Skip to main content
Trust Sources

Add trust source

POST/v4/config/ows/trust/sources

Adds a trust source to the organisation: CA certificates that you give (trust_anchor), or a published list that the wallet downloads (etsi_trusted_list, etsi_lote). Each trust source has one usedFor role, and a check reads only the trust sources of its accepted list.

KindRequiredOptionalNot allowed
trust_anchorcertificates, usedFornameurl, signerCertificates
etsi_trusted_list, etsi_loteurl (https), usedForname, signerCertificatescertificates

The wallet reads a list once in the request, within the limits of a download, so the answer has its state and the first check has the copy. When the platform downloaded the URL a short time ago, the wallet reads that copy. The content must be a list of the kind of the source with at least one entry, and its signature must verify when you give signerCertificates. A list with the usedFor status_issuer must be an etsi_lote list with a service that gives this role (a revocation service of a PID or PuB-EAA provider). Else the answer is 400 with errorId trust_source.list_not_usable (The list cannot be used: <reason>; the reason is the HTTP status, the read failure or the signature failure), and nothing is saved. Without signerCertificates, list.signatureVerified is false.

A national list that serves several roles needs one trust source for each role; the wallet still downloads each URL once. To use a trust source in a check, name it in an accepted list (for example acceptedCredentialSigners of a presentation definition). API key scope: trust-sources:create (the older trust-anchors:create still works for a period).

Authorizations

  • Authorizationstringheaderrequired

    Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.

    Scope:trust-sources:create

Body

application/json

The trust source to add. A member that the operation does not declare is refused (<name>: unknown field).

  • kindenum<string>required

    Required. trust_anchor: CA certificates in PEM. etsi_trusted_list: an ETSI TS 119 612 trusted list (XML), for example a national trusted list. etsi_lote: an ETSI TS 119 602 list of trusted entities (XML or JSON), for example an EU list of wallet providers.

    Available options:trust_anchor,etsi_trusted_list,etsi_lote

    Example:"trust_anchor"

  • namestring

    Name of the trust source, for the dashboard. Default: for a list, the last segment of the path of its URL; for a trust anchor, the common name of its first certificate.

    Example:"Wallet provider root (development CA)"

  • urlstring

    The https URL of the list, at most 2048 characters. Required for a list; refused for a trust anchor.

    Example:"https://example.eu/lists/wallet-providers.xml"

  • certificatesstring

    PEM text with 1 to 10 CA certificates (basicConstraints cA=TRUE, not expired) and up to 10 CRLs that these CAs signed, at most 65536 characters. A private key is refused. Required for a trust anchor; refused for a list.

    Example:"-----BEGIN CERTIFICATE----- MIIB... -----END CERTIFICATE-----"

  • signerCertificatesstring

    PEM text with the certificates that sign the list, at least one. The wallet then refuses a copy of the list whose signature does not verify. Optional for a list; refused for a trust anchor.

    Example:"-----BEGIN CERTIFICATE----- MIIC... -----END CERTIFICATE-----"

  • usedForenum<string>required

    Required. The one role that the organisation uses the source for. It narrows the roles that a list gives its entries.

    Available options:wallet_provider,pid_provider,qeaa_provider,pub_eaa_provider,eaa_provider,mdl_issuer,status_issuer,access_certificate_provider,registration_certificate_provider

    Example:"wallet_provider"

Response

application/json

The new trust source, with the state of its list.

  • trustSourceobject

    The new trust source.