Token Status List (TSL)

Note

Non-final document: IETF draft (version 20) defining the Token Status List (TSL), a status mechanism for JOSE or COSE tokens, including JWT, SD-JWT, CWT and mdoc.

Summary

Purpose

The IETF draft specification draft-ietf-oauth-status-list-20 (20 April 2026) defines the Token Status List (TSL) draft-ietf-oauth-status-list-20:

The principle: each token issued (the “referenced token”) is given an index in a bit array; the value of the bits at that index gives its status. This array, the status list, is published in a signed token, in JWT or CWT format draft-ietf-oauth-status-list-20, [1.](#section-1) [Introduction](#name-introduction). The eIDAS acts use it as a revocation mechanism.

Who it applies to

The draft itself imposes nothing. The eIDAS acts refer to it by two routes.

• Attestations and PID. Annex II to Implementing Regulation 2024/2979 makes clauses 2 to 6 of specification ETSI TS 119 472-1 V1.2.1 applicable, subject to adaptations; one of them adds the draft, in its version 20, to its normative references Annex II. That annex is binding on attestations issued to wallets, which must comply with at least one of its standards Art. 4(1), on PID, issued in accordance with its clauses 5 and 6, with certain sub-clauses excepted Annex, and on wallet providers, whose solutions must support these formats Art. 8.
• Wallet unit attestations. Wallet providers ensure that these attestations comply with Annex Ib to the same regulation Art. 6(2). Under that annex, a wallet provider must use token status lists as the revocation mechanism for key attestations and wallet instance attestations. This requirement refers to the IETF Token Status List specification without a version number Annex Ib.

Key points

• SD-JWT VC format. The status member of an attestation may contain the status_list member as specified in clause 6.2 of the draft Annex II. In the draft, status_list designates the status list token by a URI (uri) and the index to be consulted (idx) draft-ietf-oauth-status-list-20, [6.2.](#section-6.2) [Referenced Token in JOSE](#name-referenced-token-in-jose).
• ISO/IEC-mdoc format. One of the revocation mechanisms provided for the mobile security object (MSO) is the status list. This mechanism is specified by reference to version 20 of the token status list specification; the MSO revocation list takes the form of a status list token in CWT format Annex II.
• Revoked, not suspended. For PID, qualified attestations and those of public sector bodies, only the draft’s “valid” and “invalid” values must be used; the revocation of an MSO is permanent Annex II. The draft also provides for a temporary “SUSPENDED” status draft-ietf-oauth-status-list-20, [7.1.](#section-7.1) [Status Types Values](#name-status-types-values).
• Checking by the relying party. Checking the MSO revocation list is optional for the relying party; a relying party that must be able to check the revocation status supports both mechanisms provided Annex II.
• List size and privacy. The wallet provider ensures that the status lists of its wallet instance attestations are sufficiently large to prevent correlation and protect user privacy Annex Ib.

Clauses referred to by the acts

• Clause 6.2 of the draft (referenced token in JOSE): adaptation EAA-5.2.10.1-06 of specification ETSI TS 119 472-1 Annex II.
• mdoc format: references to the draft mostly without a clause number; its sections 8.2 and 9.2 are cited for the identifier list mechanism Annex II.
• Annex Ib: reference to the specification without a version Annex Ib.
• Annexes Ib and II to Implementing Regulation 2024/2979 reflect the changes made by Implementing Regulation 2026/1731 Implementing Regulation (EU) 2026/1731; this summary cites the consolidated version.

Links

• Acts that refer to it: Implementing Regulations 2024/2979 Implementing Regulation (EU) 2024/2979 — consolidated version of 11/08/2026, 2026/1731 Implementing Regulation (EU) 2026/1731 and, by reference, 2024/2977 Implementing Regulation (EU) 2024/2977 — consolidated version of 11/08/2026.
• Intermediate standard: ETSI TS 119 472-1 ETSI TS 119 472-1 V1.2.1.
• Related standards: version 21 of the draft draft-ietf-oauth-status-list-21; RFC 8392, CWT RFC 8392; OpenID4VCI 1.0 OpenID4VCI 1.0.
• Learning path: step 3, the European wallet.

Written by Asphalia.