The problem
A résumé is self-attested. Nothing on it has been checked by anyone, and the parts most worth checking (did they deliver, on time, repeatedly) are exactly the parts that are hardest to check.
Reference calls are theatre: the candidate picks who answers the phone, and the answer arrives as an unverifiable anecdote.
Third-party background checks are slow, expensive, and tell you about the past risk of a person rather than the reliability of their work.
The solution
- The candidate mints a share token, or exports a self-verifying bundle, at a disclosure scope they control: full breakdown, band only, or minimal.
- You verify the EdDSA signature, the expiry and the revocation status offline, against keys published at a did:web issuer identity. No API key is needed for any of it, and a revoked credential stops verifying immediately.
- What you get back is not an opinion. It is a deterministic score with a component breakdown, computed from outcomes that third parties confirmed.
How it works
Candidate shares
token or export
Offline verify
signature + revocation
Decision input
components read
The middle step needs no network call to Credda at all if you already hold the issuer keys, which is the point of signing the credential.
The API calls involved
- GET/api/v1/verify/{token}Public trust check for a share token. No API key.
- GET/api/v1/verify/{token}/credentialThe signed Verifiable Trust Credential itself.
- GET/api/v1/verify/{token}/exportSelf-verifying bundle: public score + signed W3C VC + revocation pointer.
- GET/api/v1/status/revocationStatusList2021 revocation list, served as a signed credential.
- GET/.well-known/did.jsonIssuer DID document: the published keys you verify against.
- GET/api/v1/users/{id}/score/componentsSix named 0–100 components, if the candidate granted full scope.
- GET/api/v1/users/{id}/trust-summaryEvidence-based summary, strengths and risks, deliberately never a hire/no-hire verdict.
Every endpoint on this page except the last two is public and unauthenticated.
$ curl https://api.credda.io/api/v1/verify/THEIR_SHARE_TOKEN
{ "finalScore": 87.4, "scoreBand": "Good", "credential": "..." }
# or entirely offline, in CI:
$ credda verify their-export.json # exit 0 valid, 2 invalid
Full request and response shapes are in the
API reference.
developers