Skip to main content

List credential

GET 
/v2/config/digital-wallet/openid/sdjwt/credentials

Lists the credentials in the wallet of the holder with pagination. The wallet leaves out the credentials that you deleted, and lists the Wallet Unit Attestations last. Use the query parameters to filter the list by status, credential type, expiry, identifiers or a search term, and to set the order. With groupBatches=true, the list gives one row for each batch issuance, with batchInstanceCount and batchAvailableCount. The wallet replaces a value that it cannot read with the default value and does not refuse the request.

Request​

Query Parameters

    offset integerrequired

    Default value: 0

    Number of records to skip for pagination. A negative or unreadable value falls back to 0.

    limit integerrequired

    Default value: 10

    Maximum number of records to return per page.

    expired booleanrequired

    Filter the list by expiry. true gives the expired credentials: a revoked credential, an archived Wallet Unit Attestation, or a credential whose validity ended. false gives the other credentials. A pending credential is never expired.

    search stringrequired

    Search term. The wallet matches a part of the vct, the mDoc doctype, the W3C credential type and the issuer name, without regard to case.

    sortBy stringrequired

    Possible values: [updatedAt, createdAt]

    Default value: updatedAt

    Field to sort on: updatedAt (the default) or createdAt.

    sortOrder stringrequired

    Possible values: [desc, asc]

    Default value: desc

    Sort order for the returned records (ascending or descending).

    credentialStatus stringrequired

    Possible values: [credential_pending, credential_acked, credential_accepted, credential_archived]

    Filter the list by the status of the credential in the wallet. Give one value or a comma-separated list.

    Example: credential_acked
    ids stringrequired

    Comma-separated list of credentialId values. The wallet returns only these credentials.

    Example: d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11,5f6a7b8c-9d0e-4f1a-2b3c-4d5e6f7a8b9c
    groupBatches booleanrequired

    Default value: false

    When true, the list gives one row for each batch issuance in place of one row for each copy. The row is a copy that is not presented yet, if there is one.

    vct stringrequired

    Filter the list by the Verifiable Credential Type (vct) of an IETF SD-JWT VC credential.

    Example: urn:eu.europa.ec.eudi:pid:1
    doctype stringrequired

    Filter the list by the document type (doctype) of an ISO 18013-5 mDoc credential.

    Example: org.iso.18013.5.1.mDL
    type stringrequired

    Filter the list by one credential type in the credential definition of a W3C VC credential.

    Example: VerifiableAttestation

Responses​

The wallet returned the credentials.

Response Headers
    Schema
      credential object[]

      Credential records for the current page. The array is empty if the wallet holds no credential that matches the filters.

    • Array [
      • id stringrequired

      Unique identifier of the credential record. This field holds the same value as credentialId.

      credentialId stringrequired

      Unique identifier of the credential record in the wallet of the holder. Every /credential/{credentialId}/... path takes this value.

      credentialExchangeId stringrequired

      Identifier of the OID4VCI exchange at the issuer, when the wallet knows it. Use it to match the record with the issuance history of an issuer of this platform.

      credentialToken stringrequired

      The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer's OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.

      credential objectrequired

      Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is null while the wallet waits for the credential.

      property name* any

      Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is null while the wallet waits for the credential.

      credentialStatus stringrequired

      Possible values: [credential_pending, credential_acked, credential_accepted, credential_archived]

      Current status of the credential in the wallet of the holder. credential_pending means the flow needs more steps: a transaction code, an authorization code, or a call to the OID4VCI Deferred Credential Endpoint. credential_acked means the wallet received and stored the credential. credential_accepted means the holder accepted the credential. credential_archived marks a Wallet Unit Attestation that a newer one replaced.

      acceptanceToken stringrequired

      Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint.

      deferredEndpoint stringrequired

      URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance.

      credentialIssuer stringrequired

      Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata.

      preAuthorisedCode stringrequired

      Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow.

      userPin stringrequired

      Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow.

      createdAt integerrequired

      Unix timestamp (in seconds) when this credential record was created.

      updatedAt integerrequired

      Unix timestamp (in seconds) when this credential record was last modified.

      issuedAt integerrequired

      Unix time (seconds) when the wallet first stored a credential on this record. 0 when the wallet holds no credential yet.

      refreshCount integerrequired

      Number of times that the wallet replaced the credential of this record with a new one, for example after a re-issuance.

      lastRefreshedAt integerrequired

      Unix time (seconds) of the last replacement of the credential. 0 when the wallet never replaced it.

      openIdOrganisationId stringrequired

      Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential.

      organisationId stringrequired

      Unique identifier of the organisation that holds this credential.

      userPinRequired booleanrequired

      When true, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.

      credentialFormat stringrequired

      Possible values: [``, vc+sd-jwt, vp+sd-jwt, dc+sd-jwt, jwt_vc_json, jwt_vc, mso_mdoc]

      Format of the received credential as defined in OID4VCI. jwt_vc_json and jwt_vc are W3C VC (JWT) formats, vc+sd-jwt, vp+sd-jwt, and dc+sd-jwt are IETF SD-JWT VC formats, and mso_mdoc is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.

      presentationId stringrequired

      Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).

      issuer objectrequired

      Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.

      name stringrequired

      Display name of the issuer.

      location stringrequired

      Location of the issuer.

      cover stringrequired

      URL of the issuer's cover image.

      logo stringrequired

      URL of the issuer's logo image.

      description stringrequired

      Description of the issuer.

      credentialConfigurations objectrequired

      Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example vct, doctype, credential_definition and display.

      property name* any

      Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example vct, doctype, credential_definition and display.

      txCode objectrequired

      Transaction code (tx_code) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns {"length": 0, "input_mode": "", "description": ""} when the offer has no transaction code.

      length integerrequired

      Number of characters that the transaction code has. The value is 0 when the offer has no transaction code.

      input_mode stringrequired

      Input method for the transaction code, as defined in OID4VCI. numeric accepts digits only. text accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.

      description stringrequired

      Instruction for the holder that explains how to get the transaction code.

      authorizationDetails object[]required

      Authorization details that the issuer returned in the OID4VCI Token Response. The field is null for the Pre-Authorized Code Flow.

    • Array [
      • type stringrequired

      Authorization detail type. The value is openid_credential for an OID4VCI credential issuance request.

      credential_configuration_id stringrequired

      Identifier of the credential configuration in the Credential Issuer Metadata of the issuer.

      credential_identifiers string[]required

      Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request.

    • ]
      • revocationStatus stringrequired

      Possible values: [``, Operational, Revoked, Suspended]

      Current revocation status. Operational means valid, Revoked means permanently invalidated, Suspended means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.

      legalPidAttestation stringrequired

      Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer's legal identity in the EUDI Wallet ecosystem.

      legalPidAttestationPop stringrequired

      Proof of Possession (PoP) for the issuer's LPID attestation, proving the issuer controls the associated private key.

      legalPidVerified booleanrequired

      Indicates whether the issuer's LPID attestation has been successfully verified.

      autoPresent booleanrequired

      When true, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.

      version stringrequired

      Possible values: [version_01]

      Version of the OID4VCI protocol of the issuance: version_01 (OpenID4VCI 1.0).

      cryptographicKeyIdentifier stringrequired

      Key identifier (kid) of the holder key that the credential is bound to.

      cryptographicKeyFormat stringrequired

      Possible values: [``, did:key, x509]

      Format of the holder key that the credential is bound to.

      trustAnchor stringrequired

      Holds the same value as cryptographicKeyFormat.

      kid stringrequired

      Holds the same value as cryptographicKeyIdentifier.

      legalPidAttestationValidity object[]required

      Result of the check of the LPID attestation of the issuer. Each entry holds validatedAt, attestation (isExpired, isRevoked, isVerified, errors) and proofOfPossession (isExpired, isVerified, errors).

      expiredCredentialTokens string[]required

      Array of previously issued credential tokens that have expired.

      expiredCredentials object[]required

      Array of decoded expired credential payloads.

      requiresEncryption booleanrequired

      When true, the issuer requires encrypted OID4VCI Credential Responses for this credential.

      isVerifiedWithTrustList booleanrequired

      When true, the issuer of this credential was verified against a configured trust list.

      trustServiceProvider objectrequired

      Details of the trust service provider entry that matched the issuer during trust list verification. The field is null when the wallet found no match.

      property name* any

      Details of the trust service provider entry that matched the issuer during trust list verification. The field is null when the wallet found no match.

      oAuthFlow stringrequired

      Possible values: [``, frontchannel, backchannel]

      OAuth 2.0 flow used for credential issuance. frontchannel uses browser redirects, backchannel uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.

      authorizationRequest stringrequired

      OAuth 2.0 authorization request URL for the Authorization Code Flow.

      isWalletUnitAttestation booleanrequired

      When true, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it, and the wallet refuses to delete it.

      systemManaged booleanrequired

      When true, an extension of the organisation manages this credential, and the wallet refuses to delete it.

      batchId stringrequired

      Identifier that the copies of one batch issuance share. Empty for a credential without a batch. Accept and delete act on every copy of the batch.

      presented booleanrequired

      true when the wallet has used this copy of a batch issuance in a presentation. The wallet presents each copy of a batch once. Always false for a credential without a batch.

      deferredInterval string

      Time in seconds that the issuer asks the wallet to wait before the next call to the Deferred Credential Endpoint. Present only for a deferred issuance.

      batchInstanceCount integer

      Number of copies of the batch. Present only on a row of the list operation with groupBatches=true, for a batch issuance.

      batchAvailableCount integer

      Number of copies of the batch that the wallet has not presented yet. Present only on a row of the list operation with groupBatches=true, for a batch issuance.

      notificationId stringrequired

      notification_id from the issuer, for the OpenID4VCI Notification Endpoint.

      notificationEndpoint stringrequired

      Notification Endpoint of the issuer.

      notificationSent booleanrequired

      true after the wallet sent the notification to the issuer.

      accessTokenType string

      Type of the access token from the issuer, for example bearer or DPoP.

      dpopJwk object

      JSON Web Key (JWK) representing the holder's public key for DPoP binding.

      alg string

      Algorithm intended for use with the key.

      crv stringrequired

      Cryptographic curve.

      kid string

      Key ID used to match a specific key.

      kty stringrequired

      Key type.

      x stringrequired

      X coordinate for the EC public key (Base64URL encoded).

      y stringrequired

      Y coordinate for the EC public key (Base64URL encoded).

    • ]
      • pagination object
      currentPage integer

      Current page number

      totalItems integer

      Total number of items available

      totalPages integer

      Total number of pages based on limit

      limit integer

      Number of items per page

      hasPrevious boolean

      Indicates if there's a previous page

      hasNext boolean

      Indicates if there's a next page

    Loading...
    Last updated on