---
title: "Setup"
description: "We will setup a Credential Status service inside of a tenant. If you don't have a tenant yet, you can learn how to create one here."
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/credential-status-service/setup
generated: 2026-07-20
---
# Setup

We will setup a Credential Status service inside of a tenant. If you don't have a tenant yet, you can learn
how to create one [here](https://docs.walt.id/enterprise-stack/administration/tenants/create.md).

Currently, status credentials can be stored and made available via five types of external services:

1. [AWS S3 Bucket](https://aws.amazon.com/s3/)
2. [Azure Blob Storage](https://azure.microsoft.com/en-us/products/storage/blobs)
3. [Google Cloud Storage](https://cloud.google.com/storage)
4. [S3-compatible Storage](https://www.cloudflare.com/en-gb/developer-platform/solutions/s3-compatible-object-storage/)
4. In-Memory

We support three ways to authenticate with each of these supported services:
1. [Managed Identity](#via-managed-identity) Recommended for AWS and Azure.
2. [Config](#via-config) Recommended for GCP and S3-compatible storage.
3. [Registry](#via-registry) Recommended for quick testing and local development.

Its also important to note how you can [configure the size of your status list](#capacity-configuration).

## via Managed Identity

The Credential Status service can be configured to use a managed identity for authentication. This is useful when you want to use a service principal for authentication. This is the recommended way to configure the Credential Status service.

**Info:**

It is currently only supported for AWS and Azure. For GCP and S3-compatible storage, we recommend you to use the `configRef` method below.

<br>

**Option: CURL**

Endpoint: `/v1/{target}/resource-api/services/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%2F%20Resource/post_v1__target__resource_api_services_create)

**Option: AWS**

Configuration options vary based on the bucket's hosting environment and its access method.

**Option: AWS domain**

      **Example Request**

      ```bash
      curl -X 'POST' \
        'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
        -H 'accept: */*' \
        -H 'Authorization: Bearer {yourToken}' \
        -H 'Content-Type: application/json' \
        -d '{
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region"
          }
        }
      }'
      ```
      
      **Body**
      
      ```json
      {
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region"
          }
        }
      }
      ```

**Option: CDN (custom domain)**

      **Example Request**

      ```bash
      curl -X 'POST' \
        'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
        -H 'accept: */*' \
        -H 'Authorization: Bearer {yourToken}' \
        -H 'Content-Type: application/json' \
        -d '{
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region"
          },
          "bucketUrl": "https://custom-domain.com"
        }
      }'
      ```
      
      **Body**
      
      ```json
      {
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region"
          },
          "bucketUrl": "https://custom-domain.com"
        }
      }
      ```
  
**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-  `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Defines registry & access credentials for chosen registry.
  - `type`: _aws_ - Indicates the type of registry, which is `aws` in this context.
  - `bucketName`: _string_ - The name of the AWS S3 bucket.
  - `region`: _string_ - The AWS region where the bucket is located.
  - `endpointUrl`: _string_ - (Optional) The URL of the S3-compatible registry bucket, e.g. `https://s3-mock.com`.
- `bucketUrl`: _string_ - (Optional) The URL of the registry bucket custom domain, e.g. `https://custom-domain.com`.

**Option: Azure**

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "azure",
      "bucketName": "bucket-name",
      "accountUrl": "account-url"
    }
  }
}'
```

**Body**

```json
{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "azure",
      "bucketName": "bucket-name",
      "accountUrl": "account-url"
    }
  }
}
```

**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-   `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Holds the details for the Azure registry configuration.
  - `type`: _azure_ - Indicates the type of registry, which is `azure` in this context.
  - `bucketName`: _string_ - The name of the Azure storage bucket.
  - `accountUrl`: _string_ - Account URL for Azure Blob Storage, e.g. "https://your-account.blob.core.windows.net".
- `bucketUrl`: _string_ - (Optional) The URL of the Azure storage bucket, specified as `https://storage-name.blob.core.windows.net/bucket-name`.

**Option: Google**

**Error:**

  Not supported.

**Option: S3-compatible**

**Error:**

  Not supported.

**Option: In-Memory**

**Error:**

  Not required.

## via Config

Instead of sending storage credentials inline for every Credential Status service, you can define reusable storage
profiles in `waltid-enterprise-api/config/resource-access.conf` and reference them via `configRef` when creating
services through the Enterprise API.

The configuration file uses HOCON and defines a `resourceAccess` map, where each entry is a named storage profile:

```hocon
resourceAccess = {
  # AWS S3 Example
  aws-s3-standard = {
    _type  = "AwsS3Access"
    id     = "s3-storage"
    region = "eu-north-1"
    bucket = { bucketName = "my-bucket" }
    credentials = {
      _type       = "AwsCredentials"
      accessKeyId = "abc"
      secretKey   = "xyz"
    }
  },

  # Azure Blob Storage Example
  azure-blob-storage = {
    _type  = "AzureBlobAccess"
    id     = "azure-storage"
    bucket = {
      bucketName = "documents"
      bucketUrl  = "https://example.blob.core.windows.net/"
    }
    credentials = {
      _type            = "AzureCredentials"
      connectionString = "DefaultEndpointsProtocol=https;AccountName=example;AccountKey=..."
    }
  },

  # Google Cloud Storage Example
  gcp-storage = {
    _type     = "GcpStorageAccess"
    id        = "gcp-storage-main"
    projectId = "my-project"
    bucket    = { bucketName = "gcp-bucket-main" }
    credentials = {
      _type = "GcpCredentials"
      serviceAccountKeyJson = {
        type                        = "service_account"
        project_id                  = "my-project"
        private_key_id              = "abc123..."
        private_key                 = "-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
"
        client_email                = "service-account@my-project.iam.gserviceaccount.com"
        client_id                   = "1234567890"
        auth_uri                    = "https://accounts.google.com/o/oauth2/auth"
        token_uri                   = "https://oauth2.googleapis.com/token"
        auth_provider_x509_cert_url = "https://www.googleapis.com/oauth2/v1/certs"
        client_x509_cert_url        = "https://www.googleapis.com/robot/v1/metadata/x509/service-account%40my-project.iam.gserviceaccount.com"
        universe_domain             = "googleapis.com"
      }
    }
}
```

When creating a `credential-status` service, you can now reference one of these profiles instead of providing the full
storage configuration inline:

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "configRef": "aws-s3-standard"
  }
}'
```

**Example Request Body**

```json
{
  "type": "credential-status",
  "config": {
    "configRef": "aws-s3-standard"
  }
}
```

At runtime, the Enterprise API resolves the `configRef` against `resource-access.conf` whenever the Credential Status service needs to read or write a status list. This allows centralized credential management and rotation without updating individual service records in the database.

## via Registry

**Option: CURL**

Endpoint: `/v1/{target}/resource-api/services/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20Resource/post_v1__target__resource_api_services_create)

**Option: AWS**

Configuration options vary based on the bucket's hosting environment and its access method.

**Option: AWS domain**

      **Example Request**

      ```bash
      curl -X 'POST' \
        'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
        -H 'accept: */*' \
        -H 'Authorization: Bearer {yourToken}' \
        -H 'Content-Type: application/json' \
        -d '{
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key"
          }
        }
      }'
      ```
      
      **Body**
      
      ```json
      {
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key"
          }
        }
      }
      ```

**Option: CDN (custom domain)**

      **Example Request**

      ```bash
      curl -X 'POST' \
        'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
        -H 'accept: */*' \
        -H 'Authorization: Bearer {yourToken}' \
        -H 'Content-Type: application/json' \
        -d '{
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key"
          },
          "bucketUrl": "https://custom-domain.com"
        }
      }'
      ```
      
      **Body**
      
      ```json
      {
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key"
          },
          "bucketUrl": "https://custom-domain.com"
        }
      }
      ```

**Option 3**

      **Example Request**

      ```bash
      curl -X 'POST' \
        'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
        -H 'accept: */*' \
        -H 'Authorization: Bearer {yourToken}' \
        -H 'Content-Type: application/json' \
        -d '{
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key",
            "endpointUrl": "https://s3-mock.com"
          }
        }
      }'
      ```
      
      **Body**
      
      ```json
      {
        "type": "credential-status",
        "config": {
          "registry": {
            "type": "aws",
            "bucketName": "bucket-name",
            "region": "region",
            "accessKeyId": "s3-access-key-id",
            "secretKey": "s3-secret-key",
            "endpointUrl": "https://s3-mock.com"
          }
        }
      }
      ```

**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-  `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Defines registry & access credentials for chosen registry.
  - `type`: _aws_ - Indicates the type of registry, which is `aws` in this context.
  - `bucketName`: _string_ - The name of the AWS S3 bucket.
  - `region`: _string_ - The AWS region where the bucket is located.
  - `accessKeyId`: _string_ - (Optional) The access key ID for accessing the AWS S3 bucket.
  - `secretKey`: _string_ - (Optional) The secret access key for accessing the AWS S3 bucket.
  - `endpointUrl`: _string_ - (Optional) The URL of the S3-compatible registry bucket, e.g. `https://s3-mock.com`.
- `bucketUrl`: _string_ - (Optional) The URL of the registry bucket custom domain, e.g. `https://custom-domain.com`.

  ---

  AWS access credentials are optional. If not provided, the default [Credential Provider Chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html) will be executed, relying on AWS environment configuration (e.g. EC2 instance IAM role-provided credentials).

**Option: Azure**

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "azure",
      "bucketName": "bucket-name",
      "connectionString": "connection-string"
    }
  }
}'
```

**Body**

```json
{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "azure",
      "bucketName": "bucket-name",
      "connectionString": "connection-string"
    }
  }
}
```

**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-   `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Holds the details for the Azure registry configuration.
  - `type`: _azure_ - Indicates the type of registry, which is `azure` in this context.
  - `bucketName`: _string_ - The name of the Azure storage bucket.
  - `connectionString`: _string_ - The connection string used to access the Azure storage account.
- `bucketUrl`: _string_ - (Optional) The URL of the Azure storage bucket, specified as `https://storage-name.blob.core.windows.net/bucket-name`.

**Option: Google**

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "gcp",
      "bucketName": "bucket-name",
      "projectId": "project-id",
      "serviceAccountKeyJson": {
        "type": "service_account",
        "project_id": "YOUR_PROJECT_ID",
        "private_key_id": "YOUR_PRIVATE_KEY_ID",
        "private_key": "-----BEGIN PRIVATE KEY-----
YOUR_PRIVATE_KEY
-----END PRIVATE KEY-----
",
        "client_email": "YOUR_SERVICE_ACCOUNT_EMAIL",
        "client_id": "YOUR_CLIENT_ID",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "token_uri": "https://oauth2.googleapis.com/token",
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/YOUR_SERVICE_ACCOUNT_EMAIL",
        "universe_domain": "googleapis.com"
      }
    }
  }
}'
```

**Body**

```json
{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "gcp",
      "bucketName": "bucket-name",
      "projectId": "project-id",
      "serviceAccountKeyJson": {
        "type": "service_account",
        "project_id": "YOUR_PROJECT_ID",
        "private_key_id": "YOUR_PRIVATE_KEY_ID",
        "private_key": "-----BEGIN PRIVATE KEY-----
YOUR_PRIVATE_KEY
-----END PRIVATE KEY-----
",
        "client_email": "YOUR_SERVICE_ACCOUNT_EMAIL",
        "client_id": "YOUR_CLIENT_ID",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "token_uri": "https://oauth2.googleapis.com/token",
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/YOUR_SERVICE_ACCOUNT_EMAIL",
        "universe_domain": "googleapis.com"
      }
    }
  }
}
```

**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-   `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Holds the details for the GCP registry configuration.
  - `type`: _gcp_ - Indicates the type of registry, which is `gcp` in this context.
  - `bucketName`: _string_ - The name of the GCP storage bucket.
  - `projectId`: _string_ - The ID of the GCP project.
  - `serviceAccountKeyJson`: _object_ - Contains the service account key details for accessing GCP.
    - `type`: _service_account_ - Specifies the type of account
    - `project_id`: _string_ - The project ID for the service account.
    - `private_key_id`: _string_ - The ID of the private key.
    - `private_key`: _string_ - The private key for the service account, specified in a PEM format.
    - `client_email`: _string_ - The email associated with the service account.
    - `client_id`: _string_ - The client ID for the service account.
    - `auth_uri`: _string_ - The URI for authentication.
    - `token_uri`: _string_ - The URI for token issuance.
    - `auth_provider_x509_cert_url`: _string_ - The URL for the authentication provider's certificate.
    - `client_x509_cert_url`: _string_ - The URL for the client certificate.
    - `universe_domain`: _string_ - The domain for the universe of the API.
- `bucketUrl`: _string_ - (Optional) The URL of the GCP storage bucket, specified as `https://storage.cloud.google.com/bucket-name`.

**Option: S3-compatible**

**Example Request**

  ```bash
  curl -X 'POST' \
    'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
    -H 'accept: */*' \
    -H 'Authorization: Bearer {yourToken}' \
    -H 'Content-Type: application/json' \
    -d '{
    "type": "credential-status",
    "config": {
      "registry": {
        "type": "aws",
        "bucketName": "bucket-name",
        "region": "region",
        "accessKeyId": "s3-access-key-id",
        "secretKey": "s3-secret-key",
        "endpointUrl": "https://s3-mock.com"
      }
    }
  }'
  ```

**Body**

  ```json
  {
    "type": "credential-status",
    "config": {
      "registry": {
        "type": "aws",
        "bucketName": "bucket-name",
        "region": "region",
        "accessKeyId": "s3-access-key-id",
        "secretKey": "s3-secret-key",
        "endpointUrl": "https://s3-mock.com"
      }
    }
  }
  ```

**Body Parameters**

-  `type`: _credential-status_ - Specifies the type of service to create. In this case, it is `credential-status`.
-  `config`: _object_ - Storage configurations for status credential service.
- `registry`: _object_ - Defines registry & access credentials for chosen registry.
  - `type`: _aws_ - Indicates the type of registry, which is `aws` in this context.
  - `bucketName`: _string_ - The name of the AWS S3 bucket.
  - `region`: _string_ - The AWS region where the bucket is located.
  - `accessKeyId`: _string_ - (Optional) The access key ID for accessing the AWS S3 bucket.
  - `secretKey`: _string_ - (Optional) The secret access key for accessing the AWS S3 bucket.
  - `endpointUrl`: _string_ - (Optional) The URL of the S3-compatible registry bucket, e.g. `https://s3-mock.com`.

**Option: In-Memory**

**Error:**

  When using `in-memory` storage, the status credential is publicly available at:
  </br>
  `/v1/{target}/credential-status-service-api/status-credential/fetch`.
  </br>
  This endpoint is disabled by default and requires the `dev-mode` feature.

  <br>

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "in-memory"
    }
  }
}'
```

**Body**

```json
{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "in-memory"
    }
  }
}
```

---

**Path Parameters**

- `orgID`: - When performing operations within an organization, it is essential to use the organization's Base URL or
  another valid host alias. For example, if your organization is named `test`, your default Base URL will
  be `test.enterprise-sandbox.walt.dev` when using the sandbox environment.
- `target`: _resourceIdentifier_ - The target indicates the organization + tenant in which to create the new credential
  status service and the service's
  ID (`{organizationID}.{tenantID}.[NewCredentialStatusServiceID]`), e.g. `waltid.tenant1.credential-status-service-id`

---

**Response Codes**

- `201` - Service created successfully.
- `401` - Invalid authentication.

## Capacity Configuration

You can configure capacity settings when creating a credential status service to enable monitoring and automatic rollover when status lists approach capacity.

**Option: CURL**

**Endpoint:** `POST /v1/{target}/resource-api/services/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Resource%20API%20%7C%20Services/post_v1__target__resource_api_services_create)

##### Example Request

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "credential-status",
  "config": {
    "registry": {
      "type": "in-memory"
    },
    "capacity": {
      "maxEntries": 32000,
      "warningThresholdPercent": 50,
      "criticalThresholdPercent": 80,
      "autoRollover": true,
      "rolloverSuffix": "-v"
    }
  }
}'
```

**Path Parameters**

- **orgID**: _String_ (required) - Your organization's Base URL. For example, if your organization is named `test`, your default Base URL will be `test.enterprise-sandbox.waltid.dev` when using the sandbox environment.

- **target**: _String_ (required) - The target resource identifier specifying the organization and tenant. Format: `{organizationID}.{tenantID}`, e.g. `waltid.tenant1`

**Header Parameters**

- **Authorization**: _String_ (required) - Bearer token obtained from your Enterprise authentication. Format: `Bearer {token}`.

**Body Parameters**

- **type**: _String_ (required) - The service type to create. Must be `"credential-status"` for this service.

- **config**: _Object_ (required) - Service configuration object containing:
  - **registry**: _Object_ (required) - Storage configuration for status credentials. See [Registry Configuration](#registry-configuration) for available options.
  - **capacity**: _Object_ (optional) - Capacity monitoring and rollover configuration. Contains:
    - **maxEntries**: _Integer_ (optional) - Maximum entries for this status list. Range: 1-32,000. Defaults to `32000`.
    - **warningThresholdPercent**: _Integer_ (optional) - Percentage at which WARNING status is triggered. Range: 1-99. Defaults to `80`.
    - **criticalThresholdPercent**: _Integer_ (optional) - Percentage at which CRITICAL status is triggered. Must be greater than `warningThresholdPercent`. Defaults to `95`.
    - **autoRollover**: _Boolean_ (optional) - Enable automatic creation of a new status list when the critical threshold is reached. Defaults to `false`.
    - **rolloverSuffix**: _String_ (optional) - Suffix appended to versioned rollover status lists (e.g., `config-v2`, `config-v3`). Defaults to `"-v"`.

### Automatic Rollover

When `autoRollover` is enabled, the system automatically creates a new status list when the current one reaches the critical threshold:

1. New entries continue to be created using the same base config ID
2. The system automatically routes to the active status list version
3. New status lists are named with the configured suffix (e.g., `config-v2`, `config-v3`)
4. Existing entries remain in their original status lists

**Info:**

Automatic rollover requires the `ES_CREDENTIAL_STATUS_CREATE_LIST` permission in addition to `ES_CREDENTIAL_STATUS_CREATE_STATUS_ENTRY`.

### Monitoring Capacity

Use the capacity endpoint to check status list usage:

```
GET /v1/{target}/credential-status-service-api/status-credential/capacity
```

See [Manage Status Credentials](https://docs.walt.id/enterprise-stack/services/credential-status-service/manage.md#check-status-list-capacity) for details on the response format and status values.