OpenID Conformance

Read OpenID Conformance extension

GET/v4/config/platform/extension/openid-conformance

Reads the OpenID Conformance extension: the conformance material that makes your organisation ready for the OpenID Foundation HAIP conformance runs (OpenID4VCI and OpenID4VP), as an issuer, a verifier and a holder wallet. Copy the values into the test plan configurations of the conformance suite.

When you turn the extension on, the wallet makes test signing keys with certificates of the built-in test CA of the organisation, adds trust sources for the test roots, makes system-managed credential definitions (SD-JWT VC PID, mdoc PID, mdoc mDL and mdoc Photo ID) and presentation definitions (SD-JWT VC PID and mdoc PID), issues one of each credential to the organisation wallet, and sets the issuer and holder settings of the runs. readiness tells you which of these settings are still as the runs need them. The extension is for testing only. It takes no signing key.

The answer is 404 when the extension is not enabled. Turn it on first with PUT /v4/config/platform/extension/openidConformance and the body {"enabled": true}.

Language of the request sample

curl 'https://demo-api.igrant.io/v4/config/platform/extension/openid-conformance' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "extensionStatus": true,
  "caPem": "-----BEGIN CERTIFICATE-----\nMIICqzCCAlGgAwIBAgIUQm9vdENBX2NvbmZvcm1hbmNl...\n-----END CERTIFICATE-----\n",
  "providerCaPem": "-----BEGIN CERTIFICATE-----\nMIICnTCCAkOgAwIBAgIUUHJvdmlkZXJDQV9jb25mb3Jt...\n-----END CERTIFICATE-----\n",
  "accessCaPem": "-----BEGIN CERTIFICATE-----\nMIICmzCCAkGgAwIBAgIUQWNjZXNzQ0FfY29uZm9ybWFu...\n-----END CERTIFICATE-----\n",
  "attesterJwk": {
    "alg": "ES256",
    "crv": "P-256",
    "d": "<private-key-d>",
    "kty": "EC",
    "x": "EZnfU1tqyjuRCe7qLoipiaa3haYFmpWrqWU0YAjSLA4",
    "x5c": [
      "MIID4DCCA4WgAwIBAgIQLVldR93XQJjdoBUr9RiabDAKBggqhkjOPQQDAjBl..."
    ],
    "y": "c4emH2X_CPpYddEV297NnoWhyCt7vjy_Gs1sU7fMJR4"
  },
  "keyAttestationJwk": {
    "alg": "ES256",
    "crv": "P-256",
    "d": "<private-key-d>",
    "kty": "EC",
    "x": "aKIMUFQ6o3yXBMv9J4aYE_HEsb2onHVPUy9_1knsrN8",
    "x5c": [
      "MIID1jCCA3ygAwIBAgIQGum7f6Kb7EJWdyQ5FD7WVTAKBggqhkjOPQQDAjBl..."
    ],
    "y": "lhQaQdD3cletY5ws1OfiMorjXl42__wPiiqW51mUFN0"
  },
  "credentialSigningKid": "078aec5c832e4090815c58889889525b",
  "statusListSigningKid": "998684f171d346608cb75d8d0380a01d",
  "sdJwtPidCredentialDefinitionId": "b0c28543-ac18-4fc3-b606-a08380ec9e60",
  "mdocPidCredentialDefinitionId": "6804af16-b4d1-4300-a2ed-1fcd9dd5b5d5",
  "mdocMdlCredentialDefinitionId": "c288f540-9cb1-424d-b0d6-8ec8842f5360",
  "mdocPhotoIdCredentialDefinitionId": "77b17ae6-61dc-46d5-89d1-7d6f82dd7ad8",
  "sdJwtPidPresentationDefinitionId": "e037ed13-9b6a-4f6a-94d0-5206aedf7e3a",
  "mdocPidPresentationDefinitionId": "8fddf1c8-a771-4883-a9fb-f25b7d7827bc",
  "reportTokenConfigured": true,
  "sdJwtPidHolderCredentialId": "ac643153-02e8-4a35-b4e8-a2acf14244f0",
  "mdocPidHolderCredentialId": "69809761-148b-4506-94d6-06856023d71e",
  "mdocMdlHolderCredentialId": "222a4b42-2271-4726-bc6f-2ed0f470404c",
  "mdocPhotoIdHolderCredentialId": "6bdfd520-956c-4555-9ad3-5f6dc931c832",
  "conformanceLoginOidcProviderId": "8dbe1c04-e6b1-4a11-bc3c-70ba06a708d7",
  "holder": {
    "clientId": "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbnZGWTy36n8qZVgSxrhfnUrkXPbRDKMsrUFTwXa54mWjbz1jdNccxZEMThivLFzbHtVPL8npZr1oU7zPsi7ZRYzfpuuGQCu7MtnfkaLN6ZtJNRxbeBQNN3R7jTeYzDM1z9i",
    "attestationIssuer": "https://demo-api.igrant.io/organisation/9dd765f7-4002-446b-ada4-d16dab77c866/service/wallet-provider",
    "walletProviderTrustAnchorPem": "-----BEGIN CERTIFICATE-----\nMIIBszCCAVmgAwIBAgIUV2FsbGV0UHJvdmlkZXJUcnVz...\n-----END CERTIFICATE-----\n",
    "keyAttestationTrustAnchorPem": "-----BEGIN CERTIFICATE-----\nMIIBszCCAVmgAwIBAgIUS2V5QXR0ZXN0YXRpb25UcnVz...\n-----END CERTIFICATE-----\n",
    "redirectUri": "https://demo-api.igrant.io/organisation/60905277-d953-4ef7-aa4c-cec413d00d93/service/callback"
  },
  "credentialIssuerUrl": "https://demo-api.igrant.io/organisation/60905277-d953-4ef7-aa4c-cec413d00d93/service/version-01",
  "authorizationServer": "https://demo-api.igrant.io/organisation/60905277-d953-4ef7-aa4c-cec413d00d93/service/version-01",
  "conformanceCaTrustSourceIds": {
    "access_certificate_provider": "a892d26b-dae0-4f66-b6e1-49ef651ddf81",
    "eaa_provider": "5a74520d-49ed-40f4-b3a2-1e5dc1a8c93b",
    "mdl_issuer": "44b2be40-4a12-4efa-babf-9d73a1d57532",
    "pid_provider": "898f8ef2-e570-45b1-80fe-40d73e5f6aa4",
    "pub_eaa_provider": "d8a27a96-f21e-4012-9b29-151be9b0f5a2",
    "qeaa_provider": "b8633456-7cc1-4aa9-828c-505c38bd2d23"
  },
  "conformanceProviderCaTrustSourceIds": {
    "access_certificate_provider": "5053df9f-7831-4ae3-b9f9-9879a36aa8d5",
    "eaa_provider": "14bae76f-0c81-43e7-b8c2-30f86609d03d",
    "pid_provider": "8a124a18-4efc-4be5-bca8-c0d0f91b3816",
    "wallet_provider": "ee92f935-d7d1-461f-a379-2d3c0af2d3d4"
  },
  "suiteMdocIacaTrustSourceIds": {
    "mdl_issuer": "6c1d4d89-1b82-4bab-971f-af70225612bb",
    "pid_provider": "0dfbed62-efa9-4d5e-886d-bfba0d7277b4"
  },
  "verificationCallbackUrl": "https://demo-api.igrant.io/organisation/60905277-d953-4ef7-aa4c-cec413d00d93/service/verification-callback",
  "readiness": [
    {
      "id": "credentialSigningKey",
      "name": "x509 credential signing key",
      "ready": true,
      "reason": ""
    },
    {
      "id": "conformanceCaTrustSource",
      "name": "Conformance CA trust source",
      "ready": true,
      "reason": ""
    },
    {
      "id": "conformanceProviderCaTrustSource",
      "name": "Conformance provider CA trust source",
      "ready": true,
      "reason": ""
    },
    {
      "id": "suiteMdocIacaTrustSource",
      "name": "Suite mdoc IACA trust source",
      "ready": true,
      "reason": ""
    },
    {
      "id": "walletProviderTrustAnchor",
      "name": "Wallet provider trust anchor (for wallet tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "issuerEncryptionRequiredOff",
      "name": "Issuer Encryption Required off (for issuer tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "issuerDpopRequiredOn",
      "name": "Issuer DPoP required (for issuer tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "issuerBatchIssuanceOn",
      "name": "Issuer batch issuance on, batch size 3 (for issuer tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "issuerSignedMetadataOn",
      "name": "Issuer signed metadata with the conformance key (for issuer tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "issuerDisplayExtensionsOff",
      "name": "Issuer display extensions off (for issuer tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "verifierCredentialEncryptionOn",
      "name": "Verifier credential encryption on (for verifier tests)",
      "ready": true,
      "reason": ""
    },
    {
      "id": "holderCredentialEncryptionOn",
      "name": "Holder credential encryption on (for wallet tests)",
      "ready": true,
      "reason": ""
    }
  ]
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:extensions:read

Response

application/json

The conformance material of the organisation.

extensionStatusboolean
Always true in this answer. An extension that is not enabled gives 404.
caPemstring
The mdoc IACA test root of the organisation (PEM): the root of the Document Signer of the conformance mDL and of the status list signer.
providerCaPemstring
The provider test root of the organisation (PEM): the root of the PID and EAA signing keys, of the attester and of the key attestation. Empty for an extension that was turned on before this root existed, until you turn it off and on again.
accessCaPemstring
The access test root of the organisation (PEM): the root of the relying party key that signs the request objects. Empty for an extension that was turned on before this root existed, until you turn it off and on again.
attesterJwkobject | null
The test wallet attester key as a private JWK (with d and the certificate chain in x5c). The suite signs the wallet unit attestation with it. It is a test key: never use it outside the conformance runs.
keyAttestationJwkobject | null
The test key attestation key as a private JWK (with d and the certificate chain in x5c), for the key attestation that the suite presents to the issuer. It is a test key.
credentialSigningKidstring
The X.509 credential signing key (the Document Signer of the mDL) in the key store of the organisation.
statusListSigningKidstring
The status list signing key of the conformance mdoc credential configurations. Empty for an extension that was turned on before this key existed, until you turn it off and on again.
sdJwtPidCredentialDefinitionIdstring
The system-managed credential definition of the SD-JWT VC PID (urn:eudi:pid:1).
mdocPidCredentialDefinitionIdstring
The system-managed credential definition of the mdoc PID (eu.europa.ec.eudi.pid.1).
mdocMdlCredentialDefinitionIdstring
The system-managed credential definition of the mdoc mDL (org.iso.18013.5.1.mDL). Empty for an extension that was turned on before it existed.
mdocPhotoIdCredentialDefinitionIdstring
The system-managed credential definition of the mdoc Photo ID (org.iso.23220.photoid.1). Empty for an extension that was turned on before it existed.
sdJwtPidPresentationDefinitionIdstring
The system-managed presentation definition that asks for the SD-JWT VC PID.
mdocPidPresentationDefinitionIdstring
The system-managed presentation definition that asks for the mdoc PID.
reportTokenConfiguredboolean
true when you stored the API token of the conformance suite with Set conformance suite token. The answer never holds the token.
sdJwtPidHolderCredentialIdstring
The SD-JWT VC PID that the organisation wallet holds for the wallet tests (issued to itself when the extension was turned on).
mdocPidHolderCredentialIdstring
The mdoc PID that the organisation wallet holds for the wallet tests.
mdocMdlHolderCredentialIdstring
The mdoc mDL that the organisation wallet holds for the wallet tests.
mdocPhotoIdHolderCredentialIdstring
The mdoc Photo ID that the organisation wallet holds for the wallet tests.
conformanceLoginOidcProviderIdstring
The built-in OpenID Conformance login provider that the conformance credential definitions use (for conformance runs only): the issuer tests ask you to log in there.
holderobject
The holder values of the OpenID4VCI wallet test plan, read from the wallet. Each member is empty when the wallet cannot give them.
credentialIssuerUrlstring
The Credential Issuer Identifier of the organisation. The suite configuration must hold it exactly.
authorizationServerstring
The authorisation server of the issuer (authorization_servers in the issuer metadata). It is the same as credentialIssuerUrl.
conformanceCaTrustSourceIdsobject | null
The trust sources that the extension added for the mdoc IACA test root: one for each role (for example pid_provider or mdl_issuer) to the ID of the trust source.
conformanceProviderCaTrustSourceIdsobject | null
The trust sources that the extension added for the provider test root, by role.
suiteMdocIacaTrustSourceIdsobject | null
The trust sources that the extension added for the mdoc IACA root of the conformance suite, by role.
verificationCallbackUrlstring
The verification callback page of the wallet, the directPostRedirectUri of the conformance presentation definitions.
readinessobject[]
The settings that the conformance runs need, read from the wallet, one item for each setting. An item that is not ready tells why.