Skip to main content

Q4 2026 (October - December)

November 2026 (2026.11.x)​

This release includes breaking changes to the wallet API. Where an endpoint still has an old path in the iGrant.io cloud service, its endpoint page shows that path behind a switch.

Organisation Wallet Suite​

  • One path scheme for the wallet API - all wallet routes now follow /v4/{group}/ows/{role}, without the digital-wallet, openid and sdjwt segments, and path parameters are named after their resources
  • Issuance history - the issuance history replaces the credential history as the record of one credential configuration offered to one wallet (credentialExchangeId), with a typed issue body, a transaction code generated by the issuer and a list of its issued credentials
  • Several credential configurations in one offer - one issue call creates an issuance history for each credential configuration of the definition, all in one credential offer with one QR code. Filter by offerId to find them
  • Key attestation checks - the issuer rejects a self-attested key attestation: it must be signed by a wallet provider or, on Android, chain to the Google Hardware Attestation Root. Each check is recorded with a stable KA_* code and shown in the dashboard
  • Display of the other party - records show the name, logo and cover image exactly as the other party provides them, or null, instead of placeholders such as "Unknown". New organisations no longer get a generated logo or a stock cover image
  • Trust gates - the gates have one name each (credential signer, issuer, relying party, status issuer and wallet provider) with matching settings and checks. A check runs only when its Require switch is on, and only against its accepted list, and a trust source shows where it is used
  • Final revocation - revoking an issuance history revokes all of its credentials. The issuer no longer suspends a credential or makes a revoked credential valid again
  • Cursor pages - the issuer lists return pages of {"items", "nextCursor"}, with a total only on request (includeTotal=true)
  • Issuance statistics - issuance histories are counted in five buckets (in progress, expired, denied, issued and revoked), for the organisation and for each credential definition
  • Expiry of unused offers - an issuance history in progress expires at the end of its current grant
  • Credential definition versions - every change creates a new version that the issuance histories refer to, and the revocation settings belong to each credential configuration
  • Configuration with PATCH - the issuer, holder, verifier and wallet provider configurations are updated with PATCH and a JSON Merge Patch, and the issuer settings are grouped by protocol
  • Webhook events - new event types ows.<role>.<resource>.<event> for the issuer, verifier and holder, with a small signed body, delivery in order and retries for up to 24 hours. See Webhook Events
  • Protocol endpoints - the token, nonce, credential and other issuer endpoints are now under /organisation/{organisationId}/service/{version}, as given in the issuer metadata
  • Signing key in each credential configuration - a request that creates or updates a credential definition sets cryptographicKeyFormat and cryptographicKeyIdentifier in each credential configuration, and a signing key at the top level is refused (credential_definition.configuration_fields_at_top_level). The old paths still accept it and use it for each credential configuration that has no signing key of its own
  • Removed - requiresWalletAttestation, the top-level allowsCredentialReissuance of a credential definition, the trusted list check of the organisation's own keys, the route POST /v4/config/ows/key-management/trust-lookup, and holder support for registration certificates (it will come back later)

October 2026 (2026.10.x)​

Organisation Wallet Suite​

  • More secure vaults for signing keys - organisations can now store signing keys in OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS, Azure Key Vault or a QTSP via the CSC API, with PKCS#11 HSM support for on-premise deployments
  • Fine-grained API key permissions - API key access control now supports 115 permissions across 29 resources, restricting each integration to authorised endpoints and storing only secure, keyed hashes
  • Purpose-specific certificate templates - key management now supports purpose-specific certificate templates for PID, EAA, QEAA, WRPAC, mdoc and status list signing, with key usage and expiry details aligned with ETSI EN 319 412-2
  • Standard OpenID4VCI 1.0 error codes - issuer, authorisation server and wallet provider errors now follow standard OpenID4VCI 1.0 OAuth error codes, with clearer descriptions for troubleshooting
  • Certified security levels for wallet key attestation - wallet key attestation now supports certified security levels, including Android StrongBox, verified boot checks and attestation revocation validation, aligned with OpenID4VCI 1.0 and EUDI ARF TS3
  • OpenID conformance checklists and sandbox signing keys - OpenID conformance testing now includes profile-specific configuration checklists and bulk report downloads, while sandboxes support full signing key management
  • Stricter issuance and verification checks - credential issuance and verification now include single-use pre-authorised codes, full certificate-chain validation, stricter PID and age verification checks, standardised credential matching and encrypted request compression

Data Wallet​

  • Verifier authentication and clearer request errors - OpenID4VP 1.0 verifier authentication now supports X.509 certificates, DID keys, and verifier attestations, alongside encrypted requests, advanced credential queries, localised error messages, and explanations of invalid requests in 16 languages
  • Multiple transactions in one request - the SDK now supports multiple transactions in a single OpenID4VP request, with individual transaction hashes and EUDI ARF TS12 support for payments, login risk, account access and e-mandates
  • OpenID4VCI 1.0 issuance improvements - OpenID4VCI 1.0 issuance now supports signed issuer metadata, deferred credential handling, clearer issuance states and DPoP-bound token refresh and notifications
  • Clearer error feedback - standardised SDK error handling now preserves issuer and authorisation server error codes, enabling clearer user feedback, retry handling, and management of rejected credential reissuance
  • Age verification with redirect URIs - age verification now supports redirect URI-based services, with controlled acceptance of unsigned requests through synchronised wallet metadata
  • Accessibility, security and usability improvements - accessibility improvements include localised screen-reader labels, hardware-backed key handling, enhanced Android device attestation, automatic Wallet Unit Attestation renewal and clearer credential details