Token Status List: revocation anyone can check
The Token Status List is a compact, signed bit array in which an issuer publishes the status of many credentials. A verifier looks up whether a specific credential is still valid — without revealing to the issuer which one it is checking.
How it works
Every credential carries a reference to a list and an index. The list is compressed and signed; a set bit means revoked or suspended. Many credentials share one list, which protects privacy.
At Mandact
Mandates reference a status list (lib/credential/statusList.ts); the SDK's offline check fetches and caches it. For the binding decision, /v1/verify additionally checks the status live — without a cache.
Two levels, one truth
Offline the list suffices for a quick pre-check; before an action with legal effect the live status counts. A revocation takes effect there from the next check.
Status
Implemented; used in the SDK offline check.