📄️ Receive credential
Starts an OID4VCI issuance into the wallet of your organisation. The wallet reads the Credential Issuer Metadata of the issuer, gets the token, and receives the credential.
📄️ Receive deferred credential
Polls the OID4VCI Deferred Credential Endpoint to retrieve a credential that was not immediately available during issuance. The wallet uses the acceptance token of the credential record to make the request. If the issuer is not ready, the wallet returns the credential record with the status `credential_pending`: call again after `deferredInterval` seconds. This operation has no request body.
📄️ Receive credential with user PIN
Submits the transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. The wallet sends the transaction code with the pre-authorized code to the Token Endpoint of the issuer, and then requests the credential.
📄️ Configure auto presentation for the credential
Turns automatic presentation on or off for an accepted credential. The credential must be in `credential_accepted`. The wallet sets the same value on every active credential of the same type (the same `vct`, mDoc doctype or W3C `type`), but returns only the credential that you gave in the path.
📄️ Read credential revocation status
Checks the current revocation status of a held credential with the status list of the issuer (IETF Token Status List). The wallet reads the status list token, updates `revocationStatus` of the credential record, and returns the record. The credential must be in `credential_acked` or `credential_accepted`.
📄️ Read credential
Retrieves a credential record from the wallet of the holder by its `credentialId`.
📄️ Delete credential
Deletes a credential from the wallet of the holder, with every copy of its batch. The wallet marks the records as deleted, leaves them out of the list and the presentations, and then sends the OID4VCI `credential_deleted` notification to the issuer. That last step is best effort, so a failure there does not undo the delete. To decline an offer, delete its credential record. The wallet refuses to delete a Wallet Unit Attestation, or a credential that an extension manages.
📄️ Exchange code and receive credential
Exchanges an authorization code for an access token and receives the credential in the OID4VCI Authorization Code Flow. Call this operation after the authorization server redirects the user back with `code` and `state`.
📄️ List credential
Lists the credentials in the wallet of the holder with pagination. The wallet leaves out the credentials that you deleted, and lists the Wallet Unit Attestations last. Use the query parameters to filter the list by status, credential type, expiry, identifiers or a search term, and to set the order. With `groupBatches=true`, the list gives one row for each batch issuance, with `batchInstanceCount` and `batchAvailableCount`. The wallet replaces a value that it cannot read with the default value and does not refuse the request.
📄️ Receive verification
Processes an OpenID4VP Authorization Request from a verifier and makes a presentation record. The wallet resolves the request, checks the identity of the verifier, and stores the DCQL query, the transaction data, the trust list result and the response encryption parameters. The wallet accepts only the response type `vp_token`.
📄️ Filter verification
Filters the credentials in the wallet of the holder against the request of the verifier and returns the matches. Call this operation after the receive operation, and use the result to build the request body of the send operation.
📄️ Send verification
Builds the Verifiable Presentation from the credentials that the holder selected and sends it to the verifier.
📄️ Read verification
Retrieves a presentation record (V3) from the wallet of the holder. Give the `presentationId` that the receive operation returned. The record holds the DCQL query, the transaction data, the trust list result and the response encryption parameters.
📄️ Delete verification
Deletes a presentation record from the wallet of the holder. The response has no body.
📄️ List verification
Lists the presentation records (V3) in the wallet of the holder. You can filter the records by status and by a search term, and set the sort order. The wallet sorts the records by `updatedAt`.
📄️ Read wallet unit status
Reads the wallet unit status from the holder's point of view. The status follows the Wallet Unit Attestation (WUA) lifecycle and the presence of a Legal Person Identification Data (LPID) credential in the wallet.
📄️ Read credential issuer metadata
Reads and checks the OID4VCI Credential Issuer Metadata of a credential issuer. Give the Credential Issuer Identifier, or the URL of its metadata document. The wallet reads the metadata from the `.well-known/openid-credential-issuer` location of that identifier, and refuses it when its `credential_issuer` is not exactly that identifier. The wallet removes the keys that its metadata model does not define, including `signed_metadata`, and returns the optional keys that the issuer left out with the value `null`. Each entry of `display` gets the default value `Not Discoverable` for `location` and `description` when the issuer gives no value. The wallet does not change the contents of `credential_configurations_supported`. Use its keys as `credentialConfigurationIds` of a wallet-initiated issuance.
📄️ Request credential re-issuance
Asks the issuer for a new copy of a held credential, for example when it expires, over OID4VCI. The wallet uses the stored access token of the credential, and gets a new one with the stored refresh token when the access token has expired. Reissuance is not applicable to a Wallet Unit Attestation. This operation has no request body.
📄️ Accept credential
Accepts a received credential in the wallet of the holder. The credential must be in `credential_acked`. The wallet changes the status to `credential_accepted` and sends the OID4VCI `credential_accepted` notification to the issuer. For a batch issuance, the wallet accepts every copy of the batch and sends one notification. This operation has no request body.
📄️ Read holder global configuration
Reads the holder global configuration for OID4VCI and OpenID4VP flows. An organisation has one holder global configuration. The wallet makes it with the default values when the organisation wallet is deployed, so you do not create it. By default the wallet checks the revocation status of the held credentials once a day (`refreshCredentialStatusInterval` 86400).
📄️ Update holder global configuration
Updates the holder global configuration for OID4VCI and OpenID4VP flows. An organisation has one holder global configuration, so the path has no identifier.
📄️ Read notification
Retrieves a wallet notification by its ID. The wallet creates a notification for each OID4VCI credential lifecycle event.
📄️ Update notification
Marks a wallet notification as read. The wallet accepts only the value `read`, because a notification cannot go back to the `unread` state.
📄️ Delete notification
Deletes a wallet notification. When the notification has the type `credential_acked` and the related credential is still in the state `credential_acked`, the wallet also deletes that credential: this declines the offer. The response has no body. An unknown notification ID also gives HTTP 204.
📄️ List notification
Lists the wallet notifications for OID4VCI credential lifecycle events. You can filter the notifications by read status, by notification type and by a search term.
📄️ Delete all notifications
Deletes all wallet notifications for the organisation. There is no filter and no confirmation parameter. Unlike the delete operation for one notification, this operation keeps the credentials that the notifications refer to. The response has no body.
📄️ Stream notifications (SSE)
Streams wallet notifications for OID4VCI credential lifecycle events over Server-Sent Events. The server keeps the connection open and writes one frame for each new notification.
📄️ Create SSE ticket
Exchanges the `Authorization` header of the caller for a one-time ticket for one Server-Sent Events (SSE) operation. The browser `EventSource` API cannot set request headers, so your backend calls this operation with the API key, and the browser puts only the ticket in the SSE URL, in the `ticket` query parameter. The API key then does not appear in a URL, in the browser or in an access log.