Filter verification

POST 
/v2/config/digital-wallet/openid/sdjwt/verification/:presentationId/filter

Filters the credentials in the wallet of the holder against the request of the verifier and returns the matches. Call this operation after the receive operation, and use the result to build the request body of the send operation.

The response holds credentials when the verifier sent a DCQL query. DCQL is the only query form that an iGrant.io verifier sends, so this is the usual answer. The response holds inputDescriptors in place of it only for a request from an outside verifier that still uses a DIF Presentation Exchange definition. The wallet never returns both keys.

The array holds one entry for every credential query, even for a query that no credential in the wallet answers. Read matchedCredentials on each entry: an empty array marks a requirement that the holder cannot meet.

The request has no body. The wallet discards a body if you send one.

There is no V3 version of this operation. Use it together with the V3 receive, read and send operations.

Request

Path Parameters

presentationId stringrequired
Unique identifier of the presentation record in the wallet of the holder: the presentationId of the record, which the receive verification operation returns. The id of the record holds the same value.
Example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73

Responses

200

The wallet compared the credentials with the verifier's request and returns the matches.

Response Headers

application/json

Schema

Schema

credentials object[]
Matches for each credential query in the DCQL query of the verifier, with one entry for every query. The wallet leaves this property out only when the verifier sent a DIF Presentation Exchange definition. Give the id of each entry in the credentials array of the send operation.
Array [
id stringrequired
Identifier of the DCQL credential query that these credentials match. Give this value as the id of the matching entry in the credentials array of the send operation. For a Presentation Exchange request this is the Input Descriptor identifier.
name string
Human-readable name of the credential requirement. Present only for a Presentation Exchange request that holds a name. Never present for a DCQL query.
purpose string
Reason why the verifier asks for this credential. Present only for a Presentation Exchange request that holds a purpose. Never present for a DCQL query.
claimSets array[]
The options of claim_sets of the DCQL credential query, in order of preference. Each option is a list of claim identifiers. Give one option, exactly, as claimIds in the send operation. Present only when the query has claim_sets.
multiple boolean
true when the DCQL credential query allows more than one credential. Give the credentials in credentialIds in the send operation. Present only when it is true.
matchedCredentials object[]required
Credentials in the wallet of the holder that agree with this query. The array is empty when the wallet holds no matching credential. The wallet always gives the property, and it is never null.
Array [
credentialId stringrequired
Identifier of the matching credential in the wallet of the holder. Give this value as credentialId, or in credentialIds, in the request body of the send operation.
type string[]
Credential types of the matching W3C Verifiable Credential. The wallet leaves this property out for other credential formats.
vct string
Verifiable Credential Type of the matching IETF SD-JWT VC. The wallet leaves this property out for other credential formats.
doctype string
Document type of the matching ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats.
match objectrequired
Claims of this credential that agree with the query, with their values. The keys are claim names or dotted claim paths. Take the values for claimIds of the send operation from claimSets, not from these keys.
For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example org.iso.18013.5.1.family_name. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace.
When the query asks for no single claim, the wallet lists every claim that it can disclose: every namespace.element for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole credentialSubject for a W3C VC JWT.
property name* any
Claims of this credential that agree with the query, with their values. The keys are claim names or dotted claim paths. Take the values for claimIds of the send operation from claimSets, not from these keys.
For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example org.iso.18013.5.1.family_name. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace.
When the query asks for no single claim, the wallet lists every claim that it can disclose: every namespace.element for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole credentialSubject for a W3C VC JWT.
]
]
inputDescriptors object[]
Matches for each Input Descriptor, for a request from an outside verifier that still uses a DIF Presentation Exchange definition, with one entry for every Input Descriptor. The wallet leaves this property out when the verifier sent a DCQL query.
Array [
id stringrequired
Identifier of the DCQL credential query that these credentials match. Give this value as the id of the matching entry in the credentials array of the send operation. For a Presentation Exchange request this is the Input Descriptor identifier.
name string
Human-readable name of the credential requirement. Present only for a Presentation Exchange request that holds a name. Never present for a DCQL query.
purpose string
Reason why the verifier asks for this credential. Present only for a Presentation Exchange request that holds a purpose. Never present for a DCQL query.
claimSets array[]
The options of claim_sets of the DCQL credential query, in order of preference. Each option is a list of claim identifiers. Give one option, exactly, as claimIds in the send operation. Present only when the query has claim_sets.
multiple boolean
true when the DCQL credential query allows more than one credential. Give the credentials in credentialIds in the send operation. Present only when it is true.
matchedCredentials object[]required
Credentials in the wallet of the holder that agree with this query. The array is empty when the wallet holds no matching credential. The wallet always gives the property, and it is never null.
Array [
credentialId stringrequired
Identifier of the matching credential in the wallet of the holder. Give this value as credentialId, or in credentialIds, in the request body of the send operation.
type string[]
Credential types of the matching W3C Verifiable Credential. The wallet leaves this property out for other credential formats.
vct string
Verifiable Credential Type of the matching IETF SD-JWT VC. The wallet leaves this property out for other credential formats.
doctype string
Document type of the matching ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats.
match objectrequired
Claims of this credential that agree with the query, with their values. The keys are claim names or dotted claim paths. Take the values for claimIds of the send operation from claimSets, not from these keys.
For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example org.iso.18013.5.1.family_name. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace.
When the query asks for no single claim, the wallet lists every claim that it can disclose: every namespace.element for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole credentialSubject for a W3C VC JWT.
property name* any
Claims of this credential that agree with the query, with their values. The keys are claim names or dotted claim paths. Take the values for claimIds of the send operation from claimSets, not from these keys.
For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example org.iso.18013.5.1.family_name. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace.
When the query asks for no single claim, the wallet lists every claim that it can disclose: every namespace.element for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole credentialSubject for a W3C VC JWT.
]
]

Example (from schema)

{
  "credentials": [
    {
      "id": "Person-Identification-Data-PID",
      "name": "string",
      "purpose": "string",
      "claimSets": [
        [
          "given_name",
          "family_name",
          "birthdate"
        ],
        [
          "given_name",
          "family_name",
          "age_over_18"
        ]
      ],
      "multiple": true,
      "matchedCredentials": [
        {
          "credentialId": "d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11",
          "type": [
            "string"
          ],
          "vct": "string",
          "doctype": "string",
          "match": {}
        }
      ]
    }
  ],
  "inputDescriptors": [
    {
      "id": "Person-Identification-Data-PID",
      "name": "string",
      "purpose": "string",
      "claimSets": [
        [
          "given_name",
          "family_name",
          "birthdate"
        ],
        [
          "given_name",
          "family_name",
          "age_over_18"
        ]
      ],
      "multiple": true,
      "matchedCredentials": [
        {
          "credentialId": "d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11",
          "type": [
            "string"
          ],
          "vct": "string",
          "doctype": "string",
          "match": {}
        }
      ]
    }
  ]
}

400

The presentation ID is unknown, the record is already presentation_acked, or the wallet unit is not operational. The wallet also refuses this operation for a sandbox organisation.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...