Skip to main content

Read presentation definition

GET 
/v2/config/digital-wallet/openid/sdjwt/presentation-definition/:presentationDefinitionId

Reads one presentation definition by its presentationDefinitionId. The id of the answer holds the same value as presentationDefinitionId.

Request​

Path Parameters

    presentationDefinitionId stringrequired

    Unique identifier of the presentation definition that specifies the credential and claims requirements for OpenID4VP verification.

Responses​

The server found the presentation definition.

Response Headers
    Schema
      presentationDefinition objectrequired
      id stringrequired

      Identifier of the presentation definition. It holds the same value as presentationDefinitionId.

      openIdOrganisationId stringrequired

      Identifier of the digital wallet of the organisation that owns this presentation definition.

      presentationDefinitionId stringrequired

      Unique identifier that the server gives to the presentation definition. Use this identifier in a verification request and in the path of the read, update and delete endpoints.

      label stringrequired

      Human-readable label that gives the purpose of this presentation definition, for example 'Verify Portable Document A1'. The dashboard shows this label.

      dcqlQuery object

      Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder.

      The query holds a credentials array. Each entry has an id, a format and a format-specific meta object: doctype_value for mso_mdoc, vct_values for dc+sd-jwt, and type_values for jwt_vc_json. An entry can also hold claims, claim_sets, require_cryptographic_holder_binding, multiple and trusted_authorities. A top-level credential_sets array can group the credential queries.

      The server leaves this property out when the presentation definition has no DCQL query.

      property name* any

      Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder.

      The query holds a credentials array. Each entry has an id, a format and a format-specific meta object: doctype_value for mso_mdoc, vct_values for dc+sd-jwt, and type_values for jwt_vc_json. An entry can also hold claims, claim_sets, require_cryptographic_holder_binding, multiple and trusted_authorities. A top-level credential_sets array can group the credential queries.

      The server leaves this property out when the presentation definition has no DCQL query.

      transactionDataDefinitionType stringrequired

      Possible values: [``, payment_data, payment, login_risk_transaction, login_risk_transaction_non_ts12, account_access, emandate, data_agreement_record, data_disclosure_agreement_record, qes_data]

      Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the transactionData of the verification request. Read GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions for the schema of each type.

      The value is an empty string when the presentation definition binds no transaction data.

      createdAt numberrequired

      Unix timestamp, in seconds, of the moment that the server created this presentation definition.

      updatedAt numberrequired

      Unix timestamp, in seconds, of the moment that the server last changed this presentation definition.

      version string

      Possible values: [version_01, iso18013_7_annex_c]

      OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. version_01 is OpenID4VP 1.0. iso18013_7_annex_c is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.

      cryptographicKeyIdentifier stringrequired

      Key identifier of the key that signs the Authorization Request. When the create request names no key, this is the default key of the organisation. The value is an empty string when the request is not signed.

      cryptographicKeyFormat string

      Possible values: [did:key, x509]

      Format of the signing key. It sets how the wallet of the holder resolves the identity of the verifier. The server leaves this property out when the request is not signed (clientIdScheme redirect_uri outside the DC API response modes).

      scope stringrequired

      OAuth 2.0 scope value for a scope-based presentation request. The value is an empty string when the presentation definition holds no scope.

      responseType stringrequired

      Possible values: [vp_token, device_response]

      OAuth 2.0 response type of the Authorization Request. vp_token asks for a Verifiable Presentation. device_response asks for an ISO 18013-5 DeviceResponse and is only for iso18013_7_annex_c.

      clientIdScheme string

      Possible values: [redirect_uri, did, verifier_attestation, x509_san_dns, x509_hash]

      Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. redirect_uri uses a redirect URI, did uses a DID, verifier_attestation uses a Verifier Attestation JWT, x509_san_dns uses the SAN DNS name of an X.509 certificate, and x509_hash uses the hash of an X.509 certificate. With the DC API response modes, redirect_uri is only a logical identifier and not a real redirect target. The server leaves this property out for iso18013_7_annex_c.

      directPostRedirectUri string

      URI that the wallet of the holder opens after it posts the Authorization Response. For the direct_post and direct_post.jwt response modes. The server leaves this property out when the presentation definition holds no URI.

      responseMode string

      Possible values: [direct_post, direct_post.jwt, dc_api, dc_api.jwt]

      Response mode that sets how the wallet of the holder delivers the Authorization Response. Direct Post: direct_post posts the response over HTTP. direct_post.jwt posts the response as an encrypted JWT. DC API: dc_api uses the W3C Digital Credentials API and returns the response without JWE encryption. dc_api.jwt uses the Digital Credentials API and returns the response as a JWE.

      dcApiRequestType string

      Possible values: [signed, unsigned]

      Signing type of the DC API request. Only for the dc_api and dc_api.jwt response modes. signed means that the verifier signs the Authorization Request. unsigned means that the verifier sends the request unsigned. The server leaves this property out when the presentation definition holds no value.

      expectedOrigins string[]

      Origins that the wallet accepts for a signed DC API request. The server leaves this property out when the presentation definition holds no origin.

      encryptedResponseEncValuesSupported string[]

      Possible values: [A128CBC-HS256, A128GCM, A256GCM]

      JWE content encryption algorithms that the verifier accepts for the Authorization Response. It applies to the direct_post.jwt response mode; the dc_api.jwt flow ignores it and always advertises A128GCM and A256GCM.

      The server leaves this property out when the presentation definition holds no algorithm.

      systemManaged booleanrequired

      true when the platform owns this presentation definition. You cannot delete a system managed presentation definition.

      extentionEnabled booleanrequired

      true when an extension uses this presentation definition. You cannot update such a presentation definition, and you cannot delete most of them. Note the spelling of this property name.

      presentationDefinition objectrequired

      Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is null for every presentation definition that uses dcqlQuery.

      property name* any

      Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is null for every presentation definition that uses dcqlQuery.

      transactionDataCredentialIds string[]

      Identifiers of the credential queries that the transaction data binds to. The server leaves this property out when the presentation definition holds no value.

      excludeVerifierDisplayMetadata booleanrequired

      true when the Authorization Request leaves out the display metadata of the verifier (name, logo and description).

    Loading...
    Last updated on