Revocation

Checking and managing revocation status for delegation credentials

Revocation Checking

KYA-OS requires implementation of credential revocation to enable withdrawal of delegation.

StatusList2021 Verification

The preferred revocation method uses the W3C StatusList2021 specification:

async function checkRevocationStatus(credential) {
  if (!credential.credentialStatus) {
    throw new Error("Credential lacks status information");
  }

  if (credential.credentialStatus.type !== "StatusList2021Entry") {
    throw new Error("Unsupported status type");
  }

  // Extract status list URL and index
  const statusListUrl =
    credential.credentialStatus.statusListCredential ||
    credential.credentialStatus.id.split("#")[0];
  const statusListIndex = parseInt(
    credential.credentialStatus.statusListIndex,
    10
  );

  // Fetch the status list
  const response = await fetch(statusListUrl);
  const statusListCredential = await response.json();

  // Decode and check the status
  const statusList = decodeStatusList(
    statusListCredential.credentialSubject.encodedList
  );
  const isRevoked = statusList.getStatus(statusListIndex);

  return { isRevoked };
}

Revocation Freshness

Revocation status is evaluated on every verification - verification verdicts are never cached (the v1.13.0 security fix: the verifier's cache holds only the signature-validity result, so a revoked credential can no longer keep verifying from a warm cache). If your deployment can tolerate bounded status-list staleness, declare it explicitly by wrapping your status resolver with withStatusCache(resolver, { maxStalenessMs }) - never with ad-hoc TTL caching of verification results.

For performance optimization:

  1. Implement efficient status list processing
  2. Consider webhook notifications for critical credential revocations