Presentation definitions

Update presentation definition

PUT/v4/config/ows/verifier/presentation-definitions/{presentationDefinitionId}

Changes a presentation definition. Send the whole dcqlQuery in every update: without it the server answers 400 Presentation definition is required. The other members are partial: a member that you leave out, send as null, or send as an empty string or array keeps its stored value. Two exceptions: an empty expectedOrigins array clears the origins, and an empty listedClaims object clears the list. A new value replaces the stored one; the server does not merge objects.

The server checks each rule that the change touches with the rules of Create presentation definition, on the resulting values. For example, a dcApiRequestType in the body is checked against the stored responseMode when the body has none, and a new dcqlQuery is checked against the stored listedClaims, credentialQueryOptions and transactionDataCredentialIds.

Differences from create:

label: a label of one character or less after trimming keeps the stored label; there is no 3-character minimum.
clientIdScheme cannot be cleared.
For an unsigned request (clientIdScheme redirect_uri outside the DC API response modes), the server removes the stored signing key, and refuses a key in the body.

A presentation definition that a platform extension uses cannot be changed. A change does not affect a verification request that is already sent: each request keeps a copy of its definition (presentationDefinitionSnapshot).

Update presentation definition

Language of the request sample

ExampleExample request

curl -X PUT 'https://demo-api.igrant.io/v4/config/ows/verifier/presentation-definitions/{presentationDefinitionId}' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "label": "PID check",
  "version": "version_01",
  "scope": "",
  "responseType": "vp_token",
  "clientIdScheme": "x509_san_dns",
  "responseMode": "direct_post",
  "dcqlQuery": {
    "credentials": [
      {
        "id": "pid",
        "format": "dc+sd-jwt",
        "require_cryptographic_holder_binding": true,
        "multiple": false,
        "meta": {
          "vct_values": [
            "urn:eudi:pid:1"
          ]
        },
        "claims": [
          {
            "path": [
              "family_name"
            ]
          },
          {
            "path": [
              "given_name"
            ]
          },
          {
            "path": [
              "birthdate"
            ]
          },
          {
            "path": [
              "nationalities"
            ]
          }
        ]
      }
    ]
  },
  "cryptographicKeyFormat": "x509",
  "cryptographicKeyIdentifier": "c6b150f6dcd446459a66192e8f8303d1"
}'

{
  "presentationDefinition": {
    "id": "f68775a6-2d74-49ae-91e5-66afd201131a",
    "presentationDefinitionId": "f68775a6-2d74-49ae-91e5-66afd201131a",
    "label": "PID check",
    "transactionDataDefinitionType": "",
    "version": "version_01",
    "cryptographicKeyFormat": "x509",
    "cryptographicKeyIdentifier": "c6b150f6dcd446459a66192e8f8303d1",
    "scope": "",
    "responseType": "vp_token",
    "dcqlQuery": {
      "credentials": [
        {
          "id": "pid",
          "format": "dc+sd-jwt",
          "require_cryptographic_holder_binding": true,
          "multiple": false,
          "meta": {
            "vct_values": [
              "urn:eudi:pid:1"
            ]
          },
          "claims": [
            {
              "path": [
                "family_name"
              ]
            },
            {
              "path": [
                "given_name"
              ]
            },
            {
              "path": [
                "birthdate"
              ]
            },
            {
              "path": [
                "nationalities"
              ]
            }
          ]
        }
      ]
    },
    "clientIdScheme": "x509_san_dns",
    "hasVerifierDisplayMetadata": true,
    "responseMode": "direct_post",
    "createdAt": 1794149124,
    "updatedAt": 1794149124,
    "openIdOrganisationId": "60905277-d953-4ef7-aa4c-cec413d00d93",
    "isExtensionEnabled": false,
    "isSystemManaged": false,
    "signingKeyCheck": {
      "result": "selected",
      "messages": []
    }
  },
  "signingKeyWarnings": []
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:presentation-definitions:update

Path parameters

presentationDefinitionIdstringrequired
The presentationDefinitionId of the presentation definition, from List presentation definitions or the answer of Create presentation definition.

Body

application/json

The members to change. A member that the operation does not declare is refused (<name>: unknown field), also the removed names trustAnchor and kid.

labelstring
New name, at most 100 characters and unique in the organisation. A label of one character or less after trimming keeps the stored label. The labels that the platform extensions use are refused, in any letter case.
At most 100 characters.
dcqlQueryobject
The DCQL query. Required in every update: send the whole query, it replaces the stored one. The rules of the dcqlQuery of the create operation apply.
listedClaimsobject
New list of the claims that the dashboard builder shows for each credential query, keyed by the id of the query. You do not need it with the API.

It replaces the stored list; {} clears it. Each key must be the id of a credential query of the resulting dcqlQuery, and each claim needs a non-empty path. When you change dcqlQuery and send no list, the stored list is checked against the new query: send the list of the new query, or {}.
credentialQueryOptionsobject
New trust rule of each credential query (requiresTrustedCredentialSigner, acceptedCredentialSigners), keyed by the id of the query. It replaces the stored options. When you leave it out, the stored options stay, without the options of a credential query that a new dcqlQuery removes.
transactionDataDefinitionTypeenum<string>
New transaction data template. List transaction data templates gives the JSON Schema of each type.
Available options:payment_data,payment,login_risk_transaction,login_risk_transaction_non_ts12,account_access,emandate,data_agreement_record,data_disclosure_agreement_record,qes_data
transactionDataCredentialIdsstring[]
New id values of the dc+sd-jwt credential queries that the transaction data binds to. Each must be the id of a credential query of the resulting dcqlQuery.
hasVerifierDisplayMetadataboolean
true: the client_metadata of the request has the display metadata of the verifier. false: only the members of OpenID4VP 1.0 section 5.1. Changes only when you send true or false.
clientIdSchemeenum<string>
New way for the verifier to identify itself to the wallet. x509_hash and x509_san_dns need an x509 key. redirect_uri gives an unsigned request outside the DC API response modes.
Available options:redirect_uri,verifier_attestation,x509_san_dns,x509_hash
directPostRedirectUristring
New absolute URI that the wallet opens after it posts the response, for direct_post and direct_post.jwt.
responseModeenum<string>
New response mode: direct_post, direct_post.jwt (encrypted), dc_api or dc_api.jwt (encrypted, over the Digital Credentials API).
Available options:direct_post,direct_post.jwt,dc_api,dc_api.jwt
dcApiRequestTypeenum<string>
New DC API request type: signed (use it in production) or unsigned. Only when the resulting responseMode is dc_api or dc_api.jwt.
Available options:signed,unsigned
expectedOriginsstring[]
New web origins of the pages that may send a signed DC API request. Required for a signed request: the stored origins count when the body has none. An empty array clears the origins.
versionenum<string>
New protocol: version_01 (OpenID4VP 1.0) or iso18013_7_annex_c (ISO/IEC 18013-7 Annex C).
Available options:version_01,iso18013_7_annex_c
scopestring
New OAuth 2.0 scope value, unique in the organisation.
responseTypeenum<string>
New response type. version_01 takes only vp_token, and iso18013_7_annex_c takes only device_response.
Available options:vp_token,device_response
encryptedResponseEncValuesSupportedenum<string>[]
New JWE content encryption algorithms for a direct_post.jwt response.
Available options:A128CBC-HS256,A128GCM,A256GCM
cryptographicKeyFormatenum<string>
Format of the new signing key. x509 needs a key with a certificate chain; iso18013_7_annex_c needs x509. The removed value jwk gives HTTP 400.
Available options:x509
cryptographicKeyIdentifierstring
The kid of the new signing key, from List keys. The server checks it as on create.

Response

application/json

The changed presentation definition.

signingKeyWarningsstring[]
The warnings of the signing key, for a key whose certificate preset this use does not accept (also a key with no certificate preset): one text for each rule of this use that its certificate does not fit. Always present; an empty list when there is no warning. The save is not refused.
presentationDefinitionobject
A presentation definition: the DCQL query of a verifier and the transport settings that each of its verification requests uses. A member without a value is left out, except the required members.