Credential Schema

A credential schema is a separate, published document that says what shape a credential's claims are allowed to take, which fields exist, what type each one is, which are required, so a verifier (or issuer tooling) can check a credential is well-formed before trusting anything inside it. It's the same idea as validating a JSON API response against an OpenAPI spec, applied to Verifiable Credentials.

In the W3C Verifiable Credentials Data Model, this shows up as an optional credentialSchema property on the credential itself:

"credentialSchema": {
  "id": "https://example.org/schemas/kyc-level-1.json",
  "type": "JsonSchema"
}

The property is a pointer, not a schema language in its own right, id is a URL a verifier can fetch, and type names which schema language governs it. The two languages actually used in practice are IETF JSON Schema (the widely used, general-purpose format most API developers already know) and, less commonly, ShEx (Shape Expressions, built for validating RDF graphs directly). Either way, credentialSchema gives a verifier something concrete to check a credential's structure against, separate from, and prior to, checking whether its signature is valid.

Where it comes from

The property is part of the W3C Verifiable Credentials Data Model, from the same W3C VC Working Group and largely the same editors, Manu Sporny and Dave Longley among them, behind the rest of the data model (see the Verifiable Credential entry). JSON Schema itself is a separate, older IETF effort with its own line of editors across several draft generations (Austin Wright, Henry Andrews, and Ben Hutton among the more recent ones). Solidus designed neither the property nor either schema language it can point to.

Solidus status

Not built. Solidus's VerifiableCredential type, published in @solidus-network/types, carries no credentialSchema field, nothing in the type definition, and nothing in the issuance path, references or checks a credential against a published schema document. A credential's shape today is whatever the issuing code happens to construct; nothing independently verifies that shape against a schema a stranger could fetch and check separately.

One naming coincidence worth flagging directly: Solidus's Pod backend (pod/apps/backend/src/routes/credentials.ts) defines its own internal variable literally called credentialSchema, a Zod validator for the shape of an HTTP request body hitting the Pod's own credential-storage API. It has nothing to do with the W3C VC property described here; it's a coincidence of naming inside an unrelated part of the codebase, named here so it isn't mistaken for the real thing.

Check it yourself: npm view @solidus-network/types, then read the VerifiableCredential interface directly, credentialSchema isn't among its fields. A negative result, and this entry says so rather than implying otherwise.