Agent Skills catalogue
Every skill below lives in L3-iGrant/skills and is installed with npx skills add L3-iGrant/skills. This catalogue is generated from each skill's SKILL.md, so it always reflects the latest published version. Use the search box to filter, and select any card to open its SKILL.md.
Start here
Read the overview skill first; every other skill assumes the contracts it defines.
API reference
One skill per group of the OID4VC API, field-exact and linked to the live documentation.
igrantio-api-api-keys
API Key group of the iGrant.io OID4VC API: create, update, delete, and list the API keys of an organisation, and bind a key to a sandbox organisation. Covers the scope enum (config, audit, service, onboard), the 30-day expiry fallback, the fact that every answer carries the full signed token, and the token rotation that create, update, and bind each cause. Use when you provision server-side credentials for the OpenID4VCI and OpenID4VP endpoints, or when a key must run against a sandbox wallet.
igrantio-api-holder
Holder group of the iGrant.io OpenID4VC API: take a credential offer into the organisation wallet (receive, user PIN, deferred, authorization-code exchange), list, read, accept, configure auto-present, re-issue and delete held credentials, read credential issuer metadata and wallet unit status, make a credential offer, and answer an OpenID4VP request with the V3 receive, filter and send operations, plus the wallet notification list and the Server-Sent Events stream. Use this skill when your organisation acts as the holder wallet, or whenever you need the exact holder path, correlation id, or enum value.
igrantio-api-issuer
Issuer group of the iGrant.io OpenID4VC API: create and maintain credential definitions (claim path pointers, display, revocation, scopes, logo and cover images, templates, URI preview), issue credentials InTime or Deferred over OpenID4VCI 1.0, read and delete issuance history, update the revocation status of an issued credential, and validate transaction data. Use this skill when you build the issuing side of an EUDI Wallet (EUDIW) or European Business Wallet (EUBW) integration, or whenever you need the exact issuer path, request field, or enum value.
igrantio-api-key-management
The Key Management group of the iGrant.io OID4VC API: configure and read the secure vaults (iGrant.io, Hashicorp, QTSP, DB-backed) that hold the signing keys, list the keys as JWKs with their DIDs, create and delete ECDSA P-256 keys, generate a CSR, upload an X.509 certificate chain to fill x5c, and select a Qualified Trust Service Provider signing credential over the CSC API. Use when you set up or rotate the keys that sign OID4VCI credentials and OpenID4VP responses.
igrantio-api-sandboxes
Sandboxes group of the iGrant.io OID4VC API: create, read, update, delete, and list sandbox organisations - separate test wallets inside your organisation, each with its own credential definitions, presentation definitions, webhooks, and keys - plus name, logo image, and cover image updates. This skill is the canonical home for the sandbox call style: how the X-SandboxOrgId header works, why it works only with a bearer token, how X-SubwalletId falls back, and how to bind an API key to a sandbox organisation. Read it before you send any OID4VC request against a sandbox.
igrantio-api-team-management
Team Management group of the iGrant.io OID4VC API: create, read, delete, and list the admins of an organisation, and enable or disable passwordless login with EUDI Wallet for one admin. This is the API behind the Manage Team page of the dashboard. Covers the admin record fields (roleName, pendingInvitation, authentication.oidcPasswordless), the search filter on the list, and the split between the v2 onboard endpoints and the v3 passwordless-login endpoint. Use when you add or remove admins of an organisation, or when you turn wallet-based login on or off for an admin.
igrantio-api-trust-anchor
The Trust Anchor group of the iGrant.io OID4VC API: manage the ETSI trust lists (trust authorities) that the service uses to validate issuers and verifiers in OID4VCI and OpenID4VP flows. Create, read, update, enable or disable, delete and list trust authorities, and work with the two built-in trust lists that every organisation gets. Use when you decide which issuers a verifier accepts, or which verifiers a wallet trusts.
igrantio-api-user-management
User Management group of the iGrant.io OID4VC API: the account of the signed-in admin. Read and update the profile, read and update the avatar image, reset the password, read the authentication configuration, and manage the passwordless-login methods - link a PID credential from an EUDI Wallet or an iGrant.io Authenticator credential, monitor both with SSE streams, and remove them. This is the API behind the Manage User page of the dashboard. Use when you build a profile or account-settings flow, or when you wire up passwordless login for the signed-in admin.
igrantio-api-verifier
Verifier group of the iGrant.io OpenID4VC API: create presentation definitions that hold a DCQL query (credential queries, claim sets, credential sets, trusted authorities, transaction data templates), send an OpenID4VP 1.0 Authorization Request with the V3 send operation, read and list the verification history, receive a Digital Credentials API response, revalidate a finished exchange, and delete a verification record. Use this skill when you build the relying-party side of an EUDI Wallet (EUDIW) or European Business Wallet (EUBW) integration, or whenever you need the exact verifier path, DCQL field, or enum value.
igrantio-api-wallet-provider
Wallet Provider group of the iGrant.io OID4VC API: deploy the organisation wallet, turn on the wallet provider capability, register and manage wallet units (the records behind a Wallet Unit Attestation, WUA), list organisation wallet units with their LPID and WUA status, and read wallet provider performance statistics. Use when you act as an EUDI Wallet (EUDIW) or European Business Wallet (EUBW) wallet provider under eIDAS 2.0, or when you must read or change the OID4VC deployment of an organisation.
igrantio-api-webhooks
The Webhook group of the iGrant.io OID4VC API: create, read, update, delete and list webhooks, discover the subscribable event types and payload content types, ping a payload URL, and read recent deliveries. Covers the delivery envelope (deliveryID, webhookID, timestamp, type, data), the X-IGrant-Signature HMAC-SHA256 scheme, and the flat response shapes of ping and single-delivery read. Use when you register or debug an OWS webhook receiver, verify a signature, or check why an event did not arrive.
Credential schemas
Claim path pointer schemas from the verifiable data registry, ready to become credential definitions.
igrantio-credential-schema-age-verification
Claim path pointer schema for the EUDI Age Verification attestation (doctype eu.europa.ec.av.1) from the iGrant.io verifiable data registry. It holds the five age-over booleans - age_over_14, age_over_16, age_over_18, age_over_21 and age_over_65 - as selectively disclosable mdoc claims. Use this skill when you create an age verification credential definition on the iGrant.io OpenID4VC API, or when you need the exact claim paths, namespace and doctype for a proof-of-age credential.
igrantio-credential-schema-authenticator
Claim path pointer schema for the iGrant.io Authenticator credential (credential type io.igrant.authenticator) from the iGrant.io verifiable data registry. It holds one claim, email_address, and the registry publishes it in all three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you create an authenticator credential definition on the iGrant.io OpenID4VC API, when you build passwordless sign-in with a wallet, or when you need the exact claim path for each of the three credential formats.
igrantio-credential-schema-boarding-pass
Claim path pointer schema for the Boarding Pass credential (credential type VerifiableFerryBoardingPassCredentialSDJWT, namespace eu.europa.ec.eudi.boardingpass) from the iGrant.io verifiable data registry. It holds the 14 flat travel claims of a ferry or airline boarding pass: departure and arrival date, time and port, passenger name, seat number and type, ticket number, ticket QR and vessel description. Use this skill when you create a boarding pass credential definition on the iGrant.io OpenID4VC API, or when you need the exact claim paths of a travel ticket credential.
igrantio-credential-schema-certificate-of-registration
Claim path pointer schema for the Certificate Of Registration credential (credential type CertificateOfRegistration, mdoc doctype org.iso.18013.5.1.cor) from the iGrant.io verifiable data registry. It holds 13 claims that attest a company registration: name, orgNumber, legalForm, legalStatus, activity, registrationDate and the registeredAddress object with its six parts. The registry publishes it in all three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you create a company registration credential definition on the iGrant.io OpenID4VC API or build a European Business Wallet (EUBW) integration.
igrantio-credential-schema-e-receipt
Claim path pointer schema for the eReceipt credential (credential type VerifiablevReceiptSDJWT, namespace eu.europa.ec.eudi.verifiablereceipt) from the iGrant.io verifiable data registry. It holds 33 nested claims of a digital purchase receipt: seller address and party name, purchase_receipt lines and items, monetary_total, tax_total and tax_subtotal, payment and card account data, and delivery date and time. Use this skill when you create an eReceipt credential definition on the iGrant.io OpenID4VC API, or when you need the exact nested claim paths of a verifiable purchase receipt.
igrantio-credential-schema-loyalty-card
Claim path pointer schema for the Loyalty Card credential (credential type LoyaltyCard, mdoc doctype eu.europa.ec.eudi.loyaltycard) from the iGrant.io verifiable data registry. It holds 25 nested claims in five groups: credential, customer, loyalty_card, organization and portfolio, with the card identifier and status, the customer contact data, and the available points, miles and wallet balance. The registry publishes it in all three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you create a loyalty card credential definition on the iGrant.io OpenID4VC API.
igrantio-credential-schema-lpid
Claim path pointer schema for Legal Person Identification Data (LPID, credential type LegalPersonIdentificationData, mdoc doctype org.iso.18013.5.1.lpid) from the iGrant.io verifiable data registry. It holds two claims, identifier and legalName, and the registry publishes it in all three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you create an LPID credential definition on the iGrant.io OpenID4VC API, when you build a European Business Wallet (EUBW) integration, or when you need the exact claim path for each of the three credential formats.
igrantio-credential-schema-mobile-driving-license
Claim path pointer schema for the ISO/IEC 18013-5 Mobile Driving Licence (mDL, doctype org.iso.18013.5.1.mDL) from the iGrant.io verifiable data registry. It holds the 25 mdoc claims of the org.iso.18013.5.1 namespace, from family_name and birth_date to driving_privileges, portrait, age_over_18 and issuing_authority. Use this skill when you create an mDL credential definition on the iGrant.io OpenID4VC API, or when you need the exact claim paths, namespace and doctype of a mobile driving licence.
igrantio-credential-schema-passport
Claim path pointer schema for the Passport credential (credential type Passport, mdoc doctype org.iso.18013.5.1.passport) from the iGrant.io verifiable data registry. It holds the travel document claims: serialNumber, firstName, lastName, birthDate, gender, nationality, personalNumber, expiryDate, issuerAuthority, image and signature. The registry publishes it in all three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you create a passport credential definition on the iGrant.io OpenID4VC API, or when you need the exact claim path for each of the three credential formats.
igrantio-credential-schema-payment-wallet-attestation
Claim path pointer schema for the Payment Wallet Attestation, titled Payment Authenticator (v2), from the iGrant.io verifiable data registry. It holds the eight fundingSource claims of a tokenised payment instrument: aliasId, currency, icon, iin, panLastFour, parLastFour, scheme and type. Use this skill when you create a payment wallet attestation credential definition on the iGrant.io OpenID4VC API, when you build a Strong Customer Authentication or payment flow, or when you validate transaction data that carries a paymentWalletAttestation.
igrantio-credential-schema-pda1
Claim path pointer schema for the Portable Document A1 (PDA1) credential, the EU social security document that states which member state legislation applies to a worker. Holds the registry documents for the dc+sd-jwt, jwt_vc_json and mso_mdoc formats, with all six PDA1 sections: personal data, applicable legislation, status confirmation, employer or self-employed activity, work places, and the issuing institution. Use this skill when you build a PDA1 credential definition for the iGrant.io OpenID4VC API, or when you need the exact PDA1 claim path.
igrantio-credential-schema-photo-id
Claim path pointer schema for the Photo ID credential, the ISO/IEC 23220 photo identity document of the EUDI Wallet. Holds the registry documents for the dc+sd-jwt, jwt_vc_json and mso_mdoc formats, with the iso23220 core person claims, the photoid extra identity claims, and the dtc digital travel credential data groups. Use this skill when you build a Photo ID credential definition for the iGrant.io OpenID4VC API, or when you need the exact Photo ID claim path.
igrantio-credential-schema-pid-v2
Claim path pointer schema for the Person Identification Data (PID) credential of EU ARF 2.8.0, the current core identity attestation of the EUDI Wallet. Holds the registry documents for the dc+sd-jwt and mso_mdoc formats, with names, place of birth, nationalities, document number, issuing authority, portrait, resident address and trust anchor, and it marks which claims are mandatory. Use this skill when you build an ARF 2.8.0 PID credential definition for the iGrant.io OpenID4VC API.
igrantio-credential-schema-pid
Claim path pointer schema for the Person Identification Data (PID) credential, the core identity attestation of the EUDI Wallet. Holds the registry documents for the dc+sd-jwt, jwt_vc_json and mso_mdoc formats, with name, birth date, address, contact data and the age-over flags. Use this skill when you build a PID credential definition for the iGrant.io OpenID4VC API, or when you need the exact PID claim path. For the EU ARF 2.8.0 shape, read igrantio-credential-schema-pid-v2.
igrantio-credential-schema-qesac
Claim path pointer schema for the QESAC credential. The registry defines the credential in the dc+sd-jwt format with one mandatory claim, credentialId. Use this skill when you build a QESAC credential definition for the iGrant.io OpenID4VC API, or when you need the exact QESAC claim path.
igrantio-credential-schema-sca-payment-account
Claim path pointer schema for the Payment Account Credential (TS12), an SCA payment credential of the EUDI Wallet. The registry defines it in the dc+sd-jwt format with three mandatory and selectively disclosable claims: iban, bic and currency. Use this skill when you build a payment account credential definition for the iGrant.io OpenID4VC API.
igrantio-credential-schema-sca-payment-card
Claim path pointer schema for the Payment Card Credential (TS12), an SCA payment credential of the EUDI Wallet. The registry defines it in the dc+sd-jwt format with three mandatory and selectively disclosable claims: pan_last_four, scheme and scheme_logo. Use this skill when you build a payment card credential definition for the iGrant.io OpenID4VC API.
igrantio-credential-schema-sca-payment-user
Claim path pointer schema for the Payment User Credential (TS12), an SCA payment credential of the EUDI Wallet. The registry defines it in the dc+sd-jwt format and holds an empty claims array, so the credential carries no registry claim path. Use this skill when you build a payment user credential definition for the iGrant.io OpenID4VC API.
igrantio-credential-schema-software-statement
Claim path pointer schema for the Software Statement credential, which attests a registered client application. The registry defines it in the dc+sd-jwt format with one mandatory claim, client_uri. Use this skill when you build a software statement credential definition for the iGrant.io OpenID4VC API.
igrantio-credential-schema-student-id
Claim path pointer schema for the Student ID credential, which attests the enrolment and the affiliation of a student. Holds the registry documents for the dc+sd-jwt, jwt_vc_json and mso_mdoc formats, with the eduPerson and SCHAC attributes of the education federations: eduPersonAffiliation, eduPersonPrincipalName, schacHomeOrganization and more. Use this skill when you build a Student ID credential definition for the iGrant.io OpenID4VC API.
igrantio-schema-discovery
How to find a credential schema or a DCQL query for the iGrant.io Organisation Wallet Suite. Start with the iGrant.io verifiable data registry (claim path pointer schemas and DCQL query templates). If the credential type you need is not there, check the WE BUILD attestation rulebooks catalog for a rulebook that defines it, and build the claim path pointer document from the rulebook. Use this skill when no igrantio-credential-schema-* or igrantio-dcql-query-* skill matches the credential you must issue or verify.
DCQL query templates
DCQL query documents from the registry, ready to become presentation definitions.
igrantio-dcql-query-age-verification
DCQL query template for the EU Age Verification attestation (doctype eu.europa.ec.av.1, mso_mdoc). It asks a wallet for the age threshold flags age_over_14, age_over_16, age_over_18, age_over_21 and age_over_65, and discloses no birth date and no name. Use this skill when you build an age gate for adult content, alcohol, gambling, or any service with a legal age limit, and you need the exact doctype, namespace and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-authenticator
DCQL query template for the iGrant.io Authenticator credential (credential type io.igrant.authenticator). It asks a wallet for one claim, email_address, in dc+sd-jwt, jwt_vc_json or mso_mdoc. Use this skill when you build passwordless login with an EUDI Wallet, so a returning user proves the email address that identifies the account, and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-certificate-of-registration
DCQL query template for the Certificate Of Registration credential, the company registration extract of a legal entity. It asks a wallet for the registered name, legal form, activity, registration date, legal status, organisation number and the registered address, in dc+sd-jwt, jwt_vc_json or mso_mdoc (doctype org.iso.18013.5.1.cor). Use this skill when you onboard a business with a European Business Wallet and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-loyalty-card
DCQL query template for the Loyalty Card credential. It asks a wallet for the customer details, the card identifier and status, the point, mile and wallet balances, the issuing organisation, and the credential dates, in dc+sd-jwt, jwt_vc_json or mso_mdoc (doctype eu.europa.ec.eudi.loyaltycard). Use this skill when you let a member show a loyalty card from an EUDI Wallet at checkout or at a service desk, and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-lpid
DCQL query template for Legal Person Identification Data (LPID), the identity attestation of a company or other legal person. It asks a wallet for two claims, identifier and legalName, in dc+sd-jwt, jwt_vc_json or mso_mdoc (doctype org.iso.18013.5.1.lpid). Use this skill when a European Business Wallet must prove which legal entity acts, and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-mobile-driving-license
DCQL query template for the ISO 18013-5 Mobile Driving Licence (mDL), doctype org.iso.18013.5.1.mDL in mso_mdoc. It asks a wallet for the 25 mandatory and optional data elements of the org.iso.18013.5.1 namespace, from family_name and driving_privileges to portrait, age_over_18 and un_distinguishing_sign. Use this skill when you build car rental, roadside checks, vehicle hire or an age gate on an mDL, and you need the exact doctype, namespace and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-passport
DCQL query template for the Passport credential. It asks a wallet for the serial number, personal number, first and last name, birth date, gender, nationality, expiry date, issuing authority, portrait image and signature, in dc+sd-jwt, jwt_vc_json or mso_mdoc (doctype org.iso.18013.5.1.passport). Use this skill when you build border, travel, hotel check-in or strong identity onboarding on an EUDI Wallet, and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-payment-wallet-attestation
DCQL query template for the Payment Wallet Attestation, titled Payment Authenticator (v2), credential type PaymentWalletAttestation in dc+sd-jwt. It asks a wallet for the funding source: alias identifier, currency, issuer identification number, last four digits of the PAN, card scheme, type and icon. Use this skill when you build strong customer authentication for a payment with an EUDI Wallet, and you need the exact vct, claim paths and the transaction data rule from the iGrant.io verifiable data registry.
igrantio-dcql-query-pda1
DCQL query template for the Portable Document A1 (PDA1), the EU social security attestation that says which member state legislation applies to a posted or multi-state worker. It asks a wallet for the six sections of the form, in dc+sd-jwt, jwt_vc_json or mso_mdoc (doctype org.iso.18013.5.1.pda1). Use this skill when you build labour inspection, posted worker checks or cross-border payroll on an EUDI Wallet, and you need the exact credential type and claim paths from the iGrant.io verifiable data registry.
igrantio-dcql-query-photo-id
DCQL query template for the Photo ID credential (doctype and vct eu.europa.ec.eudi.photoid.1) from the iGrant.io verifiable data registry. Holds the full claim list for three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc. Use this skill when you build an OpenID4VP presentation definition that asks an EUDI Wallet for a Photo ID, when you need the exact claim path of a travel document group (dtc), an ISO 23220 attribute (iso23220), or a photoid attribute, or when you check that your query matches the registry.
igrantio-dcql-query-pid-v2
DCQL query template for the Person Identification Data (PID) credential of EU ARF 2.8.0 (vct urn:eudi:pid:1, mDoc doctype eu.europa.ec.eudi.pid.1) from the iGrant.io verifiable data registry. Holds the claim list for dc+sd-jwt and mso_mdoc, with the name, birth name, place of birth, address parts, document number, issuing data, nationalities, portrait and trust anchor. Use this skill when you build an OpenID4VP presentation definition against the ARF 2.8.0 PID rule book, or when you need the exact claim path of a PID attribute.
igrantio-dcql-query-pid
DCQL query template for the Person Identification Data (PID) credential (vct urn:eu.europa.ec.eudi:pid:1, mDoc doctype eu.europa.ec.eudi.pid.1) from the iGrant.io verifiable data registry. Holds the claim list for three formats: dc+sd-jwt, jwt_vc_json and mso_mdoc, with the name, birth date, address, contact and age-over claims. Use this skill when you build an OpenID4VP presentation definition that asks an EUDI Wallet for identity data, or when you need the exact PID claim path for an age check or an address check. For the EU ARF 2.8.0 PID, read igrantio-dcql-query-pid-v2.
igrantio-dcql-query-qesac
DCQL query template for the QESAC credential (Qualified Electronic Signature Authorisation Credential, credential type QESAC) from the iGrant.io verifiable data registry. The dc+sd-jwt query asks for one claim, credentialId, which names the signing credential that the holder authorises. Use this skill when you build a remote signing flow: the presentation definition must set transactionDataDefinitionType to qes_data, and the send request must carry the matching transactionData with the document hashes.
igrantio-dcql-query-sca-payment-account
DCQL query template for the Payment Account Credential (TS12) from the iGrant.io verifiable data registry. The dc+sd-jwt query asks for iban, bic and currency, and the vct is the payment_account VCT metadata URL of the issuer. Use this skill when you build a Strong Customer Authentication (SCA) flow under ETSI TS 119 462 (TS12): the presentation definition must set a transactionDataDefinitionType, and the send request must carry the matching transactionData.
igrantio-dcql-query-sca-payment-card
DCQL query template for the Payment Card Credential (TS12) from the iGrant.io verifiable data registry. The dc+sd-jwt query asks for pan_last_four, scheme and scheme_logo, and the vct is the card VCT metadata URL of the issuer. Use this skill when you build a Strong Customer Authentication (SCA) flow under ETSI TS 119 462 (TS12) and the holder must confirm which card pays: the presentation definition must set a transactionDataDefinitionType, and the send request must carry the matching transactionData.
igrantio-dcql-query-sca-payment-user
DCQL query template for the Payment User Credential (TS12) from the iGrant.io verifiable data registry. The dc+sd-jwt query holds an empty claims array, so it asks for the whole credential of the payment service user, and the vct is the payment_service_user VCT metadata URL of the issuer. Use this skill when you build a Strong Customer Authentication (SCA) flow under ETSI TS 119 462 (TS12) and the holder must prove who authorises the payment: the presentation definition must set a transactionDataDefinitionType, and the send request must carry the matching transactionData.
igrantio-dcql-query-software-statement
DCQL query template for the Software Statement credential (credential type SoftwareStatement) from the iGrant.io verifiable data registry. The dc+sd-jwt query asks for one claim, client_uri, which names the client that the statement describes. Use this skill when a relying party or a wallet must check the registration of a client application before it trusts it, for example in an open banking or a dynamic client registration flow.
igrantio-dcql-query-student-id
DCQL query template for the Student ID credential from the iGrant.io verifiable data registry. Holds the claim list for three formats: dc+sd-jwt (vct VerifiableStudentID), jwt_vc_json (type VerifiableStudentIDJWT) and mso_mdoc (doctype eu.europa.ec.eudi.studentid.1). Carries the SCHAC and eduPerson attributes, for example schacHomeOrganization, eduPersonPrincipalName, eduPersonAffiliation and eduPersonScopedAffiliation. Use this skill when you build an OpenID4VP presentation definition that proves student status for a discount, a campus service or a library account.
Issuer (OpenID4VCI)
Issue verifiable credentials to an EUDI or European Business Wallet.
igrantio-issuer-backend
Build the backend for an OpenID4VCI credential ISSUER against the iGrant.io Organisation Wallet Suite (OWS). A tenant-aware Node/TypeScript (Express) service that hides per-organisation API keys behind a proxy, registers and receives OWS issuance webhooks (HMAC-verified), and pushes live status to the browser over SSE. Use when an application must issue verifiable credentials (SD-JWT VC, W3C VC, mso_mdoc) to an eIDAS 2.0 EUDI Wallet (EUDIW) or European Business Wallet (EUBW) and the API key must never reach the frontend.
igrantio-issuer-frontend
Build the browser UI for an OpenID4VCI credential ISSUER against the iGrant.io Organisation Wallet Suite. Request in-time or deferred issuance through your tenant backend proxy, render the credential-offer QR (or same-device deep link) for an EUDI Wallet (EUDIW) or European Business Wallet (EUBW), and reflect live status over SSE (offer scanned → credential accepted). Composes igrantio-frontend-client; talks to igrantio-issuer-backend.
Verifier (OpenID4VP + DCQL)
Request and verify credential presentations.
igrantio-verifier-backend
Build the backend for an OpenID4VP + DCQL credential VERIFIER / relying party against the iGrant.io Organisation Wallet Suite (OWS). A tenant-aware Node/TypeScript (Express) service that hides per-organisation API keys behind a proxy, registers and receives OWS verification webhooks (HMAC-verified), and pushes the verified result to the browser over SSE. Use when an application must request and verify a credential presentation from an eIDAS 2.0 EUDI Wallet (EUDIW) or European Business Wallet (EUBW) and the API key must never reach the frontend. Supports wallet-signed transaction data (SCA payments, e-mandates, login/risk authentication, account access, QES document signing).
igrantio-verifier-frontend
Build the browser UI for an OpenID4VP + DCQL credential VERIFIER / relying party against the iGrant.io Organisation Wallet Suite. Send a presentation request through your tenant backend proxy, render the QR (cross-device) or invoke the same-device Digital Credentials API to reach the EUDI Wallet (EUDIW) or European Business Wallet (EUBW), and read the disclosed claims + verified decision live over SSE. Composes igrantio-frontend-client; talks to igrantio-verifier-backend.
Digital Credentials API (DC API)
Same-device presentation invoked through the browser.
igrantio-dcapi-android
Same-device and cross-device credential verification on Android via the W3C Digital Credentials API (browser invokes the wallet, no QR scan needed on same device) using OpenID4VP on the iGrant.io Organisation Wallet Suite. Presentation definition with responseMode dc_api (or signed with expectedOrigins), verification request v3 with requestByReference, navigator.credentials.get invocation from Chrome 141+, then verify vpTokenResponse and trust-list status. For EUDI Wallet (EUDIW) and European Business Wallet (EUBW) relying parties under eIDAS 2.0.
igrantio-dcapi-ios
Same-device and cross-device credential verification on iOS/iPadOS via the W3C Digital Credentials API using ISO 18013-7 Annex C request/response with ISO/IEC 18013-5 mdoc/mDL credentials on the iGrant.io Organisation Wallet Suite. On iOS the DC API runs over Annex C only and the request must be signed (expectedOrigins required). Presentation definition, verification request v3 with requestByReference, wallet invocation from the browser, then verify vpTokenResponse and trust-list status. For EUDI Wallet (EUDIW) relying parties under eIDAS 2.0.
DCQL query recipes
Ready-made DCQL queries for common verification scenarios.
igrantio-dcql-claim-sets
DCQL pattern: claim_sets with fallback for selective disclosure - prefer a minimal boolean claim (is_over_21) and fall back to birth_date only when the preferred claim is unavailable, in an OpenID4VP verification of a PID SD-JWT on the iGrant.io Organisation Wallet Suite. Data-minimised age verification for EUDI Wallet (EUDIW) under eIDAS 2.0 and GDPR.
igrantio-dcql-credential-sets
DCQL pattern: credential_sets with alternatives - accept any one of several identity credentials (PID, Passport, or Photo ID, all dc+sd-jwt with cryptographic holder binding) in a single OpenID4VP verification on the iGrant.io Organisation Wallet Suite. Proof of identity for EUDI Wallet (EUDIW) relying parties under eIDAS 2.0 when multiple credential types are acceptable.
igrantio-dcql-kyc
DCQL pattern: KYC request combining two required credential groups in one OpenID4VP verification on the iGrant.io Organisation Wallet Suite - a Photo ID (mso_mdoc) for identity plus proof of address where either a Utility Bill or a Bank Statement (dc+sd-jwt) is acceptable. Know-your-customer onboarding for banks, fintechs, and regulated services with EUDI Wallet (EUDIW) under eIDAS 2.0.
igrantio-dcql-multiple-statements
DCQL pattern: request several instances of the SAME credential type in one OpenID4VP verification using multiple: true on the iGrant.io Organisation Wallet Suite - a loan provider collecting six recent BankStatement SD-JWT credentials (period, account number, holder name) in a single flow. Loan applications, income checks, and any multi-instance evidence gathering with EUDI Wallet (EUDIW) under eIDAS 2.0.
igrantio-dcql-postal-codes
DCQL pattern: claim VALUE matching - accept a credential only when a claim equals one of an allowed list, using the values array on a claim query in OpenID4VP on the iGrant.io Organisation Wallet Suite. Example: a delivery service accepts a PID/address credential (dc+sd-jwt) only for postal codes inside its delivery zones. Geographic or attribute-gated eligibility checks with EUDI Wallet (EUDIW) under eIDAS 2.0.
igrantio-dcql-student-pass
DCQL pattern: mandatory plus optional credential groups in one OpenID4VP verification on the iGrant.io Organisation Wallet Suite - a student transport pass requiring PID (mso_mdoc) plus Student ID or Enrolment Letter, with an OPTIONAL (required: false) residency group (Utility Bill or Rental Agreement) unlocking an extra discount. Shows required: false credential_sets for EUDI Wallet (EUDIW) verifiers under eIDAS 2.0.
igrantio-dcql-trusted-authority
DCQL pattern: accept a credential only when its issuer is anchored in a specific trust list, using the trusted_authorities field (etsi_tl trust list, EBSI, or OpenID Federation trust anchor) in an OpenID4VP verification on the iGrant.io Organisation Wallet Suite. Example: a University Degree SD-JWT accepted only from EU/EWC Trust List issuers. For EUDI Wallet (EUDIW) and European Business Wallet (EUBW) verifiers under eIDAS 2.0.
Holder wallet and portals
Hold credentials in an organisation wallet and build holder portals.
igrantio-business-wallet-portal
Umbrella recipe for building a CUSTOM European Business Wallet (EBW) portal on the iGrant.io Organisation Wallet Suite - the path most customers take. Orchestrates the holder skills end to end - deploy the tenant backend (igrantio-holder-backend), scaffold or hand-build the portal UI (igrantio-holder-frontend), run everything on the live notifications inbox (igrantio-holder-notifications), and look up exact endpoints in igrantio-api-holder - with the page-by-page build order (base configuration, received credentials, shared credentials, share wizard, notifications), EBW onboarding to a valid wallet unit, and DCQL test requests. Use when an organisation wants its own business wallet portal with only holder functions.
igrantio-holder-backend
Build the backend for an EUDI Wallet / European Business Wallet HOLDER (the wallet side) against the iGrant.io Organisation Wallet Suite (OWS). A tenant-aware Node/TypeScript (Express) service that hides the organisation's API key behind a proxy scoped to holder endpoints - receive credential offers (OpenID4VCI wallet side, incl. transaction code, front-channel authorization code, and deferred issuance), manage held credentials, receive and answer verifier presentation requests (OpenID4VP + DCQL wallet side), holder configuration, wallet-unit status - and relays the holder notifications SSE stream. Use when an application must act as the wallet, receiving, holding, and presenting verifiable credentials.
igrantio-holder-frontend
Build the browser UI for an EUDI Wallet / European Business Wallet HOLDER portal against the iGrant.io Organisation Wallet Suite - the customer-facing wallet frontend. Receive credential offers (OpenID4VCI - transaction code, front-channel authorization, deferred), show received/archived credentials with per-format claim rendering, blur-by-default personal data, and trust-list badges, answer verifier presentation requests through the full DCQL selection wizard (credential-set OPTION groups, claim-set disclosure profiles, multiple-instance pick, transaction-data consent), and drive everything from the live notifications inbox. Composes igrantio-frontend-client and igrantio-holder-notifications; talks to igrantio-holder-backend.
igrantio-holder-notifications
Composable building block: the iGrant.io OWS holder notifications inbox - the wallet-side channel that tells a HOLDER a credential offer, transaction code, front-channel authorization, deferred credential, or presentation request needs action. REST endpoints to list and delete notifications, a live Server-Sent Events stream (auth via the authorization query parameter because EventSource cannot send headers), a backend relay that injects the key, and a dependency-free browser client with reconnect/backoff and a notification-to-next-action decision table. Composed by igrantio-holder-backend.
Building blocks
Shared backend and frontend primitives that the flows compose.
igrantio-backend-proxy
Composable building block: a tenant-aware reverse proxy that hides per-organisation iGrant.io OWS API keys from the browser. Resolves a tenant slug to its API key, allow-lists the OWS paths the frontend may reach, injects Authorization "ApiKey <key>", and forwards to OWS. Use to add API-key hiding + per-tenant key management to any Node/TypeScript backend; the OpenID4VCI issuer and OpenID4VP verifier backends compose it.
igrantio-backend-sse
Composable building block: stream stored iGrant.io OWS webhook events to a browser over Server-Sent Events, keyed by exchange id (CredentialExchangeId / presentationExchangeId), with consume-and-delete. Provides GET /webhook/sse/:exchangeId and DELETE /webhook/:exchangeId over an EventStore. Use to push live credential issuance (OpenID4VCI) and verification (OpenID4VP) status to a frontend without polling.
igrantio-backend-webhooks
Composable building block: register, receive, and verify iGrant.io OWS digital-wallet webhooks for OpenID4VCI issuance and OpenID4VP verification events. Idempotently create a webhook via config-create-webhook (skip if one already targets the payloadUrl), verify the X-iGrant-Signature HMAC-SHA256, map each topic to its exchange id (CredentialExchangeId / presentationExchangeId), and store the event. Use to add OWS webhook handling to any Node/TypeScript backend.
igrantio-frontend-client
Generic, dependency-free browser client for the iGrant.io Organisation Wallet Suite (OWS): a typed fetch client for EUDI Wallet (EUDIW) credential issuance (OpenID4VCI) and verification (OpenID4VP) via your tenant backend proxy, a Server-Sent-Events consumer (EventSource + consume-and-delete + reconnect), and optional React hooks (useSSE, useOwsClient, credential/ verification history) plus QR/deep-link helpers. No @igrant/* SDK. Use as the shared frontend foundation for igrantio-issuer-frontend and igrantio-verifier-frontend.
igrantio-qr-code
Wallet QR code panel for EUDI Wallet (EUDIW) and European Business Wallet (EUBW) flows on the iGrant.io Organisation Wallet Suite: credential-offer / presentation-request QR with optional centre logo, optional green tick on scan, refresh that mints a new exchange, open-in-wallet deep link, transaction-code block, and pending/scanned/error states. Use whenever an issuer or verifier frontend renders a wallet QR.
igrantio-usecase-ui
Default iGrant.io look and feel for EUDI Wallet (EUDIW) and European Business Wallet (EUBW) use-case frontends, ported at exact values from the iGrant.io use-case SDK and landing page: design tokens, Byrd + Plus Jakarta Sans typography, split layout with sticky stepper cards, uppercase buttons, content card, QR box, status stages, page shell, and strings-driven i18n. Used by default when the user has not specified their own UI or layout.
Use cases
End-to-end example integrations.
igrantio-ebw-owner-id
Issue a European Business Wallet Owner ID (Legal Person Identification Data, LPID) to an organisation wallet using OpenID4VCI deferred issuance on the iGrant.io Organisation Wallet Suite, per European Wallet Consortium (EWC) RFC005. SD-JWT credential; the schema identifier stays LPID for backwards compatibility. Use when an application must issue the EUBW owner identity credential to a business wallet under eIDAS 2.0.
igrantio-eu-age-verification
EU Age Verification on the iGrant.io Organisation Wallet Suite: issue an age verification attestation as an ISO/IEC 18013-5 mdoc (doctype eu.europa.ec.av.1, boolean age_over_NN claims) via OpenID4VCI InTime, then verify a selectively disclosed age_over_18 proof via OpenID4VP + DCQL - no birthdate or identity revealed. Implements the EU Age Verification solution profile for EUDI Wallet (EUDIW) under eIDAS 2.0. Use for age-restricted content, products, or services.
Consent management
Record and manage individual consents against a data agreement.
igrantio-consent-records
Record and manage individual consents against a data agreement using the iGrant.io Consent Building Block, given a dataAgreementId and an individualId. Node/TypeScript backend for the individual Consent-Record API: create, read, list, update (allow/withdraw), history, and delete-all (GDPR right to be forgotten). Use when an application must capture and manage a user's consent decisions. Get individualId from igrantio-individuals.
igrantio-individuals
Onboard application users into the iGrant.io Consent Building Block as "individuals" and keep a mapping between your own userId and the returned individualId. Node/TypeScript backend for the Consent BB admin Individual API (create, read, update, list). Use when an application signs up users and must create a corresponding individual so GDPR consents can later be recorded against a data agreement. Pairs with igrantio-consent-records.