
}

Managing Trusted Issuers

// Add a trusted issuer:
POST /api/trust-registry/issuers
{
  "issuerDid": "did:web:kyb-registry.example.com",
  "credentialTypes": ["KYBVerificationCredential", "AMLCheckCredential"],
  "displayName": "Example KYB Registry",
  "tenantId": "tenant-acme"
}

// Remove a trusted issuer:
DELETE /api/trust-registry/issuers/did:web:kyb-registry.example.com?tenantId=tenant-acme

Trust is Per-Credential-Type

A DID trusted for one credential type is not automatically trusted for others. This granularity prevents a trusted KYB issuer from issuing financial audit credentials that your workflow also accepts.