--- id: dcql-2-4-4-kyc-request-photo-id-address-proof title: "DCQL: Combined Credential Sets" hide_title: false sidebar_label: Combined Credential Sets slug: /dcql-2-4-4-kyc-request-photo-id-address-proof/ description: DCQL combined credential sets requiring multiple mandatory credential groups, each with alternative options. keywords: [DCQL, combined credential sets, KYC, identity verification, OpenID4VP, credential query, EUDI Wallet, photo ID, address proof] --- > **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration: > > ```bash > npx skills add L3-iGrant/skills > ``` > > This page maps to the `igrantio-dcql-kyc` skill. Install just that one with: > > ```bash > npx skills add L3-iGrant/skills -s igrantio-dcql-kyc > ``` import Link from "@docusaurus/Link"; import { ApiKeyManager } from "@site/src/components/ApiKeyManager"; import DcqlStepTemplate from "@site/src/components/DCQL/DcqlStepTemplate"; Multiple `credential_sets` can be combined in a single DCQL query, each marked as required. This allows a verifier to request several credential groups simultaneously, where each group may accept alternatives. **Scenario:** A KYC check requires: - A **Photo ID** credential for identity verification. - A separate **Proof of Address**, where either a **Utility Bill** or **Bank Statement** is acceptable. For the underlying DCQL query, diagram and example, see the **“KYC request with Photo ID and address proof”** use case in our [DCQL concepts article](/concepts/eudi-wallet-dcql-openid4vp-business-wallet-payments/#244-use-case-kyc-request-with-photo-id-and-address-proof). ![Fig 04: Require a Photo ID (Mandatory) plus Proof of Address via Utility Bill or Bank Statement.](../cDocs/articles/dcql-images/fig-04-dcql-eudi-wallet-photo-id-proof-of-address.png) ## Step 1: Get the API Key (Issuer Admin) To obtain your API key, please contact [support@igrant.io](mailto:support@igrant.io?subject=Request%20API%20Key). Once you have received your API key, enter it in the field below and click the **Set API Key** button to save it for future use. ## Step 2: Create Credential Definition (Issuer Admin) To create a credential definition, run the interactive blocks below using the **Run** button. Alternatively, you can manually copy the JSON body and use it in the API request available [here](https://docs.igrant.io/docs/openid4vc-api/config-create-digital-wallet-open-id-credential-definition). > Note: The `kid` value is mandatory with trust anchor `x509`. To obtain the `kid` value for the respective organisation use the API available [here](https://docs.igrant.io/docs/openid4vc-api/config-read-digital-wallet-open-id-organisation-identifier). From the API response, copy the `credentialDefinitionId` and `id` value from the `credentialDefinitions` array for use in the Step 3. Credential definitions for this KYC use case: ### Bank Statement A Bank Statement credential provides verified financial information including account details, transaction history, and balance information. It serves as a proof of financial stability and is commonly used for KYC (Know Your Customer) verification processes in accordance with [European Anti-Money Laundering directives](https://commission.europa.eu/projects/anti-money-laundering_en). ", "credentialDefinitions": [ { "credentialFormat": "dc+sd-jwt", "vct": "BankStatement", "claims": { "claims": [ { "limitDisclosure": true, "mandatory": true, "path": [ "accountHolderName" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "accountNumber" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "address" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "transactions", "amount" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "transactions", "date" ] } ] } } ] }`} /> ### Utility Bill A Utility Bill credential contains verified address information from utility service providers such as electricity, water, or telecommunications companies. It serves as a proof of residence and is commonly required for address verification in accordance with [EU identity verification standards](https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation). ", "credentialDefinitions": [ { "credentialFormat": "dc+sd-jwt", "vct": "UtilityBill", "claims": { "claims": [ { "limitDisclosure": true, "mandatory": true, "path": [ "name" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "age" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "address" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "billingDetails", "detail1" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "billingDetails", "detail2" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "billingDetails", "detail3" ] } ] } } ] }`} /> ### Photo ID Photo ID is based on an electronic Machine-Readable Travel Document (eMRTD), is issued and verified as a digital credential under the [EU Digital Travel Credential (DTC) framework](https://ec.europa.eu/commission/presscorner/detail/en/ip_24_5047) and the EU Digital Identity Framework (eIDAS Regulation). For more technical details, please refer to [EWC RFC 013: Issue Photo ID](https://github.com/EWC-consortium/eudi-wallet-rfcs/blob/main/ewc-rfc013-issue-photoid.md). ", "credentialDefinitions": [ { "credentialFormat": "mso_mdoc", "doctype": "eu.europa.ec.eudi.photoid.1", "display": { "name": "Photo ID", "description": "Photo ID" }, "claims": { "claims": [ { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dg_content_info"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg1"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg10"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg11"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg12"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg13"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg14"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg15"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg16"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg2"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg3"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg4"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg5"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg6"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg7"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg8"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_dg9"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_sod"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "dtc", "dtc_version"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "age_birth_year"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "age_in_years"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "age_over_18"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "family_name_latin1"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "given_name_latin1"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "issue_date"] }, { "limitDisclosure": true, "mandatory": true, "path": [ "eu.europa.ec.eudi", "iso23220", "issuing_authority_unicode" ] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "name_at_birth"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "nationality"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "birthplace"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "given_name_unicode"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "family_name_unicode"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "birth_date"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "sex"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "portrait"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "portrait_capture_date"] }, { "limitDisclosure": true, "mandatory": true, "path": [ "eu.europa.ec.eudi", "iso23220", "resident_address_unicode" ] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "resident_city_unicode"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "resident_postal_code"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "issuing_country"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "expiry_date"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "iso23220", "resident_country"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "birth_city"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "birth_country"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "birth_state"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "travel_document_number"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "person_id"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "administrative_number"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "resident_street"] }, { "limitDisclosure": true, "mandatory": true, "path": ["eu.europa.ec.eudi", "photoid", "resident_state"] } ] } } ] }`} /> ## Step 3: Issue and Receive Credential (Issuer/Holder) The holder of the wallet submits a request for the issuance of a credential by executing the JSON code block below using the **Run** button in `InTime` issuance mode. Choose the credential format and replace `` and `` with the actual values obtained from the previous step. Alternatively, you may use the API available [here](/docs/openid4vc-api/config-digital-wallet-open-id-issue-credential). The user needs to issue **three** credentials to the holder wallet: - Bank Statement - Utility Bill - Photo ID After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the [Data Wallet](https://www.igrant.io/datawallet.html) (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device, such as via a browser. ### Bank Statement result?.credentialHistory?.credentialOffer || ""} initialJsonData={`{ "issuanceMode": "InTime", "credentialDefinitionId": "", "urlScheme": "openid-credential-offer://", "credentials": [ { "id": "", "claims": { "accountHolderName": "Alice Andersson", "accountNumber": "SE45 5000 0000 0583 9825 7466", "address": "Sveavägen 44, 111 34 Stockholm, Sweden", "transactions": { "amount": "1250.50", "date": "2025-09-15" } } } ], "userPin": "" }`} /> ### Utility Bill result?.credentialHistory?.credentialOffer || ""} initialJsonData={`{ "issuanceMode": "InTime", "credentialDefinitionId": "", "urlScheme": "openid-credential-offer://", "credentials": [ { "id": "", "claims": { "name": "Alice Andersson", "age": "34", "address": "Sveavägen 44, 111 34 Stockholm, Sweden", "billingDetails": { "detail1": "Electricity – September 2025", "detail2": "Usage: 250 kWh", "detail3": "Provider: Stockholm Energi" } } } ], "userPin": "" }`} /> ### Photo ID result?.credentialHistory?.credentialOffer || ""} initialJsonData={`{ "issuanceMode": "InTime", "credentialDefinitionId": "", "urlScheme": "openid-credential-offer://", "credentials": [ { "id": "", "claims": { "eu.europa.ec.eudi": { "dtc": { "dg_content_info": "Swedish national ID document data groups", "dtc_dg1": "Primary identifier and personal identity number", "dtc_dg10": "Resident address data group", "dtc_dg11": "Issuing authority information", "dtc_dg12": "Document metadata", "dtc_dg13": "Portrait image data", "dtc_dg14": "Signature data group", "dtc_dg15": "Optional data group 15", "dtc_dg16": "Optional data group 16", "dtc_dg2": "Name and nationality", "dtc_dg3": "Birth information", "dtc_dg4": "Sex and physical attributes", "dtc_dg5": "Document number and series", "dtc_dg6": "Issuing country and authority", "dtc_dg7": "Document validity period", "dtc_dg8": "Additional personal attributes", "dtc_dg9": "Machine readable zone data", "dtc_sod": "Security object and digital signature", "dtc_version": "EUDI DTC profile version 1.0" }, "iso23220": { "age_birth_year": 1991, "age_in_years": 34, "age_over_18": true, "birth_date": "1991-04-12", "birthplace": "Gothenburg, Sweden", "document_number": "SE123456789", "expiry_date": "2030-06-30", "family_name_latin1": "Andersson", "family_name_unicode": "Andersson", "given_name_latin1": "Alice", "given_name_unicode": "Alice", "issue_date": "2025-01-15", "issuing_authority_unicode": "Swedish Tax Agency", "issuing_country": "SWE", "name_at_birth": "Alice Andersson", "nationality": "SWE", "portrait": "base64-encoded-image-or-url", "portrait_capture_date": "2025-01-10T10:00:00Z", "resident_address_unicode": "Sveavägen 44, 111 34 Stockholm", "resident_city_unicode": "Stockholm", "resident_country": "SWE", "resident_postal_code": "111 34", "sex": 2 }, "photoid": { "administrative_number": "ADMIN-2025-0001", "birth_city": "Gothenburg", "birth_country": "Sweden", "birth_state": "Västra Götaland County", "person_id": "SE-19910412-1234", "resident_house_number": "44", "resident_state": "Stockholm County", "resident_street": "Sveavägen", "travel_document_number": "PA1234567" } } } } ], "userPin": "" } `} /> To receive and accept the credential via API. First, use the `credentialOffer` to call the [Receive Credential API](https://docs.igrant.io/docs/openid4vc-api/config-receive-digital-wallet-open-id-credential/). Once you have the response, copy the `credentialId` and provide it at [Accept Credential API](https://staging-docs.igrant.io/docs/openid4vc-api/config-accept-digital-wallet-open-id-credential/) to accept the credential. ## Step 4: Create Presentation Definition (Verifier Admin) To create a presentation definition for requesting proof, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request provided [here](/docs/openid4vc-api/config-digital-wallet-open-id-presentation-definition). ", "dcqlQuery": { "credentials": [ { "id": "bank_statement", "format": "dc+sd-jwt", "meta": { "vct_values": [ "BankStatement" ] }, "claims": [ { "path": [ "accountHolderName" ] }, { "path": [ "accountNumber" ] }, { "path": [ "address" ] }, { "path": [ "transactions", "amount" ] }, { "path": [ "transactions", "date" ] } ], "require_cryptographic_holder_binding": true }, { "id": "utility_bill", "format": "dc+sd-jwt", "meta": { "vct_values": [ "UtilityBill" ] }, "claims": [ { "path": [ "name" ] }, { "limitDisclosure": true, "mandatory": true, "path": [ "age" ] }, { "path": [ "address" ] }, { "path": [ "billingDetails", "detail1" ] }, { "path": [ "billingDetails", "detail2" ] }, { "path": [ "billingDetails", "detail3" ] } ], "require_cryptographic_holder_binding": true }, { "id": "photo_id", "format": "mso_mdoc", "meta": { "doctype_value": "eu.europa.ec.eudi.photoid.1" }, "claims": [ { "path": [ "eu.europa.ec.eudi", "dtc", "dg_content_info" ] }, { "path": [ "eu.europa.ec.eudi", "iso23220", "age_birth_year" ] }, { "path": [ "eu.europa.ec.eudi", "photoid", "birth_city" ] } ], "require_cryptographic_holder_binding": true } ], "credential_sets": [ { "options": [ [ "photo_id" ] ], "required": true }, { "options": [ [ "utility_bill" ], [ "bank_statement" ] ], "required": true } ] } }`} /> Once a presentation definition is created, the `presentationDefinitionId` can be reused to verify multiple credentials (Step 6). ## Step 5: Create Verification Request (Verifier/Relying Party) To create the verification request, execute the code block below using the **Run** button. Alternatively, you can manually copy the JSON and use it in the body of the API available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-verification-request-v-3). After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the verification request using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the verification request on their mobile device, such as via a browser. result?.verificationHistory?.vpTokenQrCode || ""} initialJsonData={`{ "requestByReference": true, "presentationDefinitionId": "" }`} /> Users can copy the `presentationExchangeId` from the JSON response for use in Step 7 to read verification history. ## Step 6: Send and Receive Verifiable Presentation (Holder) The holder wallet accepts (consents) to send the requested credentials. - **Receive Verification:** - Use the `vpTokenQrCode`(step 5) with the API available [here](/docs/openid4vc-api/config-receive-digital-wallet-open-id-verification-v-3/) to receive the verification. - Copy the `presentationId` from the JSON response received from **Receive Verification** for use in Step 6b. - **Filter Verification:** - Use that `presentationId` with the API available [here](/docs/openid4vc-api/config-filter-digital-wallet-open-id-verification) to find matching credentials. - Save the `` and `` from the response. - **Send Verification:** - Use the `presentationId`, `` and `` with the API available [here](/docs/openid4vc-api/config-send-digital-wallet-open-id-verification-presentation-v-3) to send the credentials to the verifier. ## Step 7: Send and Receive Verifiable Presentation (Verifier/Relying Party) - The Verfier (Relying Party) receives the requested credentials and can verify it. They may read the received credential by executing the [Read Verification History API](/docs/openid4vc-api/config-read-digital-wallet-open-id-verification-history-v-3). - From the response received, the `vpTokenResponse` can be decoded using [JWT Decoder](/docs/devtools-jwt-decoder/). - From the decoded response, the `verifiableCredential` inside the 'vp' can be further decoded to view the received credentials.