Trust Registry
Also called issuer trust registry, trusted issuer list, issuer registry
A trust registry is the piece of infrastructure that answers a question a portable credential can't answer on its own: not "is this credential genuine" (cryptography settles that) but "should I trust whoever issued it"? Anyone can, in principle, issue a credential that says "verified: yes." A trust registry is a public, queryable list of which issuers are actually accredited, what strength of check (see Level of Assurance) they're accredited to perform, and whether that accreditation has since been revoked.
The mechanism that makes this accountability real, not decorative, is de-listing: if an issuer turns out to be careless or fraudulent, removing it from the registry immediately flips every future check of its credentials to "reject," across every verifier that consults the registry, without anyone needing to individually blocklist that issuer themselves.
Who actually built this
The Trust over IP Foundation (ToIP) formalized the general Trust Registry Protocol pattern. The EU runs the largest deployed example most people can point to: its eIDAS "Trusted Lists" publish, per member state, every qualified trust service provider recognized under EU law, and EBSI (the European Blockchain Services Infrastructure) runs its own Trusted Issuers Registry for verifiable credentials specifically. Solidus's registry follows the same general idea at much smaller scale, with its own API, not a conformant implementation of either.
Solidus today
Solidus operates one live registry as part of Solidus Verify Capture: a public, unversioned read endpoint any verifier, or any stranger with a terminal, can query, returning an issuer's status (enrolled, suspended, or delisted) and the assurance levels it's accredited to issue at. It has been verified live and working, including its fail-closed behavior for unknown issuers.
See also
Credential Portability is the product this registry exists to make trustworthy. Level of Assurance is the accreditation scope the registry tracks per issuer. SSI discusses the centralization tradeoff a Solidus-operated registry represents.
Where it comes from
Someone else specified this. Solidus assembles it.
A trust registry. A lookup a verifier can query to ask "is this issuer accredited, and for what level of assurance?", is a pattern formalized by the Trust over IP Foundation's Trust Registry Protocol work, and already deployed at nation-state scale: the EU's eIDAS "Trusted Lists" publish every member state's qualified trust service providers, and the EU's EBSI infrastructure runs its own Trusted Issuers Registry for exactly this purpose. Solidus composes this general pattern; it did not invent the idea of a trust registry, and it does not implement ToIP's or EBSI's specific protocol wire format, it wrote its own, narrower version to fit its own credential pipeline.
How to check this
Running in production today.
curl https://capture-api.solidus.network/registry/issuers/did:solidus:testnet:1111111111111111111111zz returns a live HTTP 404 with the body {"message":"issuer not enrolled in this registry"}, confirmed 2026-07-17. Unknown issuers are rejected outright, never treated as a soft miss, checkable by anyone with a terminal, right now.