List verification history

GET 
/v3/config/digital-wallet/openid/sdjwt/verification/history

Lists verification exchange records. Each record holds one OpenID4VP verification lifecycle. The server sorts the records by updatedAt and uses sortOrder for the direction.

The response also holds verificationHistoryStats. These counters cover every verification exchange record of the organisation, not only the current page and not only the records that agree with the filters.

The filters combine with a logical AND. The presentationReceived, requestPending and verificationFailed flags are shortcuts for common status filters. They overwrite the status filter, so do not use them together with status.

The server does not return a record that you deleted, or a record of a presentation definition that you deleted.

search matches a part of the holder name and of presentationExchangeId, without regard to case. It does not look at any other property. sortOrder takes asc or desc; the server uses desc for every other value. The flags act only on the exact lowercase value true.

Request

Query Parameters

offset integerrequired

Default value: 0

Number of records to skip for pagination. A negative or unreadable value falls back to 0.

limit integerrequired

Default value: 10

Maximum number of records to return per page.

status string[]required
Possible values: [request_sent, request_received, presentation_pending, presentation_acked]
Filter the verification exchange records by their OpenID4VP lifecycle status.
Give more than one value to match any of them. Repeat the parameter, or give the values in one comma-separated list. The server keeps a value it does not know, and that value then matches no record.
Example: [presentation_acked]
presentationDefinitionId stringrequired

Filter by presentation definition identifier to retrieve OpenID4VP verification records for a specific verification template.

individualId stringrequired

Filter by individual identifier to retrieve records associated with a specific individual.

mapperId stringrequired

Filter by mapper identifier to retrieve records linked to a specific individual mapping.

holderDid stringrequired

Filter by the identifier of the holder. The server compares this value with holder.name of the record.

search stringrequired

Search term to filter results by

sortOrder stringrequired

Possible values: [desc, asc]

Default value: desc

Sort order for the returned records (ascending or descending).

responseCode stringrequired

Filter by the state value of the Authorization Request. The server compares this value with vpTokenRequestState. Use it to find the record that belongs to one wallet response.

presentationReceived booleanrequired

Set to true to return only the records with status presentation_acked. This flag overwrites the status filter.

requestPending booleanrequired

Set to true to return only the records that wait for the holder, that is the records with status request_sent or request_received. This flag overwrites the status filter.

verificationFailed booleanrequired

Set to true to return only the records with status presentation_acked and verified equal to false. This flag overwrites the status filter.

Responses

200

The server listed the verification exchange records.

Response Headers

application/json

Schema

Schema

verificationHistory object[]required
Verification exchange records for the current page. The array is empty when no record agrees with the filters.
Array [
presentationExchangeId stringrequired
Unique identifier of the verification exchange. Give this value as the presentationExchangeId path parameter to read, delete or revalidate the record, and to receive a DC API response for it.
id stringrequired
Identifier of the record. It holds the same value as presentationExchangeId.
vpTokenQrCode stringrequired
OpenID4VP Authorization Request URI encoded for QR code display or deep link. The holder's wallet scans or clicks this to initiate the presentation flow. Empty when using DC API response modes (dc_api or dc_api.jwt).
vpTokenRequestState stringrequired
State parameter for the OpenID4VP Authorization Request, used to correlate the request with the response.
vpTokenRequest stringrequired
Full OpenID4VP Authorization Request URI or payload. Empty when using DC API response modes (dc_api or dc_api.jwt).
presentationSubmission objectrequired
Wrapper that holds the Presentation Submission object of the wallet.
DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns null here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. Read presentation to get the credentials of the holder.
presentation_submission object
DIF Presentation Exchange Submission object that maps the credentials of the holder to the requirements of the verifier. Kept for old records only.
definition_id stringrequired
Identifier of the Presentation Definition that this submission fulfills.
descriptor_map object[]required
Array of Descriptor Map entries mapping each requested credential to its location in the Verifiable Presentation.
Array [
format stringrequired
Credential format of the matched credential (e.g. jwt_vc_json, dc+sd-jwt, mso_mdoc).
id stringrequired
Identifier of the Input Descriptor from the Presentation Definition that this entry satisfies.
path stringrequired
JSONPath expression pointing to the Verifiable Credential within the Verifiable Presentation token.
path_nested object
Nested path descriptor for credentials wrapped in envelope formats (e.g. JWT inside a VP JWT).
format stringrequired
Credential format of the nested credential (e.g. jwt_vc_json, dc+sd-jwt, mso_mdoc).
id stringrequired
Identifier of the Input Descriptor from the Presentation Definition that this nested entry satisfies.
path stringrequired
JSONPath expression pointing to the credential within the nested envelope.
]
id stringrequired
Unique identifier for this Presentation Submission.
status stringrequired
Possible values: [request_sent, request_received, presentation_pending, presentation_acked]
Lifecycle status of the verification exchange:
1. request_sent: The server made the OpenID4VP Authorization Request. The exchange waits for the holder.
2. request_received: The wallet of the holder got, or scanned, the Authorization Request.
3. presentation_pending: The wallet started the response but the verifier did not get a complete Authorization Response yet.
4. presentation_acked: The holder sent the Verifiable Presentation and the verifier processed it.
verified booleanrequired
Result of the verification of the Verifiable Presentation. The server checks the cryptographic signatures, the credential status and the presented claims against the DCQL query of the presentation definition.
createdAt numberrequired
Unix timestamp (in seconds) when this verification record was created.
updatedAt numberrequired
Unix timestamp (in seconds) when this verification record was last modified.
presentationDefinitionId stringrequired
Identifier of the presentation definition used for this verification request.
openIdOrganisationId stringrequired
Identifier of the digital wallet of the organisation that sent this verification request.
holder objectrequired
Metadata of the holder.
name stringrequired
Identifier of the holder, for example a DID or the name from the client metadata. An empty string when the server has no value.
presentation object[]required
Decoded credentials that the holder presented. The shape of each entry follows the credential format. null until the holder answers.
vpTokenResponse string[]required
Verifiable Presentation tokens that the wallet sent. The array holds one entry for each credential that the Authorization Request asked for. null until the wallet answers.
transactionData objectrequired
Transaction data confirmed by the holder during the presentation flow.
property name* any
Transaction data confirmed by the holder during the presentation flow.
transactionDataBase64 stringrequired
Base64url encoding of the transaction data that the Authorization Request holds.
credentialExchangeId stringrequired
Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification. Always empty on the response of the send operation. The server fills it in later, when the issuance flow starts.
responseType stringrequired
Possible values: [vp_token, device_response]
OAuth 2.0 response type of the Authorization Request.
dataAgreementId stringrequired
Identifier of the data agreement record that this verification exchange created.
userId stringrequired
Identifier of the dashboard user or individual that started this verification request.
presentationValidity object[]required
Validation result for each credential in the presentation, with the signature check, the expiry check and the revocation status. The revalidate operation writes a new value here. null until the holder answers.
clientIdScheme stringrequired
Possible values: [redirect_uri, did, verifier_attestation, x509_san_dns, x509_hash]
Client ID scheme used by the verifier in the OpenID4VP Authorization Request.
directPostRedirectUri stringrequired
URI that the wallet opens after it posts the Authorization Response. Empty for the DC API response modes (dc_api or dc_api.jwt).
responseMode stringrequired
Possible values: [direct_post, direct_post.jwt, dc_api, dc_api.jwt, iar-post, iar-post.jwt]
OpenID4VP response mode determining how the Authorization Response is delivered:
• direct_post: Response sent via HTTP POST to the verifier's redirect_uri without encryption.
• direct_post.jwt: Response sent via HTTP POST encrypted as a JWE.
• dc_api: Response delivered over the W3C Digital Credentials API transport without JWE encryption. Compatible with both signed and unsigned dcApiRequestType values.
• dc_api.jwt: Response delivered over the W3C Digital Credentials API transport encrypted as a JWE.
• iar-post: Response sent through the Interactive Authorisation Request transport without encryption.
• iar-post.jwt: Response sent through the Interactive Authorisation Request transport encrypted as a JWE.
verifierAttestation stringrequired
Verifier Attestation JWT sent to the holder, proving the verifier's authorization.
individualId stringrequired
Identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set individualId.
mapperId stringrequired
External identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set mapperId.
dataAgreement objectrequired
Data agreement that gives the terms for this verification exchange.
property name* any
Data agreement that gives the terms for this verification exchange.
nonce stringrequired
Cryptographic nonce used in the OpenID4VP Authorization Request to ensure freshness and prevent replay attacks.
dcApiProtocol string
Possible values: [openid4vp-v1-unsigned, openid4vp-v1-signed, org-iso-mdoc]
Digital Credentials API exchange protocol identifier returned when the presentation definition is configured for DC API response modes. Identifies the protocol variant used with the W3C Digital Credentials API (navigator.credentials.get()):
• openid4vp-v1-unsigned: The Authorization Request goes to the DC API of the browser without a signature. The browser can inspect the request for risk analysis. Use it for development and tests only.
• openid4vp-v1-signed: The verifier key signs the Authorization Request, and the request goes to the DC API of the browser as an opaque string. This gives verifier authentication. Use it for live use.
• org-iso-mdoc: The Authorization Request follows ISO 18013-7 Annex C. The wallet answers with an encrypted CBOR EncryptedResponse. Only present for the DC API response modes and for iso18013_7_annex_c.
dcApiRequest object
Request object for the W3C Digital Credentials API, structured for browser invocation via navigator.credentials.get(). Contains browser-specific request formats for Chrome and Safari. Only present when responseMode is dc_api or dc_api.jwt.
chrome object
Digital Credentials API request format for Chromium-based browsers. Uses the providers structure per the W3C Digital Credentials API specification.
digital object
Digital credential request options for Chromium-based browsers.
providers object[]
Array of credential request providers, each specifying a protocol and request data.
Array [
protocol string
Digital Credentials API exchange protocol identifier (e.g. openid4vp-v1-signed, openid4vp-v1-unsigned).
request object
The OpenID4VP Authorization Request payload. Structure varies by protocol:
• For openid4vp-v1-signed: Contains { "request": "<signed-JWT>" }, a JWT signed by the verifier's key.
• For openid4vp-v1-unsigned: Contains the full Authorization Request object with client_metadata, dcql_query, nonce, response_mode, response_type.
property name* any
The OpenID4VP Authorization Request payload. Structure varies by protocol:
• For openid4vp-v1-signed: Contains { "request": "<signed-JWT>" }, a JWT signed by the verifier's key.
• For openid4vp-v1-unsigned: Contains the full Authorization Request object with client_metadata, dcql_query, nonce, response_mode, response_type.
]
safari object
Digital Credentials API request format for Safari-based browsers. Uses the requests structure.
digital object
Digital credential request options for Safari-based browsers.
requests object[]
Array of credential requests for Safari, each containing data and protocol.
Array [
data string
JSON-stringified Authorization Request payload (Safari's DC API expects a string, not an object).
Decoding it yields the same structure that Chrome receives in request:
• For openid4vp-v1-signed: { "request": "<signed-JWT>" }.
• For openid4vp-v1-unsigned: the full inline Authorization Request object (response_type, response_mode, nonce, dcql_query, client_metadata, …).
protocol string
Digital Credentials API exchange protocol identifier (e.g. openid4vp-v1-signed, openid4vp-v1-unsigned).
]
requiresEncryption booleanrequired
true when the wallet must encrypt the Authorization Response as a JWE: for the direct_post.jwt and dc_api.jwt response modes, and for iso18013_7_annex_c. false for direct_post and dc_api.
signatureStamp booleanrequired
When false, the signature stamp is hidden in signed PDFs.
signatureCoordinate integer[]required
Possible values: >= 4, <= 4
Page coordinates of the signature in the signed PDF, as [x1, y1, x2, y2] in points.
files object[]required
List of files generated during the verification, including signed and unsigned PDF documents.
Array [
credentialId string
Identifier of the credential associated with this file.
error stringnullable
Error code if signing failed, null otherwise.
errorDescription stringnullable
Detailed error message if signing failed, null otherwise.
signedFile uri
URL of the signed PDF file.
unsignedFile uri
URL of the unsigned PDF file.
]
cryptographicKeyIdentifier string
Key identifier of the key that signed the Authorization Request. The server leaves this property out when the request is not signed.
cryptographicKeyFormat string
Possible values: [did:key, x509]
Format of the key that signed the Authorization Request. The server leaves this property out when the request is not signed.
presentationDefinitionSnapshot object
Copy of the presentation definition at the time of the request, in the shape of the presentation definition record. A later change of the presentation definition does not change a request that is already out.
property name* any
Copy of the presentation definition at the time of the request, in the shape of the presentation definition record. A later change of the presentation definition does not change a request that is already out.
]
pagination objectrequired

currentPage integer

Current page number

totalItems integer

Total number of items available

totalPages integer

Total number of pages based on limit

limit integer

Number of items per page

hasPrevious boolean

Indicates if there's a previous page

hasNext boolean

Indicates if there's a next page

verificationHistoryStats objectrequired

Counters for every verification exchange record of the organisation. The filters and the pagination do not change these values. verificationFailed counts a subset of presentationReceived, so the four counters do not add up to total. The server returns zero for every counter when it cannot build the counts.

total integerrequired

Number of verification exchange records.

presentationReceived integerrequired

Number of records with status presentation_acked.

requestPending integerrequired

Number of records with status request_sent or request_received.

verificationFailed integerrequired

Number of records with status presentation_acked and verified equal to false.

expired integerrequired

Always 0.

Example (from schema)

{
  "verificationHistory": [
    {
      "presentationExchangeId": "8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e",
      "id": "8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e",
      "vpTokenQrCode": "string",
      "vpTokenRequestState": "string",
      "vpTokenRequest": "string",
      "presentationSubmission": {
        "presentation_submission": {
          "definition_id": "string",
          "descriptor_map": [
            {
              "format": "string",
              "id": "string",
              "path": "string",
              "path_nested": {
                "format": "string",
                "id": "string",
                "path": "string"
              }
            }
          ],
          "id": "string"
        }
      },
      "status": "request_sent",
      "verified": true,
      "createdAt": 0,
      "updatedAt": 0,
      "presentationDefinitionId": "string",
      "openIdOrganisationId": "string",
      "holder": {
        "name": "string"
      },
      "presentation": [
        {}
      ],
      "vpTokenResponse": [
        "string"
      ],
      "transactionData": {},
      "transactionDataBase64": "string",
      "credentialExchangeId": "string",
      "responseType": "vp_token",
      "dataAgreementId": "string",
      "userId": "string",
      "presentationValidity": [
        {}
      ],
      "clientIdScheme": "redirect_uri",
      "directPostRedirectUri": "string",
      "responseMode": "direct_post",
      "verifierAttestation": "string",
      "individualId": "string",
      "mapperId": "string",
      "dataAgreement": {},
      "nonce": "string",
      "dcApiProtocol": "openid4vp-v1-unsigned",
      "dcApiRequest": {
        "chrome": {
          "digital": {
            "providers": [
              {
                "protocol": "string",
                "request": {}
              }
            ]
          }
        },
        "safari": {
          "digital": {
            "requests": [
              {
                "data": "string",
                "protocol": "string"
              }
            ]
          }
        }
      },
      "requiresEncryption": true,
      "signatureStamp": true,
      "signatureCoordinate": [
        100,
        100,
        200,
        150
      ],
      "files": [
        {
          "credentialId": "string",
          "error": "string",
          "errorDescription": "string",
          "signedFile": "string",
          "unsignedFile": "string"
        }
      ],
      "cryptographicKeyIdentifier": "string",
      "cryptographicKeyFormat": "did:key",
      "presentationDefinitionSnapshot": {}
    }
  ],
  "pagination": {
    "currentPage": 1,
    "totalItems": 25,
    "totalPages": 3,
    "limit": 10,
    "hasPrevious": false,
    "hasNext": true
  },
  "verificationHistoryStats": {
    "total": 128,
    "presentationReceived": 96,
    "requestPending": 24,
    "verificationFailed": 5,
    "expired": 0
  }
}

400

The organisation has no deployed digital wallet.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

The server could not read the page of verification exchange records.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...