Every code, and what to do about it.

The address could not be reached, timed out, or answered with an error status.

Open the URL in a browser. If it needs a login or sits behind a company network, download the credential and upload the file instead.

The bytes are not a badge credential in any format the validator supports.

Check that you are not uploading a decorative copy of the badge image, a PDF certificate, or a screenshot.

The image is a valid PNG or SVG, but no credential is baked into it.

Ask the issuer for the hosted credential URL or the JSON file. Images saved from social media almost always lose the baked payload.

The PNG structure is damaged or truncated.

Download the original file again rather than copying it out of a document or a chat app.

The SVG could not be parsed, or its assertion block is broken.

Re-export the badge from the issuing platform, or use the hosted URL.

The document is not well formed JSON.

If you pasted the credential into a file by hand, check for a missing bracket or a trailing comma.

The token is not a well formed compact JWS.

A VC-JWT has exactly three base64url segments separated by dots. Copy the whole token, including the signature.

The JWT header is missing required fields or declares an unexpected type.

This is an issuing problem. Send the token to the platform that produced it.

The credential does not declare the @context the standard requires.

Usually means a credential fragment was exported rather than the full document.

A declared context could not be resolved or expanded.

Often a temporary network problem at the context host. Try again, then report it to the issuer.

The document is deeper, larger, or more repetitive than the parser limits allow.

Split batch exports into individual credentials before validating them.

A property the specification marks as required is absent, such as the issuer, the achievement, or the issuance date.

The credential cannot be relied on as evidence. Ask the issuer to reissue it.

A property exists but holds a value of the wrong shape, such as a malformed date.

Note the path reported with the error and send it to the issuing platform.

The credential body does not match the published JSON Schema for its type.

Treat it as a conformance bug on the issuing side.

A schema the credential itself points to rejected the document.

The issuer declared a stricter schema than the credential satisfies.

The type array does not describe an Open Badges credential the validator recognises.

Check whether the document is a different kind of verifiable credential.

The signature does not match the document. The content has changed since it was signed, or it was signed with a different key.

Do not trust the credential. Ask the issuer for a fresh copy and compare the two.

The key or DID named in the proof could not be fetched or read.

Common when an issuer rotates keys or moves a key file. The issuer has to republish it.

The proof uses a mechanism outside the supported set.

Tell us which proof type you are working with and we will look at adding it.

The data integrity cryptosuite is not one we verify.

Same as above. Send an example and we will take a look.

The issuer has revoked this credential on its status list.

The badge was genuine and is no longer valid. Only the issuer can explain why.

The credential is suspended, which is usually temporary.

Ask the issuer when it will be reinstated.

The validity window closed before today.

Expiry is normal for credentials that need renewal. The achievement still happened.

The validity window starts in the future.

Check the issuance date against the current date.

An identifier is not a usable IRI or DID.

An issuing bug. Report it with the reported path.

A JWT claim disagrees with the credential body it wraps, for example a different subject.

Do not trust the credential until the issuer explains it.

A claim the profile requires is absent from the token.

Report it to the issuing platform.

An issuer profile, achievement definition, image, or evidence link did not resolve.

Often a reorganised website. The credential may still be signed and valid.

The status mechanism is not one we can read.

Ask the issuer which status list they publish.

A refresh service was declared and did not answer.

Non fatal on its own. Try again later.

An expected recipient was supplied and the credential names someone else.

The public form never supplies one, so this only appears through the API.

The verifiable credential profile is outside VC 1.1 and VC 2.0.

Send us the credential and we will look at the profile.

Contexts are declared in the wrong order, which changes how terms resolve.

The Verifiable Credentials context has to come first. Report it to the issuer.