Remove public-facing API calls

[peacekeeper]

This is meant to be an internal API used to integrate VC issuing capabilities with an existing backend system such as CRM, etc. This should not contain any operations for interacting directly with a VC Holder. The API however does currently contain two such operations:

• GET on /credential/{credentialReference}/status: Retrieves the credential status and returns it in the response body.
• POST on /credential/{credentialReference}/refresh: Refreshes a credential and returns it in the response body.

These should be removed.

[kimdhamilton]

They seem reasonable to keep as internal apis...did you mean remove completely or switch to internal?

[peacekeeper]

Interesting, I haven't thought about this. I guess you're right, we could keep them and simply mark as internal instead of public!

[OR13]

This issue is stale, and has already been implemented.... this issue should be closed.

[msporny]

This was discussed on the 2021-07-27 call.

Comments made included:

• In general, there should be authorization on every endpoint.
• Internal vs. external is not a good indicator of anything.
• We need a better description related to what this issue is getting at and are leaving this issue open until either 1) the original issuer submitter opens a new, more specific issue, or 2) 30 days elapse, at which point the issue will be closed.

[msporny]

30 days elapse, at which point the issue will be closed.

This has happened, closing.