Staff-issued Open Badges v3 issuance and public verification have shipped. A
signed-in allowlisted session that may act on an organization mints an
assertion. Anyone can verify a stored assertion. Earned badges for that
organization are listed at /app/profile.
Issuance
POST /api/badges mints a signed assertion. The caller must be signed in, and
the session must be allowed to act on orgId (the active organization, or an
allowlisted session with no active organization naming that org). carlLevel
must be an integer 0–6 at or below that organization's stored certification. The
issuer signing key is not part of the request.
Verification
GET /api/badges/verify checks a stored assertion by id. No session is
required. The JSON body is { id, status, reasons? }. status is valid,
invalid, or not-found. reasons is present only when status is invalid.
The body does not include the assertion or the organization id. The scorecard's
Verify link uses this route.
What is not served
CARL does not serve an SVG badge.
There is no image at /badge/[owner]/[repo].svg, and there is no live-updating
repository image. Do not describe that URL as a CARL level.
Related
- Conformance claims: what can honestly be published as a CARL level.
- Trademark: permitted and restricted use of the CARL marks.
- Earned badges: the signed-in list at
/app/profile.