---
id: dcql-2-4-5-student-transport-pass
title: "DCQL: Mandatory and Optional Sets"
hide_title: false
sidebar_label: Mandatory and Optional Sets
slug: /dcql-2-4-5-student-transport-pass/
description: DCQL credential sets mixing mandatory and optional groups with selective claim disclosure in a single query.
keywords: [DCQL, mandatory sets, optional sets, credential sets, OpenID4VP, credential query, EUDI Wallet, selective disclosure]
---
> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```
>
> This page maps to the `igrantio-dcql-student-pass` skill. Install just that one with:
>
> ```bash
> npx skills add L3-iGrant/skills -s igrantio-dcql-student-pass
> ```
import { ApiKeyManager } from "@site/src/components/ApiKeyManager";
import DcqlStepTemplate from "@site/src/components/DCQL/DcqlStepTemplate";
DCQL `credential_sets` support a mix of mandatory and optional groups in a single query. Optional sets allow a verifier to request additional credentials that enhance the response but are not strictly required.
**Scenario:** A public transport authority requests a discounted student transport pass:
- **PID** for identity (mandatory)
- **Student ID** or **Enrolment Letter** to prove student status (mandatory)
- **Utility Bill** or **Rental Agreement** to prove local residency for an additional discount (optional)
For the underlying DCQL query, diagram and example, see the **“Student transport pass with mandatory and optional credentials”** use case in our [DCQL concepts article](/concepts/eudi-wallet-dcql-openid4vp-business-wallet-payments/#245-use-case-student-transport-pass-with-mandatory-and-optional-credentials).
## Step 1: Get the API Key (Issuer Admin)
To obtain your API key, please contact [support@igrant.io](mailto:support@igrant.io?subject=Request%20API%20Key). Once you have received your API key, enter it in the field below and click the **Set API Key** button to save it for future use.
## Step 2: Create Credential Definition (Issuer Admin)
To create a credential definition, run the code blocks below using the **Run** button. Alternatively, you can manually copy the JSON body and use it in the API request available [here](https://docs.igrant.io/docs/openid4vc-api/config-create-digital-wallet-open-id-credential-definition).
> Note: The `kid` value is mandatory with trust anchor `x509`. To obtain the `kid` value for the respective organisation use the API available [here](https://docs.igrant.io/docs/openid4vc-api/config-read-digital-wallet-open-id-organisation-identifier).
From the API response, copy the `credentialDefinitionId` and `id` value from the `credentialDefinitions` array for use in the Step 3.
Credential definitions for this use case:
The issuer can define credential definitions for the following identity credentials:
- `PID` with credential format `mso_mdoc`
- `Student ID` with credential format `dc+sd-jwt`
- `Enrolment Letter` with credential format `dc+sd-jwt`
- `Utility Bill` with credential format `dc+sd-jwt`
- `Rental Agreement` with credential format `dc+sd-jwt`
### PID
Person Identification Data (PID) is a standardised European identity credential defined under the [EU Digital Identity Framework (eIDAS 2.0)](https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation). It contains essential personal information including family name, given name, date of birth and address, enabling secure digital identification across EU member states.
",
"credentialDefinitions": [
{
"credentialFormat": "mso_mdoc",
"doctype": "urn:eu.europa.ec.eudi:pid:1",
"display": {
"name": "Person Identification Data",
"description": "Person Identification Data credential with identity attributes"
},
"claims": {
"claims": [
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"address",
"country"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"address",
"locality"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"address",
"region"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"address",
"street_address"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"birthdate"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"email"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"family_name"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"given_name"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"is_over_18"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"is_over_21"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"is_over_65"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eu.europa.ec.eudi",
"phone_number"
]
}
]
}
}
]
}`}
/>
### Student ID
A Student ID credential is an official digital identification document issued by European educational institutions. It contains student information including enrolment status, student number and academic details in accordance with the [European Student Card Initiative](https://erasmus-plus.ec.europa.eu/european-student-card-initiative) standards, providing proof of student status for various services and benefits across the [European Higher Education Area](https://education.ec.europa.eu/education-levels/higher-education/european-student-card-initiative).
",
"credentialDefinitions": [
{
"credentialFormat": "dc+sd-jwt",
"vct": "VerifiableStudentID",
"display": {
"name": "Student ID",
"description": "Verifiable student ID credential"
},
"claims": {
"claims": [
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"commonName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"dateOfBirth"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"displayName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eduPersonAffiliation",
null
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eduPersonAssurance",
null
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eduPersonPrimaryAffiliation"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eduPersonPrincipalName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"eduPersonScopedAffiliation",
null
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"familyName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"firstName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"id"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"identifier"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"mail"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"schacHomeOrganization"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"schacPersonalUniqueCode",
null
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"schacPersonalUniqueID"
]
}
]
}
}
]
}`}
/>
### Enrolment Letter
An Enrolment Letter credential is an official document from a European educational institution confirming a student's enrolment in a specific program. It includes details such as the program of study, enrolment dates and academic standing, serving as a proof of current student status in compliance with [European higher education standards](https://education.ec.europa.eu/education-levels/higher-education/european-student-card-initiative).
",
"credentialDefinitions": [
{
"credentialFormat": "dc+sd-jwt",
"vct": "EnrolmentLetter",
"display": {
"name": "Enrolment Letter",
"description": "Enrolment letter credential"
},
"claims": {
"claims": [
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"name"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"dob"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"universityName"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"statusActive"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"address",
"addressLine1"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"address",
"addressLine2"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"address",
"addressLine3"
]
}
]
}
}
]
}`}
/>
### Utility Bill
A Utility Bill credential contains verified address information from utility service providers such as electricity, water or telecommunications companies. It serves as proof of residence and is commonly required for address verification in accordance with [EU identity verification standards](https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation).
",
"credentialDefinitions": [
{
"credentialFormat": "dc+sd-jwt",
"vct": "UtilityBill",
"display": {
"name": "Utility Bill",
"description": "Utility bill credential with address details"
},
"claims": {
"claims": [
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"name"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"age"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"address"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"billingDetails",
"detail1"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"billingDetails",
"detail2"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"billingDetails",
"detail3"
]
}
]
}
}
]
}`}
/>
### Rental Agreement
A Rental Agreement credential is a digital version of a legally binding contract between a landlord and tenant, compliant with [European housing policies](https://housing.ec.europa.eu/index_en). It contains verified information about the rental property, terms of lease, and tenant details, serving as proof of residence for official purposes across EU member states.
",
"credentialDefinitions": [
{
"credentialFormat": "dc+sd-jwt",
"vct": "RentalAgreement",
"display": {
"name": "Rental Agreement",
"description": "Rental agreement credential"
},
"claims": {
"claims": [
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"name"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"address"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"amount"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"issuanceDate"
]
},
{
"limitDisclosure": true,
"mandatory": true,
"path": [
"expiryDate"
]
}
]
}
}
]
}`}
/>
## Step 3: Issue and Receive Credential (Issuer/Holder)
The holder of the wallet submits a request for the issuance of a credential by executing the JSON code block below using the **Run** button in `InTime` issuance mode. Choose the credential format and replace `` and `` with the actual values obtained from the previous step. Alternatively, you may use the API available [here](/docs/openid4vc-api/config-digital-wallet-open-id-issue-credential).
The user needs to issue **five** credentials to the holder wallet:
- `PID` with credential format `mso_mdoc`
- `Student ID` with credential format `dc+sd-jwt`
- `Enrolment Letter` with credential format `dc+sd-jwt`
- `Utility Bill` with credential format `dc+sd-jwt`
- `Rental Agreement` with credential format `dc+sd-jwt`
After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the [Data Wallet](https://www.igrant.io/datawallet.html) (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device, such as via a browser.
### PID
result?.credentialHistory?.credentialOffer || ""}
initialJsonData={`{
"issuanceMode": "InTime",
"credentialDefinitionId": "",
"urlScheme": "openid-credential-offer://",
"credentials": [
{
"id": "",
"claims": {
"eu.europa.ec.eudi": {
"address": {
"country": "Sweden",
"locality": "Stockholm",
"region": "Stockholm County",
"street_address": "Sveavägen 44, 111 34 Stockholm"
},
"birthdate": "1998-09-17",
"email": "alice.andersson@example.se",
"family_name": "Andersson",
"given_name": "Alice",
"is_over_18": true,
"is_over_21": true,
"is_over_65": false,
"phone_number": "+46 70 123 45 67"
}
}
}
],
"userPin": ""
}`}
/>
### Student ID
result?.credentialHistory?.credentialOffer || ""}
initialJsonData={`{
"issuanceMode": "InTime",
"credentialDefinitionId": "",
"urlScheme": "openid-credential-offer://",
"credentials": [
{
"id": "",
"claims": {
"commonName": "Alice Andersson",
"dateOfBirth": "1998-09-17",
"displayName": "Alice A.",
"eduPersonAffiliation": [
"student",
"member"
],
"eduPersonAssurance": [
"https://refeds.org/assurance/ID/unique",
"https://refeds.org/assurance/ID/aal2"
],
"eduPersonPrimaryAffiliation": "student",
"eduPersonPrincipalName": "alice.andersson@su.se",
"eduPersonScopedAffiliation": [
"student@su.se"
],
"familyName": "Andersson",
"firstName": "Alice",
"id": "123456",
"identifier": "alice123",
"mail": "alice.andersson@example.se",
"schacHomeOrganization": "su.se",
"schacPersonalUniqueCode": [
"urn:schac:personalUniqueCode:int:se:personalNumber:199809179999"
],
"schacPersonalUniqueID": "urn:schac:personalUniqueID:se:su.se:alice.andersson"
}
}
],
"userPin": ""
}`}
/>
### Enrolment Letter
result?.credentialHistory?.credentialOffer || ""}
initialJsonData={`{
"issuanceMode": "InTime",
"credentialDefinitionId": "",
"urlScheme": "openid-credential-offer://",
"credentials": [
{
"id": "",
"claims": {
"name": "Alice Andersson",
"dob": "1998-09-17",
"universityName": "Stockholm University",
"statusActive": "true",
"address": {
"addressLine1": "Stockholm University",
"addressLine2": "Universitetsvägen 10",
"addressLine3": "114 18 Stockholm, Sweden"
}
}
}
],
"userPin": ""
}`}
/>
### Utility Bill
result?.credentialHistory?.credentialOffer || ""}
initialJsonData={`{
"issuanceMode": "InTime",
"credentialDefinitionId": "",
"urlScheme": "openid-credential-offer://",
"credentials": [
{
"id": "",
"claims": {
"name": "Alice Andersson",
"age": "27",
"address": "Sveavägen 44, 111 34 Stockholm, Sweden",
"billingDetails": {
"detail1": "Electricity - September 2025",
"detail2": "Usage: 250 kWh",
"detail3": "Provider: Stockholm Energi"
}
}
}
],
"userPin": ""
}`}
/>
### Rental Agreement
result?.credentialHistory?.credentialOffer || ""}
initialJsonData={`{
"issuanceMode": "InTime",
"credentialDefinitionId": "",
"urlScheme": "openid-credential-offer://",
"credentials": [
{
"id": "",
"claims": {
"name": "Alice Andersson",
"address": "Sveavägen 44, 111 34 Stockholm, Sweden",
"amount": "9500",
"issuanceDate": "2024-09-13",
"expiryDate": "2026-09-23"
}
}
],
"userPin": ""
}`}
/>
To receive and accept the credential via API. First, use the `credentialOffer` to call the [Receive Credential API](https://docs.igrant.io/docs/openid4vc-api/config-receive-digital-wallet-open-id-credential/). Once you have the response, copy the `credentialId` and provide it at [Accept Credential API](https://staging-docs.igrant.io/docs/openid4vc-api/config-accept-digital-wallet-open-id-credential/) to accept the credential.
## Step 4: Create Presentation Definition (Verifier Admin)
To create a presentation definition for requesting proof, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request provided [here](/docs/openid4vc-api/config-digital-wallet-open-id-presentation-definition).
> Note: The `kid` value is mandatory with trust anchor `x509`. To obtain the `kid` value for the respective organisation use the API available [here](https://docs.igrant.io/docs/openid4vc-api/config-read-digital-wallet-open-id-organisation-identifier).
",
"dcqlQuery": {
"credentials": [
{
"id": "pid",
"format": "mso_mdoc",
"meta": {
"doctype_value": "urn:eu.europa.ec.eudi:pid:1"
},
"claims": [
{
"id": "full_name",
"path": [
"eu.europa.ec.eudi",
"given_name"
]
},
{
"id": "dob",
"path": [
"eu.europa.ec.eudi",
"birthdate"
]
}
],
"claim_sets": [
[
"full_name"
],
[
"dob"
]
]
},
{
"id": "student_id_card",
"format": "dc+sd-jwt",
"meta": {
"vct_values": [
"VerifiableStudentID"
]
},
"claims": [
{
"id": "student_id",
"path": [
"schacPersonalUniqueID"
]
},
{
"id": "university_org_name",
"path": [
"schacHomeOrganization"
]
}
],
"claim_sets": [
[
"university_org_name",
"student_id"
]
]
},
{
"id": "enrolment_letter",
"format": "dc+sd-jwt",
"meta": {
"vct_values": [
"EnrolmentLetter"
]
},
"claims": [
{
"id": "status",
"path": [
"statusActive"
]
},
{
"id": "university_name",
"path": [
"universityName"
]
}
],
"claim_sets": [
[
"university_name",
"status"
]
]
},
{
"id": "utility_bill_doc",
"format": "dc+sd-jwt",
"meta": {
"vct_values": [
"UtilityBill"
]
},
"claims": [
{
"id": "address",
"path": [
"address"
]
}
]
},
{
"id": "rental_agreement_doc",
"format": "dc+sd-jwt",
"meta": {
"vct_values": [
"RentalAgreement"
]
},
"claims": [
{
"id": "full_address",
"path": [
"address"
]
}
]
}
],
"credential_sets": [
{
"options": [
[
"pid"
]
],
"required": true
},
{
"options": [
[
"student_id_card"
],
[
"enrolment_letter"
]
],
"required": true
},
{
"options": [
[
"utility_bill_doc"
],
[
"rental_agreement_doc"
]
],
"required": false
}
]
}
}`}
/>
Once a presentation definition is created, the `presentationDefinitionId` can be reused to verify multiple credentials (Step 6).
## Step 5: Create Verification Request (Verifier/Relying Party)
To create the verification request, execute the code block below using the **Run** button. Alternatively, you can manually copy the JSON and use it in the body of the API available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-verification-request-v-3).
After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the verification request using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the verification request on their mobile device, such as via a browser.
result?.verificationHistory?.vpTokenQrCode || ""}
initialJsonData={`{
"requestByReference": true,
"presentationDefinitionId": ""
}`}
/>
Users can copy the `presentationExchangeId` from the JSON response for use in Step 8 to read verification history.
## Step 6: Send and Receive Verifiable Presentation (Holder)
The holder wallet accepts (consents) to send the requested credentials.
- **Receive Verification:**
- Use the `vpTokenQrCode`(step 5) with the API available [here](/docs/openid4vc-api/config-receive-digital-wallet-open-id-verification-v-3/) to receive the verification.
- Copy the `presentationId` from the JSON response received from **Receive Verification** for use in Step 6b.
- **Filter Verification:**
- Use that `presentationId` with the API available [here](/docs/openid4vc-api/config-filter-digital-wallet-open-id-verification) to find matching credentials.
- Save the `` and `` from the response.
- **Send Verification:**
- Use the `presentationId`, `` and `` with the API available [here](/docs/openid4vc-api/config-send-digital-wallet-open-id-verification-presentation-v-3) to send the credentials to the verifier.
## Step 7: Send and Receive Verifiable Presentation (Verifier/Relying Party)
- The Verfier (Relying Party) receives the requested credentials and can verify it. They may read the received credential by executing the [Read Verification History API](/docs/openid4vc-api/config-read-digital-wallet-open-id-verification-history-v-3).
- From the response received, the `vpTokenResponse` can be decoded using [JWT Decoder](/docs/devtools-jwt-decoder/).
- From the decoded response, the `verifiableCredential` inside the 'vp' can be further decoded to view the received credentials.