Create credential definition

POST 
/v2/config/digital-wallet/openid/sdjwt/credential-definition

Creates a new credential definition for OpenID for Verifiable Credential Issuance (OID4VCI) 1.0. Each entry of the credentialDefinitions array holds one credential configuration, with its credential format, claims and issuance settings. The issuer publishes every entry in the OID4VCI Credential Issuer Metadata and uses it as the template for the credentials it issues. Upload the card artwork with the update logo image and update cover image operations after this operation returns.

Request

application/json

Body

required

Credential definition to create. Supply label (3 to 100 characters), version and one credentialDefinitions entry for each credential configuration. Name the signing key at the top level, or in every entry.

label stringrequired

Possible values: >= 3 characters and <= 100 characters

Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1'). Used to identify the credential definition in the issuer's dashboard. The value must contain 3 to 100 characters. The labels Payment User Credential, Payment Card Credential, Payment Account Credential, PID Issuance and Photo ID Issuance are reserved for the platform.

credentialDefinitions object[]required
Possible values: >= 1
Credential configurations of this credential definition. Supply one entry for each credential configuration that the issuer must publish. Put each configuration field, such as credentialFormat or claims, inside its entry: the issuer ignores a configuration field at the top level. version and enforceWUA belong to the top level only, and the issuer refuses them inside an entry (400, unknown field).
Array [
label string
Human-readable label describing the intended use of this credential configuration.
expirationInDays integer
Possible values: >= 1 and <= 3650
Validity of the issued credential, in days (1 to 3650). The issuer calculates the expiry date from the issuance time. Without expirationInDays and expirationInSeconds, the issuer uses the validity of the issuer global configuration (credentialExpirationInSeconds, else credentialExpirationInDays, default 180 days).
expirationInSeconds integer
Possible values: >= 60 and <= 315360000
Validity of the issued credential, in seconds (60 to 315360000). When you send it, it has precedence over expirationInDays.
supportRevocation boolean
When true, enables credential revocation support. Defaults to false.
revocationMethod string
Possible values: [status_list]
Method used for credential revocation. status_list is the IETF Token Status List, and it is the only value and the default.
statusListCryptographicKeyFormat string
Possible values: [x509, did:key]
Format of the key that signs the status lists of this configuration: x509 or did:key. Optional: without it, the issuer uses the format of the key that signs the credentials.
statusListCryptographicKeyIdentifier string
Identifier of a key of Key Management that signs the status lists of this configuration. Optional: without it, the issuer uses the key that signs the credentials.
enforceCredentialUniqueness boolean
When true, ensures each credential under this configuration is unique per holder. Defaults to false.
supportCredentialReissuance boolean
When true, allows holders to request reissuance of expired or near-expiry credentials. Defaults to false.
credentialBindingMethods string[]
Possible values: [did:key, jwk, cose_key]
Holder key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The default is ["jwk"], and ["cose_key"] for mso_mdoc. An mso_mdoc configuration takes only ["cose_key"], and the other formats do not take cose_key. [] issues a credential that is not bound to a holder key (not for mso_mdoc).
authorizationRequestType string
Possible values: [authorization_details, scope_based]
Defaults to authorization_details. With scope_based, the issuer accepts only the Authorization Code Flow for this credential definition: the issue credential operation refuses userPin and presentationDefinitionId. The value does not change scope.
scope string
OAuth 2.0 scope value of this credential configuration: one scope token, with no spaces. The default is the credential configuration id. A wallet can ask for the configuration by this scope or by authorization_details (RFC 9396). Read the values of the organisation with the list scope operation.
display object
Display properties for the credential card in wallet UIs. The issuer adds the organisation logo and cover image when you do not supply logo.uri and backgroundImage.uri.
name string
Display name for the credential in wallet UIs.
description string
Human-readable description of the credential purpose.
backgroundColor string
Hex colour code for the credential card background (e.g. #FFFFFF).
textColor string
Hex colour code for text on the credential card (e.g. #000000).
logo object
Logo image of the credential card.
uri string
URL of the logo image.
altText string
Alternative text for the logo image.
backgroundImage object
Background image of the credential card.
uri string
URL of the background image.
credentialResponseInterval integer
Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint.
credentialFormat stringrequired
Possible values: [jwt_vc_json, dc+sd-jwt, mso_mdoc]
Credential format of this configuration. jwt_vc_json is W3C VC (JWT). dc+sd-jwt is IETF SD-JWT VC. mso_mdoc is ISO 18013-5 mDoc/mDL. The format determines which of type, vct and doctype you must supply.
validationPath string
Possible values: [$.vc, $]
JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. Use $.vc when credentialFormat is jwt_vc_json, and $ when credentialFormat is dc+sd-jwt or mso_mdoc.
type string[]
Credential type strings. Required when credentialFormat is jwt_vc_json, and forbidden for the other formats. These values appear in the type field of the issued W3C VC (JWT). You cannot use WalletUnitAttestation here.
vct string
Verifiable Credential Type identifier. Required when credentialFormat is dc+sd-jwt, and forbidden for the other formats (e.g. urn:eu.europa.ec.eudi:pid:1).
doctype string
Document type identifier. Required when credentialFormat is mso_mdoc, and forbidden for the other formats (e.g. org.iso.18013.5.1.lpid).
credentialDefinitionUri string
URL of an external claims schema. The issuer downloads the claims from this URL. Supply this field instead of claims or credentialDefinition. Use the preview operation to check the document before you use the URL.
cryptographicKeyFormat string
Possible values: [x509, did:key]
Format of the key that signs the credentials of this configuration: x509 or did:key. Send it together with cryptographicKeyIdentifier, or send neither: the configuration then uses the key of the credential definition. An mso_mdoc configuration needs x509.
cryptographicKeyIdentifier string
Identifier of a key of Key Management that signs the credentials of this configuration. Send it together with cryptographicKeyFormat.
credentialCategory object
The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. none (no certificate rule), pid (person identification data), eaa (non-qualified attestation), qeaa (qualified attestation) or pub-eaa (attestation issued by or for a public sector body).
supportAttestationProof boolean
When true, the issuer accepts an attestation proof (key attestation). Defaults to true. A configuration that binds a holder key needs supportJwtProof or supportAttestationProof.
supportJwtProof boolean
When true, the issuer accepts a jwt proof of possession (OpenID4VCI 1.0 proof_types_supported). Defaults to true.
enforceKeyAttestation boolean
When true, the issuer refuses an issuance without a valid key attestation. Defaults to false.
keyAttestationsRequired object
Key attestation requirements per proof type (jwt, attestation). A proof type that is present here needs a key attestation, and the configuration must accept that proof type.
attestation object
Key attestation requirements for the 'attestation' proof type.
key_storage string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted key storage security levels (e.g., ISO/IEC 18045 basic).
user_authentication string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted user authentication security levels.
jwt object
Key attestation requirements for the 'jwt' proof type.
key_storage string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted key storage security levels.
user_authentication string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted user authentication security levels.
claims object
Claims of the credential, as claim path pointers. Supply this field when credentialFormat is dc+sd-jwt or mso_mdoc and you do not supply credentialDefinitionUri. Do not supply this field when credentialFormat is jwt_vc_json; use credentialDefinition instead.
claims object[]required
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]required
Possible values: >= 1
Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or null for every element of an array. When credentialFormat is mso_mdoc, the first element is the mDoc namespace, the path holds at least two elements, and every path in the configuration uses the same first element.
mandatory boolean
When true, the issuer always includes the claim. The issuer reads a missing field as true.
limitDisclosure boolean
When true, the holder can disclose the claim selectively.
display object[]
Labels that a wallet shows for the claim.
Array [
name string
Label of the claim.
locale string
BCP47 language tag of the label, for example en-GB.
]
]
credentialDefinition object
Claims of the credential, as claim path pointers. Supply this field when credentialFormat is jwt_vc_json and you do not supply credentialDefinitionUri. Each path starts with credentialSubject, because the issuer validates the claims below $.vc.
claims object[]required
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]required
Possible values: >= 1
Claim path pointer that selects the claim below $.vc. Each element is a string for an object key, an integer for an array index, or null for every element of an array. The first element is credentialSubject.
mandatory boolean
When true, the issuer always includes the claim. The issuer reads a missing field as true.
]
]
version stringrequired

Possible values: [version_01]

Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. The only value is version_01 (OpenID4VCI 1.0). The field is mandatory: without it the issuer answers 400 (version: non zero value required). You cannot change the value after you create the credential definition.

cryptographicKeyFormat string

Possible values: [x509, did:key]

Format of the key that signs the credentials of every configuration that names no key of its own: x509 (a key with a certificate chain, recommended) or did:key. With a format and no cryptographicKeyIdentifier, the issuer uses the default key of the organisation. When you send neither key field, every entry of credentialDefinitions must name its own key, else the issuer answers 400.

cryptographicKeyIdentifier string

Identifier of a key of Key Management that signs the credentials. With an identifier and no cryptographicKeyFormat, the format is x509 when the key has a certificate chain, else did:key. You can change the key later with the update operation.

enforceWUA boolean

When true, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI credential issuance flow, as defined in the EUDI Wallet Architecture Reference Framework. Defaults to false.

supportInteractiveAuthorisationEndpoint boolean

When true, the issuer publishes an interactive authorisation endpoint for this credential definition. Defaults to false. Must be true to issue with a dynamic credential request (presentationDefinitionId in the issue credential operation).

supportWalletInitiatedIssuance boolean

When true, a wallet can start the issuance with a pushed authorisation request that names a scope or a credential configuration id. Defaults to false.

supportCredentialOfferReuse boolean

When true, one credential offer can start an issuance for more than one wallet until the offer expires. Each wallet gets its own credential exchange record. Defaults to false.

display object

Default display properties for every credential configuration of this credential definition. The issuer copies the organisation logo into logo.uri and the organisation cover image into backgroundImage.uri when you leave them empty. To upload your own artwork, use the update logo image and update cover image operations after you create the credential definition.

name string

Display name for the credential in wallet UIs.

description string

Human-readable description of the credential purpose.

backgroundColor string

Hex colour code for the credential card background (e.g. #FFFFFF).

textColor string

Hex colour code for text on the credential card (e.g. #000000).

logo object

Logo image of the credential card.

uri string

URL of the logo image.

altText string

Alternative text for the logo image.

backgroundImage object

Background image of the credential card.

uri string

URL of the background image.

Responses

200

The issuer created the credential definition and published it in the OID4VCI Credential Issuer Metadata. This operation returns 200, not 201.

Response Headers

application/json

Schema

Schema

credentialDefinition object
The credential definition that the issuer created.
id stringrequired
Identifier of the credential definition. This field holds the same value as credentialDefinitionId.
credentialDefinitionId stringrequired
Unique identifier assigned to the credential definition upon creation. Use this ID to reference the credential definition in OpenID for Verifiable Credentials Issuance (OID4VCI) operations.
openIdOrganisationId stringrequired
Identifier of the OpenID wallet deployment that holds this credential definition.
createdAt numberrequired
Unix timestamp (in seconds) indicating when this credential definition was created.
updatedAt numberrequired
Unix timestamp (in seconds) indicating when this credential definition was last modified.
label stringrequired
Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1').
credentialDefinitions object[]
Credential configurations of this credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. The value is null for a record that holds no configuration.
Array [
id string
Unique identifier of this credential configuration. The issuer generates the value. Use it in the credentials[].id field of the issue credential request, and in the credentialDefinitions[].id field of an update credential definition request.
credentialConfigurationId string
Identifier of the credential configuration as published in the OID4VCI Credential Issuer Metadata. The wallet uses this value to request this credential configuration during the issuance flow.
label string
Human-readable label describing the intended use of this credential configuration.
expirationInDays integer
Validity of the issued credential, in days.
expirationInSeconds integer
Validity of the issued credential, in seconds, when the configuration has one. It has precedence over expirationInDays.
supportRevocation boolean
When true, the issuer supports revocation of credentials from this configuration.
revocationMethod string
Possible values: [status_list]
Method used for credential revocation. status_list is the IETF Token Status List.
statusListCryptographicKeyFormat string
Possible values: [x509, did:key]
Format of the key that signs the status lists of this configuration, when the configuration names one.
statusListCryptographicKeyIdentifier string
Identifier of the key that signs the status lists of this configuration, when the configuration names one. Without it, the key that signs the credentials signs the status lists.
enforceCredentialUniqueness boolean
When true, each credential under this configuration is unique per holder.
supportCredentialReissuance boolean
When true, holders can request reissuance of expired or near-expiry credentials.
credentialBindingMethods string[]
Possible values: [did:key, jwk, cose_key]
Holder key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. cose_key is valid only for the mso_mdoc format. [] means that the credential is not bound to a holder key.
authorizationRequestType string
Possible values: [authorization_details, scope_based]
authorization_details (the default) or scope_based. With scope_based, the issuer accepts only the Authorization Code Flow for this credential definition.
scope string
OAuth 2.0 scope value of this credential configuration. The default is the credential configuration id. A wallet can ask for the configuration by this scope or by authorization_details.
display object
Display properties for the credential card in wallet UIs.
name string
Display name for the credential in wallet UIs.
locale string
BCP47 language tag for the display properties. The issuer always sets en-GB, and ignores any locale that you send.
description string
Human-readable description of the credential purpose.
backgroundColor string
Hex colour code for the credential card background (e.g. #FFFFFF).
textColor string
Hex colour code for text on the credential card (e.g. #000000).
logo object
Logo image of the credential card.
uri string
URL of the logo image.
altText string
Alternative text for the logo image.
backgroundImage object
Background image of the credential card.
uri string
URL of the background image.
credentialResponseInterval number
Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint.
credentialFormat string
Possible values: [jwt_vc_json, dc+sd-jwt, mso_mdoc]
Credential format of this configuration. jwt_vc_json is W3C VC (JWT). dc+sd-jwt is IETF SD-JWT VC. mso_mdoc is ISO 18013-5 mDoc/mDL.
validationPath string
JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is $.vc for jwt_vc_json, and $ for dc+sd-jwt and mso_mdoc.
type string[]
Credential type strings. The issuer sets this field when credentialFormat is jwt_vc_json. These values appear in the type field of the issued W3C VC (JWT).
vct string
Verifiable Credential Type identifier. The issuer sets this field when credentialFormat is dc+sd-jwt (e.g. urn:eu.europa.ec.eudi:pid:1).
doctype string
Document type identifier. The issuer sets this field when credentialFormat is mso_mdoc (e.g. org.iso.18013.5.1.lpid).
credentialDefinitionUri string
URL of the external claims schema that the issuer used to build the claims of this configuration.
cryptographicKeyFormat string
Possible values: [x509, did:key]
Format of the key that signs the credentials of this configuration: x509 or did:key. A configuration that named no key holds the key of the credential definition.
cryptographicKeyIdentifier string
Identifier of the key that signs the credentials of this configuration.
credentialCategory object
The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. none (no certificate rule), pid (person identification data), eaa (non-qualified attestation), qeaa (qualified attestation) or pub-eaa (attestation issued by or for a public sector body).
signingKeyCheck object
The check of the signing key of a credential configuration, made at the time of the answer. It covers two rules: the certificate of the key fits the credential category of the configuration, and the key of an mDL (doctype org.iso.18013.5.1.mDL) has the ISO/IEC 18013-5 Document Signer profile. The save of a credential definition uses the same check, so the result is the result that a save gives now. The result does-not-fit does not stop issuance.
result stringrequired
Possible values: [fits, does-not-fit, exempt, not-checked]
The result of the check: fits, does-not-fit, exempt or not-checked. fits: the certificate of the signing key fits the rules. does-not-fit: the certificate does not fit a rule, for example because the certificate chain of the key changed after the save. Select another key, or request a certificate with the presetId of the category (for an mDL, the preset mdoc-document-signer). exempt: the certificate does not fit, but the key has an exemption (trustedListExemption of the key: the certificate is in a trusted list), so the save does not refuse it. not-checked: the category is none and the configuration is not an mDL, so no rule applies.
messages string[]required
The texts of the check, one for each rule that the key does not fit, with the fix (the category rule first, then the mDL rule). An empty list for fits. For exempt, first Exempt: listed in <list> as <service>, then the rules. For not-checked, an empty list, or an information text when the key has a PID certificate and the configuration does not issue a PID.
suggestedCredentialCategory stringnullable
Possible values: [pid, null]
pid when credentialCategory is none, the vct or the doctype is a PID (urn:eudi:pid:1, urn:eu.europa.ec.eudi:pid:1, eu.europa.ec.eudi.pid.1), and the signing key fits pid. Set the category with an update. null in all other cases.
supportAttestationProof boolean
When true, the issuer accepts an attestation proof (key attestation).
supportJwtProof boolean
When true, the issuer accepts a jwt proof of possession (OpenID4VCI 1.0 proof_types_supported).
enforceKeyAttestation boolean
When true, the issuer refuses an issuance without a valid key attestation.
keyAttestationsRequired object
Object specifying key attestation requirements per proof type supported by the Credential Issuer.
attestation object
Key attestation requirements for the 'attestation' proof type.
key_storage string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted key storage security levels (e.g., ISO/IEC 18045 basic).
user_authentication string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted user authentication security levels.
jwt object
Key attestation requirements for the 'jwt' proof type.
key_storage string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted key storage security levels.
user_authentication string[]
Possible values: [iso_18045_basic, iso_18045_enhanced-basic, iso_18045_moderate, iso_18045_high]
Accepted user authentication security levels.
claims object
Claims of the credential, as claim path pointers. The issuer sets this field when credentialFormat is dc+sd-jwt or mso_mdoc.
claims object[]
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]
Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or null for every element of an array. For mso_mdoc, the first element is the mDoc namespace.
mandatory boolean
When true, the issuer always includes the claim.
limitDisclosure boolean
When true, the holder can disclose the claim selectively.
]
credentialDefinition object
Claims of the credential, as claim path pointers. The issuer sets this field when credentialFormat is jwt_vc_json. Each path starts with credentialSubject.
claims object[]
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]
Claim path pointer that selects the claim below $.vc. The first element is credentialSubject.
mandatory boolean
When true, the issuer always includes the claim.
]
]
version stringrequired
Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. version_01 is OpenID4VCI 1.0. A record that you created with an earlier version of this API can hold another value. The issuer sets the value at creation time and never changes it.
cryptographicKeyFormat string
Possible values: [x509, did:key]
Format of the key of the credential definition: x509 or did:key.
cryptographicKeyIdentifier string
Identifier of the key of the credential definition, from Key Management. A configuration that names no key of its own signs with this key.
trustAnchor stringrequired
Copy of cryptographicKeyFormat.
kid stringrequired
Copy of cryptographicKeyIdentifier.
enforceWUA booleanrequired
When true, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI issuance flow.
supportInteractiveAuthorisationEndpoint booleanrequired
When true, the issuer publishes an interactive authorisation endpoint for this credential definition.
supportWalletInitiatedIssuance boolean
When true, a wallet can start the issuance with a pushed authorisation request that names a scope or a credential configuration id.
supportCredentialOfferReuse boolean
When true, one credential offer can start an issuance for more than one wallet until the offer expires.
oidcProviderId string
Identifier of the external OpenID provider that authenticates the end user in the Authorization Code Flow. Empty when the credential definition has none.
systemManaged booleanrequired
When true, the platform made and manages this credential definition, for example for an extension.
extensionEnabled booleanrequired
When true, an extension supplies the credential data for this credential definition.
display objectrequired
Display properties of the credential, as published in the OID4VCI Credential Issuer Metadata. Wallets use these values to draw the credential card.
name stringrequired
Display name for the credential shown in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.
locale stringrequired
BCP47 language tag for the display properties. The issuer always sets en-GB, and ignores any locale that you send.
description stringrequired
Human-readable description of the credential purpose.
backgroundColor stringrequired
Hex colour code for the credential card background (e.g. #FFFFFF).
textColor stringrequired
Hex colour code for text on the credential card (e.g. #000000).
logo objectrequired
Logo image shown on the credential card. The issuer sets the organisation logo when you do not supply a URI. The issuer always returns the object, and uri is empty when the credential definition holds no logo.
uri stringrequired
URL of the logo image.
altText stringrequired
Alternative text for the logo image. Wallets use this text for accessibility.
backgroundImage objectrequired
Background image of the credential card. The issuer sets the organisation cover image when you do not supply a URI. The issuer always returns the object, and uri is empty when the credential definition holds no background image.
uri stringrequired
URL of the background image.
expirationInDays integerrequired
Validity of the first credential configuration, in days. Each entry of credentialDefinitions holds its own validity.
expirationInSeconds integer
Validity of the first credential configuration, in seconds, when it has one. The issuer leaves the field out when it has no value.
supportRevocation booleanrequired
When true, the issuer supports revocation of credentials from this credential definition.
revocationMethod stringrequired
Possible values: [status_list]
Method used for credential revocation. status_list is the IETF Token Status List.
enforceCredentialUniqueness booleanrequired
When true, each credential issued under this definition is unique per holder.
supportCredentialReissuance booleanrequired
When true, holders can request reissuance of expired or near-expiry credentials.
credentialBindingMethods string[]
Possible values: [did:key, jwk, cose_key]
Holder key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. cose_key is valid only for the mso_mdoc format. The value is null when the record holds no binding method.
credentialFormat stringrequired
Possible values: [jwt_vc_json, dc+sd-jwt, mso_mdoc]
Credential format identifier as defined in OID4VCI. Supported formats: jwt_vc_json (W3C VC JWT), dc+sd-jwt (IETF SD-JWT VC), mso_mdoc (ISO 18013-5 mDoc/mDL).
validationPath stringrequired
JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is $.vc for jwt_vc_json, and $ for dc+sd-jwt and mso_mdoc.
type string[]
Credential type strings as defined in the OID4VCI specification. These values appear in the type field of the issued W3C VC (JWT). The issuer omits this field when the record uses another credential format.
vct string
Verifiable Credential Type identifier used when credentialFormat is dc+sd-jwt. Included in the vct claim of the issued IETF SD-JWT VC.
doctype string
Document type identifier used when credentialFormat is mso_mdoc. Identifies the credential in the ISO 18013-5 mDoc/mDL format (e.g. org.iso.18013.5.1.lpid).
namespace stringrequired
Namespace identifier for ISO 18013-5 mDoc/mDL credentials. The value is empty for an OpenID4VCI 1.0 credential definition, because the mDoc namespace is the first element of each claim path.
credentialDefinitionUri stringrequired
URL of the external claims schema that the issuer used to build the claims of this record.
claims object
Claims of the credential, as claim path pointers. The issuer sets this field when credentialFormat is dc+sd-jwt or mso_mdoc.
claims object[]
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]
Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or null for every element of an array. For mso_mdoc, the first element is the mDoc namespace.
mandatory boolean
When true, the issuer always includes the claim.
limitDisclosure boolean
When true, the holder can disclose the claim selectively.
]
supportJwtProof boolean
When true, the issuer accepts a jwt proof of possession.
supportAttestationProof boolean
When true, the issuer accepts an attestation proof (key attestation).
enforceKeyAttestation boolean
When true, the issuer refuses an issuance without a valid key attestation.
credentialDefinition object
Claims of the credential, as claim path pointers. The issuer sets this field when credentialFormat is jwt_vc_json. Each path starts with credentialSubject.
claims object[]
One claim path pointer for each claim that the issuer publishes.
Array [
path undefined[]
Claim path pointer that selects the claim below $.vc. The first element is credentialSubject.
mandatory boolean
When true, the issuer always includes the claim.
]

Example (from schema)

{
  "credentialDefinition": {
    "id": "9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60",
    "credentialDefinitionId": "9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60",
    "openIdOrganisationId": "string",
    "createdAt": 1750000000,
    "updatedAt": 1750000600,
    "label": "Issue Portable Document A1",
    "credentialDefinitions": [
      {
        "id": "string",
        "credentialConfigurationId": "string",
        "label": "string",
        "expirationInDays": 0,
        "expirationInSeconds": 0,
        "supportRevocation": true,
        "revocationMethod": "status_list",
        "statusListCryptographicKeyFormat": "x509",
        "statusListCryptographicKeyIdentifier": "string",
        "enforceCredentialUniqueness": true,
        "supportCredentialReissuance": true,
        "credentialBindingMethods": [
          "did:key"
        ],
        "authorizationRequestType": "authorization_details",
        "scope": "string",
        "display": {
          "name": "string",
          "locale": "en-GB",
          "description": "string",
          "backgroundColor": "string",
          "textColor": "string",
          "logo": {
            "uri": "string",
            "altText": "string"
          },
          "backgroundImage": {
            "uri": "string"
          }
        },
        "credentialResponseInterval": 0,
        "credentialFormat": "jwt_vc_json",
        "validationPath": "string",
        "type": [
          "string"
        ],
        "vct": "string",
        "doctype": "string",
        "credentialDefinitionUri": "string",
        "cryptographicKeyFormat": "x509",
        "cryptographicKeyIdentifier": "string",
        "credentialCategory": "eaa",
        "signingKeyCheck": {
          "result": "fits",
          "messages": []
        },
        "suggestedCredentialCategory": null,
        "supportAttestationProof": true,
        "supportJwtProof": true,
        "enforceKeyAttestation": true,
        "keyAttestationsRequired": {
          "attestation": {
            "key_storage": [
              "iso_18045_basic"
            ],
            "user_authentication": [
              "iso_18045_basic"
            ]
          },
          "jwt": {
            "key_storage": [
              "iso_18045_basic"
            ],
            "user_authentication": [
              "iso_18045_basic"
            ]
          }
        },
        "claims": {
          "claims": [
            {
              "path": [
                "address",
                "country"
              ],
              "mandatory": true,
              "limitDisclosure": true
            }
          ]
        },
        "credentialDefinition": {
          "claims": [
            {
              "path": [
                "credentialSubject",
                "identifier"
              ],
              "mandatory": true
            }
          ]
        }
      }
    ],
    "version": "version_01",
    "cryptographicKeyFormat": "x509",
    "cryptographicKeyIdentifier": "string",
    "trustAnchor": "string",
    "kid": "string",
    "enforceWUA": true,
    "supportInteractiveAuthorisationEndpoint": true,
    "supportWalletInitiatedIssuance": true,
    "supportCredentialOfferReuse": true,
    "oidcProviderId": "string",
    "systemManaged": true,
    "extensionEnabled": true,
    "display": {
      "name": "Legal Person Identification Data",
      "locale": "en-GB",
      "description": "string",
      "backgroundColor": "#FFFFFF",
      "textColor": "#000000",
      "logo": {
        "uri": "string",
        "altText": "string"
      },
      "backgroundImage": {
        "uri": "string"
      }
    },
    "expirationInDays": 180,
    "expirationInSeconds": 0,
    "supportRevocation": true,
    "revocationMethod": "status_list",
    "enforceCredentialUniqueness": true,
    "supportCredentialReissuance": true,
    "credentialBindingMethods": [
      "did:key"
    ],
    "credentialFormat": "jwt_vc_json",
    "validationPath": "string",
    "type": [
      "string"
    ],
    "vct": "urn:eu.europa.ec.eudi:pid:1",
    "doctype": "eu.europa.ec.eudi.pid.1",
    "namespace": "string",
    "credentialDefinitionUri": "string",
    "claims": {
      "claims": [
        {
          "path": [
            "address",
            "country"
          ],
          "mandatory": true,
          "limitDisclosure": true
        }
      ]
    },
    "supportJwtProof": true,
    "supportAttestationProof": true,
    "enforceKeyAttestation": true,
    "credentialDefinition": {
      "claims": [
        {
          "path": [
            "credentialSubject",
            "identifier"
          ],
          "mandatory": true
        }
      ]
    }
  }
}

400

The request is invalid. The issuer returns this status when label is missing, has fewer than 3 or more than 100 characters, or uses a reserved platform value, when version is missing, when credentialBindingMethods holds cose_key for a credential format other than mso_mdoc, when a credentialDefinitions entry has an unknown member (for example version or enforceWUA), when no key names the signing key of an entry, when the key of an mso_mdoc entry is not x509, when a validity is outside its range, when scope is not one scope token, when a required field of the credential format is missing, when credentialCategory is not a category id, when an entry with the category eaa, qeaa or pub-eaa has a claim at the place of the EAA category of ETSI TS 119 472-1 (errorType eaa_category_claim_reserved, errorField credentialDefinitions[<index>].claims, or credentialDefinitions[<index>].type for W3C VC), or when the claims fail validation. When the certificate of the signing key of an entry does not fit its credentialCategory, or the key of an mDL entry has no ISO/IEC 18013-5 Document Signer profile, the answer has errorType signing_key_does_not_fit and errorField credentialDefinitions[<index>].cryptographicKeyIdentifier, errorMessages has the texts of the rules that the key does not fit (with the fix), and errorDescription has the field and the first text. The first entry that does not fit gives the error. A key with an exemption (trustedListExemption) is not refused.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

The field and the problem. With errorType, the field, then the first text of errorMessages.

errorType string

Possible values: [signing_key_does_not_fit, eaa_category_claim_reserved]

signing_key_does_not_fit: the certificate of the signing key of a configuration does not fit the credential category of the configuration, or the key of an mDL has no ISO/IEC 18013-5 Document Signer profile. eaa_category_claim_reserved: a configuration with the category eaa, qeaa or pub-eaa has a claim at the place of the EAA category of ETSI TS 119 472-1 (the issuer adds the category). Other errors have no errorType.

errorField string

The field of the error, with the position of the configuration in the request. credentialDefinitions[<index>].cryptographicKeyIdentifier for signing_key_does_not_fit. credentialDefinitions[<index>].claims, or credentialDefinitions[<index>].type for a W3C VC, for eaa_category_claim_reserved.

errorMessages string[]

All the texts of the refusal, one for each rule that does not fit, with the fix (the category rule first, then the mDL rule). Only with errorType. For signing_key_does_not_fit they are the same as signingKeyCheck.messages of the configuration and certificateAssessment.categoryMessages (or mdlConfigurationMessages) of the key.

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "credentialDefinitions[0].cryptographicKeyIdentifier: A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement, no QcSSCD statement, no QcType eseal). Request a certificate with the preset QEAA provider (qeaa-provider).",
  "errorType": "signing_key_does_not_fit",
  "errorField": "credentialDefinitions[0].cryptographicKeyIdentifier",
  "errorMessages": [
    "A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement, no QcSSCD statement, no QcType eseal). Request a certificate with the preset QEAA provider (qeaa-provider)."
  ]
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...