Skip to main content

Read global configuration

GET 
/v2/config/digital-wallet/openid/issuer/global-configuration

Reads the global configuration of the OID4VCI issuer. An organisation has one issuer global configuration. The wallet makes it with the default values when the organisation wallet is deployed, so you do not create it. The organisation must have a deployed digital wallet.

The response also gives settingLimits: the rule (smallest value, largest value, default and unit) of each numeric setting. Use it to check a value before you update the configuration.

Responses​

The server returns the issuer global configuration and the rule of each numeric setting.

Response Headers
    Schema
      globalConfiguration objectrequired

      The issuer global configuration of the organisation.

      id stringrequired

      Record identifier of the global configuration. The service makes this value when it saves the record. It has the same value as globalConfigurationId.

      globalConfigurationId stringrequired

      Unique identifier of the issuer global configuration. An organisation has one issuer global configuration, so the read and update operations do not use this value.

      openIdOrganisationId stringrequired

      Identifier of the OpenID wallet deployment that holds this configuration.

      credentialExpirationInDays integerrequired

      Default validity, in days, of a credential whose configuration sets none. The default is 180.

      credentialExpirationInSeconds integer

      Default validity, in seconds, of a credential whose configuration sets none. When present, it has precedence over credentialExpirationInDays.

      credentialBranding objectrequired

      Default display properties of the credential card in wallet UIs. The service always returns this object.

      name stringrequired

      Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.

      description stringrequired

      Default human-readable description for credentials displayed in wallet UIs.

      backgroundColor stringrequired

      Default hex colour code for the credential card background (e.g. #FFFFFF).

      textColor stringrequired

      Default hex colour code for text on the credential card (e.g. #000000).

      logo objectrequired

      Logo that wallets show on the credential card. The service sets uri and ignores the value in the request body.

      uri stringrequired

      URL of the default logo displayed on credential cards in wallet UIs. The service sets this URL to the organisation logo, and it changes the URL to the configuration logo after an upload to the logo image operation.

      altText stringrequired

      Alt text for the logo image, used for accessibility.

      backgroundImage objectrequired

      Background image that wallets show on the credential card. The service sets uri and ignores the value in the request body.

      uri stringrequired

      URL of the default background image for credential cards.

      credentialRequestEncryptionRequired booleanrequired

      When true, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer's encryption key.

      authorizationRequestExpiry integerrequired

      Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.

      credentialBindingMethods string[]required

      Possible values: [jwk, did:key, cose_key]

      Default holder key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The list always has cose_key, and without a stored value it is jwk and cose_key. It is a template for new credential definitions: each credential definition keeps the methods of its format.

      credentialResponseInterval numberrequired

      Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint.

      notificationEndpointEnabled object

      Shows whether the issuer publishes the OID4VCI Notification Endpoint. The service omits this field when the configuration holds no value.

      version_01 boolean

      When true, the issuer publishes the Notification Endpoint for wallets that use OpenID4VCI 1.0.

      issuerMetadata object

      Signing settings of the OID4VCI Credential Issuer Metadata. The service omits this field when the configuration holds no value.

      signedMetadataEnabled booleanrequired

      When true, the issuer publishes the Credential Issuer Metadata as a signed JWT.

      cryptographicKeyIdentifier stringnullable

      Key identifier of the key that signs the Credential Issuer Metadata. The service omits this field when signed metadata is off.

      cryptographicKeyFormat stringnullable

      Format of the signing key: x509 or did:key.

      accessTokenLifetimeInSeconds integer

      How long an access token of this issuer is valid, in seconds. The wallet gets a new one with its refresh token.

      refreshTokenLifetimeInSeconds integer

      How long a refresh token of this issuer is valid, in seconds.

      preAuthorisedCodeLifetimeInSeconds integer

      Time-to-live (in seconds) for the pre-authorised code of the Pre-Authorized Code Flow.

      authorizationCodeExpiryInSeconds integer

      Sets the time-to-live (in seconds) for the authorization code (RFC 6749 §4.1.2). After this period the code expires and can no longer be exchanged for a token.

      dpopEnabled boolean

      The authorisation server supports DPoP (RFC 9449): the metadata lists dpop_signing_alg_values_supported and the access token is bound to the key of the wallet's DPoP proof. Off by default. When off, the token endpoint issues Bearer tokens. Turning it off also turns off Require DPoP.

      dpopRequired boolean

      Makes the DPoP proof (RFC 9449) mandatory at the v1.0 token endpoint: token requests without a proof are rejected. Needs Enable DPoP; turning it on also turns on Enable DPoP. Applies at the authorisation server, immediately.

      nonceExpiryInSeconds integer

      Sets the time-to-live (in seconds) for the c_nonce issued to the wallet at the token/nonce endpoint. After this period the nonce expires and the wallet must request a fresh one before it can prove key possession.

      batchIssuanceEnabled boolean

      When true, one credential request can carry more than one proof, and the issuer issues one credential for each proof.

      batchSize integer

      The most proofs, and so credentials, that one credential request can carry.

      includeIssuerDisplayExtensions boolean

      When true, the Credential Issuer Metadata keeps the iGrant.io issuer display extensions (location and background_image).

      credentialRequestCompressionEnabled boolean

      When true, the Credential Issuer Metadata announces DEFLATE compression for an encrypted Credential Request.

      credentialResponseCompressionEnabled boolean

      When true, the Credential Issuer Metadata announces DEFLATE compression for an encrypted Credential Response.

      createdAt numberrequired

      Unix timestamp (in seconds) when this configuration was created.

      updatedAt numberrequired

      Unix timestamp (in seconds) when this configuration was last modified.

      settingLimits objectrequired

      The rule of each numeric setting of the issuer global configuration. The key is the name of the setting, for example nonceExpiryInSeconds.

      property name* object

      The rule of one numeric setting of the issuer global configuration. The wallet owns these rules.

      minimum integerrequired

      The smallest value that the update operation accepts.

      maximum integerrequired

      The largest value that the update operation accepts.

      default integernullable

      The value that the issuer uses when the setting is not set (null). null when the setting has no default.

      unit stringrequired

      The unit of the value, for example seconds.

      zeroIsNotSet boolean

      When true, the value 0 in the configuration also means that the setting is not set.

    Loading...
    Last updated on