Skip to main content

Create wallet unit

POST 
/v2/config/digital-wallet/openid/wallet-provider/wallet-unit

Registers a new wallet unit with the wallet provider. The wallet provider uses this registration to issue a Wallet Unit Attestation (WUA) to the wallet instance. The organisation must have the wallet provider capability enabled. To enable it, use PUT /v2/config/digital-wallet/openid. The response holds the assertionToken of the new wallet unit. This token is secret. Send it only to the wallet instance.

Request​

Header Parameters

    X-SandboxOrgId stringrequired

    Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.

    The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.

    X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.

    The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.

    Example: 6889e1a4c5b2f30001a3d710

Body

required

Details of the wallet unit to register.

    clientId stringrequired

    Client identifier for the new wallet unit (DID or URL).

    clientUrl string

    URL endpoint of the wallet instance. Optional.

    clientPublicKey objectrequired

    Public key JWK of the wallet instance for cryptographic verification. The service refuses the request when this object is empty.

    property name* any

    Public key JWK of the wallet instance for cryptographic verification. The service refuses the request when this object is empty.

    isAuthorised boolean

    Default value: false

    Set to true to authorize this wallet unit upon creation. Only an authorised wallet unit can get a Wallet Unit Attestation.

Responses​

The wallet provider registered the wallet unit.

Response Headers
    Schema
      walletUnit objectrequired

      The wallet unit record that the wallet provider created.

      id stringrequired

      Unique identifier for the wallet unit record. Use this value as the walletUnitId path parameter.

      clientId stringrequired

      Client identifier of the wallet instance, typically a DID or URL. Used to identify the wallet during OID4VCI and OpenID4VP protocol interactions.

      clientUrl stringrequired

      URL endpoint of the wallet instance, used for direct communication.

      clientPublicKey objectnullablerequired

      Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.

      property name* anynullable

      Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.

      isAuthorised booleanrequired

      When true, this wallet unit is authorized to interact with the Wallet Provider's services.

      assertionToken stringrequired

      Client assertion JWT of the wallet unit, used for OAuth 2.0 client authentication. This value is secret. Treat it as a credential and do not write it to logs.

      assertionTokenType stringrequired

      Type of the client assertion token.

      createdAt int64required

      Unix timestamp (in seconds) when this wallet unit was registered.

      updatedAt int64required

      Unix timestamp (in seconds) when this wallet unit record was last modified.

      walletUnitDevicePlatform stringrequired

      Device platform of the wallet unit. The known values are ios, android and organisation. The service does not check the value.

      walletUnitIntegrityToken stringrequired

      Device integrity token supplied by the wallet unit during registration, for example an App Attest or Play Integrity token.

      walletUnitKeyId stringrequired

      Identifier of the cryptographic key that the wallet unit registered for attestation.

      walletUnitMetadata objectnullablerequired

      Additional metadata that the wallet unit supplied during registration.

      property name* anynullable

      Additional metadata that the wallet unit supplied during registration.

    Loading...
    Last updated on