Skip to main content

List credential categories

GET 
/v2/config/digital-wallet/openid/credential-categories

Lists the credential categories. A credential category is the eIDAS category of the credentials that a credential configuration issues: PID, EAA, QEAA or PuB-EAA. Each category has the rules for the certificate of the key that signs the configuration, the certificate preset to request, the entitlement of the provider (ETSI TS 119 475 Annex A.2) and the sources of the rules. none has no rule.

The categories, in this order: none, pid, eaa, qeaa and pub-eaa. Give the id in credentialDefinitions[].credentialCategory of the create and update credential definition operations. The save refuses a configuration whose signing key does not fit its category, with 400 and errorType signing_key_does_not_fit. An mDL (doctype org.iso.18013.5.1.mDL) also needs a key with the ISO/IEC 18013-5 Document Signer profile, whatever its category: mdlRule gives this rule. The list is the same for every organisation.

Responses​

The service returned the credential categories.

Response Headers
    Schema
      credentialCategories object[]required

      The credential categories, in the order of the description.

    • Array [
      • id CredentialCategoryIdrequired

      Possible values: [none, pid, eaa, qeaa, pub-eaa]

      The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. none (no certificate rule), pid (person identification data), eaa (non-qualified attestation), qeaa (qualified attestation) or pub-eaa (attestation issued by or for a public sector body).

      name stringrequired

      The name of the category, for a person.

      description stringrequired

      What the category is, for a person.

      certificateRequirements string[]required

      The rules for the certificate of the signing key, one text for each rule. An empty list for none.

      presetId stringnullablerequired

      Possible values: [pid-provider, eaa-provider, qeaa-provider, pub-eaa-provider, null]

      The certificate preset to request for a key of this category (the list certificate presets operation). null for none.

      entitlement stringnullablerequired

      Possible values: [PID_Provider, Non_Q_EAA_Provider, QEAA_Provider, PUB_EAA_Provider, null]

      The entitlement of the provider in ETSI TS 119 475 Annex A.2. null for none.

      eaaCategory stringnullablerequired

      Possible values: [urn:etsi:esi:eaa:eu:qualified, urn:etsi:esi:eaa:eu:pub, null]

      The EAA category of ETSI TS 119 472-1 that the issuer adds to each credential of a configuration with this category (clause 4.2.2): for SD-JWT VC the claim category, for mdoc the data element category in the namespace org.etsi.01947201.010101, for W3C VC one more value of type. null for none, pid and eaa.

      sources string[]required

      The standards and the clauses of the rules. An empty list for none.

    • ]
      • mdlRule objectrequired

      The mDL rule: a credential configuration with credentialFormat mso_mdoc and one of the doctypes needs a signing key with the Document Signer profile of ISO/IEC 18013-5 Table B.3, whatever its credential category (also none). For an mDL with the category eaa, qeaa or pub-eaa, the key usage rule of the category also accepts Type C, as ETSI TS 119 412-6 PID-4.4.1-01 does for a PID (a known deviation from ETSI EN 319 412-3 LEG-4.3.1-3). For an mDL with the category none, request the certificate with the preset presetId; for another category, use the preset of the category and add the values of fixed.

      doctypes string[]required

      The doctypes of the rule.

      name stringrequired

      The name of the rule, for a person.

      description stringrequired

      What the rule is, for a person.

      certificateRequirements string[]required

      The rules for the certificate of the signing key, one text for each rule.

      presetId stringrequired

      Possible values: [mdoc-document-signer]

      fixed objectrequired

      The key usage and the extended key usage of the rule, in the form of a CsrRequest. For an mDL with the category pid, eaa, qeaa or pub-eaa, add them to the CSR of the preset of the category.

      keyUsage objectrequired

      The key usage extension. The keys are EC keys, so keyEncipherment and dataEncipherment are not allowed (RFC 5480 section 3). A leaf certificate has no CA key usage (keyCertSign, cRLSign).

      values string[]required

      Possible values: [digitalSignature, nonRepudiation, keyAgreement], >= 1

      The key usages, each one time.

      critical booleannullable

      true: the extension is critical. Without a value, the criticality of the preset applies (true when the preset fixes none).

      extendedKeyUsage objectrequired

      The extended key usage extension.

      values string[]required

      Possible values: >= 1

      The key purposes as OIDs in dotted form, at most 20, each one time. For example 1.0.18013.5.1.2 (ISO/IEC 18013-5 mdoc Document Signer), 1.0.18013.5.1.6 (ISO/IEC 18013-5 reader authentication) or 1.3.6.1.5.5.7.3.45 (Token Status List signer).

      critical booleannullable

      true: the extension is critical. Without a value, the criticality of the preset applies (false when the preset fixes none).

      sources string[]required

      The standards and the clauses of the rule.

    Loading...
    Last updated on