Revoke a credential without deleting the record

Expiry handles a credential that is meant to lapse. It does not handle the one issued to the wrong person, the one awarded on a mistaken result, or the one whose holder no longer qualifies.

Those need revocation.

Revoke one, or a batch

Revoke an issued or expired credential from its recipient row. Select several rows to revoke them together; pending and already-revoked rows are skipped, with the reason for each skip shown in the result. An internal reason is required. A public note is optional, and only the public note appears on the page.

Revoking is not deleting. The record stays, the public page keeps its URL, and anyone holding an old copy can still confirm what happened to it.

What the page shows

The page reports the credential as revoked. The recipient's name and attribute values are masked, downloads are hidden, and the issuer, achievement and dates remain visible. The internal reason is never published.

New credentials carry a Bitstring status list entry, so an external verifier can read the revocation without asking us. Credentials issued before status entries existed can still be revoked on our page through the registry, but an offline verifier holding the old credential cannot see that later status.

Replace, don't rewrite

A replacement is a new issue with a new public ID, a new email, and one credit. The old link stays revoked permanently. If the credential was blockchain-anchored, the anchor remains as proof that the original existed; revocation changes the status, not the chain.

What it does not do

Revocation does not erase copies someone already downloaded, and it does not make a credential disappear. It changes the status a verifier reads. If the credential should never have existed, delete it instead — but expect the public page to go with it.