components: schemas: CredentialHistoryForOpenId: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate Pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true VerifyCredentialForOpenId: type: object description: | Request body for an OpenID for Verifiable Presentation (OpenID4VP) Authorization Request. Set `presentationDefinitionId` to reference a stored presentation definition. The server reads the DCQL query and the transport settings from that record. This is the only supported way to give the credential requirements: a DCQL query cannot be sent inline. properties: presentationDefinitionId: type: string description: 'Identifier of a stored presentation definition. The server reads the DCQL query, the response mode, the transaction data template and the DC API settings from this record. The server ignores a value shorter than three characters and then answers with HTTP 400, because no requirements are left.' example: 1c3f6b1c-0c48-4b1f-9c1a-77f9c1d6a1a0 requestByReference: type: boolean default: false description: 'When `true`, the server passes the Authorization Request by reference with the `request_uri` parameter. The wallet then gets the full request from that URI. Use this option for large Authorization Requests.' example: true transactionData: type: object additionalProperties: true description: | Transaction data to add to the Authorization Request. The holder must approve this data before the wallet sends the presentation. Give this property when, and only when, the presentation definition that `presentationDefinitionId` names sets a transaction data template type. The server answers with HTTP 400 when the definition sets a template type and the body has no `transactionData`, and also when the definition sets no template type and the body has `transactionData`. The structure must agree with the JSON Schema of the template type of the presentation definition. nonce: type: string description: Cryptographic nonce for the Authorization Request. The server makes a nonce if you do not supply one. V3 endpoint only. example: z4cVLRsq9pKx0NgQ7E3hJg urlPrefix: type: string description: 'URL scheme prefix for the Authorization Request deep link that the server returns in `vpTokenQrCode`. The default is `openid4vp://`. Use a different prefix to open a specific wallet. V3 endpoint only.' example: 'openid4vp://' individualId: type: string description: Identifier of an individual in the organisation. The server sends a push notification with the Authorization Request to the device of this individual. The individual must have a push notification token. Do not set `individualId` and `mapperId` together. V3 endpoint only. mapperId: type: string description: External identifier that maps to an individual in the organisation. The server sends a push notification with the Authorization Request to the device of that individual. Do not set `individualId` and `mapperId` together. V3 endpoint only. signatureStamp: type: boolean default: false description: 'When `true`, the server puts a visible signature stamp in the signed PDF that the flow makes. V3 endpoint only.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points. The array must hold exactly four integers. V3 endpoint only.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. V3 endpoint only. required: - presentationDefinitionId VerificationHistoryForOpenId: type: object description: | Verification exchange record in the V2 shape. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) verification, from the Authorization Request to the verification result. The V2 endpoints are deprecated. They flatten some V3 fields: `vpTokenResponse` becomes a single string and `presentation` becomes a single object. They also leave out `clientIdScheme`, `responseMode`, `verifierAttestation`, `directPostRedirectUri`, `individualId`, `mapperId`, `files`, `signatureStamp`, `signatureCoordinate`, `dataAgreement`, `dataAgreementId`, `userId` and `requestExpiryTime`. Use the V3 endpoints for new integrations. The server returns every property of this schema on every V2 operation, except `dcApiRequest` and `dcApiProtocol`. A property that has no value yet holds the empty value for its type. properties: id: type: string description: Internal record identifier that the server makes when it stores the record. No operation accepts this value. Use `presentationExchangeId` to address the record. example: 6821b4b0f5b1c2a3d4e5f6a7 presentationExchangeId: type: string description: 'Unique identifier of the verification exchange. Give this value as the `presentationExchangeId` path parameter to read, delete or revalidate the record.' example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this verification exchange. presentationDefinitionId: type: string description: Identifier of the presentation definition that this verification request uses. vpTokenRequestState: type: string description: State value of the Authorization Request. The server uses it to match the response of the wallet with this record. example: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f vpTokenRequest: type: string description: 'Full Authorization Request. This is a signed JWT, or a URI with the request parameters.' vpTokenQrCode: type: string description: Authorization Request URI for a QR code or a deep link. The holder scans the QR code or opens the link to start the presentation flow. Empty when `responseMode` is `dc_api` or `dc_api.jwt`. example: 'openid4vp://?client_id=redirect_uri%3Ahttps%3A%2F%2Fverifier.example.com&request_uri=https%3A%2F%2Fverifier.example.com%2Fverification%2F8e9c0a94' vpTokenResponse: type: string description: 'Verifiable Presentation token that the wallet sent. When the wallet sends more than one token, this property holds the JSON array as a string. Empty until the wallet answers.' presentationSubmission: type: object description: | Wrapper that holds the Presentation Submission object of the wallet. DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns `null` here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. properties: presentation_submission: type: object description: DIF Presentation Exchange Submission object. It maps the credentials of the holder to the requirements of the verifier. Kept for old records only. properties: definition_id: type: string description: Identifier of the presentation definition that this submission fulfils. descriptor_map: description: Descriptor Map entries. Each entry gives the position of one requested credential in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this entry satisfies. path: type: string description: JSONPath expression that points to the credential in the Verifiable Presentation token. path_nested: type: object description: 'Nested path descriptor for credentials in an envelope format, for example a JWT in a VP JWT.' properties: format: type: string description: 'Credential format of the nested credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this nested entry satisfies. path: type: string description: JSONPath expression that points to the credential in the envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier of this Presentation Submission. required: - definition_id - descriptor_map - id status: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked description: | Lifecycle status of the verification exchange: 1. `request_sent`: The server made the Authorization Request. The exchange waits for the holder. 2. `request_received`: The wallet of the holder got the Authorization Request. 3. `presentation_pending`: The wallet started the response but the verifier did not get a complete Authorization Response yet. 4. `presentation_acked`: The holder sent the Verifiable Presentation and the verifier processed it. example: request_sent verified: type: boolean description: 'Result of the verification of the Verifiable Presentation. The server checks the signatures, the credential status and the presented claims against the DCQL query of the presentation definition. `false` until the holder answers.' requestExpired: type: boolean description: '`true` when the `exp` claim of `vpTokenRequest` is in the past. The wallet cannot use an expired Authorization Request.' requiresEncryption: type: boolean description: '`true` when the wallet must encrypt the Authorization Response as a JWE. This is the case when the presentation definition uses `direct_post.jwt` or `dc_api.jwt`.' holder: description: Metadata about the holder. type: object properties: name: type: string description: 'Identifier of the holder, for example a DID, or a name from the client metadata.' required: - name presentation: type: object additionalProperties: true description: | First decoded credential that the holder presented. The V2 endpoints return only the first credential, as an object. The value is an empty object until the holder answers. When the first credential is an IETF SD-JWT VC, the V2 endpoints do not return it directly. They wrap it in a placeholder W3C Verifiable Presentation whose `aud`, `iss`, `jti`, `sub`, `vp.holder` and `vp.id` properties hold the literal value ``, and put the real credential in `vp.verifiableCredential[0]`. Use the V3 endpoints to get the credential without this placeholder. presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation. Each entry holds the result of the signature check, the expiry check and the revocation check.' credentialExchangeId: type: string description: 'Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification.' transactionData: type: object additionalProperties: true description: Transaction data that the holder approved during the presentation flow. transactionDataBase64: type: string description: Base64url encoding of the transaction data that the Authorization Request holds. nonce: type: string description: Cryptographic nonce of the Authorization Request. It keeps the presentation fresh and stops replay. example: z4cVLRsq9pKx0NgQ7E3hJg responseType: type: string description: OAuth 2.0 response type of the Authorization Request. enum: - vp_token - id_token - device_response idToken: type: string description: OpenID Connect ID Token from the holder. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token of the holder. dcApiProtocol: type: string description: Exchange protocol identifier for the W3C Digital Credentials API. The server returns this property only when the presentation definition uses `dc_api` or `dc_api.jwt`. The value `org-iso-mdoc` marks an ISO 18013-7 Annex C exchange. enum: - openid4vp-v1-unsigned - openid4vp-v1-signed - org-iso-mdoc dcApiRequest: type: object additionalProperties: true description: 'Request object for the W3C Digital Credentials API, with one shape for Chrome and one for Safari. The server returns this property only when the presentation definition uses `dc_api` or `dc_api.jwt`. For the full structure, see the V3 verification history schema.' createdAt: type: number description: Unix timestamp in seconds when the server made this record. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the server last changed this record. example: 1747011600 required: - id - presentationExchangeId - openIdOrganisationId - presentationDefinitionId - vpTokenRequestState - vpTokenRequest - vpTokenQrCode - vpTokenResponse - status - verified - holder - presentation - createdAt - updatedAt - credentialExchangeId - transactionDataBase64 - nonce - responseType - idToken - requiresEncryption - requestExpired parameters: CredentialExchangeId: description: Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle. in: path name: credentialExchangeId required: true schema: type: string Offset: description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 Limit: name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 Status: description: Filter credential exchange records by their OID4VCI issuance lifecycle status. Accepts one value or a comma-separated list of values. in: query name: status style: form explode: false schema: type: array items: type: string enum: - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied PresentationExchangeId: description: 'Unique identifier of the verification exchange record. This is the `presentationExchangeId` property of the record, not its `id` property.' in: path name: presentationExchangeId required: true schema: type: string example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e securitySchemes: ApiKey: type: apiKey in: header name: Authorization description: 'API key authentication. The value of the `Authorization` header must be prefixed with `ApiKey ` (note the trailing space), e.g. `Authorization: ApiKey `.' BearerAuth: bearerFormat: JWT description: Access token passed with Bearer prefix in Authorization header scheme: bearer type: http openapi: 3.1.0 paths: /v2/config/digital-wallet/openid/sdjwt/credential/issue: post: description: | Issues a Verifiable Credential to a holder using the OpenID for Verifiable Credentials Issuance (OID4VCI) protocol. Supports two issuance modes: **InTime** (credential issued immediately via the Credential Endpoint) and **Deferred** (credential issued later via the Deferred Credential Endpoint by calling the [Issue deferred credential](/docs/openid4vc-api/config-update-digital-wallet-open-id-credential-history) API). Supports W3C VC (JWT), IETF SD-JWT VC, and ISO 18013-5 mDoc/mDL credential formats. operationId: configDigitalWalletOpenIdIssueCredential requestBody: required: true description: 'Issuance instruction. `issuanceMode` is the only mandatory field. Select the credential template with `credentialDefinitionId` or `credentialDefinitionUri`, and send the claims in `credential` or `credentials`. You do not set the grant type directly: the issuer uses the Pre-Authorized Code Flow when you send `userPin`, and the Authorization Code Flow when you do not.' content: application/json: schema: anyOf: - type: object title: Default (all fields) description: 'Request body for the OID4VCI issue credential operation. Only `issuanceMode` is mandatory. Supply `credentialDefinitionId` to select the credential template, and supply the claims in `credential` or `credentials`.' properties: issuanceMode: type: string description: Issuance mode. `InTime` issues the credential immediately through the OID4VCI Credential Endpoint. `Deferred` issues the credential later through the Deferred Credential Endpoint. enum: - InTime - Deferred example: InTime urlScheme: type: string default: 'openid-credential-offer://' description: 'URL scheme for the credential offer deep link. The issuer accepts any string and does not check the value. `openid-credential-offer://` is the standard OID4VCI scheme and the default. `haip://` is used for HAIP-compliant wallets.' example: 'openid-credential-offer://' credentialDefinitionId: type: string format: uuid description: 'Identifier of a pre-configured credential definition. The issuer uses the format, type, claims structure and revocation settings of this credential definition. The value must be a valid UUID.' credentialDefinitionUri: type: string description: URL of an external credential definition. Use this field instead of `credentialDefinitionId` when the credential definition is hosted outside the platform. userPin: type: string maxLength: 12 pattern: '^(.{4,12})?$' description: 'Pre-Authorized Code Flow transaction code (tx_code). When set, the wallet must include this value in the Token Request to obtain an access token. Give 4 to 12 characters. When you send this field the issuer uses the Pre-Authorized Code Flow, even if you send an empty string - an empty string selects that flow but the issuer then drops the transaction code. Leave the field out completely for the Authorisation Code Flow. You cannot combine this field with `presentationDefinitionId`.' example: '1234' credentialOfferEndpoint: type: string description: 'Credential offer endpoint URL of the wallet for issuer-initiated issuance. When you provide this URL, the issuer sends the OID4VCI Credential Offer directly to this endpoint.' credential: type: object title: Credential additionalProperties: true properties: type: type: array items: type: string description: 'Array of W3C Verifiable Credential type strings (e.g. `[''LegalPersonIdentificationData'']`). Required for W3C VC (JWT) format (`jwt_vc_json`).' credentialSubject: type: object additionalProperties: true description: Key-value pairs representing the credential claims for W3C VC (JWT) format (`jwt_vc_json`). credentialMetadata: type: object additionalProperties: true description: 'Free-form metadata that you want to keep with the credential. The issuer does not read or process this object: it stores the object inside the credential and returns it unchanged in the credential payload.' vct: type: string description: Verifiable Credential Type identifier for IETF SD-JWT VC format (`dc+sd-jwt`). doctype: type: string description: Document type identifier for ISO 18013-5 mDoc/mDL format (`mso_mdoc`). claims: type: object additionalProperties: true description: Key-value pairs representing the credential claims for IETF SD-JWT VC (`dc+sd-jwt`) or ISO 18013-5 mDoc/mDL (`mso_mdoc`) formats. id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. description: 'Credential object containing the claims to be issued via the OpenID for Verifiable Credentials Issuance (OID4VCI) protocol. Structure varies by format: use `type` and `credentialSubject` for W3C VC (JWT), `vct` and `claims` for IETF SD-JWT VC, or `doctype` and `claims` for ISO 18013-5 mDoc/mDL. The issuer does not restrict the members of this object: any member that this schema does not list passes through, is stored in the credential, and is returned in the credential payload.' credentials: type: array description: 'Array of credentials to issue in one exchange. Use this field when the credential definition contains more than one credential definition entry. Each entry must carry the `id` of the credential definition entry that it fills, because the issuer matches the entries by that value.' items: allOf: - type: object title: Credential additionalProperties: true properties: type: type: array items: type: string description: 'Array of W3C Verifiable Credential type strings (e.g. `[''LegalPersonIdentificationData'']`). Required for W3C VC (JWT) format (`jwt_vc_json`).' credentialSubject: type: object additionalProperties: true description: Key-value pairs representing the credential claims for W3C VC (JWT) format (`jwt_vc_json`). credentialMetadata: type: object additionalProperties: true description: 'Free-form metadata that you want to keep with the credential. The issuer does not read or process this object: it stores the object inside the credential and returns it unchanged in the credential payload.' vct: type: string description: Verifiable Credential Type identifier for IETF SD-JWT VC format (`dc+sd-jwt`). doctype: type: string description: Document type identifier for ISO 18013-5 mDoc/mDL format (`mso_mdoc`). claims: type: object additionalProperties: true description: Key-value pairs representing the credential claims for IETF SD-JWT VC (`dc+sd-jwt`) or ISO 18013-5 mDoc/mDL (`mso_mdoc`) formats. id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. description: 'Credential object containing the claims to be issued via the OpenID for Verifiable Credentials Issuance (OID4VCI) protocol. Structure varies by format: use `type` and `credentialSubject` for W3C VC (JWT), `vct` and `claims` for IETF SD-JWT VC, or `doctype` and `claims` for ISO 18013-5 mDoc/mDL. The issuer does not restrict the members of this object: any member that this schema does not list passes through, is stored in the credential, and is returned in the credential payload.' required: - id presentationDefinitionId: type: string description: 'Identifier of a presentation definition for dynamic credential requests. When set, the issuer requires the holder to present matching credentials through OpenID4VP before issuance continues.' transactionData: type: object additionalProperties: true description: 'Transaction data to bind to the issuance, as defined in the OpenID4VP transaction data extension. The issuer applies this field only together with `credentialDefinitionId`.' individualId: type: string description: 'Optional. Non-OID4VCI extension. Identifier of a specific individual recipient. When you provide this value, the issuer sends the credential offer as a push notification to the registered device of the individual. You cannot combine this field with `mapperId`.' mapperId: type: string description: Optional. Non-OID4VCI extension. External reference that identifies the individual recipient. The issuer resolves the individual from this value and sends the credential offer as a push notification. You cannot combine this field with `individualId`. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: Position of the signature stamp on the document page. Give exactly four pixel coordinates. The issuer refuses any other number of values. items: type: integer minItems: 4 maxItems: 4 example: - 0 - 0 - 0 - 0 required: - issuanceMode - type: object title: IETF SD-JWT VC properties: issuanceMode: type: string description: Issuance mode. `InTime` issues the credential immediately through the OID4VCI Credential Endpoint. `Deferred` issues the credential later through the Deferred Credential Endpoint. enum: - InTime - Deferred example: InTime urlScheme: type: string default: 'openid-credential-offer://' description: 'URL scheme for the credential offer deep link. The issuer accepts any string and does not check the value. `openid-credential-offer://` is the standard OID4VCI scheme and the default. `haip://` is used for HAIP-compliant wallets.' example: 'openid-credential-offer://' credentialDefinitionId: type: string description: Identifier of the credential definition configured for IETF SD-JWT VC (`dc+sd-jwt`) format. credentials: type: array description: 'Array of credentials to issue. Each entry contains the `id` from the `credentialDefinitions` array and the claims as flat key-value pairs for IETF SD-JWT VC format. The issuer matches the entries to the credential definition entries by `id`, so `id` is mandatory.' items: type: object additionalProperties: true required: - id properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. claims: type: object additionalProperties: true description: 'Flat key-value pairs representing the credential claims for IETF SD-JWT VC format. Keys are claim names (e.g. `given_name`, `birthdate`), values are the claim data. Nested objects (e.g. `address`) are supported.' userPin: type: string maxLength: 12 pattern: '^(.{4,12})?$' description: 'Transaction code (tx_code) for the Pre-Authorized Code Flow. Give 4 to 12 characters. When you send this field the issuer uses the Pre-Authorized Code Flow, even if you send an empty string - an empty string selects that flow but the issuer then drops the transaction code. Leave the field out completely for the Authorisation Code Flow.' example: '1234' required: - issuanceMode - credentialDefinitionId - credentials - type: object title: ISO 18013-5 mDoc/mDL properties: issuanceMode: type: string description: Issuance mode. `InTime` issues the credential immediately through the OID4VCI Credential Endpoint. `Deferred` issues the credential later through the Deferred Credential Endpoint. enum: - InTime - Deferred example: InTime urlScheme: type: string default: 'openid-credential-offer://' description: 'URL scheme for the credential offer deep link. The issuer accepts any string and does not check the value. `openid-credential-offer://` is the standard OID4VCI scheme and the default. `haip://` is used for HAIP-compliant wallets.' example: 'openid-credential-offer://' credentialDefinitionId: type: string description: Identifier of the credential definition configured for ISO 18013-5 mDoc/mDL (`mso_mdoc`) format. credentials: type: array description: 'Array of credentials to issue. Each entry contains the `id` from the `credentialDefinitions` array and the claims namespaced under the mDoc doctype. The issuer matches the entries to the credential definition entries by `id`, so `id` is mandatory.' items: type: object additionalProperties: true required: - id properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. claims: type: object additionalProperties: true description: Claims namespaced under the ISO 18013-5 mDoc/mDL doctype (e.g. `eu.europa.ec.eudi.pid.1`). The top-level key is the doctype namespace containing the data elements as key-value pairs. userPin: type: string maxLength: 12 pattern: '^(.{4,12})?$' description: 'Transaction code (tx_code) for the Pre-Authorized Code Flow. Give 4 to 12 characters. When you send this field the issuer uses the Pre-Authorized Code Flow, even if you send an empty string - an empty string selects that flow but the issuer then drops the transaction code. Leave the field out completely for the Authorisation Code Flow.' example: '1234' required: - issuanceMode - credentialDefinitionId - credentials - type: object title: W3C VC (JWT) properties: issuanceMode: type: string description: Issuance mode. `InTime` issues the credential immediately through the OID4VCI Credential Endpoint. `Deferred` issues the credential later through the Deferred Credential Endpoint. enum: - InTime - Deferred example: InTime urlScheme: type: string default: 'openid-credential-offer://' description: 'URL scheme for the credential offer deep link. The issuer accepts any string and does not check the value. `openid-credential-offer://` is the standard OID4VCI scheme and the default. `haip://` is used for HAIP-compliant wallets.' example: 'openid-credential-offer://' credentialDefinitionId: type: string description: Identifier of the credential definition configured for W3C VC (JWT) (`jwt_vc_json`) format. credentials: type: array description: 'Array of credentials to issue. Each entry contains the `id` from the `credentialDefinitions` array and the claims under `credentialSubject` for W3C VC (JWT) format. The issuer matches the entries to the credential definition entries by `id`, so `id` is mandatory.' items: type: object additionalProperties: true required: - id properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. credentialSubject: type: object additionalProperties: true description: W3C Verifiable Credential subject containing the claims as key-value pairs following the W3C Verifiable Credentials Data Model. userPin: type: string maxLength: 12 pattern: '^(.{4,12})?$' description: 'Transaction code (tx_code) for the Pre-Authorized Code Flow. Give 4 to 12 characters. When you send this field the issuer uses the Pre-Authorized Code Flow, even if you send an empty string - an empty string selects that flow but the issuer then drops the transaction code. Leave the field out completely for the Authorisation Code Flow.' example: '1234' required: - issuanceMode - credentialDefinitionId - credentials - type: object title: Dynamic credential request description: Request body that starts an OID4VCI issuance which first requires a presentation from the holder. The issuer sends an OpenID4VP request built from `presentationDefinitionId` before it issues the credential. You cannot use `userPin` with this variant. properties: issuanceMode: type: string description: Issuance mode. `InTime` issues the credential immediately through the OID4VCI Credential Endpoint. `Deferred` issues the credential later through the Deferred Credential Endpoint. enum: - InTime - Deferred example: InTime credentialDefinitionId: type: string description: Identifier of the credential definition to use for issuance. presentationDefinitionId: type: string description: Identifier of a presentation definition for dynamic credential requests. The issuer requires the holder to present matching credentials via OpenID for Verifiable Presentation (OpenID4VP) before issuance proceeds. credentialOfferEndpoint: type: string description: 'Wallet''s credential offer endpoint URL for issuer-initiated issuance. When provided, the issuer sends the OID4VCI Credential Offer directly to this endpoint.' urlScheme: type: string default: 'openid-credential-offer://' description: 'URL scheme for the credential offer deep link. The issuer accepts any string and does not check the value. `openid-credential-offer://` is the standard OID4VCI scheme and the default. `haip://` is used for HAIP-compliant wallets.' example: 'openid-credential-offer://' transactionData: type: object additionalProperties: true description: 'Transaction data to bind to the issuance, as defined in the OpenID4VP transaction data extension. The issuer includes this data in the presentation request that it sends to the holder.' credentials: type: array description: 'Array of credentials to issue after the holder completes the presentation. Each entry must carry the `id` of the credential definition entry that it fills, because the issuer matches the entries by that value.' items: allOf: - type: object title: Credential additionalProperties: true properties: type: type: array items: type: string description: 'Array of W3C Verifiable Credential type strings (e.g. `[''LegalPersonIdentificationData'']`). Required for W3C VC (JWT) format (`jwt_vc_json`).' credentialSubject: type: object additionalProperties: true description: Key-value pairs representing the credential claims for W3C VC (JWT) format (`jwt_vc_json`). credentialMetadata: type: object additionalProperties: true description: 'Free-form metadata that you want to keep with the credential. The issuer does not read or process this object: it stores the object inside the credential and returns it unchanged in the credential payload.' vct: type: string description: Verifiable Credential Type identifier for IETF SD-JWT VC format (`dc+sd-jwt`). doctype: type: string description: Document type identifier for ISO 18013-5 mDoc/mDL format (`mso_mdoc`). claims: type: object additionalProperties: true description: Key-value pairs representing the credential claims for IETF SD-JWT VC (`dc+sd-jwt`) or ISO 18013-5 mDoc/mDL (`mso_mdoc`) formats. id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. description: 'Credential object containing the claims to be issued via the OpenID for Verifiable Credentials Issuance (OID4VCI) protocol. Structure varies by format: use `type` and `credentialSubject` for W3C VC (JWT), `vct` and `claims` for IETF SD-JWT VC, or `doctype` and `claims` for ISO 18013-5 mDoc/mDL. The issuer does not restrict the members of this object: any member that this schema does not list passes through, is stored in the credential, and is returned in the credential payload.' required: - id required: - issuanceMode - credentialDefinitionId - presentationDefinitionId examples: InTime - Pre-Authorised Code with transaction code: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: claims: address: country: SE locality: Stockholm region: Stockholms län street_address: Sveavägen 45 birthdate: '1990-04-12' email: erik.johansson@example.se family_name: Johansson given_name: Erik is_over_18: true is_over_21: true is_over_65: true phone_number: '+46701234567' userPin: '2343' InTime - Authorisation Code Flow: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: claims: address: country: SE locality: Stockholm region: Stockholms län street_address: Sveavägen 45 birthdate: '1990-04-12' email: erik.johansson@example.se family_name: Johansson given_name: Erik is_over_18: true is_over_21: true is_over_65: true phone_number: '+46701234567' Deferred - Pre-Authorised Code with transaction code: value: issuanceMode: Deferred urlScheme: 'openid-credential-offer://' credentialDefinitionId: userPin: '2343' Deferred - Authorisation Code Flow: value: issuanceMode: Deferred urlScheme: 'openid-credential-offer://' credentialDefinitionId: With credential definition: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: claims: identifier: 123400-7899 legalName: Bygg AB userPin: '5678' Dynamic credential request: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: presentationDefinitionId: credentials: - id: claims: identifier: 123400-7899 legalName: Bygg AB userPin: '' EBWOID - IETF SD-JWT VC: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: claims: identifier: SE5567631723 legalName: Bygg AB userPin: '' EBWOID - ISO 18013-5 mDoc/mDL: value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: claims: org.iso.18013.5.1: identifier: SE5567631723 legalName: Bygg AB userPin: '' EBWOID - W3C VC (JWT): value: issuanceMode: InTime urlScheme: 'openid-credential-offer://' credentialDefinitionId: credentials: - id: credentialSubject: identifier: SE5567631723 legalName: Bygg AB userPin: '' parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: 'The issuer created the credential exchange record and the credential offer. The response holds a single object when the issuer creates one exchange record, and an array when the credential definition creates more than one record. The issuer answers `200`, not `201`.' content: application/json: schema: properties: credentialHistory: description: 'Credential exchange record, or array of credential exchange records, created for this issuance.' oneOf: - type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate - type: array items: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is invalid. The issuer returns this status when `issuanceMode` is missing or is not `InTime` or `Deferred`, when `userPin` is shorter than 4 or longer than 12 characters, when `userPin` is combined with `presentationDefinitionId`, when `credentialDefinitionId` is missing or is not a valid UUID, when `transactionData` is sent without `presentationDefinitionId` or does not match its schema, or when the issuance fails. This operation can also return the raw error body of the issuance backend instead of the `errorCode` and `errorDescription` envelope.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Internal server error. The issuer returns this status when it cannot resolve the individual for `individualId` or `mapperId`, when the individual has no push notification token, or when both fields are set.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Issue credential tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/credential/history/{credentialExchangeId}': put: description: Updates a credential exchange record. Used to issue a credential via the OID4VCI Deferred Credential Endpoint by providing the credential claims for a pending issuance. operationId: configUpdateDigitalWalletOpenIdCredentialHistory parameters: - description: Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle. in: path name: credentialExchangeId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: Credential claims for the pending deferred issuance. The `credential` field is mandatory and must not be an empty object. The issuer reads no other field from the body. content: application/json: schema: anyOf: - type: object title: Default (all fields) properties: credential: type: object additionalProperties: true properties: credentialSubject: type: object additionalProperties: true claims: type: object additionalProperties: true description: 'Updated credential object for the OID4VCI Deferred Credential Endpoint. Use `credentialSubject` for W3C VC (JWT) format, or `claims` for IETF SD-JWT VC and ISO 18013-5 mDoc/mDL formats.' required: - credential - type: object title: IETF SD-JWT VC properties: credential: type: object additionalProperties: true properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. claims: type: object additionalProperties: true description: 'Flat key-value pairs representing the credential claims for IETF SD-JWT VC format. Keys are claim names (e.g. `given_name`, `birthdate`), values are the claim data.' description: Credential object for deferred issuance in IETF SD-JWT VC (`dc+sd-jwt`) format. Contains the `id` from the `credentialDefinitions` array and `claims` as flat key-value pairs. required: - credential - type: object title: ISO 18013-5 mDoc/mDL properties: credential: type: object additionalProperties: true properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. claims: type: object additionalProperties: true description: Claims namespaced under the ISO 18013-5 mDoc/mDL doctype (e.g. `eu.europa.ec.eudi.pid.1`). The top-level key is the doctype namespace containing the data elements as key-value pairs. description: Credential object for deferred issuance in ISO 18013-5 mDoc/mDL (`mso_mdoc`) format. Contains the `id` from the `credentialDefinitions` array and `claims` namespaced under the doctype. required: - credential - type: object title: W3C VC (JWT) properties: credential: type: object additionalProperties: true properties: id: type: string description: The `id` field from a specific entry in the `credentialDefinitions` array of the create credential definition response. credentialSubject: type: object additionalProperties: true description: W3C Verifiable Credential subject containing the claims as key-value pairs following the W3C Verifiable Credentials Data Model. description: Credential object for deferred issuance in W3C VC (JWT) (`jwt_vc_json`) format. Contains the `id` from the `credentialDefinitions` array and `credentialSubject` for the claims. required: - credential examples: PID - IETF SD-JWT VC: value: credential: id: claims: address: country: SE locality: Stockholm region: Stockholms län street_address: Sveavägen 45 birthdate: '1990-04-12' email: erik.johansson@example.se family_name: Johansson given_name: Erik is_over_18: true is_over_21: true is_over_65: true phone_number: '+46701234567' PID - ISO 18013-5 mDoc/mDL: value: credential: id: claims: eu.europa.ec.eudi.pid.1: age_over_18: true age_over_21: true age_over_65: true birth_date: '1992-11-05' email: lars.andersson@example.se family_name: Andersson given_name: Lars phone_number: '+46701239876' resident_address: Storgatan 18 resident_city: Malmö resident_country: SE resident_state: Skåne län resident_street: Storgatan 18 PID - W3C VC (JWT): value: credential: id: credentialSubject: address: country: SE locality: Göteborg region: Västra Götalands län street_address: Avenyn 12 birthdate: '1985-09-23' email: anna.lindberg@example.se family_name: Lindberg given_name: Anna is_over_18: true is_over_21: true is_over_65: true phone_number: '+46709876543' EBWOID - IETF SD-JWT VC: value: credential: id: claims: identifier: SE5567631723 legalName: Bygg AB EBWOID - ISO 18013-5 mDoc/mDL: value: credential: id: claims: org.iso.18013.5.1: identifier: SE5567631723 legalName: Bygg AB EBWOID - W3C VC (JWT): value: credential: id: credentialSubject: identifier: SE5567631723 legalName: Bygg AB responses: '200': description: Credential history updated successfully content: application/json: schema: properties: credentialHistory: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is invalid. The issuer returns this status when no record matches `credentialExchangeId`, when `credential` is missing or empty, when the exchange uses the `InTime` issuance mode, or when the exchange is a dynamic credential request whose linked presentation is not yet verified. You can only update a record that uses the `Deferred` issuance mode.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Issue deferred credential tags: - Digital Wallet (OpenID4VC) - Issuer get: description: 'Retrieves a credential exchange record by ID, including the issuance status, credential offer details, and holder information. The issuer reads the stored record and does not contact the issuance backend. A record that you deleted from the issuance history is still available through this operation.' operationId: configReadDigitalWalletOpenIdCredentialHistory parameters: - description: Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle. in: path name: credentialExchangeId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: Credential history retrieved successfully content: application/json: schema: properties: credentialHistory: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, or no credential exchange record matches `credentialExchangeId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read issuance history tags: - Digital Wallet (OpenID4VC) - Issuer delete: description: 'Deletes a credential exchange record from the issuance history. The issuer marks the record as deleted and no longer returns it in the issuance history list. The issuer tells the issuance backend in the background, so the response does not show the result of that step.' operationId: configDeleteDigitalWalletOpenIdCredentialHistory parameters: - description: Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle. in: path name: credentialExchangeId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The issuer deleted the credential exchange record. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no record matches `credentialExchangeId`, or the issuer cannot delete the record.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete issuance history tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/credential/history/{credentialExchangeId}/revocation-status': put: description: Updates the revocation status of an issued credential using the IETF Token Status List. operationId: configUpdateDigitalWalletOpenIdCredentialRevocationStatus parameters: - description: Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle. in: path name: credentialExchangeId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: New revocation status for the issued credential. content: application/json: schema: type: object properties: revocationStatus: type: string description: New revocation status. `Operational` reactivates a suspended credential. `Revoked` permanently invalidates. `Suspended` temporarily invalidates (can be reactivated). enum: - Operational - Revoked - Suspended required: - revocationStatus responses: '200': description: Credential revocation status updated successfully content: application/json: schema: properties: credentialHistory: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is invalid. The issuer returns this status when no record matches `credentialExchangeId`, when `revocationStatus` is missing, or when the credential definition does not support revocation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update credential revocation status tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/credential/history: get: description: 'Lists credential exchange records with pagination and optional status filtering. Each record represents a single OID4VCI credential issuance lifecycle. The issuer sorts the records by `updatedAt` and leaves out the records that you deleted. The response also holds aggregate issuance counts for the whole organisation. The parameters `status`, `accepted`, `inProgress` and `denied` all filter on the same status field. Use only one of them in a request: if you send more than one, the issuer keeps only the last one in the order `status`, `accepted`, `inProgress`, `denied`.' operationId: configListDigitalWalletOpenIdCredentialHistory parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Filter credential exchange records by their OID4VCI issuance lifecycle status. Accepts one value or a comma-separated list of values. in: query name: status style: form explode: false schema: type: array items: type: string enum: - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied - description: Filter by credential definition identifier to retrieve OID4VCI issuance records for a specific credential type. in: query name: credentialDefinitionId schema: type: string - description: Filter by the holder's Decentralized Identifier (DID). in: query name: holderDid schema: type: string - description: Filter by individual identifier to retrieve records associated with a specific individual. in: query name: individualId required: false schema: type: string - description: Filter by mapper identifier to retrieve records linked to a specific individual mapping. in: query name: mapperId required: false schema: type: string - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - description: Filter by data agreement identifier to retrieve the issuance records that a specific data agreement governs. The server returns an error when no data agreement matches the value. in: query name: dataAgreementId required: false schema: type: string - description: 'When `true`, returns only the records that the holder accepted and that are not revoked. The value `false` has no effect.' in: query name: accepted required: false schema: type: boolean - description: 'When `true`, returns only the records that are still in progress. The server excludes accepted, deleted, denied and revoked records. The value `false` has no effect.' in: query name: inProgress required: false schema: type: boolean - description: 'When `true`, returns only the records whose credential is revoked. The value `false` has no effect.' in: query name: revoked required: false schema: type: boolean - description: 'When `true`, returns only the records for which the issuer denied the issuance. The value `false` has no effect.' in: query name: denied required: false schema: type: boolean - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: credentialHistory: description: 'Credential exchange records for the current page, sorted by the last modification time. The array is empty when no record matches.' items: type: object description: 'Credential exchange record that tracks one OID4VCI issuance. The issuer always returns every field except `transactionData`. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Identifier of the credential exchange record. This field holds the same value as `CredentialExchangeId`. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 CredentialExchangeId: type: string description: 'Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.' example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 credentialExchangeId: type: string description: Camel-case alias of `CredentialExchangeId`. The server sets both fields to the same value. Use this field in new integrations. example: 3a1f0c62-8f9a-4a17-9a4a-2f0f1c9d6a11 organisationId: type: string description: Identifier of the organisation that issues the credential. openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that processes this exchange. dataAgreementId: type: string description: Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement. dataAttributeValues: type: array description: Attribute values supplied for a data agreement based issuance. The field is `null` when the issuance uses a credential definition. items: type: object properties: name: type: string description: 'Name of the data attribute, as defined in the data agreement.' value: type: string description: Value of the data attribute for this holder. limitedDisclosure: type: boolean description: 'When `true`, the issuer makes this attribute selectively disclosable.' required: - name - value isAccessed: type: boolean description: Indicates whether the holder opened the credential offer. isTokenAccessed: type: boolean description: Indicates whether the holder called the OID4VCI Token Endpoint for this exchange. issuanceMode: type: string description: Issuance mode used for this exchange. `InTime` means the credential was issued immediately via the OID4VCI Credential Endpoint. `Deferred` means the credential is pending via the Deferred Credential Endpoint. enum: - '' - InTime - Deferred isPreAuthorised: type: boolean description: 'When `true`, the issuance used the OID4VCI Pre-Authorized Code Flow. When `false`, the Authorization Code Flow was used.' credentialOffer: type: string description: The OID4VCI Credential Offer URI sent to the holder to start the issuance flow. example: 'openid-credential-offer://?credential_offer_uri=https://api.igrant.io/...' credentialOfferEndpoint: type: string description: Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance. credentialStatus: type: string enum: - '' - pending - ready description: Processing status of the credential. `pending` means the credential is being prepared. `ready` means it is available for the holder to retrieve. status: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Lifecycle status of the credential exchange in the OID4VCI protocol flow: `offer_sent` (Credential Offer sent to holder), `offer_received` (holder scanned or received the offer), `token_issued` (issuer released an access token), `credential_issued` (credential issued via Credential Endpoint), `credential_acked` (holder acknowledged receipt), `credential_accepted` (holder accepted credential), `credential_deleted` (holder deleted credential), `issuance_denied` (issuer denied issuance).' issuerState: type: string description: Value of the OID4VCI `issuer_state` parameter. The issuer uses it to bind the Authorization Request to this exchange. authorisationRequestState: type: string description: State value of the OAuth 2.0 Authorization Request that the wallet sent. idTokenRequestState: type: string description: State value of the ID Token Request that the issuer sent to the holder. idTokenRequest: type: string description: ID Token Request that the issuer sent to the holder as a signed request object. authorisationCodeState: type: string description: State value that the issuer returns together with the authorisation code. authorisationCode: type: string description: OAuth 2.0 authorisation code issued for the Authorization Code Flow. preAuthorisedCode: type: string description: Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow. acceptanceToken: type: string description: Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint. codeChallenge: type: string description: 'PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.' codeChallengeMethod: type: string description: 'PKCE code challenge method, for example `S256`.' redirectUri: type: string description: Redirect URI that the wallet registered for the Authorization Code Flow. clientId: type: string description: 'Client identifier of the holder''s wallet, typically a DID or URL. Provided during the OID4VCI Token Request.' did: type: string description: Decentralized Identifier of the issuer that signs the credential. userPin: type: string description: Transaction code (tx_code) for the Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this exchange record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this exchange record was last modified. The list operation sorts on this field. example: 1750000600 limitedDisclosure: type: boolean description: 'When `true`, the issuer makes the data agreement attributes selectively disclosable in the issued credential.' credential: type: object additionalProperties: true description: 'The credential payload being issued. Contains `type` and `credentialSubject` for W3C VC (JWT) format, or `vct`/`doctype` and `claims` for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.' disclosureMapping: type: object additionalProperties: true description: Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting. credentialLabel: type: string description: Label of the credential definition or data agreement that this issuance uses. credentialDefinitionId: type: string description: Identifier of the credential definition that this issuance uses. credentialDefinitionUri: type: string description: URL of an external credential definition that this issuance uses. presentationDefinitionId: type: string description: Identifier of a presentation definition required for dynamic credential requests. presentationExchangeId: type: string description: Identifier of the presentation exchange session linked to a dynamic credential request. holder: description: Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the `name` field. The default value before the holder starts the flow is `Unknown`. type: object properties: name: type: string description: 'Identifier of the holder, typically a DID or display name resolved from wallet client metadata.' example: Unknown required: - name credentialFormat: type: string description: 'Credential format used for this issuance. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc`.' enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc example: dc+sd-jwt supportRevocation: type: boolean description: Indicates whether revocation is enabled for the issued credential. revocationStatus: type: string description: 'Current revocation status: `Operational` (valid), `Revoked` (permanently invalidated), `Suspended` (temporarily invalidated). The field is empty when the credential definition does not support revocation.' enum: - '' - Operational - Revoked - Suspended clientAssertion: type: string description: OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication. clientAssertionType: type: string description: 'Type of the client assertion token, for example `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.' clientAssertionVerified: type: boolean description: Indicates whether the holder's client assertion JWT was verified. walletUnitAttestation: type: string description: 'Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.' walletUnitAttestationPoP: type: string description: Proof of Possession for the Wallet Unit Attestation. walletUnitAttestationVerified: type: boolean description: Indicates whether the Wallet Unit Attestation was verified. walletUnitValidity: type: array description: Array of wallet unit validity records containing attestation and proof of possession verification status. items: type: object additionalProperties: true properties: attestation: type: object description: Wallet unit attestation verification status. properties: isExpired: type: boolean description: Indicates whether the attestation has expired. isRevoked: type: boolean description: Indicates whether the attestation has been revoked. isVerified: type: boolean description: Indicates whether the attestation was verified. proofOfPossession: type: object description: Proof of possession verification status. properties: isExpired: type: boolean description: Indicates whether the proof of possession has expired. isVerified: type: boolean description: Indicates whether the proof of possession was verified. validatedAt: type: integer description: Unix timestamp (in seconds) when the wallet unit validity was validated. credentialToken: type: string description: 'The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.' cnf: type: object additionalProperties: true description: Confirmation claim (`cnf`) containing the holder's public key JWK for key binding. jti: type: string description: 'JWT Token Identifier (`jti`), unique identifier for the issued credential token.' proof: type: string description: 'Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.' proofType: type: string description: Type of the proof provided in the Credential Request (e.g. `jwt`). proofVerified: type: boolean description: Indicates whether the issuer verified the holder's proof of key possession. decodedWalletUnitAttestation: type: object additionalProperties: true description: Decoded payload of the holder's Wallet Unit Attestation credential. idToken: type: string description: OpenID Connect ID Token shared by the holder during the issuance flow. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the holder's OpenID Connect ID Token. idTokenVerified: type: boolean description: Indicates whether the holder's OpenID Connect ID Token was verified. issuanceDeniedReason: type: string description: Human-readable reason why the issuer denied the credential issuance request. expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. transactionData: type: object additionalProperties: true description: 'Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.' credentialResponseEncryption: type: object additionalProperties: true description: Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is `null` when the wallet asks for a plain response. properties: alg: type: string description: 'JWE key management algorithm, for example `ECDH-ES`.' enc: type: string description: 'JWE content encryption algorithm, for example `A128GCM`.' jwk: type: object additionalProperties: true description: Public JSON Web Key that the issuer uses to encrypt the Credential Response. issuerTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the issuer, resolved from the trust list.' holderTrustServiceProvider: type: object additionalProperties: true description: 'Trust service provider record of the holder, resolved from the trust list.' individualId: type: string description: Identifier of the individual recipient the credential offer was sent to. mapperId: type: string description: Mapper identifier linking the credential offer to an external individual record. credentialResponseInterval: type: integer description: Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint. signatureStamp: type: boolean description: 'When `true`, the issuer adds a visible signature stamp to the issued document.' signatureCoordinate: type: array description: 'Position of the signature stamp on the document page, given as four pixel coordinates.' items: type: integer minItems: 4 maxItems: 4 required: - id - CredentialExchangeId - credentialExchangeId - organisationId - openIdOrganisationId - dataAgreementId - dataAttributeValues - isAccessed - isTokenAccessed - issuanceMode - isPreAuthorised - credentialOffer - credentialOfferEndpoint - credentialStatus - status - issuerState - authorisationRequestState - idTokenRequestState - idTokenRequest - authorisationCodeState - authorisationCode - preAuthorisedCode - acceptanceToken - codeChallenge - codeChallengeMethod - redirectUri - clientId - did - userPin - createdAt - updatedAt - limitedDisclosure - credential - disclosureMapping - credentialLabel - credentialDefinitionId - credentialDefinitionUri - presentationDefinitionId - presentationExchangeId - holder - credentialFormat - supportRevocation - revocationStatus - clientAssertion - clientAssertionType - clientAssertionVerified - walletUnitAttestation - walletUnitAttestationPoP - walletUnitAttestationVerified - walletUnitValidity - credentialToken - cnf - jti - proof - proofType - proofVerified - decodedWalletUnitAttestation - idToken - idTokenDecoded - idTokenVerified - issuanceDeniedReason - expiredCredentialTokens - expiredCredentials - credentialResponseEncryption - issuerTrustServiceProvider - holderTrustServiceProvider - individualId - mapperId - credentialResponseInterval - signatureStamp - signatureCoordinate type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true issuanceHistoryStats: type: object description: 'Aggregate issuance counts for the whole organisation. The filters, the search term and the pagination do not change these counts. The four buckets `accepted`, `inProgress`, `revoked` and `denied` divide `total` between them.' required: - total - accepted - inProgress - revoked - denied properties: total: type: integer description: Total number of credential exchange records. example: 120 accepted: type: integer description: Number of records that the holder accepted and that are not revoked. example: 84 inProgress: type: integer description: Number of records that are still in progress. example: 21 revoked: type: integer description: Number of records whose credential is revoked. example: 9 denied: type: integer description: Number of records for which the issuer denied the issuance. example: 6 type: object description: Credential history listed successfully headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, or no data agreement matches `dataAgreementId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List issuance history tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/credential-definition: post: description: | Creates a new credential definition for OpenID for Verifiable Credential Issuance (OID4VCI) 1.0. Each entry of the `credentialDefinitions` array holds one credential configuration, with its credential format, claims and issuance settings. The issuer publishes every entry in the OID4VCI Credential Issuer Metadata and uses it as the template for the credentials it issues. Upload the card artwork with the update logo image and update cover image operations after this operation returns. operationId: configCreateDigitalWalletOpenIdCredentialDefinition requestBody: required: true description: 'Credential definition to create. Supply `label` with at least 3 characters, and one `credentialDefinitions` entry for each credential configuration.' content: application/json: schema: type: object title: Credential definition description: | Credential definition for OpenID for Verifiable Credential Issuance (OID4VCI) 1.0. The top level fields hold the settings of the whole record. The `credentialDefinitions` array holds one entry for each credential configuration that the issuer publishes in the OID4VCI Credential Issuer Metadata. properties: label: type: string minLength: 3 description: 'Human-readable label describing the intended use of this credential definition (e.g. ''Issue Portable Document A1''). Used to identify the credential definition in the issuer''s dashboard. The value must contain at least 3 characters. The labels `Payment User Credential`, `Payment Card Credential`, `Payment Account Credential`, `PID Issuance` and `Photo ID Issuance` are reserved for the platform.' example: Issue Portable Document A1 credentialDefinitions: type: array minItems: 1 description: | Credential configurations of this credential definition. Supply one entry for each credential configuration that the issuer must publish. Do not repeat `version`, `trustAnchor`, `kid` or `enforceWUA` in an entry, and do not supply a configuration field such as `credentialFormat` or `claims` at the top level, because the issuer rejects the request. items: type: object description: | One credential configuration inside a credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. Every entry must use the same `authorizationRequestType` and the same `scope`. properties: label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. Defaults to 30. The issuer calculates the expiry date from the issuance time. supportRevocation: type: boolean description: 'When `true`, enables credential revocation support. Defaults to `false`.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification and is valid only when `credentialFormat` is `jwt_vc_json`. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. Defaults to `status_list`. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, ensures each credential under this configuration is unique per holder. Defaults to `false`.' supportCredentialReissuance: type: boolean description: 'When `true`, allows holders to request reissuance of expired or near-expiry credentials. Defaults to `false`.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. You can use `cose_key` only when `credentialFormat` is `mso_mdoc`. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: Determines how the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests and forbids `scope`. `scope_based` uses OAuth 2.0 scope values and requires `scope`. Defaults to `authorization_details`. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value for this credential configuration. Supply this field only when `authorizationRequestType` is `scope_based`. Read the available values with the list scope operation. display: type: object description: Display properties for the credential card in wallet UIs. The issuer adds the organisation logo and cover image when you do not supply `logo.uri` and `backgroundImage.uri`. properties: name: type: string description: Display name for the credential in wallet UIs. description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: 'Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. The format determines which of `type`, `vct` and `doctype` you must supply.' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. Use `$.vc` when `credentialFormat` is `jwt_vc_json`, and `$` when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' enum: - $.vc - $ type: type: array items: type: string description: 'Credential type strings. Required when `credentialFormat` is `jwt_vc_json`, and forbidden for the other formats. These values appear in the `type` field of the issued W3C VC (JWT). You cannot use `WalletUnitAttestation` here.' vct: type: string description: 'Verifiable Credential Type identifier. Required when `credentialFormat` is `dc+sd-jwt`, and forbidden for the other formats (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: 'Document type identifier. Required when `credentialFormat` is `mso_mdoc`, and forbidden for the other formats (e.g. `org.iso.18013.5.1.lpid`).' credentialDefinitionUri: type: string description: URL of an external claims schema. The issuer downloads the claims from this URL. Supply this field instead of `claims` or `credentialDefinition`. Use the preview operation to check the document before you use the URL. claims: type: object description: | Claims of the credential, as claim path pointers. Supply this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc` and you do not supply `credentialDefinitionUri`. Do not supply this field when `credentialFormat` is `jwt_vc_json`; use `credentialDefinition` instead. properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: | Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. When `credentialFormat` is `mso_mdoc`, the first element is the mDoc namespace, the path holds at least two elements, and every path in the configuration uses the same first element. minItems: 1 items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim. The issuer reads a missing field as `true`.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' required: - path additionalProperties: true required: - claims credentialDefinition: type: object description: | Claims of the credential, as claim path pointers. Supply this field when `credentialFormat` is `jwt_vc_json` and you do not supply `credentialDefinitionUri`. Each path starts with `credentialSubject`, because the issuer validates the claims below `$.vc`. properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim below `$.vc`. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. The first element is `credentialSubject`.' minItems: 1 items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim. The issuer reads a missing field as `true`.' required: - path additionalProperties: true required: - claims required: - credentialFormat version: type: string description: | Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. Set `version_01` for OpenID4VCI 1.0. Always supply this field, because the issuer uses an earlier version of the specification when you omit it. You cannot change the value after you create the credential definition. enum: - version_01 example: version_01 trustAnchor: type: string description: 'Decentralized Identifier (DID) method or key type used as the trust anchor for credential issuance. Determines how the issuer''s public key is published and resolved by holders and verifiers. Defaults to `did:key`. You cannot change the value after you create the credential definition.' enum: - 'did:key' - x509 kid: type: string description: 'Key Identifier (kid) referencing the cryptographic key used to sign issued credentials. Must match a key configured in the Key Management section. When you send an empty value, the issuer uses the default key of the organisation. You cannot change the value after you create the credential definition.' enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI credential issuance flow, as defined in the EUDI Wallet Architecture Reference Framework. Defaults to `false`.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition. Defaults to `false`.' display: type: object description: | Default display properties for every credential configuration of this credential definition. The issuer copies the organisation logo into `logo.uri` and the organisation cover image into `backgroundImage.uri` when you leave them empty. To upload your own artwork, use the update logo image and update cover image operations after you create the credential definition. properties: name: type: string description: Display name for the credential in wallet UIs. description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. required: - label - credentialDefinitions examples: PID - IETF SD-JWT VC: value: label: Person Identification Data (PID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: Person Identification Data - PID expirationInDays: 180 supportRevocation: true revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details display: name: Person Identification Data (PID) description: 'You are about to receive your Person Identification Data (PID) as a verifiable digital credential from a trusted issuer, ready to be securely stored and used in your EUDI Wallet.' backgroundColor: '#ffffff' textColor: '#000000' credentialResponseInterval: 5 credentialFormat: dc+sd-jwt vct: 'urn:eu.europa.ec.eudi:pid:1' claims: claims: - limitDisclosure: true mandatory: true path: - address - limitDisclosure: true mandatory: true path: - address - country - limitDisclosure: true mandatory: true path: - address - locality - limitDisclosure: true mandatory: true path: - address - region - limitDisclosure: true mandatory: true path: - address - street_address - limitDisclosure: true mandatory: true path: - birthdate - limitDisclosure: true mandatory: true path: - email - limitDisclosure: true mandatory: true path: - family_name - limitDisclosure: true mandatory: true path: - given_name - limitDisclosure: true mandatory: true path: - is_over_18 - limitDisclosure: true mandatory: true path: - is_over_21 - limitDisclosure: true mandatory: true path: - is_over_65 - limitDisclosure: true mandatory: true path: - phone_number PID - ISO 18013-5 mDoc/mDL: value: label: Person Identification Data (PID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: Person Identification Data - PID expirationInDays: 180 supportRevocation: true revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details display: name: Person Identification Data (PID) description: 'You are about to receive your Person Identification Data (PID) as a verifiable digital credential from a trusted issuer, ready to be securely stored and used in your EUDI Wallet.' backgroundColor: '#ffffff' textColor: '#000000' credentialResponseInterval: 5 credentialFormat: mso_mdoc doctype: eu.europa.ec.eudi.pid.1 claims: claims: - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - age_over_18 - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - age_over_21 - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - age_over_65 - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - birth_date - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - email - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - family_name - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - given_name - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - phone_number - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - resident_address - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - resident_city - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - resident_country - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - resident_state - limitDisclosure: true mandatory: true path: - eu.europa.ec.eudi.pid.1 - resident_street PID - W3C VC (JWT): value: label: Person Identification Data (PID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: Person Identification Data (PID) expirationInDays: 180 supportRevocation: true validationPath: $.vc revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details display: name: Person Identification Data (PID) description: 'You are about to receive your Person Identification Data (PID) as a verifiable digital credential from a trusted issuer, ready to be securely stored and used in your EUDI Wallet.' backgroundColor: '#ffffff' textColor: '#000000' credentialResponseInterval: 5 credentialFormat: jwt_vc_json type: - 'urn:eu.europa.ec.eudi:pid:1' credentialDefinition: claims: - mandatory: true path: - credentialSubject - address - mandatory: true path: - credentialSubject - address - country - mandatory: true path: - credentialSubject - address - locality - mandatory: true path: - credentialSubject - address - region - mandatory: true path: - credentialSubject - address - street_address - mandatory: true path: - credentialSubject - birthdate - mandatory: true path: - credentialSubject - email - mandatory: true path: - credentialSubject - family_name - mandatory: true path: - credentialSubject - given_name - mandatory: true path: - credentialSubject - is_over_18 - mandatory: true path: - credentialSubject - is_over_21 - mandatory: true path: - credentialSubject - is_over_65 - mandatory: true path: - credentialSubject - phone_number EBWOID - IETF SD-JWT VC: value: label: European Business Wallet Owner ID (EBWOID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: European Business Wallet Owner ID (EBWOID) expirationInDays: 30 supportRevocation: true revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details credentialResponseInterval: 5 credentialFormat: dc+sd-jwt vct: LegalPersonIdentificationData claims: claims: - limitDisclosure: true mandatory: true path: - identifier - limitDisclosure: true mandatory: true path: - legalName EBWOID - ISO 18013-5 mDoc/mDL: value: label: European Business Wallet Owner ID (EBWOID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: European Business Wallet Owner ID (EBWOID) expirationInDays: 30 supportRevocation: true revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details credentialResponseInterval: 5 credentialFormat: mso_mdoc doctype: org.iso.18013.5.1.lpid claims: claims: - limitDisclosure: true mandatory: true path: - org.iso.18013.5.1 - identifier - limitDisclosure: true mandatory: true path: - org.iso.18013.5.1 - legalName EBWOID - W3C VC (JWT): value: label: European Business Wallet Owner ID (EBWOID) trustAnchor: 'did:key' version: version_01 kid: '' enforceWUA: false credentialDefinitions: - label: European Business Wallet Owner ID (EBWOID) expirationInDays: 30 supportRevocation: true revocationMethod: status_list enforceCredentialUniqueness: false supportCredentialReissuance: false credentialBindingMethods: - 'did:key' - jwk - x5c - kid authorizationRequestType: authorization_details credentialResponseInterval: 5 credentialFormat: jwt_vc_json validationPath: $.vc type: - LegalPersonIdentificationData credentialDefinition: claims: - mandatory: true path: - credentialSubject - identifier - mandatory: true path: - credentialSubject - legalName parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: 'The issuer created the credential definition and published it in the OID4VCI Credential Issuer Metadata. This operation returns 200, not 201.' content: application/json: schema: properties: credentialDefinition: description: The credential definition that the issuer created. type: object properties: id: type: string description: Identifier of the credential definition. This field holds the same value as `credentialDefinitionId`. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 credentialDefinitionId: type: string description: Unique identifier assigned to the credential definition upon creation. Use this ID to reference the credential definition in OpenID for Verifiable Credentials Issuance (OID4VCI) operations. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this credential definition. createdAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was created. example: 1750000000 updatedAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was last modified. example: 1750000600 label: type: string description: Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1'). example: Issue Portable Document A1 credentialDefinitions: type: array description: Credential configurations of this credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. The value is `null` for a record that holds no configuration. items: type: object description: 'One credential configuration inside a credential definition, as stored by the issuer. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata.' properties: id: type: string description: 'Unique identifier of this credential configuration. The issuer generates the value. Use it in the `credentials[].id` field of the issue credential request, and in the `credentialDefinitions[].id` field of an update credential definition request.' credentialConfigurationId: type: string description: Identifier of the credential configuration as published in the OID4VCI Credential Issuer Metadata. The wallet uses this value to request this credential configuration during the issuance flow. label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this configuration.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential under this configuration is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: How the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests. `scope_based` uses OAuth 2.0 scope values. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value of this credential configuration. The issuer sets this field when `authorizationRequestType` is `scope_based`. display: type: object description: Display properties for the credential card in wallet UIs. properties: name: type: string description: Display name for the credential in wallet UIs. locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. These values appear in the `type` field of the issued W3C VC (JWT). vct: type: string description: 'Verifiable Credential Type identifier. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: Document type identifier. The issuer sets this field when `credentialFormat` is `mso_mdoc` (e.g. `org.iso.18013.5.1.lpid`). credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this configuration. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true version: type: string description: Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. `version_01` is OpenID4VCI 1.0. A record that you created with an earlier version of this API can hold another value. The issuer sets the value at creation time and never changes it. example: version_01 trustAnchor: type: string description: DID method or key type used as the trust anchor for credential issuance. enum: - 'did:key' - x509 kid: type: string description: Key Identifier (kid) referencing the cryptographic key used to sign issued credentials. enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI issuance flow.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition.' systemManaged: type: boolean description: 'When `true`, the platform manages this credential definition. You cannot change or delete a system managed credential definition.' extensionEnabled: type: boolean description: 'When `true`, an extension supplies the credential data for this credential definition.' display: type: object description: 'Display properties of the credential, as published in the OID4VCI Credential Issuer Metadata. Wallets use these values to draw the credential card.' properties: name: type: string description: 'Display name for the credential shown in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Legal Person Identification Data locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: 'Logo image shown on the credential card. The issuer sets the organisation logo when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no logo.' properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. Wallets use this text for accessibility. required: - uri - altText backgroundImage: type: object description: 'Background image of the credential card. The issuer sets the organisation cover image when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no background image.' properties: uri: type: string description: URL of the background image. required: - uri required: - name - locale - description - backgroundColor - textColor - logo - backgroundImage expirationInDays: type: number description: Number of days until the issued credential expires. example: 30 supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this credential definition.' revocationMethod: type: string description: 'Method used for credential revocation. `status_list` uses the IETF Token Status List, `status_list_2021` uses the W3C Status List 2021, `swiss_token_status_list_v1` uses the Swiss profile.' enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential issued under this definition is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. The value is `null` when the record holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key credentialFormat: type: string description: 'Credential format identifier as defined in OID4VCI. Supported formats: `jwt_vc_json` (W3C VC JWT), `dc+sd-jwt` (IETF SD-JWT VC), `mso_mdoc` (ISO 18013-5 mDoc/mDL).' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings as defined in the OID4VCI specification. These values appear in the `type` field of the issued W3C VC (JWT). The issuer omits this field when the record uses another credential format. vct: type: string description: Verifiable Credential Type identifier used when `credentialFormat` is `dc+sd-jwt`. Included in the `vct` claim of the issued IETF SD-JWT VC. example: 'urn:eu.europa.ec.eudi:pid:1' doctype: type: string description: Document type identifier used when `credentialFormat` is `mso_mdoc`. Identifies the credential in the ISO 18013-5 mDoc/mDL format (e.g. `org.iso.18013.5.1.lpid`). example: eu.europa.ec.eudi.pid.1 namespace: type: string description: 'Namespace identifier for ISO 18013-5 mDoc/mDL credentials. The value is empty for an OpenID4VCI 1.0 credential definition, because the mDoc namespace is the first element of each claim path.' credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this record. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true required: - id - credentialDefinitionId - openIdOrganisationId - createdAt - updatedAt - label - display - expirationInDays - credentialFormat - credentialDefinitionUri - validationPath - version - trustAnchor - kid - enforceWUA - supportRevocation - revocationMethod - enforceCredentialUniqueness - supportCredentialReissuance - supportInteractiveAuthorisationEndpoint - namespace - systemManaged - extensionEnabled type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: | The request is invalid. The issuer returns this status when `label` is missing or shorter than 3 characters, when `label` uses a reserved platform value, when `credentialBindingMethods` holds `cose_key` for a credential format other than `mso_mdoc`, when a `credentialDefinitions` entry repeats `version`, `trustAnchor`, `kid` or `enforceWUA`, when a configuration field is present both at the top level and in an entry, when the entries do not agree on `authorizationRequestType` or `scope`, when a required field of the credential format is missing, or when the claims fail validation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create credential definition tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/credential-definition/{credentialDefinitionId}': get: description: | Retrieves a credential definition by its ID, with the credential configurations that it holds in `credentialDefinitions`. Each configuration holds the credential format, the claims and the issuance settings. operationId: configReadDigitalWalletOpenIdCredentialDefinition parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: Credential definition retrieved successfully content: application/json: schema: properties: credentialDefinition: type: object description: | Credential definition record as stored by the issuer. The top level fields hold the settings of the whole record, and `credentialDefinitions` holds one entry for each credential configuration that the issuer publishes in the OID4VCI Credential Issuer Metadata. properties: id: type: string description: Identifier of the credential definition. This field holds the same value as `credentialDefinitionId`. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 credentialDefinitionId: type: string description: Unique identifier assigned to the credential definition upon creation. Use this ID to reference the credential definition in OpenID for Verifiable Credentials Issuance (OID4VCI) operations. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this credential definition. createdAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was created. example: 1750000000 updatedAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was last modified. example: 1750000600 label: type: string description: Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1'). example: Issue Portable Document A1 credentialDefinitions: type: array description: Credential configurations of this credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. The value is `null` for a record that holds no configuration. items: type: object description: 'One credential configuration inside a credential definition, as stored by the issuer. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata.' properties: id: type: string description: 'Unique identifier of this credential configuration. The issuer generates the value. Use it in the `credentials[].id` field of the issue credential request, and in the `credentialDefinitions[].id` field of an update credential definition request.' credentialConfigurationId: type: string description: Identifier of the credential configuration as published in the OID4VCI Credential Issuer Metadata. The wallet uses this value to request this credential configuration during the issuance flow. label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this configuration.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential under this configuration is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: How the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests. `scope_based` uses OAuth 2.0 scope values. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value of this credential configuration. The issuer sets this field when `authorizationRequestType` is `scope_based`. display: type: object description: Display properties for the credential card in wallet UIs. properties: name: type: string description: Display name for the credential in wallet UIs. locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. These values appear in the `type` field of the issued W3C VC (JWT). vct: type: string description: 'Verifiable Credential Type identifier. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: Document type identifier. The issuer sets this field when `credentialFormat` is `mso_mdoc` (e.g. `org.iso.18013.5.1.lpid`). credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this configuration. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true version: type: string description: Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. `version_01` is OpenID4VCI 1.0. A record that you created with an earlier version of this API can hold another value. The issuer sets the value at creation time and never changes it. example: version_01 trustAnchor: type: string description: DID method or key type used as the trust anchor for credential issuance. enum: - 'did:key' - x509 kid: type: string description: Key Identifier (kid) referencing the cryptographic key used to sign issued credentials. enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI issuance flow.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition.' systemManaged: type: boolean description: 'When `true`, the platform manages this credential definition. You cannot change or delete a system managed credential definition.' extensionEnabled: type: boolean description: 'When `true`, an extension supplies the credential data for this credential definition.' display: type: object description: 'Display properties of the credential, as published in the OID4VCI Credential Issuer Metadata. Wallets use these values to draw the credential card.' properties: name: type: string description: 'Display name for the credential shown in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Legal Person Identification Data locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: 'Logo image shown on the credential card. The issuer sets the organisation logo when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no logo.' properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. Wallets use this text for accessibility. required: - uri - altText backgroundImage: type: object description: 'Background image of the credential card. The issuer sets the organisation cover image when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no background image.' properties: uri: type: string description: URL of the background image. required: - uri required: - name - locale - description - backgroundColor - textColor - logo - backgroundImage expirationInDays: type: number description: Number of days until the issued credential expires. example: 30 supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this credential definition.' revocationMethod: type: string description: 'Method used for credential revocation. `status_list` uses the IETF Token Status List, `status_list_2021` uses the W3C Status List 2021, `swiss_token_status_list_v1` uses the Swiss profile.' enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential issued under this definition is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. The value is `null` when the record holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key credentialFormat: type: string description: 'Credential format identifier as defined in OID4VCI. Supported formats: `jwt_vc_json` (W3C VC JWT), `dc+sd-jwt` (IETF SD-JWT VC), `mso_mdoc` (ISO 18013-5 mDoc/mDL).' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings as defined in the OID4VCI specification. These values appear in the `type` field of the issued W3C VC (JWT). The issuer omits this field when the record uses another credential format. vct: type: string description: Verifiable Credential Type identifier used when `credentialFormat` is `dc+sd-jwt`. Included in the `vct` claim of the issued IETF SD-JWT VC. example: 'urn:eu.europa.ec.eudi:pid:1' doctype: type: string description: Document type identifier used when `credentialFormat` is `mso_mdoc`. Identifies the credential in the ISO 18013-5 mDoc/mDL format (e.g. `org.iso.18013.5.1.lpid`). example: eu.europa.ec.eudi.pid.1 namespace: type: string description: 'Namespace identifier for ISO 18013-5 mDoc/mDL credentials. The value is empty for an OpenID4VCI 1.0 credential definition, because the mDoc namespace is the first element of each claim path.' credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this record. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true required: - id - credentialDefinitionId - openIdOrganisationId - createdAt - updatedAt - label - display - expirationInDays - credentialFormat - credentialDefinitionUri - validationPath - version - trustAnchor - kid - enforceWUA - supportRevocation - revocationMethod - enforceCredentialUniqueness - supportCredentialReissuance - supportInteractiveAuthorisationEndpoint - namespace - systemManaged - extensionEnabled type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, or no credential definition matches `credentialDefinitionId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read credential definition tags: - Digital Wallet (OpenID4VC) - Issuer put: description: | Updates an existing credential definition. The changes apply to future credential issuances that use this definition. This operation replaces the whole `credentialDefinitions` array, so always send every credential configuration that the issuer must keep. Set `credentialDefinitions[].id` to the identifier of an existing configuration to change it, and omit the field to add a new one. The issuer always discards `display.logo.uri` and `display.backgroundImage.uri` from the request body and keeps the stored images; use the update logo image and update cover image operations to change the artwork. `version`, `trustAnchor`, `kid`, `supportRevocation` and `revocationMethod` are immutable after creation, and this operation does not accept them. operationId: configUpdateDigitalWalletOpenIdCredentialDefinition parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: 'New values for the credential definition. Every field is optional except `credentialDefinitions`. When `label` is present, it must contain at least 3 characters.' content: application/json: schema: type: object title: Credential definition description: | New values for a credential definition. This operation replaces the whole `credentialDefinitions` array, so always send every credential configuration that the issuer must keep. `version`, `trustAnchor`, `kid`, `supportRevocation` and `revocationMethod` are immutable after creation, and this operation does not accept them. properties: label: type: string minLength: 3 description: 'Human-readable label describing the intended use of this credential definition (e.g. ''Issue Portable Document A1''). When you supply the field, the value must contain at least 3 characters. The issuer keeps the current label when you omit the field. The labels `Payment User Credential`, `Payment Card Credential`, `Payment Account Credential`, `PID Issuance` and `Photo ID Issuance` are reserved for the platform.' example: Issue Portable Document A1 credentialDefinitions: type: array minItems: 1 description: | Credential configurations of this credential definition, as the complete new list. Set `id` on an entry to change a configuration that the issuer already published. Omit `id` to add a new configuration. Leave an existing configuration out of the array to remove it. Do not supply a configuration field such as `credentialFormat` or `claims` at the top level, because the issuer rejects the request. items: allOf: - type: object description: | One credential configuration inside a credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. Every entry must use the same `authorizationRequestType` and the same `scope`. properties: label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. Defaults to 30. The issuer calculates the expiry date from the issuance time. supportRevocation: type: boolean description: 'When `true`, enables credential revocation support. Defaults to `false`.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification and is valid only when `credentialFormat` is `jwt_vc_json`. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. Defaults to `status_list`. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, ensures each credential under this configuration is unique per holder. Defaults to `false`.' supportCredentialReissuance: type: boolean description: 'When `true`, allows holders to request reissuance of expired or near-expiry credentials. Defaults to `false`.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. You can use `cose_key` only when `credentialFormat` is `mso_mdoc`. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: Determines how the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests and forbids `scope`. `scope_based` uses OAuth 2.0 scope values and requires `scope`. Defaults to `authorization_details`. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value for this credential configuration. Supply this field only when `authorizationRequestType` is `scope_based`. Read the available values with the list scope operation. display: type: object description: Display properties for the credential card in wallet UIs. The issuer adds the organisation logo and cover image when you do not supply `logo.uri` and `backgroundImage.uri`. properties: name: type: string description: Display name for the credential in wallet UIs. description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: 'Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. The format determines which of `type`, `vct` and `doctype` you must supply.' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. Use `$.vc` when `credentialFormat` is `jwt_vc_json`, and `$` when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' enum: - $.vc - $ type: type: array items: type: string description: 'Credential type strings. Required when `credentialFormat` is `jwt_vc_json`, and forbidden for the other formats. These values appear in the `type` field of the issued W3C VC (JWT). You cannot use `WalletUnitAttestation` here.' vct: type: string description: 'Verifiable Credential Type identifier. Required when `credentialFormat` is `dc+sd-jwt`, and forbidden for the other formats (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: 'Document type identifier. Required when `credentialFormat` is `mso_mdoc`, and forbidden for the other formats (e.g. `org.iso.18013.5.1.lpid`).' credentialDefinitionUri: type: string description: URL of an external claims schema. The issuer downloads the claims from this URL. Supply this field instead of `claims` or `credentialDefinition`. Use the preview operation to check the document before you use the URL. claims: type: object description: | Claims of the credential, as claim path pointers. Supply this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc` and you do not supply `credentialDefinitionUri`. Do not supply this field when `credentialFormat` is `jwt_vc_json`; use `credentialDefinition` instead. properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: | Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. When `credentialFormat` is `mso_mdoc`, the first element is the mDoc namespace, the path holds at least two elements, and every path in the configuration uses the same first element. minItems: 1 items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim. The issuer reads a missing field as `true`.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' required: - path additionalProperties: true required: - claims credentialDefinition: type: object description: | Claims of the credential, as claim path pointers. Supply this field when `credentialFormat` is `jwt_vc_json` and you do not supply `credentialDefinitionUri`. Each path starts with `credentialSubject`, because the issuer validates the claims below `$.vc`. properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim below `$.vc`. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. The first element is `credentialSubject`.' minItems: 1 items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim. The issuer reads a missing field as `true`.' required: - path additionalProperties: true required: - claims required: - credentialFormat - type: object properties: id: type: string description: 'Identifier of an existing credential configuration. Read the value from `credentialDefinitions[].id` of a read or list credential definition response.' enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI credential issuance flow, as defined in the EUDI Wallet Architecture Reference Framework.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition.' display: type: object description: | Default display properties for every credential configuration of this credential definition. The issuer always discards `logo.uri` and `backgroundImage.uri` from this object and keeps the stored values, whether you send them or not. To change the artwork, use the update logo image and update cover image operations. properties: name: type: string description: Display name for the credential in wallet UIs. description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. The issuer discards `uri` and keeps the stored image. properties: uri: type: string description: URL of the logo image. The issuer ignores this field on update. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. The issuer discards `uri` and keeps the stored image. properties: uri: type: string description: URL of the background image. The issuer ignores this field on update. required: - credentialDefinitions examples: PID - IETF SD-JWT VC: summary: Change one published configuration and add a second one value: label: Person Identification Data (PID) enforceWUA: false credentialDefinitions: - id: 3f8b1c20-9a4d-4f11-b7c6-2e5a8d0f4b31 label: Person Identification Data - PID expirationInDays: 365 supportCredentialReissuance: true enforceCredentialUniqueness: false credentialBindingMethods: - 'did:key' - jwk authorizationRequestType: authorization_details display: name: Person Identification Data (PID) description: 'Your Person Identification Data, issued as a verifiable digital credential.' backgroundColor: '#ffffff' textColor: '#000000' credentialFormat: dc+sd-jwt validationPath: $ vct: 'urn:eu.europa.ec.eudi:pid:1' claims: claims: - path: - given_name mandatory: true limitDisclosure: true - path: - family_name mandatory: true limitDisclosure: true - path: - birthdate mandatory: true limitDisclosure: true - label: Person Identification Data - PID (mDL) expirationInDays: 365 credentialBindingMethods: - cose_key authorizationRequestType: authorization_details credentialFormat: mso_mdoc validationPath: $ doctype: org.iso.18013.5.1.pid claims: claims: - path: - org.iso.18013.5.1 - given_name mandatory: true limitDisclosure: true - path: - org.iso.18013.5.1 - family_name mandatory: true limitDisclosure: true responses: '200': description: The issuer updated the credential definition and published the new credential configurations in the OID4VCI Credential Issuer Metadata. content: application/json: schema: type: object properties: credentialDefinition: type: object description: | Credential definition record as stored by the issuer. The top level fields hold the settings of the whole record, and `credentialDefinitions` holds one entry for each credential configuration that the issuer publishes in the OID4VCI Credential Issuer Metadata. properties: id: type: string description: Identifier of the credential definition. This field holds the same value as `credentialDefinitionId`. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 credentialDefinitionId: type: string description: Unique identifier assigned to the credential definition upon creation. Use this ID to reference the credential definition in OpenID for Verifiable Credentials Issuance (OID4VCI) operations. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this credential definition. createdAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was created. example: 1750000000 updatedAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was last modified. example: 1750000600 label: type: string description: Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1'). example: Issue Portable Document A1 credentialDefinitions: type: array description: Credential configurations of this credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. The value is `null` for a record that holds no configuration. items: type: object description: 'One credential configuration inside a credential definition, as stored by the issuer. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata.' properties: id: type: string description: 'Unique identifier of this credential configuration. The issuer generates the value. Use it in the `credentials[].id` field of the issue credential request, and in the `credentialDefinitions[].id` field of an update credential definition request.' credentialConfigurationId: type: string description: Identifier of the credential configuration as published in the OID4VCI Credential Issuer Metadata. The wallet uses this value to request this credential configuration during the issuance flow. label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this configuration.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential under this configuration is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: How the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests. `scope_based` uses OAuth 2.0 scope values. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value of this credential configuration. The issuer sets this field when `authorizationRequestType` is `scope_based`. display: type: object description: Display properties for the credential card in wallet UIs. properties: name: type: string description: Display name for the credential in wallet UIs. locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. These values appear in the `type` field of the issued W3C VC (JWT). vct: type: string description: 'Verifiable Credential Type identifier. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: Document type identifier. The issuer sets this field when `credentialFormat` is `mso_mdoc` (e.g. `org.iso.18013.5.1.lpid`). credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this configuration. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true version: type: string description: Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. `version_01` is OpenID4VCI 1.0. A record that you created with an earlier version of this API can hold another value. The issuer sets the value at creation time and never changes it. example: version_01 trustAnchor: type: string description: DID method or key type used as the trust anchor for credential issuance. enum: - 'did:key' - x509 kid: type: string description: Key Identifier (kid) referencing the cryptographic key used to sign issued credentials. enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI issuance flow.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition.' systemManaged: type: boolean description: 'When `true`, the platform manages this credential definition. You cannot change or delete a system managed credential definition.' extensionEnabled: type: boolean description: 'When `true`, an extension supplies the credential data for this credential definition.' display: type: object description: 'Display properties of the credential, as published in the OID4VCI Credential Issuer Metadata. Wallets use these values to draw the credential card.' properties: name: type: string description: 'Display name for the credential shown in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Legal Person Identification Data locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: 'Logo image shown on the credential card. The issuer sets the organisation logo when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no logo.' properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. Wallets use this text for accessibility. required: - uri - altText backgroundImage: type: object description: 'Background image of the credential card. The issuer sets the organisation cover image when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no background image.' properties: uri: type: string description: URL of the background image. required: - uri required: - name - locale - description - backgroundColor - textColor - logo - backgroundImage expirationInDays: type: number description: Number of days until the issued credential expires. example: 30 supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this credential definition.' revocationMethod: type: string description: 'Method used for credential revocation. `status_list` uses the IETF Token Status List, `status_list_2021` uses the W3C Status List 2021, `swiss_token_status_list_v1` uses the Swiss profile.' enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential issued under this definition is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. The value is `null` when the record holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key credentialFormat: type: string description: 'Credential format identifier as defined in OID4VCI. Supported formats: `jwt_vc_json` (W3C VC JWT), `dc+sd-jwt` (IETF SD-JWT VC), `mso_mdoc` (ISO 18013-5 mDoc/mDL).' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings as defined in the OID4VCI specification. These values appear in the `type` field of the issued W3C VC (JWT). The issuer omits this field when the record uses another credential format. vct: type: string description: Verifiable Credential Type identifier used when `credentialFormat` is `dc+sd-jwt`. Included in the `vct` claim of the issued IETF SD-JWT VC. example: 'urn:eu.europa.ec.eudi:pid:1' doctype: type: string description: Document type identifier used when `credentialFormat` is `mso_mdoc`. Identifies the credential in the ISO 18013-5 mDoc/mDL format (e.g. `org.iso.18013.5.1.lpid`). example: eu.europa.ec.eudi.pid.1 namespace: type: string description: 'Namespace identifier for ISO 18013-5 mDoc/mDL credentials. The value is empty for an OpenID4VCI 1.0 credential definition, because the mDoc namespace is the first element of each claim path.' credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this record. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true required: - id - credentialDefinitionId - openIdOrganisationId - createdAt - updatedAt - label - display - expirationInDays - credentialFormat - credentialDefinitionUri - validationPath - version - trustAnchor - kid - enforceWUA - supportRevocation - revocationMethod - enforceCredentialUniqueness - supportCredentialReissuance - supportInteractiveAuthorisationEndpoint - namespace - systemManaged - extensionEnabled '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: | The request is invalid. The issuer returns this status when no credential definition matches `credentialDefinitionId`, when the request body is not valid JSON, when `label` is shorter than 3 characters or uses a reserved platform value, when `credentialBindingMethods` holds `cose_key` for a credential format other than `mso_mdoc`, when a configuration field is present both at the top level and in a `credentialDefinitions` entry, or when the claims fail validation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update credential definition tags: - Digital Wallet (OpenID4VC) - Issuer delete: description: | Deletes a credential definition and removes its credential configurations from the OID4VCI Credential Issuer Metadata. The issuer also deletes every credential issuance history record of this credential definition. Credentials that the issuer already gave to a holder stay valid; revoke them first if you must withdraw them. operationId: configDeleteDigitalWalletOpenIdCredentialDefinition parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The issuer deleted the credential definition. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no credential definition matches `credentialDefinitionId`, or the issuer cannot delete the credential definition.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete credential definition tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/credential-definitions: get: description: | Lists all credential definitions configured for OID4VCI credential issuance, with the newest change first. Each entry also holds the issuance counts of the credential definition, and the response holds the aggregate issuance counts of the organisation. `search` matches the label and the credential definition ID. `sortOrder` sorts on the last modification time. `vct`, `doctype` and `type` match the value at the top level of a record and in its credential configurations. operationId: configListDigitalWalletOpenIdCredentialDefinition parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Filter by IETF SD-JWT VC verifiable credential type identifier. in: query name: vct schema: type: string - description: Filter by ISO 18013-5 mDoc/mDL document type identifier. in: query name: doctype schema: type: string - description: Filter by W3C Verifiable Credential type (JWT format). in: query name: type schema: type: string - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - description: 'When `true`, the server does not calculate the issuance counts. Use this option for a faster response. The server then returns zero in `totalCountOfCredentialHistory` and in each `issuanceBreakdown` field.' in: query name: skipCounts required: false schema: type: boolean default: false - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: credentialDefinition: description: 'Credential definitions for the current page, sorted by the last modification time. The value is `null` or an empty array when the page holds no record.' items: allOf: - type: object description: | Credential definition record as stored by the issuer. The top level fields hold the settings of the whole record, and `credentialDefinitions` holds one entry for each credential configuration that the issuer publishes in the OID4VCI Credential Issuer Metadata. properties: id: type: string description: Identifier of the credential definition. This field holds the same value as `credentialDefinitionId`. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 credentialDefinitionId: type: string description: Unique identifier assigned to the credential definition upon creation. Use this ID to reference the credential definition in OpenID for Verifiable Credentials Issuance (OID4VCI) operations. example: 9f1c2a34-5b6d-4e7f-8a90-1b2c3d4e5f60 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this credential definition. createdAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was created. example: 1750000000 updatedAt: type: number description: Unix timestamp (in seconds) indicating when this credential definition was last modified. example: 1750000600 label: type: string description: Human-readable label describing the intended use of this credential definition (e.g. 'Issue Portable Document A1'). example: Issue Portable Document A1 credentialDefinitions: type: array description: Credential configurations of this credential definition. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata. The value is `null` for a record that holds no configuration. items: type: object description: 'One credential configuration inside a credential definition, as stored by the issuer. The issuer publishes each entry as a separate credential configuration in the OID4VCI Credential Issuer Metadata.' properties: id: type: string description: 'Unique identifier of this credential configuration. The issuer generates the value. Use it in the `credentials[].id` field of the issue credential request, and in the `credentialDefinitions[].id` field of an update credential definition request.' credentialConfigurationId: type: string description: Identifier of the credential configuration as published in the OID4VCI Credential Issuer Metadata. The wallet uses this value to request this credential configuration during the issuance flow. label: type: string description: Human-readable label describing the intended use of this credential configuration. expirationInDays: type: number description: Number of days until the issued credential expires. supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this configuration.' revocationMethod: type: string description: Method used for credential revocation. `status_list` uses the IETF Token Status List specification. `status_list_2021` uses the W3C Status List 2021 specification. `swiss_token_status_list_v1` uses the Swiss profile of Token Status List. enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential under this configuration is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. items: type: string enum: - 'did:key' - jwk - cose_key authorizationRequestType: type: string description: How the wallet requests authorization during the OID4VCI issuance flow. `authorization_details` uses RFC 9396 Rich Authorization Requests. `scope_based` uses OAuth 2.0 scope values. enum: - authorization_details - scope_based scope: type: string description: OAuth 2.0 scope value of this credential configuration. The issuer sets this field when `authorizationRequestType` is `scope_based`. display: type: object description: Display properties for the credential card in wallet UIs. properties: name: type: string description: Display name for the credential in wallet UIs. locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). logo: type: object description: Logo image of the credential card. properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. backgroundImage: type: object description: Background image of the credential card. properties: uri: type: string description: URL of the background image. credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. credentialFormat: type: string description: Credential format of this configuration. `jwt_vc_json` is W3C VC (JWT). `dc+sd-jwt` is IETF SD-JWT VC. `mso_mdoc` is ISO 18013-5 mDoc/mDL. enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. These values appear in the `type` field of the issued W3C VC (JWT). vct: type: string description: 'Verifiable Credential Type identifier. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` (e.g. `urn:eu.europa.ec.eudi:pid:1`).' doctype: type: string description: Document type identifier. The issuer sets this field when `credentialFormat` is `mso_mdoc` (e.g. `org.iso.18013.5.1.lpid`). credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this configuration. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true version: type: string description: Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification that the issuer uses for the issuance flow. `version_01` is OpenID4VCI 1.0. A record that you created with an earlier version of this API can hold another value. The issuer sets the value at creation time and never changes it. example: version_01 trustAnchor: type: string description: DID method or key type used as the trust anchor for credential issuance. enum: - 'did:key' - x509 kid: type: string description: Key Identifier (kid) referencing the cryptographic key used to sign issued credentials. enforceWUA: type: boolean description: 'When `true`, the issuer requires the holder to present a valid Wallet Unit Attestation (WUA) during the OID4VCI issuance flow.' supportInteractiveAuthorisationEndpoint: type: boolean description: 'When `true`, the issuer publishes an interactive authorisation endpoint for this credential definition.' systemManaged: type: boolean description: 'When `true`, the platform manages this credential definition. You cannot change or delete a system managed credential definition.' extensionEnabled: type: boolean description: 'When `true`, an extension supplies the credential data for this credential definition.' display: type: object description: 'Display properties of the credential, as published in the OID4VCI Credential Issuer Metadata. Wallets use these values to draw the credential card.' properties: name: type: string description: 'Display name for the credential shown in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Legal Person Identification Data locale: type: string description: 'BCP47 language tag for the display properties. The issuer always sets `en-GB`, and ignores any locale that you send.' example: en-GB description: type: string description: Human-readable description of the credential purpose. backgroundColor: type: string description: Hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: 'Logo image shown on the credential card. The issuer sets the organisation logo when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no logo.' properties: uri: type: string description: URL of the logo image. altText: type: string description: Alternative text for the logo image. Wallets use this text for accessibility. required: - uri - altText backgroundImage: type: object description: 'Background image of the credential card. The issuer sets the organisation cover image when you do not supply a URI. The issuer always returns the object, and `uri` is empty when the credential definition holds no background image.' properties: uri: type: string description: URL of the background image. required: - uri required: - name - locale - description - backgroundColor - textColor - logo - backgroundImage expirationInDays: type: number description: Number of days until the issued credential expires. example: 30 supportRevocation: type: boolean description: 'When `true`, the issuer supports revocation of credentials from this credential definition.' revocationMethod: type: string description: 'Method used for credential revocation. `status_list` uses the IETF Token Status List, `status_list_2021` uses the W3C Status List 2021, `swiss_token_status_list_v1` uses the Swiss profile.' enum: - status_list - status_list_2021 - swiss_token_status_list_v1 enforceCredentialUniqueness: type: boolean description: 'When `true`, each credential issued under this definition is unique per holder.' supportCredentialReissuance: type: boolean description: 'When `true`, holders can request reissuance of expired or near-expiry credentials.' credentialBindingMethods: type: array description: Cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. `cose_key` is valid only for the `mso_mdoc` format. The value is `null` when the record holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key credentialFormat: type: string description: 'Credential format identifier as defined in OID4VCI. Supported formats: `jwt_vc_json` (W3C VC JWT), `dc+sd-jwt` (IETF SD-JWT VC), `mso_mdoc` (ISO 18013-5 mDoc/mDL).' enum: - jwt_vc_json - dc+sd-jwt - mso_mdoc validationPath: type: string description: 'JSONPath expression that selects the part of the credential payload that the issuer validates against the claims. The value is `$.vc` for `jwt_vc_json`, and `$` for `dc+sd-jwt` and `mso_mdoc`.' type: type: array items: type: string description: Credential type strings as defined in the OID4VCI specification. These values appear in the `type` field of the issued W3C VC (JWT). The issuer omits this field when the record uses another credential format. vct: type: string description: Verifiable Credential Type identifier used when `credentialFormat` is `dc+sd-jwt`. Included in the `vct` claim of the issued IETF SD-JWT VC. example: 'urn:eu.europa.ec.eudi:pid:1' doctype: type: string description: Document type identifier used when `credentialFormat` is `mso_mdoc`. Identifies the credential in the ISO 18013-5 mDoc/mDL format (e.g. `org.iso.18013.5.1.lpid`). example: eu.europa.ec.eudi.pid.1 namespace: type: string description: 'Namespace identifier for ISO 18013-5 mDoc/mDL credentials. The value is empty for an OpenID4VCI 1.0 credential definition, because the mDoc namespace is the first element of each claim path.' credentialDefinitionUri: type: string description: URL of the external claims schema that the issuer used to build the claims of this record. claims: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `dc+sd-jwt` or `mso_mdoc`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: 'Claim path pointer that selects the claim in the credential payload. Each element is a string for an object key, an integer for an array index, or `null` for every element of an array. For `mso_mdoc`, the first element is the mDoc namespace.' items: description: 'Object key, array index, or `null` for every element of an array.' example: - address - country mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' limitDisclosure: type: boolean description: 'When `true`, the holder can disclose the claim selectively.' additionalProperties: true credentialDefinition: type: object description: 'Claims of the credential, as claim path pointers. The issuer sets this field when `credentialFormat` is `jwt_vc_json`. Each path starts with `credentialSubject`.' properties: claims: type: array description: One claim path pointer for each claim that the issuer publishes. items: type: object properties: path: type: array description: Claim path pointer that selects the claim below `$.vc`. The first element is `credentialSubject`. items: description: 'Object key, array index, or `null` for every element of an array.' example: - credentialSubject - identifier mandatory: type: boolean description: 'When `true`, the issuer always includes the claim.' additionalProperties: true required: - id - credentialDefinitionId - openIdOrganisationId - createdAt - updatedAt - label - display - expirationInDays - credentialFormat - credentialDefinitionUri - validationPath - version - trustAnchor - kid - enforceWUA - supportRevocation - revocationMethod - enforceCredentialUniqueness - supportCredentialReissuance - supportInteractiveAuthorisationEndpoint - namespace - systemManaged - extensionEnabled - type: object properties: totalCountOfCredentialHistory: type: integer description: Number of credential exchange records created from this credential definition. example: 42 issuanceBreakdown: type: object description: 'Issuance counts for this credential definition. The server returns zero in every field when you set `skipCounts` to `true`, and also when it cannot calculate the counts.' properties: total: type: integer description: Total number of credential exchange records for this credential definition. example: 42 accepted: type: integer description: Number of records that the holder accepted and that are not revoked. example: 30 inProgress: type: integer description: Number of records that are still in progress. example: 7 revoked: type: integer description: Number of records whose credential is revoked. example: 3 denied: type: integer description: Number of records for which the issuer denied the issuance. example: 2 type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true issuanceHistoryStats: type: object description: Aggregate issuance counts for the whole organisation. The filters and the pagination do not change these counts. properties: total: type: integer description: Total number of credential exchange records. example: 120 accepted: type: integer description: Number of records that the holder accepted and that are not revoked. example: 84 inProgress: type: integer description: Number of records that are still in progress. example: 21 revoked: type: integer description: Number of records whose credential is revoked. example: 9 denied: type: integer description: Number of records for which the issuer denied the issuance. example: 6 type: object description: Credential definitions listed successfully headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is unknown or the wallet is not deployed. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List credential definition tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/credential-definition/preview: post: description: | Fetches a credential schema document from a URI so that you can inspect it before you create a credential definition from it. The service downloads the document at `credentialDefinitionUri` and returns it unchanged in `credentialDefinition`. For OpenID4VCI 1.0, the document is a claim path pointer document: its `claims` array holds one entry per claim, each with a `path` array. Send one request per URI. operationId: configPreviewDigitalWalletOpenIdCredentialDefinition requestBody: content: application/json: schema: type: object required: - credentialDefinitionUri properties: credentialDefinitionUri: type: string format: uri description: HTTP or HTTPS URI of the credential schema document to fetch. example: 'https://schemas.example.com/lpid.json' parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: Credential schema document fetched successfully content: application/json: schema: type: object required: - credentialDefinition properties: credentialDefinition: type: object description: 'The schema document that the service fetched from `credentialDefinitionUri`, returned unchanged.' additionalProperties: true headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, the URI is missing, or the document could not be fetched or read.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Preview credential definition from URI tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/credential-definition/{credentialDefinitionId}/coverimage': get: deprecated: false description: | Retrieves the cover image of an OID4VCI credential definition. This operation needs no authentication, because wallets read the image from the URL that the issuer publishes in the OID4VCI Credential Issuer Metadata. Anybody who knows the credential definition ID can read the image. operationId: configReadDigitalWalletOpenIdCredentialCoverImage parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string responses: '200': description: The server returns the raw image bytes. The `Content-Type` response header holds `image/jpeg`. content: image/jpeg: schema: type: string format: binary headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: No credential definition matches `credentialDefinitionId`. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The credential definition holds no cover image, or the server cannot read the stored image.' headers: {} security: [] summary: Read credential definition cover image tags: - Digital Wallet (OpenID4VC) - Issuer put: deprecated: false description: | Uploads or updates the cover image of an OID4VCI credential definition. This operation is the only way to upload your own cover image, because the create and update credential definition operations ignore `display.backgroundImage.uri`. The server stores the image, then sets `display.backgroundImage.uri` of the credential definition and of every credential configuration that it holds to the URL of the new image. Use this operation after you create the credential definition. operationId: configUpdateDigitalWalletOpenIdCredentialCoverImage parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: content: multipart/form-data: encoding: {} schema: properties: coverimage: format: binary type: string description: Image file to store as the credential card background of the credential definition. required: - coverimage type: object required: true description: Multipart form that holds the image file in the `coverimage` field. responses: '200': description: The server stored the image and updated the credential definition. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no credential definition matches `credentialDefinitionId`, or the issuer cannot save the new image reference.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The server cannot read the uploaded file from the `coverimage` form field, or cannot store the image.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update credential definition cover image tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/credential-definition/{credentialDefinitionId}/logoimage': get: deprecated: false description: | Retrieves the logo image of an OID4VCI credential definition. This operation needs no authentication, because wallets read the image from the URL that the issuer publishes in the OID4VCI Credential Issuer Metadata. Anybody who knows the credential definition ID can read the image. operationId: configReadDigitalWalletOpenIdCredentialLogoImage parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string responses: '200': description: The server returns the raw image bytes. The `Content-Type` response header holds `image/jpeg`. content: image/jpeg: schema: type: string format: binary headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: No credential definition matches `credentialDefinitionId`. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The credential definition holds no logo image, or the server cannot read the stored image.' headers: {} security: [] summary: Read credential definition logo image tags: - Digital Wallet (OpenID4VC) - Issuer put: deprecated: false description: | Uploads or updates the logo image of an OID4VCI credential definition. This operation is the only way to upload your own logo, because the create and update credential definition operations ignore `display.logo.uri`. The server stores the image, then sets `display.logo.uri` of the credential definition and of every credential configuration that it holds to the URL of the new image. Use this operation after you create the credential definition. operationId: configUpdateDigitalWalletOpenIdCredentialLogoImage parameters: - description: 'Unique identifier of the credential definition that specifies the credential format, type, and claims structure for OID4VCI issuance.' in: path name: credentialDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: content: multipart/form-data: encoding: {} schema: properties: logoimage: format: binary type: string description: Image file to store as the credential card logo of the credential definition. required: - logoimage type: object required: true description: Multipart form that holds the image file in the `logoimage` field. responses: '200': description: The server stored the image and updated the credential definition. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no credential definition matches `credentialDefinitionId`, or the issuer cannot save the new image reference.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The server cannot read the uploaded file from the `logoimage` form field, or cannot store the image.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update credential definition logo image tags: - Digital Wallet (OpenID4VC) - Issuer /v3/config/digital-wallet/openid/sdjwt/verification/send: post: description: | Sends an OpenID4VP Authorization Request (V3) with enhanced features including transaction data, data agreements, and PDF signing support. The transport (Direct Post vs. W3C Digital Credentials API) is determined entirely by the referenced presentation definition's `responseMode`: - `direct_post` / `direct_post.jwt` → response contains `vpTokenQrCode` and `vpTokenRequest` (URI / JWT). Holder scans the QR or follows the deep link; wallet posts the response to `redirect_uri`. - `dc_api` / `dc_api.jwt` → response contains `dcApiRequest` (browser-specific shapes for Chrome and Safari) and `dcApiProtocol`. The verifier frontend feeds `dcApiRequest.chrome` (or `dcApiRequest.safari`) into `navigator.credentials.get()` and forwards the wallet's response to `POST /v2/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}/receive`. `vpTokenQrCode` and `vpTokenRequest` are empty in DC API flows. The request body itself carries no DC API fields, `responseMode`, `dcApiRequestType`, `expectedOrigins`, and `encryptedResponseEncValuesSupported` are configured at presentation-definition creation time and inherited from the referenced PD. Set `individualId` or `mapperId` to push the Authorization Request to the device of a known individual. The individual must have a push notification token. Do not set both properties in one request. Read `presentationExchangeId` from the response. Every other verification operation takes that value as its path parameter. Do not use `id`, which is an internal record identifier. Two properties of the record hold no value yet on this response: `credentialExchangeId` is always empty, and `requestExpired` is always `false`. Read the record with `GET /v3/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}` to get a computed `requestExpired`, or compare `requestExpiryTime` with the current time. operationId: configCreateDigitalWalletOpenIdVerificationRequestV3 requestBody: required: true description: Delivery options for the Authorization Request. Set `presentationDefinitionId` to name the stored presentation definition that holds the credential requirements. content: application/json: schema: type: object description: | Request body for an OpenID for Verifiable Presentation (OpenID4VP) Authorization Request. Set `presentationDefinitionId` to reference a stored presentation definition. The server reads the DCQL query and the transport settings from that record. This is the only supported way to give the credential requirements: a DCQL query cannot be sent inline. properties: presentationDefinitionId: type: string description: 'Identifier of a stored presentation definition. The server reads the DCQL query, the response mode, the transaction data template and the DC API settings from this record. The server ignores a value shorter than three characters and then answers with HTTP 400, because no requirements are left.' example: 1c3f6b1c-0c48-4b1f-9c1a-77f9c1d6a1a0 requestByReference: type: boolean default: false description: 'When `true`, the server passes the Authorization Request by reference with the `request_uri` parameter. The wallet then gets the full request from that URI. Use this option for large Authorization Requests.' example: true transactionData: type: object additionalProperties: true description: | Transaction data to add to the Authorization Request. The holder must approve this data before the wallet sends the presentation. Give this property when, and only when, the presentation definition that `presentationDefinitionId` names sets a transaction data template type. The server answers with HTTP 400 when the definition sets a template type and the body has no `transactionData`, and also when the definition sets no template type and the body has `transactionData`. The structure must agree with the JSON Schema of the template type of the presentation definition. nonce: type: string description: Cryptographic nonce for the Authorization Request. The server makes a nonce if you do not supply one. V3 endpoint only. example: z4cVLRsq9pKx0NgQ7E3hJg urlPrefix: type: string description: 'URL scheme prefix for the Authorization Request deep link that the server returns in `vpTokenQrCode`. The default is `openid4vp://`. Use a different prefix to open a specific wallet. V3 endpoint only.' example: 'openid4vp://' individualId: type: string description: Identifier of an individual in the organisation. The server sends a push notification with the Authorization Request to the device of this individual. The individual must have a push notification token. Do not set `individualId` and `mapperId` together. V3 endpoint only. mapperId: type: string description: External identifier that maps to an individual in the organisation. The server sends a push notification with the Authorization Request to the device of that individual. Do not set `individualId` and `mapperId` together. V3 endpoint only. signatureStamp: type: boolean default: false description: 'When `true`, the server puts a visible signature stamp in the signed PDF that the flow makes. V3 endpoint only.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points. The array must hold exactly four integers. V3 endpoint only.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. V3 endpoint only. required: - presentationDefinitionId examples: Send verification request: value: presentationDefinitionId: requestByReference: true urlPrefix: 'openid4vp://' parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server made the Authorization Request and saved the verification exchange record. content: application/json: schema: type: object properties: verificationHistory: type: object description: | Verification exchange record. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) verification, from the Authorization Request to the verification result. The server returns every property of this schema on every operation, except `dcApiRequest` and `dcApiProtocol`. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: presentationExchangeId: type: string description: 'Unique identifier of the verification exchange. Give this value as the `presentationExchangeId` path parameter to read, delete or revalidate the record, and to receive a DC API response for it.' example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e id: type: string description: Internal record identifier that the server makes when it stores the record. No operation accepts this value. Use `presentationExchangeId` to address the record. example: 6821b4b0f5b1c2a3d4e5f6a7 vpTokenQrCode: type: string description: OpenID4VP Authorization Request URI encoded for QR code display or deep link. The holder's wallet scans or clicks this to initiate the presentation flow. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). vpTokenRequestState: type: string description: 'State parameter for the OpenID4VP Authorization Request, used to correlate the request with the response.' vpTokenRequest: type: string description: Full OpenID4VP Authorization Request URI or payload. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). presentationSubmission: type: object description: | Wrapper that holds the Presentation Submission object of the wallet. DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns `null` here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. Read `presentation` to get the credentials of the holder. properties: presentation_submission: type: object description: DIF Presentation Exchange Submission object that maps the credentials of the holder to the requirements of the verifier. Kept for old records only. properties: definition_id: type: string description: Identifier of the Presentation Definition that this submission fulfills. descriptor_map: description: Array of Descriptor Map entries mapping each requested credential to its location in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this entry satisfies. path: type: string description: JSONPath expression pointing to the Verifiable Credential within the Verifiable Presentation token. path_nested: type: object description: Nested path descriptor for credentials wrapped in envelope formats (e.g. JWT inside a VP JWT). properties: format: type: string description: 'Credential format of the nested credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this nested entry satisfies. path: type: string description: JSONPath expression pointing to the credential within the nested envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier for this Presentation Submission. required: - definition_id - descriptor_map - id status: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked description: | Lifecycle status of the verification exchange: 1. `request_sent`: The server made the OpenID4VP Authorization Request. The exchange waits for the holder. 2. `request_received`: The wallet of the holder got, or scanned, the Authorization Request. 3. `presentation_pending`: The wallet started the response but the verifier did not get a complete Authorization Response yet. 4. `presentation_acked`: The holder sent the Verifiable Presentation and the verifier processed it. example: request_sent verified: type: boolean description: 'Result of the verification of the Verifiable Presentation. The server checks the cryptographic signatures, the credential status and the presented claims against the DCQL query of the presentation definition.' createdAt: type: number description: Unix timestamp (in seconds) when this verification record was created. updatedAt: type: number description: Unix timestamp (in seconds) when this verification record was last modified. presentationDefinitionId: type: string description: Identifier of the presentation definition used for this verification request. openIdOrganisationId: type: string description: Identifier of the OpenID4VP organisation that initiated this verification request. holder: description: 'Contains the metadata describing a holder. For e.g. Name, location, logo e.t.c' type: object properties: name: type: string description: Identifier of the holder. For .e.g. DID or Name obtained from client metadata if available. required: - name presentation: type: array items: type: object additionalProperties: true description: Decoded credentials that the holder presented. The shape of each entry follows the credential format. `null` until the holder answers. vpTokenResponse: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent. The array holds one entry for each credential that the Authorization Request asked for. `null` until the wallet answers. transactionData: type: object additionalProperties: true description: Transaction data confirmed by the holder during the presentation flow. transactionDataBase64: type: string description: Base64url encoding of the transaction data that the Authorization Request holds. credentialExchangeId: type: string description: 'Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification. Always empty on the response of the send operation. The server fills it in later, when the issuance flow starts.' responseType: type: string description: OAuth 2.0 response type of the Authorization Request. enum: - vp_token - id_token - device_response idToken: type: string description: OpenID Connect ID Token from the holder. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token of the holder. dataAgreementId: type: string description: Identifier of the data agreement record that this verification exchange created. userId: type: string description: Identifier of the dashboard user or individual that started this verification request. requestExpired: type: boolean description: '`true` when the `exp` claim of `vpTokenRequest` is in the past. The wallet cannot use an expired Authorization Request. The read and list operations compute this value when they answer. The send and revalidate operations always return `false`.' requestExpiryTime: type: number description: Unix timestamp in seconds when the Authorization Request expires. The server reads this value from the `exp` claim of `vpTokenRequest`. `0` when the request has no expiry. example: 1747015200 presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation, with the signature check, the expiry check and the revocation status. The revalidate operation writes a new value here. `null` until the holder answers.' clientIdScheme: type: string description: Client ID scheme used by the verifier in the OpenID4VP Authorization Request. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: URI the wallet redirects to after posting the Authorization Response. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). responseMode: type: string description: | OpenID4VP response mode determining how the Authorization Response is delivered: - `direct_post`: Response sent via HTTP POST to the verifier's `redirect_uri` without encryption. - `direct_post.jwt`: Response sent via HTTP POST encrypted as a JWE. - `dc_api`: Response delivered over the W3C Digital Credentials API transport without JWE encryption. Compatible with both `signed` and `unsigned` `dcApiRequestType` values. - `dc_api.jwt`: Response delivered over the W3C Digital Credentials API transport encrypted as a JWE. - `iar-post`: Response sent through the Interactive Authorisation Request transport without encryption. - `iar-post.jwt`: Response sent through the Interactive Authorisation Request transport encrypted as a JWE. enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt - iar-post - iar-post.jwt verifierAttestation: type: string description: 'Verifier Attestation JWT sent to the holder, proving the verifier''s authorization.' individualId: type: string description: Identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `individualId`. mapperId: type: string description: External identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `mapperId`. dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. nonce: type: string description: Cryptographic nonce used in the OpenID4VP Authorization Request to ensure freshness and prevent replay attacks. dcApiProtocol: type: string description: | Digital Credentials API exchange protocol identifier returned when the presentation definition is configured for DC API response modes. Identifies the protocol variant used with the W3C Digital Credentials API (`navigator.credentials.get()`): - `openid4vp-v1-unsigned`: The Authorization Request is passed unencrypted to the browser's DC API. The browser can inspect the request for risk analysis. Use for development/testing only. - `openid4vp-v1-signed`: The Authorization Request is signed by the verifier's key and passed as an opaque string to the browser's DC API. Provides verifier authentication. Recommended for production. - `org-iso-mdoc`: The Authorization Request follows ISO 18013-7 Annex C. The wallet answers with an encrypted CBOR `EncryptedResponse`. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. enum: - openid4vp-v1-unsigned - openid4vp-v1-signed - org-iso-mdoc dcApiRequest: type: object description: | Request object for the W3C Digital Credentials API, structured for browser invocation via `navigator.credentials.get()`. Contains browser-specific request formats for Chrome and Safari. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. properties: chrome: type: object description: Digital Credentials API request format for Chromium-based browsers. Uses the `providers` structure per the W3C Digital Credentials API specification. properties: digital: type: object description: Digital credential request options for Chromium-based browsers. properties: providers: type: array description: 'Array of credential request providers, each specifying a protocol and request data.' items: type: object properties: protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' request: type: object description: | The OpenID4VP Authorization Request payload. Structure varies by protocol: - For `openid4vp-v1-signed`: Contains `{ "request": "" }`, a JWT signed by the verifier's key. - For `openid4vp-v1-unsigned`: Contains the full Authorization Request object with `client_metadata`, `dcql_query`, `nonce`, `response_mode`, `response_type`. additionalProperties: true safari: type: object description: Digital Credentials API request format for Safari-based browsers. Uses the `requests` structure. properties: digital: type: object description: Digital credential request options for Safari-based browsers. properties: requests: type: array description: 'Array of credential requests for Safari, each containing data and protocol.' items: type: object properties: data: type: string description: | JSON-stringified Authorization Request payload (Safari's DC API expects a string, not an object). Decoding it yields the same structure that Chrome receives in `request`: - For `openid4vp-v1-signed`: `{ "request": "" }`. - For `openid4vp-v1-unsigned`: the full inline Authorization Request object (`response_type`, `response_mode`, `nonce`, `dcql_query`, `client_metadata`, …). protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' requiresEncryption: type: boolean description: Indicates whether the OpenID4VP Authorization Response must be encrypted as a JWE. `true` when `responseMode` is `direct_post.jwt` or `dc_api.jwt`. `false` when `responseMode` is `direct_post` or `dc_api`. signatureStamp: type: boolean description: 'When `false`, the signature stamp is hidden in signed PDFs.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 files: type: array description: 'List of files generated during the verification, including signed and unsigned PDF documents.' items: type: object properties: credentialId: type: string description: Identifier of the credential associated with this file. error: type: string nullable: true description: 'Error code if signing failed, null otherwise.' errorDescription: type: string nullable: true description: 'Detailed error message if signing failed, null otherwise.' signedFile: type: string format: uri description: URL of the signed PDF file. unsignedFile: type: string format: uri description: URL of the unsigned PDF file. required: - id - presentationExchangeId - openIdOrganisationId - presentationDefinitionId - vpTokenRequestState - vpTokenRequest - vpTokenQrCode - status - verified - holder - createdAt - updatedAt - credentialExchangeId - transactionDataBase64 - nonce - responseType - idToken - clientIdScheme - responseMode - verifierAttestation - directPostRedirectUri - requiresEncryption - individualId - mapperId - signatureStamp - dataAgreementId - userId - requestExpired - requestExpiryTime required: - verificationHistory examples: Direct Post (direct_post): summary: Holder scans `vpTokenQrCode` or follows the deep link value: verificationHistory: id: 6821b4b0f5b1c2a3d4e5f6a7 presentationExchangeId: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e presentationDefinitionId: 1c3f6b1c-0c48-4b1f-9c1a-77f9c1d6a1a0 vpTokenQrCode: 'openid4vp://?client_id=redirect_uri%3Ahttps%3A%2F%2Fissuer.example.com%2Forganisation%2Fxyz%2Fservice&request_uri=https%3A%2F%2Fissuer.example.com%2Forganisation%2Fxyz%2Fservice%2Fverification%2F8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e&request_uri_method=post' vpTokenRequest: 'openid4vp://?client_id=redirect_uri%3A...&request_uri=...' vpTokenRequestState: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f responseMode: direct_post clientIdScheme: redirect_uri requiresEncryption: false nonce: z4cVLRsq9pKx0NgQ7E3hJg openIdOrganisationId: 7f9b1e2c-3a4d-4b5e-8c9f-0a1b2c3d4e5f status: request_sent verified: false holder: name: '' responseType: vp_token idToken: '' verifierAttestation: '' directPostRedirectUri: '' credentialExchangeId: '' transactionDataBase64: '' dataAgreementId: '' userId: '' individualId: '' mapperId: '' signatureStamp: false requestExpired: false requestExpiryTime: 1747015200 createdAt: 1747011600 updatedAt: 1747011600 DC API Unsigned (dc_api): summary: Verifier frontend invokes `navigator.credentials.get()` with `dcApiRequest` value: verificationHistory: id: 6821b4b0f5b1c2a3d4e5f6a8 presentationExchangeId: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d presentationDefinitionId: 1c3f6b1c-0c48-4b1f-9c1a-77f9c1d6a1a0 vpTokenQrCode: '' vpTokenRequest: '' vpTokenRequestState: f3e2d1c0-b9a8-7654-3210-fedcba987654 responseMode: dc_api clientIdScheme: redirect_uri requiresEncryption: false nonce: z4cVLRsq9pKx0NgQ7E3hJg dcApiProtocol: openid4vp-v1-unsigned dcApiRequest: chrome: digital: providers: - protocol: openid4vp-v1-unsigned request: response_type: vp_token response_mode: dc_api nonce: z4cVLRsq9pKx0NgQ7E3hJg dcql_query: credentials: - id: Person Identification Data - PID format: dc+sd-jwt meta: vct_values: - PersonIdentificationData claims: - path: - family_name - path: - given_name client_metadata: client_name: Example Verifier vp_formats_supported: dc+sd-jwt: sd-jwt_alg_values: - ES256 kb-jwt_alg_values: - ES256 safari: digital: requests: - protocol: openid4vp-v1-unsigned data: '{"response_type":"vp_token","response_mode":"dc_api","nonce":"z4cVLRsq9pKx0NgQ7E3hJg","dcql_query":{"credentials":[{"id":"Person Identification Data - PID","format":"dc+sd-jwt","meta":{"vct_values":["PersonIdentificationData"]},"claims":[{"path":["family_name"]},{"path":["given_name"]}]}]},"client_metadata":{"client_name":"Example Verifier"}}' openIdOrganisationId: 7f9b1e2c-3a4d-4b5e-8c9f-0a1b2c3d4e5f status: request_sent verified: false holder: name: '' responseType: vp_token idToken: '' verifierAttestation: '' directPostRedirectUri: '' credentialExchangeId: '' transactionDataBase64: '' dataAgreementId: '' userId: '' individualId: '' mapperId: '' signatureStamp: false requestExpired: false requestExpiryTime: 0 createdAt: 1747011600 updatedAt: 1747011600 DC API Signed + Encrypted (dc_api.jwt): summary: 'Signed Authorization Request JWT, wallet response will be returned as a JWE' value: verificationHistory: id: 6821b4b0f5b1c2a3d4e5f6a9 presentationExchangeId: 9f8e7d6c-5b4a-3210-fedc-ba9876543210 presentationDefinitionId: 1c3f6b1c-0c48-4b1f-9c1a-77f9c1d6a1a0 vpTokenQrCode: '' vpTokenRequest: '' vpTokenRequestState: 11111111-2222-3333-4444-555555555555 responseMode: dc_api.jwt clientIdScheme: redirect_uri requiresEncryption: true nonce: uVj0pAq4cZmDk2yL6RxBvg dcApiProtocol: openid4vp-v1-signed dcApiRequest: chrome: digital: providers: - protocol: openid4vp-v1-signed request: request: 'eyJhbGciOiJFUzI1NiIsImtpZCI6IjEiLCJ0eXAiOiJvYXV0aC1hdXRoei1yZXErand0IiwieDVjIjpbIk1JSUI..."]}.eyJjbGllbnRfaWQiOiJyZWRpcmVjdF91cmk6aHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbSIsInJlc3BvbnNlX3R5cGUiOiJ2cF90b2tlbiIsInJlc3BvbnNlX21vZGUiOiJkY19hcGkuand0IiwibmV4cGVjdGVkX29yaWdpbnMiOlsiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbSJdLCJkY3FsX3F1ZXJ5Ijp7Li4ufX0.signature' safari: digital: requests: - protocol: openid4vp-v1-signed data: '{"request":"eyJhbGciOiJFUzI1NiIsImtpZCI6IjEiLCJ0eXAiOiJvYXV0aC1hdXRoei1yZXErand0IiwieDVjIjpbIk1JSUI...signature"}' openIdOrganisationId: 7f9b1e2c-3a4d-4b5e-8c9f-0a1b2c3d4e5f status: request_sent verified: false holder: name: '' responseType: vp_token idToken: '' verifierAttestation: '' directPostRedirectUri: '' credentialExchangeId: '' transactionDataBase64: '' dataAgreementId: '' userId: '' individualId: '' mapperId: '' signatureStamp: false requestExpired: false requestExpiryTime: 0 createdAt: 1747011600 updatedAt: 1747011600 headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, the body has no `presentationDefinitionId`, no presentation definition has that identifier, the body disagrees with the transaction data template of the presentation definition, or the digital wallet refused the request.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Internal server error. The server also answers with this status when the body sets `individualId` and `mapperId` together, when the individual is unknown, or when the individual has no push notification token.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Send verification request tags: - Digital Wallet (OpenID4VC) - Verifier '/v3/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}': get: description: | Reads one verification exchange record by its identifier. Give the `presentationExchangeId` property of the record, not its `id` property. The server recomputes `requestExpired` from the `exp` claim of `vpTokenRequest` before it answers, so the value is always current. It does not recompute `requestExpiryTime`, which keeps the value from the time of the send operation. This operation still returns a record that a delete operation removed. operationId: configReadDigitalWalletOpenIdVerificationHistoryV3 parameters: - description: 'Unique identifier of the verification exchange record. This is the `presentationExchangeId` property of the record, not its `id` property.' in: path name: presentationExchangeId required: true schema: type: string example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server found the verification exchange record. content: application/json: schema: type: object properties: verificationHistory: type: object description: | Verification exchange record. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) verification, from the Authorization Request to the verification result. The server returns every property of this schema on every operation, except `dcApiRequest` and `dcApiProtocol`. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: presentationExchangeId: type: string description: 'Unique identifier of the verification exchange. Give this value as the `presentationExchangeId` path parameter to read, delete or revalidate the record, and to receive a DC API response for it.' example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e id: type: string description: Internal record identifier that the server makes when it stores the record. No operation accepts this value. Use `presentationExchangeId` to address the record. example: 6821b4b0f5b1c2a3d4e5f6a7 vpTokenQrCode: type: string description: OpenID4VP Authorization Request URI encoded for QR code display or deep link. The holder's wallet scans or clicks this to initiate the presentation flow. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). vpTokenRequestState: type: string description: 'State parameter for the OpenID4VP Authorization Request, used to correlate the request with the response.' vpTokenRequest: type: string description: Full OpenID4VP Authorization Request URI or payload. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). presentationSubmission: type: object description: | Wrapper that holds the Presentation Submission object of the wallet. DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns `null` here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. Read `presentation` to get the credentials of the holder. properties: presentation_submission: type: object description: DIF Presentation Exchange Submission object that maps the credentials of the holder to the requirements of the verifier. Kept for old records only. properties: definition_id: type: string description: Identifier of the Presentation Definition that this submission fulfills. descriptor_map: description: Array of Descriptor Map entries mapping each requested credential to its location in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this entry satisfies. path: type: string description: JSONPath expression pointing to the Verifiable Credential within the Verifiable Presentation token. path_nested: type: object description: Nested path descriptor for credentials wrapped in envelope formats (e.g. JWT inside a VP JWT). properties: format: type: string description: 'Credential format of the nested credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this nested entry satisfies. path: type: string description: JSONPath expression pointing to the credential within the nested envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier for this Presentation Submission. required: - definition_id - descriptor_map - id status: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked description: | Lifecycle status of the verification exchange: 1. `request_sent`: The server made the OpenID4VP Authorization Request. The exchange waits for the holder. 2. `request_received`: The wallet of the holder got, or scanned, the Authorization Request. 3. `presentation_pending`: The wallet started the response but the verifier did not get a complete Authorization Response yet. 4. `presentation_acked`: The holder sent the Verifiable Presentation and the verifier processed it. example: request_sent verified: type: boolean description: 'Result of the verification of the Verifiable Presentation. The server checks the cryptographic signatures, the credential status and the presented claims against the DCQL query of the presentation definition.' createdAt: type: number description: Unix timestamp (in seconds) when this verification record was created. updatedAt: type: number description: Unix timestamp (in seconds) when this verification record was last modified. presentationDefinitionId: type: string description: Identifier of the presentation definition used for this verification request. openIdOrganisationId: type: string description: Identifier of the OpenID4VP organisation that initiated this verification request. holder: description: 'Contains the metadata describing a holder. For e.g. Name, location, logo e.t.c' type: object properties: name: type: string description: Identifier of the holder. For .e.g. DID or Name obtained from client metadata if available. required: - name presentation: type: array items: type: object additionalProperties: true description: Decoded credentials that the holder presented. The shape of each entry follows the credential format. `null` until the holder answers. vpTokenResponse: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent. The array holds one entry for each credential that the Authorization Request asked for. `null` until the wallet answers. transactionData: type: object additionalProperties: true description: Transaction data confirmed by the holder during the presentation flow. transactionDataBase64: type: string description: Base64url encoding of the transaction data that the Authorization Request holds. credentialExchangeId: type: string description: 'Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification. Always empty on the response of the send operation. The server fills it in later, when the issuance flow starts.' responseType: type: string description: OAuth 2.0 response type of the Authorization Request. enum: - vp_token - id_token - device_response idToken: type: string description: OpenID Connect ID Token from the holder. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token of the holder. dataAgreementId: type: string description: Identifier of the data agreement record that this verification exchange created. userId: type: string description: Identifier of the dashboard user or individual that started this verification request. requestExpired: type: boolean description: '`true` when the `exp` claim of `vpTokenRequest` is in the past. The wallet cannot use an expired Authorization Request. The read and list operations compute this value when they answer. The send and revalidate operations always return `false`.' requestExpiryTime: type: number description: Unix timestamp in seconds when the Authorization Request expires. The server reads this value from the `exp` claim of `vpTokenRequest`. `0` when the request has no expiry. example: 1747015200 presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation, with the signature check, the expiry check and the revocation status. The revalidate operation writes a new value here. `null` until the holder answers.' clientIdScheme: type: string description: Client ID scheme used by the verifier in the OpenID4VP Authorization Request. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: URI the wallet redirects to after posting the Authorization Response. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). responseMode: type: string description: | OpenID4VP response mode determining how the Authorization Response is delivered: - `direct_post`: Response sent via HTTP POST to the verifier's `redirect_uri` without encryption. - `direct_post.jwt`: Response sent via HTTP POST encrypted as a JWE. - `dc_api`: Response delivered over the W3C Digital Credentials API transport without JWE encryption. Compatible with both `signed` and `unsigned` `dcApiRequestType` values. - `dc_api.jwt`: Response delivered over the W3C Digital Credentials API transport encrypted as a JWE. - `iar-post`: Response sent through the Interactive Authorisation Request transport without encryption. - `iar-post.jwt`: Response sent through the Interactive Authorisation Request transport encrypted as a JWE. enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt - iar-post - iar-post.jwt verifierAttestation: type: string description: 'Verifier Attestation JWT sent to the holder, proving the verifier''s authorization.' individualId: type: string description: Identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `individualId`. mapperId: type: string description: External identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `mapperId`. dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. nonce: type: string description: Cryptographic nonce used in the OpenID4VP Authorization Request to ensure freshness and prevent replay attacks. dcApiProtocol: type: string description: | Digital Credentials API exchange protocol identifier returned when the presentation definition is configured for DC API response modes. Identifies the protocol variant used with the W3C Digital Credentials API (`navigator.credentials.get()`): - `openid4vp-v1-unsigned`: The Authorization Request is passed unencrypted to the browser's DC API. The browser can inspect the request for risk analysis. Use for development/testing only. - `openid4vp-v1-signed`: The Authorization Request is signed by the verifier's key and passed as an opaque string to the browser's DC API. Provides verifier authentication. Recommended for production. - `org-iso-mdoc`: The Authorization Request follows ISO 18013-7 Annex C. The wallet answers with an encrypted CBOR `EncryptedResponse`. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. enum: - openid4vp-v1-unsigned - openid4vp-v1-signed - org-iso-mdoc dcApiRequest: type: object description: | Request object for the W3C Digital Credentials API, structured for browser invocation via `navigator.credentials.get()`. Contains browser-specific request formats for Chrome and Safari. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. properties: chrome: type: object description: Digital Credentials API request format for Chromium-based browsers. Uses the `providers` structure per the W3C Digital Credentials API specification. properties: digital: type: object description: Digital credential request options for Chromium-based browsers. properties: providers: type: array description: 'Array of credential request providers, each specifying a protocol and request data.' items: type: object properties: protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' request: type: object description: | The OpenID4VP Authorization Request payload. Structure varies by protocol: - For `openid4vp-v1-signed`: Contains `{ "request": "" }`, a JWT signed by the verifier's key. - For `openid4vp-v1-unsigned`: Contains the full Authorization Request object with `client_metadata`, `dcql_query`, `nonce`, `response_mode`, `response_type`. additionalProperties: true safari: type: object description: Digital Credentials API request format for Safari-based browsers. Uses the `requests` structure. properties: digital: type: object description: Digital credential request options for Safari-based browsers. properties: requests: type: array description: 'Array of credential requests for Safari, each containing data and protocol.' items: type: object properties: data: type: string description: | JSON-stringified Authorization Request payload (Safari's DC API expects a string, not an object). Decoding it yields the same structure that Chrome receives in `request`: - For `openid4vp-v1-signed`: `{ "request": "" }`. - For `openid4vp-v1-unsigned`: the full inline Authorization Request object (`response_type`, `response_mode`, `nonce`, `dcql_query`, `client_metadata`, …). protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' requiresEncryption: type: boolean description: Indicates whether the OpenID4VP Authorization Response must be encrypted as a JWE. `true` when `responseMode` is `direct_post.jwt` or `dc_api.jwt`. `false` when `responseMode` is `direct_post` or `dc_api`. signatureStamp: type: boolean description: 'When `false`, the signature stamp is hidden in signed PDFs.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 files: type: array description: 'List of files generated during the verification, including signed and unsigned PDF documents.' items: type: object properties: credentialId: type: string description: Identifier of the credential associated with this file. error: type: string nullable: true description: 'Error code if signing failed, null otherwise.' errorDescription: type: string nullable: true description: 'Detailed error message if signing failed, null otherwise.' signedFile: type: string format: uri description: URL of the signed PDF file. unsignedFile: type: string format: uri description: URL of the unsigned PDF file. required: - id - presentationExchangeId - openIdOrganisationId - presentationDefinitionId - vpTokenRequestState - vpTokenRequest - vpTokenQrCode - status - verified - holder - createdAt - updatedAt - credentialExchangeId - transactionDataBase64 - nonce - responseType - idToken - clientIdScheme - responseMode - verifierAttestation - directPostRedirectUri - requiresEncryption - individualId - mapperId - signatureStamp - dataAgreementId - userId - requestExpired - requestExpiryTime required: - verificationHistory headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, or no verification exchange record has the supplied `presentationExchangeId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read verification history tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}': delete: description: | Deletes a verification exchange record. The server marks the record as deleted and asks the digital wallet deployment to delete its copy. The response has no body. The list operations leave out a deleted record, but the read operations still return it. The server does not wait for the digital wallet deployment, so a successful answer does not prove that the wallet deleted its copy. operationId: configDeleteDigitalWalletOpenIdVerificationHistory parameters: - description: 'Unique identifier of the verification exchange record. This is the `presentationExchangeId` property of the record, not its `id` property.' in: path name: presentationExchangeId required: true schema: type: string example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server deleted the verification exchange record. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, no verification exchange record has the supplied `presentationExchangeId`, or the digital wallet refused the delete.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete verification history tags: - Digital Wallet (OpenID4VC) - Verifier /v3/config/digital-wallet/openid/sdjwt/verification/history: get: description: | Lists verification exchange records. Each record holds one OpenID4VP verification lifecycle. The server sorts the records by `updatedAt` and uses `sortOrder` for the direction. The response also holds `verificationHistoryStats`. These counters cover every verification exchange record of the organisation, not only the current page and not only the records that agree with the filters. The filters combine with a logical AND. The `requestPending`, `verificationFailed` and `expired` flags are shortcuts for common status filters. `requestPending` and `verificationFailed` overwrite the `status` filter, so do not use them together with `status`. The `expired` flag does not work today; see its description. The server does not return a record that a delete operation removed. `search` matches a part of the holder name and of `presentationExchangeId`. It does not look at any other property. `sortOrder` takes `asc` or `desc`; the server uses `desc` for every other value. The `requestPending`, `verificationFailed` and `expired` flags act only on the exact lowercase value `true`. operationId: configListDigitalWalletOpenIdVerificationHistoryV3 parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: | Filter the verification exchange records by their OpenID4VP lifecycle status. Give more than one value to match any of them. Repeat the parameter, or give the values in one comma-separated list. The server keeps a value it does not know, and that value then matches no record. in: query name: status required: false explode: true schema: type: array items: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked example: - presentation_acked - description: Filter by presentation definition identifier to retrieve OpenID4VP verification records for a specific verification template. in: query name: presentationDefinitionId required: false schema: type: string - description: Filter by individual identifier to retrieve records associated with a specific individual. in: query name: individualId required: false schema: type: string - description: Filter by mapper identifier to retrieve records linked to a specific individual mapping. in: query name: mapperId required: false schema: type: string - description: Filter by the holder's Decentralized Identifier (DID). in: query name: holderDid schema: type: string - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - name: responseCode in: query required: false description: Filter by the state value of the Authorization Request. The server compares this value with `vpTokenRequestState`. Use it to find the record that belongs to one wallet response. schema: type: string - name: requestPending in: query required: false description: 'Set to `true` to return only the records that wait for the holder, that is the records with status `request_sent` or `request_received`. This flag overwrites the `status` filter.' schema: type: boolean - name: verificationFailed in: query required: false description: Set to `true` to return only the records with status `presentation_acked` and `verified` equal to `false`. This flag overwrites the `status` filter. schema: type: boolean - name: expired in: query required: false description: | Set to `true` to return only the records whose Authorization Request expired, that is the records with a `requestExpiryTime` in the past. **Do not use this parameter yet.** A defect in the server makes the filter compare against a property name that no record holds, so `expired=true` always gives an empty page. To find the expired records, read the page without this filter and compare `requestExpiryTime` with the current time, or read `requestExpired` on each record. schema: type: boolean - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: type: object properties: verificationHistory: description: Verification exchange records for the current page. The array is empty when no record agrees with the filters. items: type: object description: | Verification exchange record. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) verification, from the Authorization Request to the verification result. The server returns every property of this schema on every operation, except `dcApiRequest` and `dcApiProtocol`. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: presentationExchangeId: type: string description: 'Unique identifier of the verification exchange. Give this value as the `presentationExchangeId` path parameter to read, delete or revalidate the record, and to receive a DC API response for it.' example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e id: type: string description: Internal record identifier that the server makes when it stores the record. No operation accepts this value. Use `presentationExchangeId` to address the record. example: 6821b4b0f5b1c2a3d4e5f6a7 vpTokenQrCode: type: string description: OpenID4VP Authorization Request URI encoded for QR code display or deep link. The holder's wallet scans or clicks this to initiate the presentation flow. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). vpTokenRequestState: type: string description: 'State parameter for the OpenID4VP Authorization Request, used to correlate the request with the response.' vpTokenRequest: type: string description: Full OpenID4VP Authorization Request URI or payload. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). presentationSubmission: type: object description: | Wrapper that holds the Presentation Submission object of the wallet. DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns `null` here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. Read `presentation` to get the credentials of the holder. properties: presentation_submission: type: object description: DIF Presentation Exchange Submission object that maps the credentials of the holder to the requirements of the verifier. Kept for old records only. properties: definition_id: type: string description: Identifier of the Presentation Definition that this submission fulfills. descriptor_map: description: Array of Descriptor Map entries mapping each requested credential to its location in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this entry satisfies. path: type: string description: JSONPath expression pointing to the Verifiable Credential within the Verifiable Presentation token. path_nested: type: object description: Nested path descriptor for credentials wrapped in envelope formats (e.g. JWT inside a VP JWT). properties: format: type: string description: 'Credential format of the nested credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this nested entry satisfies. path: type: string description: JSONPath expression pointing to the credential within the nested envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier for this Presentation Submission. required: - definition_id - descriptor_map - id status: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked description: | Lifecycle status of the verification exchange: 1. `request_sent`: The server made the OpenID4VP Authorization Request. The exchange waits for the holder. 2. `request_received`: The wallet of the holder got, or scanned, the Authorization Request. 3. `presentation_pending`: The wallet started the response but the verifier did not get a complete Authorization Response yet. 4. `presentation_acked`: The holder sent the Verifiable Presentation and the verifier processed it. example: request_sent verified: type: boolean description: 'Result of the verification of the Verifiable Presentation. The server checks the cryptographic signatures, the credential status and the presented claims against the DCQL query of the presentation definition.' createdAt: type: number description: Unix timestamp (in seconds) when this verification record was created. updatedAt: type: number description: Unix timestamp (in seconds) when this verification record was last modified. presentationDefinitionId: type: string description: Identifier of the presentation definition used for this verification request. openIdOrganisationId: type: string description: Identifier of the OpenID4VP organisation that initiated this verification request. holder: description: 'Contains the metadata describing a holder. For e.g. Name, location, logo e.t.c' type: object properties: name: type: string description: Identifier of the holder. For .e.g. DID or Name obtained from client metadata if available. required: - name presentation: type: array items: type: object additionalProperties: true description: Decoded credentials that the holder presented. The shape of each entry follows the credential format. `null` until the holder answers. vpTokenResponse: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent. The array holds one entry for each credential that the Authorization Request asked for. `null` until the wallet answers. transactionData: type: object additionalProperties: true description: Transaction data confirmed by the holder during the presentation flow. transactionDataBase64: type: string description: Base64url encoding of the transaction data that the Authorization Request holds. credentialExchangeId: type: string description: 'Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification. Always empty on the response of the send operation. The server fills it in later, when the issuance flow starts.' responseType: type: string description: OAuth 2.0 response type of the Authorization Request. enum: - vp_token - id_token - device_response idToken: type: string description: OpenID Connect ID Token from the holder. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token of the holder. dataAgreementId: type: string description: Identifier of the data agreement record that this verification exchange created. userId: type: string description: Identifier of the dashboard user or individual that started this verification request. requestExpired: type: boolean description: '`true` when the `exp` claim of `vpTokenRequest` is in the past. The wallet cannot use an expired Authorization Request. The read and list operations compute this value when they answer. The send and revalidate operations always return `false`.' requestExpiryTime: type: number description: Unix timestamp in seconds when the Authorization Request expires. The server reads this value from the `exp` claim of `vpTokenRequest`. `0` when the request has no expiry. example: 1747015200 presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation, with the signature check, the expiry check and the revocation status. The revalidate operation writes a new value here. `null` until the holder answers.' clientIdScheme: type: string description: Client ID scheme used by the verifier in the OpenID4VP Authorization Request. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: URI the wallet redirects to after posting the Authorization Response. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). responseMode: type: string description: | OpenID4VP response mode determining how the Authorization Response is delivered: - `direct_post`: Response sent via HTTP POST to the verifier's `redirect_uri` without encryption. - `direct_post.jwt`: Response sent via HTTP POST encrypted as a JWE. - `dc_api`: Response delivered over the W3C Digital Credentials API transport without JWE encryption. Compatible with both `signed` and `unsigned` `dcApiRequestType` values. - `dc_api.jwt`: Response delivered over the W3C Digital Credentials API transport encrypted as a JWE. - `iar-post`: Response sent through the Interactive Authorisation Request transport without encryption. - `iar-post.jwt`: Response sent through the Interactive Authorisation Request transport encrypted as a JWE. enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt - iar-post - iar-post.jwt verifierAttestation: type: string description: 'Verifier Attestation JWT sent to the holder, proving the verifier''s authorization.' individualId: type: string description: Identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `individualId`. mapperId: type: string description: External identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `mapperId`. dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. nonce: type: string description: Cryptographic nonce used in the OpenID4VP Authorization Request to ensure freshness and prevent replay attacks. dcApiProtocol: type: string description: | Digital Credentials API exchange protocol identifier returned when the presentation definition is configured for DC API response modes. Identifies the protocol variant used with the W3C Digital Credentials API (`navigator.credentials.get()`): - `openid4vp-v1-unsigned`: The Authorization Request is passed unencrypted to the browser's DC API. The browser can inspect the request for risk analysis. Use for development/testing only. - `openid4vp-v1-signed`: The Authorization Request is signed by the verifier's key and passed as an opaque string to the browser's DC API. Provides verifier authentication. Recommended for production. - `org-iso-mdoc`: The Authorization Request follows ISO 18013-7 Annex C. The wallet answers with an encrypted CBOR `EncryptedResponse`. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. enum: - openid4vp-v1-unsigned - openid4vp-v1-signed - org-iso-mdoc dcApiRequest: type: object description: | Request object for the W3C Digital Credentials API, structured for browser invocation via `navigator.credentials.get()`. Contains browser-specific request formats for Chrome and Safari. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. properties: chrome: type: object description: Digital Credentials API request format for Chromium-based browsers. Uses the `providers` structure per the W3C Digital Credentials API specification. properties: digital: type: object description: Digital credential request options for Chromium-based browsers. properties: providers: type: array description: 'Array of credential request providers, each specifying a protocol and request data.' items: type: object properties: protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' request: type: object description: | The OpenID4VP Authorization Request payload. Structure varies by protocol: - For `openid4vp-v1-signed`: Contains `{ "request": "" }`, a JWT signed by the verifier's key. - For `openid4vp-v1-unsigned`: Contains the full Authorization Request object with `client_metadata`, `dcql_query`, `nonce`, `response_mode`, `response_type`. additionalProperties: true safari: type: object description: Digital Credentials API request format for Safari-based browsers. Uses the `requests` structure. properties: digital: type: object description: Digital credential request options for Safari-based browsers. properties: requests: type: array description: 'Array of credential requests for Safari, each containing data and protocol.' items: type: object properties: data: type: string description: | JSON-stringified Authorization Request payload (Safari's DC API expects a string, not an object). Decoding it yields the same structure that Chrome receives in `request`: - For `openid4vp-v1-signed`: `{ "request": "" }`. - For `openid4vp-v1-unsigned`: the full inline Authorization Request object (`response_type`, `response_mode`, `nonce`, `dcql_query`, `client_metadata`, …). protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' requiresEncryption: type: boolean description: Indicates whether the OpenID4VP Authorization Response must be encrypted as a JWE. `true` when `responseMode` is `direct_post.jwt` or `dc_api.jwt`. `false` when `responseMode` is `direct_post` or `dc_api`. signatureStamp: type: boolean description: 'When `false`, the signature stamp is hidden in signed PDFs.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 files: type: array description: 'List of files generated during the verification, including signed and unsigned PDF documents.' items: type: object properties: credentialId: type: string description: Identifier of the credential associated with this file. error: type: string nullable: true description: 'Error code if signing failed, null otherwise.' errorDescription: type: string nullable: true description: 'Detailed error message if signing failed, null otherwise.' signedFile: type: string format: uri description: URL of the signed PDF file. unsignedFile: type: string format: uri description: URL of the unsigned PDF file. required: - id - presentationExchangeId - openIdOrganisationId - presentationDefinitionId - vpTokenRequestState - vpTokenRequest - vpTokenQrCode - status - verified - holder - createdAt - updatedAt - credentialExchangeId - transactionDataBase64 - nonce - responseType - idToken - clientIdScheme - responseMode - verifierAttestation - directPostRedirectUri - requiresEncryption - individualId - mapperId - signatureStamp - dataAgreementId - userId - requestExpired - requestExpiryTime type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true verificationHistoryStats: type: object description: 'Counters for every verification exchange record of the organisation. The filters and the pagination do not change these values. `verificationFailed` counts a subset of `presentationReceived`, so the four counters do not add up to `total`. The server returns zero for every counter when it cannot build the counts.' properties: total: type: integer description: Number of verification exchange records. example: 128 presentationReceived: type: integer description: Number of records with status `presentation_acked`. example: 96 requestPending: type: integer description: Number of records with status `request_sent` or `request_received`. example: 24 verificationFailed: type: integer description: Number of records with status `presentation_acked` and `verified` equal to `false`. example: 5 expired: type: integer description: Number of records whose Authorization Request expired. example: 8 required: - total - presentationReceived - requestPending - verificationFailed - expired required: - verificationHistory - pagination - verificationHistoryStats description: The server listed the verification exchange records. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the digital wallet deployment is not resolved.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The server could not read the page of verification exchange records. headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List verification history tags: - Digital Wallet (OpenID4VC) - Verifier /v2/config/digital-wallet/openid/sdjwt/presentation-definition: post: description: | Creates a presentation definition. The presentation definition gives the credential types and the claims that the verifier needs for an OpenID4VP verification. Give the credential requirements as a Digital Credentials Query Language (DCQL) query in `dcqlQuery`. The verifier is OpenID4VP 1.0 and accepts DCQL queries only. The presentation definition also holds the transport settings that every verification request inherits: `responseMode`, `clientIdScheme`, `dcApiRequestType`, `expectedOrigins` and `encryptedResponseEncValuesSupported`. Both **Direct Post** (`direct_post`, `direct_post.jwt`) and **DC API** (`dc_api`, `dc_api.jwt`) response modes are available. Rules that the server applies: - `label` is mandatory and must be 3 to 100 characters long. - `label` must not be a label that an extension reserves, for example 'Age Verification', 'Document Signing' or 'Know-Your-Customer (KYC)'. - `dcqlQuery` is mandatory when `responseType` is `vp_token` or `device_response`. Do not send it when `responseType` is `id_token`. - Each entry of `dcqlQuery.credentials` needs an `id` and a `format`. The `format` controls which `meta` keys the server accepts: `mso_mdoc` takes `doctype_value` only, `dc+sd-jwt` takes `vct_values` or `type_values`, and `jwt_vc_json` takes `type_values` only. The `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc` formats take no `meta` key at all. Any other key is refused. - `claim_sets` needs a non-empty `claims` array in the same credential query. - Each entry of `dcqlQuery.credential_sets` needs a non-empty `options` array. - `directPostRedirectUri` is allowed only when `responseMode` is `direct_post`. The server refuses it for `direct_post.jwt`. - `encryptedResponseEncValuesSupported` is mandatory when `responseMode` is `direct_post.jwt`, and the verifier global configuration must permit response encryption. - `dcApiRequestType` is allowed only when `responseMode` is `dc_api` or `dc_api.jwt`. - `expectedOrigins` is mandatory when the request type is `signed`. `dc_api.jwt` defaults to `signed` and `dc_api` defaults to `unsigned`. - `transactionDataDefinitionType` is mandatory when the DCQL query asks for a Payment Wallet Attestation, a QESAC credential or an SCA attestation. The `iso18013_7_annex_c` version has more rules: `responseType` must be `device_response`, `trustAnchor` must be `x509`, `clientIdScheme` must be `null`, `transactionDataDefinitionType` must be absent, `expectedOrigins` must hold **exactly one** origin, every credential query must use `mso_mdoc` with a `meta.doctype_value`, a non-empty `claims` array and `require_cryptographic_holder_binding` set to `true`, every claim path must hold two elements, and `credential_sets` and `claim_sets` are not allowed. operationId: configDigitalWalletOpenIdPresentationDefinition requestBody: required: true description: 'Label, credential requirements and transport settings of the new presentation definition.' content: application/json: schema: anyOf: - type: object title: Default (all fields) properties: label: type: string minLength: 3 maxLength: 100 description: 'Human-readable label that gives the purpose of this presentation definition, for example ''Verify Portable Document A1''. The dashboard shows this label. The label must be 3 to 100 characters long. Labels that extensions reserve are refused, for example ''Age Verification'', ''Document Signing'' and ''Know-Your-Customer (KYC)''.' dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder. This is the only way to give the credential requirements. The query holds a `credentials` array. Each entry needs an `id` and a `format`. The `format` controls which `meta` keys the server accepts. Each entry can also hold `claims`, `claim_sets`, `require_cryptographic_holder_binding`, `multiple` and `trusted_authorities`. A top-level `credential_sets` array can group the credential queries. `dcqlQuery` is mandatory when `responseType` is `vp_token` or `device_response`. Do not send it when `responseType` is `id_token`. properties: credentials: type: array minItems: 1 description: 'Credential queries. The wallet of the holder must satisfy every entry, unless `credential_sets` says otherwise.' items: type: object additionalProperties: true properties: id: type: string description: 'Identifier of this credential query. `credential_sets` and the presentation response use this value. Use letters, digits, spaces, `_` and `-`. The server does not apply this check to the `iso18013_7_annex_c` version.' format: type: string description: Credential format that the verifier accepts for this query. enum: - dc+sd-jwt - vc+sd-jwt - vp+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc meta: type: object additionalProperties: true description: | Format-specific match rules. The server refuses any key that the `format` does not allow: - `mso_mdoc` - `doctype_value` only. - `dc+sd-jwt` - `vct_values` or `type_values`. - `jwt_vc_json` - `type_values` only. `vct_values` is refused. - `vc+sd-jwt`, `vp+sd-jwt`, `jwt_vc` - no key is allowed. Leave `meta` out. properties: vct_values: type: array description: Accepted `vct` values of the SD-JWT VC. Use this property with the `dc+sd-jwt` format only. items: type: string type_values: type: array description: 'Accepted type sets of the credential. Each entry is an array of type names, and the credential must hold every type of at least one entry. Use this property with the `dc+sd-jwt` and `jwt_vc_json` formats only.' items: type: array items: type: string doctype_value: type: string description: 'Accepted `docType` of the mDoc, for example `org.iso.18013.5.1.mDL`. Use this property with `mso_mdoc` only.' claims: type: array description: Claims that the verifier asks for. Leave this property out to ask for the whole credential. items: type: object additionalProperties: true properties: id: type: string description: Identifier of this claim query. `claim_sets` uses this value. Give an `id` to every claim when you use `claim_sets`. path: type: array description: 'Pointer to the claim inside the credential. Each element is a property name, or an array index. For `mso_mdoc` the path holds two elements: the namespace and the data element, for example `[''org.iso.18013.5.1'', ''family_name'']`. For `jwt_vc_json` the path starts with `credentialSubject`.' items: {} values: type: array description: Values that the claim must hold. Leave this property out to accept every value. items: {} claim_sets: type: array description: 'Alternative sets of claims. Each entry is an array of claim `id` values, and the wallet satisfies the first entry that it can. Send this property only together with a non-empty `claims` array.' items: type: array items: type: string require_cryptographic_holder_binding: type: boolean description: '`true` when the credential must prove that the holder owns it.' multiple: type: boolean description: '`true` when the wallet can return more than one credential for this query.' trusted_authorities: type: array description: Issuers that the verifier trusts for this query. items: type: object additionalProperties: true properties: type: type: string description: 'Type of the trust list, for example `etsi_tl` for an ETSI trusted list or `aki` for an authority key identifier.' values: type: array description: Identifiers of the trusted issuers. items: type: string required: - id - format credential_sets: type: array description: Groups of credential queries. Each entry gives the combinations of credential query identifiers that satisfy the request. items: type: object additionalProperties: true properties: options: type: array minItems: 1 description: 'Accepted combinations. Each entry is an array of credential query identifiers. This property is mandatory, and it must hold at least one combination.' items: type: array items: type: string required: type: boolean description: '`true` when the wallet must satisfy one of the `options`.' purpose: description: 'Reason why the verifier asks for this group of credentials. The server accepts a string, a number or an object here.' required: - options required: - credentials transactionDataDefinitionType: type: string description: | Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the `transactionData` of the verification request. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. This property is mandatory when the DCQL query asks for a Payment Wallet Attestation, a QESAC credential or an SCA attestation. enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data version: type: string default: version_01 description: 'OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. `iso18013_7_annex_c` is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.' enum: - version_01 - iso18013_7_annex_c kid: type: string description: Key Identifier (kid) of the cryptographic key of the verifier. The server uses the key of the organisation when you send no `kid`. The key must be valid when `dcApiRequestType` is `signed`. trustAnchor: type: string default: 'did:key' description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. `iso18013_7_annex_c` needs `x509`. enum: - 'did:key' - x509 scope: type: string description: OAuth 2.0 scope value for a scope-based presentation request. responseType: type: string default: vp_token description: OAuth 2.0 response type of the Authorization Request. `vp_token` asks for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token and accepts no `dcqlQuery`. `device_response` asks for an ISO 18013-5 DeviceResponse and is only for `iso18013_7_annex_c`. enum: - vp_token - id_token - device_response clientIdScheme: type: string default: redirect_uri description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. `redirect_uri` uses a redirect URI, `did` uses a DID, `verifier_attestation` uses a Verifier Attestation JWT, `x509_san_dns` uses the SAN DNS name of an X.509 certificate, and `x509_hash` uses the hash of an X.509 certificate. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target. Send `null` for `iso18013_7_annex_c`.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes.' responseMode: type: string default: direct_post description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: Signing type of the DC API request. Only allowed when `responseMode` is `dc_api` or `dc_api.jwt`. `signed` makes the verifier sign the Authorization Request. `unsigned` gives no verifier authentication. The server treats a missing value as `unsigned` for `dc_api` and as `signed` for `dc_api.jwt`. Use `signed` in production. enum: - signed - unsigned expectedOrigins: type: array description: 'Origins that the wallet accepts for a signed DC API request. The wallet compares these values with the actual origin to find a replay. Mandatory when the effective `dcApiRequestType` is `signed`, and mandatory for `iso18013_7_annex_c`. The wallet ignores this property for an unsigned request.' items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. This property is mandatory when `responseMode` is `direct_post.jwt`, and the verifier global configuration must permit response encryption. When the stored value is empty, the verification request falls back to all three algorithms: `A128CBC-HS256`, `A128GCM` and `A256GCM`. The `dc_api.jwt` response mode ignores this property. That flow always advertises `A128GCM` and `A256GCM`, and encrypts with `A256GCM`. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM required: - label - type: object title: IETF SD-JWT VC description: Presentation definition that asks for an IETF SD-JWT VC credential with a DCQL query. properties: label: type: string minLength: 3 maxLength: 100 description: 'Human-readable label that gives the purpose of this presentation definition. The dashboard shows this label. The label must be 3 to 100 characters long. Labels that extensions reserve are refused, for example ''Age Verification'', ''Document Signing'' and ''Know-Your-Customer (KYC)''.' trustAnchor: type: string default: 'did:key' description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 version: type: string default: version_01 description: OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. enum: - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key of the verifier. The server uses the key of the organisation when you send no `kid`. The key must be valid when `dcApiRequestType` is `signed`. responseType: type: string default: vp_token description: OAuth 2.0 response type of the Authorization Request. Use `vp_token` to ask for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token and accepts no `dcqlQuery`. enum: - vp_token - id_token clientIdScheme: type: string default: redirect_uri description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash responseMode: type: string default: direct_post description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes.' transactionDataDefinitionType: type: string description: Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data dcApiRequestType: type: string description: Signing type of the DC API request. Only allowed when `responseMode` is `dc_api` or `dc_api.jwt`. `signed` makes the verifier sign the Authorization Request. `unsigned` gives no verifier authentication. The server treats a missing value as `unsigned` for `dc_api` and as `signed` for `dc_api.jwt`. Use `signed` in production. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The wallet compares these values with the actual origin to find a replay. Mandatory when the effective `dcApiRequestType` is `signed`. The wallet ignores this property for an unsigned request. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. This property is mandatory when `responseMode` is `direct_post.jwt`, and the verifier global configuration must permit response encryption. When the stored value is empty, the verification request falls back to all three algorithms: `A128CBC-HS256`, `A128GCM` and `A256GCM`. The `dc_api.jwt` response mode ignores this property. That flow always advertises `A128GCM` and `A256GCM`, and encrypts with `A256GCM`. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query for the IETF SD-JWT VC format. It holds a `credentials` array, and every entry needs an `id` and a `format`. Set `format` to `dc+sd-jwt` and give the accepted credential types in `meta.vct_values`. Claim paths are flat, for example `['identifier']`. Ask only for subject claims, for example `given_name` or `birthdate`. The envelope claims `iss`, `iat`, `exp`, `cnf`, `vct` and `status` are always in the presentation. You cannot ask for them. required: - label - type: object title: ISO 18013-5 mDoc/mDL description: Presentation definition that asks for an ISO 18013-5 mDoc or mDL credential with a DCQL query. properties: label: type: string minLength: 3 maxLength: 100 description: 'Human-readable label that gives the purpose of this presentation definition. The dashboard shows this label. The label must be 3 to 100 characters long. Labels that extensions reserve are refused, for example ''Age Verification'', ''Document Signing'' and ''Know-Your-Customer (KYC)''.' trustAnchor: type: string default: 'did:key' description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 version: type: string default: version_01 description: OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. enum: - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key of the verifier. The server uses the key of the organisation when you send no `kid`. The key must be valid when `dcApiRequestType` is `signed`. responseType: type: string default: vp_token description: OAuth 2.0 response type of the Authorization Request. Use `vp_token` to ask for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token and accepts no `dcqlQuery`. enum: - vp_token - id_token clientIdScheme: type: string default: redirect_uri description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash responseMode: type: string default: direct_post description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes.' transactionDataDefinitionType: type: string description: Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data dcApiRequestType: type: string description: Signing type of the DC API request. Only allowed when `responseMode` is `dc_api` or `dc_api.jwt`. `signed` makes the verifier sign the Authorization Request. `unsigned` gives no verifier authentication. The server treats a missing value as `unsigned` for `dc_api` and as `signed` for `dc_api.jwt`. Use `signed` in production. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The wallet compares these values with the actual origin to find a replay. Mandatory when the effective `dcApiRequestType` is `signed`. The wallet ignores this property for an unsigned request. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. This property is mandatory when `responseMode` is `direct_post.jwt`, and the verifier global configuration must permit response encryption. When the stored value is empty, the verification request falls back to all three algorithms: `A128CBC-HS256`, `A128GCM` and `A256GCM`. The `dc_api.jwt` response mode ignores this property. That flow always advertises `A128GCM` and `A256GCM`, and encrypts with `A256GCM`. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query for the ISO 18013-5 mDoc/mDL format. It holds a `credentials` array, and every entry needs an `id` and a `format`. Set `format` to `mso_mdoc` and give the document type in `meta.doctype_value`. Every claim path holds two elements: the namespace and the data element, for example `['org.iso.18013.5.1', 'family_name']`. Ask only for subject data elements, for example `given_name` or `birth_date`. The MSO fields `validityInfo`, `digestAlgorithm` and `deviceKey` are always in the presentation. You cannot ask for them. required: - label - type: object title: W3C VC (JWT) description: Presentation definition that asks for a W3C VC in JWT format with a DCQL query. properties: label: type: string minLength: 3 maxLength: 100 description: 'Human-readable label that gives the purpose of this presentation definition. The dashboard shows this label. The label must be 3 to 100 characters long. Labels that extensions reserve are refused, for example ''Age Verification'', ''Document Signing'' and ''Know-Your-Customer (KYC)''.' trustAnchor: type: string default: 'did:key' description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 version: type: string default: version_01 description: OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. enum: - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key of the verifier. The server uses the key of the organisation when you send no `kid`. The key must be valid when `dcApiRequestType` is `signed`. responseType: type: string default: vp_token description: OAuth 2.0 response type of the Authorization Request. Use `vp_token` to ask for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token and accepts no `dcqlQuery`. enum: - vp_token - id_token clientIdScheme: type: string default: redirect_uri description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash responseMode: type: string default: direct_post description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes.' transactionDataDefinitionType: type: string description: Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data dcApiRequestType: type: string description: Signing type of the DC API request. Only allowed when `responseMode` is `dc_api` or `dc_api.jwt`. `signed` makes the verifier sign the Authorization Request. `unsigned` gives no verifier authentication. The server treats a missing value as `unsigned` for `dc_api` and as `signed` for `dc_api.jwt`. Use `signed` in production. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The wallet compares these values with the actual origin to find a replay. Mandatory when the effective `dcApiRequestType` is `signed`. The wallet ignores this property for an unsigned request. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. This property is mandatory when `responseMode` is `direct_post.jwt`, and the verifier global configuration must permit response encryption. When the stored value is empty, the verification request falls back to all three algorithms: `A128CBC-HS256`, `A128GCM` and `A256GCM`. The `dc_api.jwt` response mode ignores this property. That flow always advertises `A128GCM` and `A256GCM`, and encrypts with `A256GCM`. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query for the W3C VC (JWT) format. It holds a `credentials` array, and every entry needs an `id` and a `format`. Set `format` to `jwt_vc_json` and give the accepted type sets in `meta.type_values`, which is an array of arrays. Every claim path starts with `credentialSubject`, for example `['credentialSubject', 'identifier']`. Ask only for claims under `credentialSubject`. The envelope fields `issuer`, `issuanceDate`, `expirationDate` and `credentialStatus` are always in the presentation. You cannot ask for them. required: - label examples: EBWOID - IETF SD-JWT VC: value: label: European Business Wallet Owner ID (EBWOID) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: direct_post dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false EBWOID - ISO 18013-5 mDoc/mDL: value: label: European Business Wallet Owner ID (EBWOID) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: direct_post dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: mso_mdoc meta: doctype_value: org.iso.18013.5.1.lpid claims: - path: - org.iso.18013.5.1 - identifier - path: - org.iso.18013.5.1 - legalName require_cryptographic_holder_binding: true multiple: false EBWOID - W3C VC (JWT): value: label: European Business Wallet Owner ID (EBWOID) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: direct_post dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: jwt_vc_json meta: type_values: - - LegalPersonIdentificationData claims: - path: - credentialSubject - identifier - path: - credentialSubject - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - IETF SD-JWT VC (DC API, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - IETF SD-JWT VC (DC API, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: unsigned dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - IETF SD-JWT VC (DC API JWT, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - IETF SD-JWT VC (DC API JWT, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: unsigned encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - ISO 18013-5 mDoc/mDL (DC API, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: mso_mdoc meta: doctype_value: org.iso.18013.5.1.lpid claims: - path: - org.iso.18013.5.1 - identifier - path: - org.iso.18013.5.1 - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - ISO 18013-5 mDoc/mDL (DC API, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: unsigned dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: mso_mdoc meta: doctype_value: org.iso.18013.5.1.lpid claims: - path: - org.iso.18013.5.1 - identifier - path: - org.iso.18013.5.1 - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - ISO 18013-5 mDoc/mDL (DC API JWT, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: mso_mdoc meta: doctype_value: org.iso.18013.5.1.lpid claims: - path: - org.iso.18013.5.1 - identifier - path: - org.iso.18013.5.1 - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - ISO 18013-5 mDoc/mDL (DC API JWT, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: unsigned encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: mso_mdoc meta: doctype_value: org.iso.18013.5.1.lpid claims: - path: - org.iso.18013.5.1 - identifier - path: - org.iso.18013.5.1 - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - W3C VC (JWT) (DC API, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: jwt_vc_json meta: type_values: - - LegalPersonIdentificationData claims: - path: - credentialSubject - identifier - path: - credentialSubject - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - W3C VC (JWT) (DC API, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api dcApiRequestType: unsigned dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: jwt_vc_json meta: type_values: - - LegalPersonIdentificationData claims: - path: - credentialSubject - identifier - path: - credentialSubject - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - W3C VC (JWT) (DC API JWT, Signed)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Signed) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: jwt_vc_json meta: type_values: - - LegalPersonIdentificationData claims: - path: - credentialSubject - identifier - path: - credentialSubject - legalName require_cryptographic_holder_binding: true multiple: false 'EBWOID - W3C VC (JWT) (DC API JWT, Unsigned)': value: label: European Business Wallet Owner ID (EBWOID) (DC API JWT Unsigned) kid: '' trustAnchor: 'did:key' version: version_01 scope: '' responseType: vp_token clientIdScheme: redirect_uri responseMode: dc_api.jwt dcApiRequestType: unsigned encryptedResponseEncValuesSupported: - A128CBC-HS256 - A128GCM - A256GCM dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: jwt_vc_json meta: type_values: - - LegalPersonIdentificationData claims: - path: - credentialSubject - identifier - path: - credentialSubject - legalName require_cryptographic_holder_binding: true multiple: false parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server created the presentation definition. content: application/json: schema: type: object properties: presentationDefinition: type: object properties: id: type: string description: 'Internal record identifier of the presentation definition. The list endpoint returns the value of `presentationDefinitionId` here. The create, read and update endpoints return a different internal identifier. Always use `presentationDefinitionId` to address the presentation definition.' openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that owns this presentation definition. presentationDefinitionId: type: string description: 'Unique identifier that the server gives to the presentation definition. Use this identifier in a verification request and in the path of the read, update and delete endpoints.' label: type: string description: 'Human-readable label that gives the purpose of this presentation definition, for example ''Verify Portable Document A1''. The dashboard shows this label.' dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder. The query holds a `credentials` array. Each entry has an `id`, a `format` and a format-specific `meta` object: `doctype_value` for `mso_mdoc`, `vct_values` or `type_values` for `dc+sd-jwt`, and `type_values` for `jwt_vc_json`. An entry can also hold `claims`, `claim_sets`, `require_cryptographic_holder_binding`, `multiple` and `trusted_authorities`. A top-level `credential_sets` array can group the credential queries. The server leaves this property out when the presentation definition has no DCQL query. transactionDataDefinitionType: type: string description: | Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the `transactionData` of the verification request. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. The value is an empty string when the presentation definition binds no transaction data. enum: - '' - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this presentation definition.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this presentation definition.' version: type: string description: 'OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. `iso18013_7_annex_c` is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.' enum: - version_01 - iso18013_7_annex_c kid: type: string description: Key Identifier (kid) of the cryptographic key that the verifier uses to sign the Authorization Request and to receive an encrypted response. The value is an empty string when the presentation definition holds no key identifier. trustAnchor: type: string description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 scope: type: string description: OAuth 2.0 scope value for a scope-based presentation request. The value is an empty string when the presentation definition holds no scope. responseType: type: string description: OAuth 2.0 response type of the Authorization Request. `vp_token` asks for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token. `device_response` asks for an ISO 18013-5 DeviceResponse and is only for `iso18013_7_annex_c`. enum: - vp_token - id_token - device_response clientIdScheme: type: string description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. `redirect_uri` uses a redirect URI, `did` uses a DID, `verifier_attestation` uses a Verifier Attestation JWT, `x509_san_dns` uses the SAN DNS name of an X.509 certificate, and `x509_hash` uses the hash of an X.509 certificate. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target. The server leaves this property out for `iso18013_7_annex_c`.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes. The server leaves this property out when the presentation definition holds no URI.' responseMode: type: string description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: Signing type of the DC API request. Only for the `dc_api` and `dc_api.jwt` response modes. `signed` means that the verifier signs the Authorization Request. `unsigned` means that the verifier sends the request unsigned. The server leaves this property out when the presentation definition holds no value. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The server leaves this property out when the presentation definition holds no origin. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. It applies to the `direct_post.jwt` response mode; the `dc_api.jwt` flow ignores it and always advertises `A128GCM` and `A256GCM`. The server leaves this property out when the presentation definition holds no algorithm. The verification request then falls back to all three algorithms. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM systemManaged: type: boolean description: '`true` when the platform owns this presentation definition. You cannot delete a system managed presentation definition.' extentionEnabled: type: boolean description: '`true` when an extension uses this presentation definition. You cannot update such a presentation definition, and you cannot delete most of them. Note the spelling of this property name.' presentationDefinition: type: object additionalProperties: true description: Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is `null` for every presentation definition that uses `dcqlQuery`. You cannot set this property. required: - id - presentationDefinitionId - label - transactionDataDefinitionType - kid - scope - responseType - createdAt - updatedAt - openIdOrganisationId - systemManaged - extentionEnabled required: - presentationDefinition headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The body is not valid JSON, `label` is missing or shorter than 3 characters, `label` is a label that an extension reserves, `dcApiRequestType` does not agree with `responseMode`, `expectedOrigins` is missing for a signed DC API request, `directPostRedirectUri` is set for `direct_post.jwt`, `encryptedResponseEncValuesSupported` is missing for `direct_post.jwt` or the verifier global configuration does not permit response encryption, the DCQL query is not valid, `transactionDataDefinitionType` is missing for a transaction data credential, the organisation is unknown, the digital wallet deployment is not resolved, or the digital wallet refused the presentation definition.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create presentation definition tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/sdjwt/presentation-definition/{presentationDefinitionId}': get: description: | Reads one presentation definition by its `presentationDefinitionId`. The `id` of the answer is the internal record identifier, and it is not the same value as `presentationDefinitionId`. The list endpoint returns `presentationDefinitionId` in `id`. operationId: configReadDigitalWalletOpenIdPresentationDefinition parameters: - description: Unique identifier of the presentation definition that specifies the credential and claims requirements for OpenID4VP verification. in: path name: presentationDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server found the presentation definition. content: application/json: schema: type: object properties: presentationDefinition: type: object properties: id: type: string description: 'Internal record identifier of the presentation definition. The list endpoint returns the value of `presentationDefinitionId` here. The create, read and update endpoints return a different internal identifier. Always use `presentationDefinitionId` to address the presentation definition.' openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that owns this presentation definition. presentationDefinitionId: type: string description: 'Unique identifier that the server gives to the presentation definition. Use this identifier in a verification request and in the path of the read, update and delete endpoints.' label: type: string description: 'Human-readable label that gives the purpose of this presentation definition, for example ''Verify Portable Document A1''. The dashboard shows this label.' dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder. The query holds a `credentials` array. Each entry has an `id`, a `format` and a format-specific `meta` object: `doctype_value` for `mso_mdoc`, `vct_values` or `type_values` for `dc+sd-jwt`, and `type_values` for `jwt_vc_json`. An entry can also hold `claims`, `claim_sets`, `require_cryptographic_holder_binding`, `multiple` and `trusted_authorities`. A top-level `credential_sets` array can group the credential queries. The server leaves this property out when the presentation definition has no DCQL query. transactionDataDefinitionType: type: string description: | Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the `transactionData` of the verification request. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. The value is an empty string when the presentation definition binds no transaction data. enum: - '' - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this presentation definition.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this presentation definition.' version: type: string description: 'OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. `iso18013_7_annex_c` is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.' enum: - version_01 - iso18013_7_annex_c kid: type: string description: Key Identifier (kid) of the cryptographic key that the verifier uses to sign the Authorization Request and to receive an encrypted response. The value is an empty string when the presentation definition holds no key identifier. trustAnchor: type: string description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 scope: type: string description: OAuth 2.0 scope value for a scope-based presentation request. The value is an empty string when the presentation definition holds no scope. responseType: type: string description: OAuth 2.0 response type of the Authorization Request. `vp_token` asks for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token. `device_response` asks for an ISO 18013-5 DeviceResponse and is only for `iso18013_7_annex_c`. enum: - vp_token - id_token - device_response clientIdScheme: type: string description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. `redirect_uri` uses a redirect URI, `did` uses a DID, `verifier_attestation` uses a Verifier Attestation JWT, `x509_san_dns` uses the SAN DNS name of an X.509 certificate, and `x509_hash` uses the hash of an X.509 certificate. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target. The server leaves this property out for `iso18013_7_annex_c`.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes. The server leaves this property out when the presentation definition holds no URI.' responseMode: type: string description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: Signing type of the DC API request. Only for the `dc_api` and `dc_api.jwt` response modes. `signed` means that the verifier signs the Authorization Request. `unsigned` means that the verifier sends the request unsigned. The server leaves this property out when the presentation definition holds no value. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The server leaves this property out when the presentation definition holds no origin. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. It applies to the `direct_post.jwt` response mode; the `dc_api.jwt` flow ignores it and always advertises `A128GCM` and `A256GCM`. The server leaves this property out when the presentation definition holds no algorithm. The verification request then falls back to all three algorithms. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM systemManaged: type: boolean description: '`true` when the platform owns this presentation definition. You cannot delete a system managed presentation definition.' extentionEnabled: type: boolean description: '`true` when an extension uses this presentation definition. You cannot update such a presentation definition, and you cannot delete most of them. Note the spelling of this property name.' presentationDefinition: type: object additionalProperties: true description: Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is `null` for every presentation definition that uses `dcqlQuery`. You cannot set this property. required: - id - presentationDefinitionId - label - transactionDataDefinitionType - kid - scope - responseType - createdAt - updatedAt - openIdOrganisationId - systemManaged - extentionEnabled required: - presentationDefinition headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, or no presentation definition has the supplied `presentationDefinitionId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read presentation definition tags: - Digital Wallet (OpenID4VC) - Verifier put: description: | Updates a presentation definition. The update endpoint reads fewer properties than the create endpoint. It reads `label`, `dcqlQuery`, `transactionDataDefinitionType`, `clientIdScheme`, `directPostRedirectUri`, `responseMode`, `dcApiRequestType` and `expectedOrigins`. It ignores `version`, `trustAnchor`, `kid`, `scope`, `responseType` and `encryptedResponseEncValuesSupported`. To change one of the ignored properties, delete the presentation definition and create it again. The server keeps the current `label` when you send no `label`, a label of one character, or a label of only spaces. Unlike create, update does not apply a 3-character minimum, so a 2-character label is accepted and stored. Rules that the server applies: - `label` must not be a label that an extension reserves, for example 'Age Verification', 'Document Signing' or 'Know-Your-Customer (KYC)'. - You cannot update a presentation definition that an extension uses. - `dcqlQuery` replaces the stored DCQL query. Send the full query, because the server does not merge it with the stored one. - `directPostRedirectUri` is allowed only when the effective `responseMode` is `direct_post`. The server refuses it for `direct_post.jwt`. - `dcApiRequestType` is allowed only when `responseMode` is `dc_api` or `dc_api.jwt`. If the body has no `responseMode`, the server uses the `responseMode` of the stored record. - `expectedOrigins` is mandatory when the effective request type is `signed`. The server accepts the stored `expectedOrigins` when the body has none. This endpoint cannot set `clientIdScheme` to `null`. Send no `clientIdScheme` to make the server use `redirect_uri`. operationId: configUpdateDigitalWalletOpenIdPresentationDefinition parameters: - description: Unique identifier of the presentation definition that specifies the credential and claims requirements for OpenID4VP verification. in: path name: presentationDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: Properties of the presentation definition to change. The server ignores every other property. content: application/json: schema: type: object title: Update presentation definition additionalProperties: true properties: label: type: string minLength: 1 maxLength: 100 description: 'New human-readable label of the presentation definition. Update does not apply the 3-character minimum of the create endpoint, so a 2-character label is accepted and stored. The server keeps the stored label when you send a label of one character, or a label of only spaces. Labels that extensions reserve are refused.' dcqlQuery: type: object additionalProperties: true description: | New Digital Credentials Query Language (DCQL) query. It holds a `credentials` array, and every entry needs an `id` and a `format`. The `format` controls which `meta` keys the server accepts: `mso_mdoc` takes `doctype_value` only, `dc+sd-jwt` takes `vct_values` or `type_values`, and `jwt_vc_json` takes `type_values` only. The `vc+sd-jwt`, `vp+sd-jwt` and `jwt_vc` formats take no `meta` key at all. Each entry of `credential_sets` needs a non-empty `options` array. This query replaces the stored query. The server keeps the stored query when you send no `dcqlQuery`. transactionDataDefinitionType: type: string description: New type of transaction data that the verification request binds. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data clientIdScheme: type: string description: New client ID scheme of the Authorization Request. The scheme sets how the verifier identifies itself to the wallet of the holder. The server uses `redirect_uri` when you send no value. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: New URI that the wallet opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`. responseMode: type: string description: New response mode. It sets how the wallet of the holder delivers the Authorization Response. enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: New DC API request signing type. `signed` makes the verifier sign the Authorization Request. `unsigned` gives no verifier authentication. Use `signed` in production. enum: - signed - unsigned expectedOrigins: type: array items: type: string description: New list of origins that the wallet accepts for a signed DC API request. The wallet compares these values with the actual origin to find a replay. examples: Change the label and the DCQL query: value: label: European Business Wallet Owner ID (EBWOID) dcqlQuery: credentials: - id: Legal Person Identification Data - LPID format: dc+sd-jwt meta: vct_values: - LegalPersonIdentificationData claims: - path: - identifier - path: - legalName require_cryptographic_holder_binding: true multiple: false clientIdScheme: redirect_uri responseMode: direct_post Move to a signed DC API request: value: responseMode: dc_api.jwt dcApiRequestType: signed expectedOrigins: - 'https://verifier.example.com' responses: '200': description: The server updated the presentation definition. content: application/json: schema: type: object properties: presentationDefinition: type: object properties: id: type: string description: 'Internal record identifier of the presentation definition. The list endpoint returns the value of `presentationDefinitionId` here. The create, read and update endpoints return a different internal identifier. Always use `presentationDefinitionId` to address the presentation definition.' openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that owns this presentation definition. presentationDefinitionId: type: string description: 'Unique identifier that the server gives to the presentation definition. Use this identifier in a verification request and in the path of the read, update and delete endpoints.' label: type: string description: 'Human-readable label that gives the purpose of this presentation definition, for example ''Verify Portable Document A1''. The dashboard shows this label.' dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder. The query holds a `credentials` array. Each entry has an `id`, a `format` and a format-specific `meta` object: `doctype_value` for `mso_mdoc`, `vct_values` or `type_values` for `dc+sd-jwt`, and `type_values` for `jwt_vc_json`. An entry can also hold `claims`, `claim_sets`, `require_cryptographic_holder_binding`, `multiple` and `trusted_authorities`. A top-level `credential_sets` array can group the credential queries. The server leaves this property out when the presentation definition has no DCQL query. transactionDataDefinitionType: type: string description: | Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the `transactionData` of the verification request. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. The value is an empty string when the presentation definition binds no transaction data. enum: - '' - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this presentation definition.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this presentation definition.' version: type: string description: 'OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. `iso18013_7_annex_c` is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.' enum: - version_01 - iso18013_7_annex_c kid: type: string description: Key Identifier (kid) of the cryptographic key that the verifier uses to sign the Authorization Request and to receive an encrypted response. The value is an empty string when the presentation definition holds no key identifier. trustAnchor: type: string description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 scope: type: string description: OAuth 2.0 scope value for a scope-based presentation request. The value is an empty string when the presentation definition holds no scope. responseType: type: string description: OAuth 2.0 response type of the Authorization Request. `vp_token` asks for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token. `device_response` asks for an ISO 18013-5 DeviceResponse and is only for `iso18013_7_annex_c`. enum: - vp_token - id_token - device_response clientIdScheme: type: string description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. `redirect_uri` uses a redirect URI, `did` uses a DID, `verifier_attestation` uses a Verifier Attestation JWT, `x509_san_dns` uses the SAN DNS name of an X.509 certificate, and `x509_hash` uses the hash of an X.509 certificate. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target. The server leaves this property out for `iso18013_7_annex_c`.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes. The server leaves this property out when the presentation definition holds no URI.' responseMode: type: string description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: Signing type of the DC API request. Only for the `dc_api` and `dc_api.jwt` response modes. `signed` means that the verifier signs the Authorization Request. `unsigned` means that the verifier sends the request unsigned. The server leaves this property out when the presentation definition holds no value. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The server leaves this property out when the presentation definition holds no origin. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. It applies to the `direct_post.jwt` response mode; the `dc_api.jwt` flow ignores it and always advertises `A128GCM` and `A256GCM`. The server leaves this property out when the presentation definition holds no algorithm. The verification request then falls back to all three algorithms. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM systemManaged: type: boolean description: '`true` when the platform owns this presentation definition. You cannot delete a system managed presentation definition.' extentionEnabled: type: boolean description: '`true` when an extension uses this presentation definition. You cannot update such a presentation definition, and you cannot delete most of them. Note the spelling of this property name.' presentationDefinition: type: object additionalProperties: true description: Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is `null` for every presentation definition that uses `dcqlQuery`. You cannot set this property. required: - id - presentationDefinitionId - label - transactionDataDefinitionType - kid - scope - responseType - createdAt - updatedAt - openIdOrganisationId - systemManaged - extentionEnabled required: - presentationDefinition headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, no presentation definition has the supplied `presentationDefinitionId`, an extension uses the presentation definition, `label` is a label that an extension reserves, `dcApiRequestType` does not agree with `responseMode`, `expectedOrigins` is missing for a signed DC API request, `directPostRedirectUri` is set for `direct_post.jwt`, the DCQL query is not valid, or the digital wallet refused the update.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update presentation definition tags: - Digital Wallet (OpenID4VC) - Verifier delete: description: | Deletes a presentation definition. You cannot delete a presentation definition that an extension uses, and you cannot delete a system managed presentation definition. In both cases the server answers with HTTP 400. operationId: configDeleteDigitalWalletOpenIdPresentationDefinition parameters: - description: Unique identifier of the presentation definition that specifies the credential and claims requirements for OpenID4VP verification. in: path name: presentationDefinitionId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The server deleted the presentation definition. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, no presentation definition has the supplied `presentationDefinitionId`, an extension uses the presentation definition, the presentation definition is system managed, or the digital wallet refused the delete.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete presentation definition tags: - Digital Wallet (OpenID4VC) - Verifier /v2/config/digital-wallet/openid/sdjwt/presentation-definitions: get: description: | Lists the presentation definitions of the organisation. The server sorts them by `updatedAt` and uses `sortOrder` for the direction. Each item holds the presentation definition and the verification counters for that presentation definition. In this list the `id` of each item equals its `presentationDefinitionId`. The response also holds `verificationHistoryStats`. These counters cover every verification exchange record of the organisation, not only the current page. Set `skipCounts` to `true` to skip the per item counters. The server then returns zero for every counter of every item, and the answer is faster. `search` finds a presentation definition by its `label` or by its `presentationDefinitionId`. The search is not case-sensitive. operationId: configListDigitalWalletOpenIdPresentationDefinition parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - name: transactionDataType in: query required: false description: Filter by the transaction data type of the presentation definition. The server compares this value with `transactionDataDefinitionType`. schema: type: string enum: - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data - name: skipCounts in: query required: false description: Set to `true` to skip the per item verification counters. Every counter of every item is then zero. Use this option for a faster answer. schema: type: boolean default: false - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: type: object properties: presentationDefinition: description: Presentation definitions for the current page. The array is empty when the organisation has no presentation definition. type: array items: allOf: - type: object properties: id: type: string description: 'Internal record identifier of the presentation definition. The list endpoint returns the value of `presentationDefinitionId` here. The create, read and update endpoints return a different internal identifier. Always use `presentationDefinitionId` to address the presentation definition.' openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that owns this presentation definition. presentationDefinitionId: type: string description: 'Unique identifier that the server gives to the presentation definition. Use this identifier in a verification request and in the path of the read, update and delete endpoints.' label: type: string description: 'Human-readable label that gives the purpose of this presentation definition, for example ''Verify Portable Document A1''. The dashboard shows this label.' dcqlQuery: type: object additionalProperties: true description: | Digital Credentials Query Language (DCQL) query that gives the credentials and the claims that the verifier asks from the holder. The query holds a `credentials` array. Each entry has an `id`, a `format` and a format-specific `meta` object: `doctype_value` for `mso_mdoc`, `vct_values` or `type_values` for `dc+sd-jwt`, and `type_values` for `jwt_vc_json`. An entry can also hold `claims`, `claim_sets`, `require_cryptographic_holder_binding`, `multiple` and `trusted_authorities`. A top-level `credential_sets` array can group the credential queries. The server leaves this property out when the presentation definition has no DCQL query. transactionDataDefinitionType: type: string description: | Type of transaction data that the verification request binds. The holder must approve the transaction data before the wallet sends the presentation. The value selects the JSON Schema that the server uses to validate the `transactionData` of the verification request. Read `GET /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions` for the schema of each type. The value is an empty string when the presentation definition binds no transaction data. enum: - '' - payment_data - payment - login_risk_transaction - login_risk_transaction_non_ts12 - account_access - emandate - data_agreement_record - data_disclosure_agreement_record - qes_data createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this presentation definition.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this presentation definition.' version: type: string description: 'OpenID for Verifiable Presentations (OpenID4VP) version of the Authorization Request. `version_01` is OpenID4VP 1.0. `iso18013_7_annex_c` is the ISO 18013-7 Annex C profile, which asks for mDoc credentials over the Digital Credentials API.' enum: - version_01 - iso18013_7_annex_c kid: type: string description: Key Identifier (kid) of the cryptographic key that the verifier uses to sign the Authorization Request and to receive an encrypted response. The value is an empty string when the presentation definition holds no key identifier. trustAnchor: type: string description: DID method or key type that the verifier uses as its trust anchor. It sets how the holder resolves the identity of the verifier. enum: - 'did:key' - x509 scope: type: string description: OAuth 2.0 scope value for a scope-based presentation request. The value is an empty string when the presentation definition holds no scope. responseType: type: string description: OAuth 2.0 response type of the Authorization Request. `vp_token` asks for a Verifiable Presentation. `id_token` asks for an OpenID Connect ID Token. `device_response` asks for an ISO 18013-5 DeviceResponse and is only for `iso18013_7_annex_c`. enum: - vp_token - id_token - device_response clientIdScheme: type: string description: 'Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet of the holder. `redirect_uri` uses a redirect URI, `did` uses a DID, `verifier_attestation` uses a Verifier Attestation JWT, `x509_san_dns` uses the SAN DNS name of an X.509 certificate, and `x509_hash` uses the hash of an X.509 certificate. With the DC API response modes, `redirect_uri` is only a logical identifier and not a real redirect target. The server leaves this property out for `iso18013_7_annex_c`.' enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: 'URI that the wallet of the holder opens after it posts the Authorization Response. Only for the `direct_post` response mode. The server refuses this property for `direct_post.jwt`, and it has no meaning for the DC API response modes. The server leaves this property out when the presentation definition holds no URI.' responseMode: type: string description: 'Response mode that sets how the wallet of the holder delivers the Authorization Response. **Direct Post:** `direct_post` posts the response over HTTP. `direct_post.jwt` posts the response as an encrypted JWT. **DC API:** `dc_api` uses the W3C Digital Credentials API and returns the response without JWE encryption. `dc_api.jwt` uses the Digital Credentials API and returns the response as a JWE.' enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt dcApiRequestType: type: string description: Signing type of the DC API request. Only for the `dc_api` and `dc_api.jwt` response modes. `signed` means that the verifier signs the Authorization Request. `unsigned` means that the verifier sends the request unsigned. The server leaves this property out when the presentation definition holds no value. enum: - signed - unsigned expectedOrigins: type: array description: Origins that the wallet accepts for a signed DC API request. The server leaves this property out when the presentation definition holds no origin. items: type: string encryptedResponseEncValuesSupported: type: array description: | JWE content encryption algorithms that the verifier accepts for the Authorization Response. It applies to the `direct_post.jwt` response mode; the `dc_api.jwt` flow ignores it and always advertises `A128GCM` and `A256GCM`. The server leaves this property out when the presentation definition holds no algorithm. The verification request then falls back to all three algorithms. items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM systemManaged: type: boolean description: '`true` when the platform owns this presentation definition. You cannot delete a system managed presentation definition.' extentionEnabled: type: boolean description: '`true` when an extension uses this presentation definition. You cannot update such a presentation definition, and you cannot delete most of them. Note the spelling of this property name.' presentationDefinition: type: object additionalProperties: true description: Legacy credential requirements of a presentation definition that an older OpenID4VP version created. The value is `null` for every presentation definition that uses `dcqlQuery`. You cannot set this property. required: - id - presentationDefinitionId - label - transactionDataDefinitionType - kid - scope - responseType - createdAt - updatedAt - openIdOrganisationId - systemManaged - extentionEnabled - type: object properties: totalCountOfVerificationHistory: type: integer description: Number of verification exchange records that use this presentation definition. The value is `0` when `skipCounts` is `true`. example: 42 verificationBreakdown: type: object description: 'Verification counters for this presentation definition. Every counter is `0` when `skipCounts` is `true`. A record can be in more than one counter, so the counters do not add up to `total`.' properties: total: type: integer description: Number of verification exchange records that use this presentation definition. example: 42 presentationReceived: type: integer description: Number of these records with status `presentation_acked`. example: 30 requestPending: type: integer description: Number of these records with status `request_sent` or `request_received`. example: 9 verificationFailed: type: integer description: Number of these records with status `presentation_acked` and `verified` equal to `false`. example: 3 expired: type: integer description: Number of these records whose Authorization Request expired. example: 2 required: - total - presentationReceived - requestPending - verificationFailed - expired required: - totalCountOfVerificationHistory - verificationBreakdown pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true verificationHistoryStats: type: object description: 'Counters for every verification exchange record of the organisation. The filters and the pagination do not change these values. A record can be in more than one counter, so the counters do not add up to `total`.' properties: total: type: integer description: Number of verification exchange records. example: 128 presentationReceived: type: integer description: Number of records with status `presentation_acked`. example: 96 requestPending: type: integer description: Number of records with status `request_sent` or `request_received`. example: 24 verificationFailed: type: integer description: Number of records with status `presentation_acked` and `verified` equal to `false`. example: 5 expired: type: integer description: Number of records whose Authorization Request expired. example: 8 required: - total - presentationReceived - requestPending - verificationFailed - expired required: - presentationDefinition - pagination - verificationHistoryStats description: The server listed the presentation definitions. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the digital wallet deployment is not resolved.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The server could not read the page of presentation definitions. headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List presentation definition tags: - Digital Wallet (OpenID4VC) - Verifier /v2/config/webhook: post: deprecated: false description: | This endpoint creates a webhook. The webhook sends the events that you subscribe to, to an external IT system. The payload URL must start with `http://` or `https://`, and it must be unique for the organisation. Subscribe to a minimum of 1 event type. The service sends each event as an HTTP POST to the payload URL. The body holds 5 fields: `deliveryID`, `webhookID`, `timestamp`, `type` and `data`. The `type` field holds 1 of the subscribed event types, and the `data` field holds the event object. For an OID4VC event, `data` holds `organisationId`, an optional `sandboxOrgId`, and the credential or the presentation record. The service signs each delivery with the `X-IGrant-Signature` header. The value is `t=,sig=`, where `` is the lowercase hexadecimal HMAC-SHA256 of `.` with the secret key. The service always signs the JSON payload, also when the content type is `application/x-www-form-urlencoded`. In that case, URL decode the `payload` form field before you check the signature. The service makes 1 delivery attempt for each event. There is no automatic retry. The response status code of this operation is `200`, not `201`. The response holds the secret key in clear text. operationId: configCreateWebhook requestBody: content: application/json: schema: properties: webhook: allOf: - required: - payloadUrl - contentType - subscribedEvents - secretKey type: object title: CreateOrUpdateWebhook description: 'The webhook configuration to create or to update. The service ignores `id`, `orgId`, `sandboxOrgId` and `timestamp` if you send them. It takes the organisation from the `organizationId` header.' properties: payloadUrl: type: string description: 'The HTTPS or HTTP URL that receives the webhook payload. The value must start with `http://` or `https://` and must be unique for the organisation.' example: 'https://example.com/hooks/igrant' contentType: type: string description: 'The content type of the webhook payload. For `application/x-www-form-urlencoded`, the JSON payload is sent in a single form field named `payload`.' enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook does not receive event deliveries. Optional. Defaults to `false`.' default: false secretKey: type: string description: 'Secret key used to compute the `X-IGrant-Signature` HMAC-SHA256 header for each delivery. The receiver uses it to check the authenticity of the payload. Do not use a value of spaces only: the service accepts it but then sends no signature header.' skipSslVerification: type: boolean description: 'When `true`, the server does not verify the TLS certificate of the payload URL. Optional. Defaults to `false`.' default: false description: The webhook configuration to create. required: - webhook type: object description: The webhook configuration. required: true parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: webhook: allOf: - required: - id - orgId - payloadUrl - contentType - subscribedEvents - disabled - secretKey - skipSslVerification - timestamp type: object title: Webhook description: 'A webhook configuration of the organisation. The service always sends every field of this object, except `sandboxOrgId`.' properties: id: type: string description: Unique identifier of the webhook. example: 68a1f2c3d4e5f6a7b8c9d0e1 orgId: type: string description: Unique identifier of the organisation that owns the webhook. sandboxOrgId: type: string description: Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope. payloadUrl: type: string description: URL that receives the webhook payload. example: 'https://example.com/hooks/igrant' contentType: type: string description: Content type of the webhook payload. enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook receives no event delivery.' secretKey: type: string description: 'Secret key that the service uses to calculate the `X-IGrant-Signature` header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.' skipSslVerification: type: boolean description: 'When `true`, the service does not verify the TLS certificate of the payload URL.' timestamp: type: string description: 'UTC time when the service created the webhook, in `YYYY-MM-DDThh:mm:ssZ` format. The service does not change this value on an update.' example: '2026-08-09T10:11:12Z' description: 'The webhook that the server created. The server sets the `id`, the `orgId` and the `timestamp` fields.' required: - webhook type: object description: OK headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Bad request. The server sends this error if a mandatory field is missing, if the payload URL does not start with `http://` or `https://`, if a webhook with the same payload URL exists, if you subscribe to no event type, or if an event type or a content type is not valid.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create webhook tags: - Webhook '/v2/config/webhook/{webhookId}': get: deprecated: false description: This endpoint reads 1 webhook of the organisation by its ID. operationId: configReadWebhook parameters: - description: The ID of the webhook to read. example: 68a1f2c3d4e5f6a7b8c9d0e1 in: path name: webhookId required: true schema: type: string style: simple - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: webhook: allOf: - required: - id - orgId - payloadUrl - contentType - subscribedEvents - disabled - secretKey - skipSslVerification - timestamp type: object title: Webhook description: 'A webhook configuration of the organisation. The service always sends every field of this object, except `sandboxOrgId`.' properties: id: type: string description: Unique identifier of the webhook. example: 68a1f2c3d4e5f6a7b8c9d0e1 orgId: type: string description: Unique identifier of the organisation that owns the webhook. sandboxOrgId: type: string description: Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope. payloadUrl: type: string description: URL that receives the webhook payload. example: 'https://example.com/hooks/igrant' contentType: type: string description: Content type of the webhook payload. enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook receives no event delivery.' secretKey: type: string description: 'Secret key that the service uses to calculate the `X-IGrant-Signature` header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.' skipSslVerification: type: boolean description: 'When `true`, the service does not verify the TLS certificate of the payload URL.' timestamp: type: string description: 'UTC time when the service created the webhook, in `YYYY-MM-DDThh:mm:ssZ` format. The service does not change this value on an update.' example: '2026-08-09T10:11:12Z' description: The webhook configuration. required: - webhook type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Resource not found. The organisation has no webhook with the given ID, or the webhook is deleted.' headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read webhook tags: - Webhook put: deprecated: false description: | This endpoint updates a webhook. The request body replaces the payload URL, the content type, the subscribed events, the disabled flag, the secret key and the SSL verification flag of the webhook. The payload URL must start with `http://` or `https://`, and no other webhook of the organisation can use it. Subscribe to a minimum of 1 event type. This is a full replacement, not a partial update. Send every field on every call. The service keeps the `id`, the `orgId`, the `sandboxOrgId` and the `timestamp` of the stored webhook. The `timestamp` stays the creation time. operationId: configUpdateWebhook parameters: - description: The ID of the webhook to update. example: 68a1f2c3d4e5f6a7b8c9d0e1 in: path name: webhookId required: true schema: type: string style: simple - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: content: application/json: schema: properties: webhook: allOf: - required: - payloadUrl - contentType - subscribedEvents - secretKey type: object title: CreateOrUpdateWebhook description: 'The webhook configuration to create or to update. The service ignores `id`, `orgId`, `sandboxOrgId` and `timestamp` if you send them. It takes the organisation from the `organizationId` header.' properties: payloadUrl: type: string description: 'The HTTPS or HTTP URL that receives the webhook payload. The value must start with `http://` or `https://` and must be unique for the organisation.' example: 'https://example.com/hooks/igrant' contentType: type: string description: 'The content type of the webhook payload. For `application/x-www-form-urlencoded`, the JSON payload is sent in a single form field named `payload`.' enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook does not receive event deliveries. Optional. Defaults to `false`.' default: false secretKey: type: string description: 'Secret key used to compute the `X-IGrant-Signature` HMAC-SHA256 header for each delivery. The receiver uses it to check the authenticity of the payload. Do not use a value of spaces only: the service accepts it but then sends no signature header.' skipSslVerification: type: boolean description: 'When `true`, the server does not verify the TLS certificate of the payload URL. Optional. Defaults to `false`.' default: false description: The new webhook configuration. required: - webhook type: object description: The new webhook configuration. required: true responses: '200': content: application/json: schema: properties: webhook: allOf: - required: - id - orgId - payloadUrl - contentType - subscribedEvents - disabled - secretKey - skipSslVerification - timestamp type: object title: Webhook description: 'A webhook configuration of the organisation. The service always sends every field of this object, except `sandboxOrgId`.' properties: id: type: string description: Unique identifier of the webhook. example: 68a1f2c3d4e5f6a7b8c9d0e1 orgId: type: string description: Unique identifier of the organisation that owns the webhook. sandboxOrgId: type: string description: Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope. payloadUrl: type: string description: URL that receives the webhook payload. example: 'https://example.com/hooks/igrant' contentType: type: string description: Content type of the webhook payload. enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook receives no event delivery.' secretKey: type: string description: 'Secret key that the service uses to calculate the `X-IGrant-Signature` header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.' skipSslVerification: type: boolean description: 'When `true`, the service does not verify the TLS certificate of the payload URL.' timestamp: type: string description: 'UTC time when the service created the webhook, in `YYYY-MM-DDThh:mm:ssZ` format. The service does not change this value on an update.' example: '2026-08-09T10:11:12Z' description: The webhook after the update. required: - webhook type: object description: OK headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Bad request. The server sends this error if a mandatory field is missing, if the payload URL does not start with `http://` or `https://`, if a different webhook uses the same payload URL, if you subscribe to no event type, or if an event type or a content type is not valid.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Resource not found. The organisation has no webhook with the given ID, or the webhook is deleted.' headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update webhook tags: - Webhook delete: deprecated: false description: 'This endpoint deletes a webhook. The server disables the webhook and marks it as deleted. After the delete, the webhook sends no more events, and the other webhook endpoints do not find it. The response contains the webhook in its final state.' operationId: configDeleteWebhook parameters: - description: The ID of the webhook to delete. example: 68a1f2c3d4e5f6a7b8c9d0e1 in: path name: webhookId required: true schema: type: string style: simple - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: webhook: allOf: - required: - id - orgId - payloadUrl - contentType - subscribedEvents - disabled - secretKey - skipSslVerification - timestamp type: object title: Webhook description: 'A webhook configuration of the organisation. The service always sends every field of this object, except `sandboxOrgId`.' properties: id: type: string description: Unique identifier of the webhook. example: 68a1f2c3d4e5f6a7b8c9d0e1 orgId: type: string description: Unique identifier of the organisation that owns the webhook. sandboxOrgId: type: string description: Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope. payloadUrl: type: string description: URL that receives the webhook payload. example: 'https://example.com/hooks/igrant' contentType: type: string description: Content type of the webhook payload. enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook receives no event delivery.' secretKey: type: string description: 'Secret key that the service uses to calculate the `X-IGrant-Signature` header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.' skipSslVerification: type: boolean description: 'When `true`, the service does not verify the TLS certificate of the payload URL.' timestamp: type: string description: 'UTC time when the service created the webhook, in `YYYY-MM-DDThh:mm:ssZ` format. The service does not change this value on an update.' example: '2026-08-09T10:11:12Z' description: The webhook after the delete. The `disabled` field is always `true`. required: - webhook type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Resource not found. The organisation has no webhook with the given ID, or the webhook is deleted.' headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete webhook tags: - Webhook /v2/config/webhooks: get: deprecated: false description: | This endpoint lists all the webhooks of the organisation. Each item in the list also gives the result of the last payload delivery to the webhook. The server does not list deleted webhooks. Use the `offset` and `limit` query parameters to page through the list. The newest webhook comes first. The server replaces an `offset` that is less than 0 and a `limit` that is 0 or less with the default value. Each item holds the secret key of the webhook in clear text. operationId: configListWebhooks parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: properties: pagination: allOf: - type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: The pagination data for the list. webhooks: description: The webhooks on the requested page. items: allOf: - required: - id - orgId - payloadUrl - contentType - subscribedEvents - disabled - secretKey - skipSslVerification - timestamp type: object title: Webhook description: 'A webhook configuration of the organisation. The service always sends every field of this object, except `sandboxOrgId`.' properties: id: type: string description: Unique identifier of the webhook. example: 68a1f2c3d4e5f6a7b8c9d0e1 orgId: type: string description: Unique identifier of the organisation that owns the webhook. sandboxOrgId: type: string description: Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope. payloadUrl: type: string description: URL that receives the webhook payload. example: 'https://example.com/hooks/igrant' contentType: type: string description: Content type of the webhook payload. enum: - application/json - application/x-www-form-urlencoded subscribedEvents: type: object title: subscribedEvents description: 'The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.' properties: consentManagementWebhook: type: array description: 'Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string description: Subscribed event enum: - data.update.initiated - data.update.cancelled - consent.allowed - consent.disallowed - consent.auto_expiry - data.delete.initiated - data.download.initiated - data.delete.cancelled - data.download.cancelled digitalWalletWebhook: type: array description: | Digital wallet event types. Every OID4VC event uses this group; the `openid.*` values are the only values that an OID4VCI or OpenID4VP integration needs. The `digitalwallet.*` values belong to the older DIDComm protocol. The `openid.credential.*` events follow the issuer side of an OID4VCI exchange. The `openid.holder.credential.*` events follow the holder side. The `openid.presentation.*.v3` events follow an OpenID4VP exchange: `request_sent`, `request_received` and `presentation_acked` come from the verifier side, and `presentation_pending` and `presentation_acked` come from the holder side. items: type: string description: Subscribed event enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 dataMarketplaceWebhook: type: array description: Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record. items: type: string description: Subscribed event enum: - datamarketplace.data_disclosure_agreement_record disabled: type: boolean description: 'When `true`, the webhook receives no event delivery.' secretKey: type: string description: 'Secret key that the service uses to calculate the `X-IGrant-Signature` header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.' skipSslVerification: type: boolean description: 'When `true`, the service does not verify the TLS certificate of the payload URL.' timestamp: type: string description: 'UTC time when the service created the webhook, in `YYYY-MM-DDThh:mm:ssZ` format. The service does not change this value on an update.' example: '2026-08-09T10:11:12Z' - properties: isLastDeliverySuccess: description: 'The result of the last payload delivery to the webhook. The value is `true` if the last delivery is complete and the endpoint sent a status code from 200 to 208, or 226. The value is also `true` if the server made no delivery to the webhook until now.' example: true type: boolean required: - isLastDeliverySuccess type: object description: A webhook with the result of its last payload delivery. title: WebhookWithLastDeliveryStatus type: array required: - webhooks - pagination type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List all webhooks tags: - Webhook '/v2/config/webhook/{webhookId}/ping': post: deprecated: false description: | This endpoint pings a webhook that was defined to trigger events to an external IT system. Use it to check that the payload URL answers. The service sends a POST with an empty body to the payload URL. A ping carries no `X-IGrant-Signature` header, so the receiver cannot check its authenticity. The service does not record a ping as a webhook delivery. The service answers with `200` for a reachable payload URL and for an unreachable one. Read the `status` field to tell the two apart. operationId: configPingWebhook parameters: - in: path name: webhookId required: true schema: type: string style: simple - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: type: object title: WebhookPing description: Result of a webhook ping. The service always sends all 6 fields. required: - responseStatusCode - responseStatusStr - executionStartTimestamp - executionEndTimestamp - status - statusDescription properties: responseStatusCode: type: integer format: int32 description: HTTP status code that the payload URL sent. The value is `0` when the service could not reach the payload URL. example: 200 responseStatusStr: type: string description: HTTP status text that the payload URL sent. The value is an empty string when the service could not reach the payload URL. example: 200 OK executionStartTimestamp: type: string description: UTC time when the ping started. executionEndTimestamp: type: string description: UTC time when the ping ended. status: type: string description: Result of the ping. `completed` means the payload URL answered. `failed` means the service could not reach it. enum: - completed - failed example: completed statusDescription: type: string description: Reason for a failure. The value is an empty string when `status` is `completed`. description: The service completed the ping. The `status` field tells you if the payload URL answered. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Resource not found headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Ping webhook tags: - Webhook '/v2/config/webhooks/{webhookId}/deliveries': get: deprecated: false description: This endpoint is used to read recent webhook deliveries with pagination from the consent building block that were sent to an external IT system. operationId: configListAllRecentWebhookDeliveries parameters: - in: path name: webhookId required: true schema: type: string style: simple - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 responses: '200': content: application/json: schema: properties: pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true webhookDeliveries: description: WebhookDelivery items: oneOf: - type: object title: WebhookDelivery description: One payload delivery attempt to a webhook. The service always sends all 7 fields. required: - id - webhookId - responseStatusCode - responseStatusStr - timestamp - status - statusDescription properties: id: type: string description: Unique identifier of the delivery. This is the `deliveryID` field of the delivered payload. example: 68a1f2c3d4e5f6a7b8c9d0e1 webhookId: type: string description: Unique identifier of the webhook that made the delivery. responseStatusCode: type: integer format: int32 description: HTTP status code that the payload URL sent. The value is `0` when the service could not reach the payload URL. example: 200 responseStatusStr: type: string description: HTTP status text that the payload URL sent. The value is an empty string when the service could not reach the payload URL. example: 200 OK timestamp: type: string description: UTC time when the delivery started. status: type: string description: 'Result of the delivery. `completed` means the payload URL answered, also when it answered with an error code. Read `responseStatusCode` to see the answer. `failed` means the service could not reach the payload URL.' enum: - completed - failed example: completed statusDescription: type: string description: Reason for a failure. The value is an empty string when the delivery succeeded. type: array required: - webhookDeliveries - pagination type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Resource not found headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List all webhook deliveries tags: - Webhook '/v2/config/webhooks/{webhookId}/delivery/{deliveryId}': get: deprecated: false description: | This endpoint reads 1 payload delivery of a webhook. Give the webhook ID and the delivery ID in the path. The service sends the delivery object as the whole response body. There is no wrapper field. The service does not send the request headers, the request payload, the response headers or the response body of the delivery. It keeps them, but no endpoint gives them back. operationId: configReadRecentWebhookDelivery parameters: - in: path name: webhookId required: true schema: type: string style: simple - in: path name: deliveryId required: true schema: type: string style: simple responses: '200': content: application/json: schema: type: object title: WebhookDelivery description: One payload delivery attempt to a webhook. The service always sends all 7 fields. required: - id - webhookId - responseStatusCode - responseStatusStr - timestamp - status - statusDescription properties: id: type: string description: Unique identifier of the delivery. This is the `deliveryID` field of the delivered payload. example: 68a1f2c3d4e5f6a7b8c9d0e1 webhookId: type: string description: Unique identifier of the webhook that made the delivery. responseStatusCode: type: integer format: int32 description: HTTP status code that the payload URL sent. The value is `0` when the service could not reach the payload URL. example: 200 responseStatusStr: type: string description: HTTP status text that the payload URL sent. The value is an empty string when the service could not reach the payload URL. example: 200 OK timestamp: type: string description: UTC time when the delivery started. status: type: string description: 'Result of the delivery. `completed` means the payload URL answered, also when it answered with an error code. Read `responseStatusCode` to see the answer. `failed` means the service could not reach the payload URL.' enum: - completed - failed example: completed statusDescription: type: string description: Reason for a failure. The value is an empty string when the delivery succeeded. description: The service returned the webhook delivery. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The webhook has no delivery with the given delivery ID. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no webhook with the given webhook ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read webhook delivery tags: - Webhook /v2/config/sandbox-org: post: description: |- Creates a sandbox organisation for the organisation. A sandbox organisation is a separate wallet inside your organisation. It has its own credential definitions, presentation definitions, webhooks and keys, so you can test an issuance or a verification flow without a change to the main wallet. The main wallet of the organisation must be deployed before you create a sandbox organisation. The name must be unique in the organisation. The service deploys a new wallet for the sandbox organisation and copies the logo image and the cover image of the organisation to it. To use the new sandbox organisation in a later request, send its `id` in the `X-SandboxOrgId` header, or bind an API key to it with `PUT /config/admin/apikey/{apiKeyId}/sandbox-org`. operationId: configCreateSandboxOrg requestBody: description: The sandbox organisation to create. required: true content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: description: The sandbox organisation to create. type: object title: CreateSandboxOrgForOpenId required: - name properties: name: type: string description: 'Name of the sandbox organisation. This field is mandatory. The name must be unique in the organisation. If a sandbox organisation with the same name exists, the service gives HTTP 400.' example: Acme Test Issuer description: type: string description: 'Description of the sandbox organisation. This field is optional, and the service stores an empty string when you leave it out.' example: Sandbox organisation for issuance tests example: sandboxOrg: name: Acme Test Issuer description: Sandbox organisation for issuance tests responses: '201': description: The service created the sandbox organisation. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: description: 'The sandbox organisation that the service created. The service sets the `id`, the `openIdDeploymentId`, the `status` and the timestamps.' type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain example: sandboxOrg: id: 6889e1a4c5b2f30001a3d710 name: Acme Test Issuer description: Sandbox organisation for issuance tests openIdDeploymentId: 6889e1a4c5b2f30001a3d711 status: 2 ledgerId: 0 infrastructureProvider: iGrant version: 1.0.0 role: '' trustAnchor: '' isWalletProvider: false secureVault: 0 secureVaults: null logoImageId: 6889e1a4c5b2f30001a3d6f0 coverImageId: 6889e1a4c5b2f30001a3d6f1 logoImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f0/web' coverImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f1/web' createdAt: 1754745764 updatedAt: 1754745764 isMain: false headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The main wallet of the organisation is not deployed, the `name` is missing, a sandbox organisation with the same name exists, or the service could not deploy the wallet.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create sandbox organisation tags: - Digital Wallet (OpenID4VC) - Sandboxes '/v2/config/sandbox-org/{sandboxOrgId}': get: description: |- Reads one sandbox organisation of the organisation. Give the sandbox organisation ID in the path. The response also gives the OpenID endpoints of the wallet of the sandbox organisation. Use these endpoints to point a holder wallet or an external IT system to this sandbox organisation. If the sandbox organisation has no OpenID deployment, all the endpoint fields hold an empty string. operationId: configReadSandboxOrg parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string responses: '200': description: The service returns the sandbox organisation. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: description: The sandbox organisation with the OpenID endpoints of its wallet. title: SandboxOrgWithEndpointsForOpenId allOf: - type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain - type: object required: - agentServiceEndpoint - credentialIssuerMetadata - authorizationServerMetadata - notificationEndpoint - jwksEndpoint properties: agentServiceEndpoint: type: string description: Base URL of the wallet of the sandbox organisation. example: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service' credentialIssuerMetadata: type: string description: URL of the credential issuer metadata of the sandbox organisation. A wallet reads this document to start an OID4VCI flow. example: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/.well-known/openid-credential-issuer' authorizationServerMetadata: type: string description: URL of the authorization server metadata of the sandbox organisation. A wallet reads this document to find the token endpoint and the supported grant types. example: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/.well-known/oauth-authorization-server' notificationEndpoint: type: string description: URL of the OID4VCI notification endpoint of the sandbox organisation. A wallet sends the result of a credential issuance to this endpoint. example: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/notification' jwksEndpoint: type: string description: URL of the JSON Web Key Set of the sandbox organisation. A wallet reads the public keys from this endpoint to validate the signature of a credential. example: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/jwks' example: sandboxOrg: id: 6889e1a4c5b2f30001a3d710 name: Acme Test Issuer description: Sandbox organisation for issuance tests openIdDeploymentId: 6889e1a4c5b2f30001a3d711 status: 2 ledgerId: 0 infrastructureProvider: iGrant version: 1.0.0 role: '' trustAnchor: '' isWalletProvider: false secureVault: 0 secureVaults: null logoImageId: 6889e1a4c5b2f30001a3d6f0 coverImageId: 6889e1a4c5b2f30001a3d6f1 logoImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f0/web' coverImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f1/web' createdAt: 1754745764 updatedAt: 1754745764 isMain: false agentServiceEndpoint: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service' credentialIssuerMetadata: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/.well-known/openid-credential-issuer' authorizationServerMetadata: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/.well-known/oauth-authorization-server' notificationEndpoint: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/notification' jwksEndpoint: 'https://demo-api.igrant.io/v3/organisation/6889e1a4c5b2f30001a3d711/service/jwks' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read sandbox organisation tags: - Digital Wallet (OpenID4VC) - Sandboxes put: description: |- Updates the name and the description of one sandbox organisation. Give the sandbox organisation ID in the path. The service changes only the fields that you send with a value that is not an empty string. To keep a field, leave it out. The new name must be unique in the organisation. You cannot update the main wallet through this endpoint. If the given ID is the main wallet, the service gives HTTP 400. If the sandbox organisation is deployed, the service also sends the new name and the new description to its wallet. operationId: configUpdateSandboxOrg parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string requestBody: description: The fields of the sandbox organisation to change. required: true content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: description: The fields of the sandbox organisation to change. type: object title: UpdateSandboxOrgForOpenId properties: name: type: string description: 'New name of the sandbox organisation. The name must be unique in the organisation. If a different sandbox organisation has the same name, the service gives HTTP 400. An empty string keeps the current name.' example: Acme Test Issuer description: type: string description: New description of the sandbox organisation. An empty string keeps the current description. example: Sandbox organisation for issuance tests example: sandboxOrg: name: Acme Test Issuer description: Sandbox organisation for issuance tests responses: '200': description: The service updated the sandbox organisation. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain description: The sandbox organisation after the update. example: sandboxOrg: id: 6889e1a4c5b2f30001a3d710 name: Acme Test Issuer description: Sandbox organisation for issuance tests openIdDeploymentId: 6889e1a4c5b2f30001a3d711 status: 2 ledgerId: 0 infrastructureProvider: iGrant version: 1.0.0 role: '' trustAnchor: '' isWalletProvider: false secureVault: 0 secureVaults: null logoImageId: 6889e1a4c5b2f30001a3d6f0 coverImageId: 6889e1a4c5b2f30001a3d6f1 logoImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f0/web' coverImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f1/web' createdAt: 1754745764 updatedAt: 1754748900 isMain: false headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The given ID is the main wallet, a different sandbox organisation has the same name, or the service could not send the change to the wallet of the sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update sandbox organisation tags: - Digital Wallet (OpenID4VC) - Sandboxes delete: description: |- Deletes one sandbox organisation of the organisation. Give the sandbox organisation ID in the path. The service removes the wallet of the sandbox organisation and all the data in it. You cannot delete the main wallet. If the given ID is the main wallet, the service gives HTTP 400. After the deletion, an API key that is bound to this sandbox organisation no longer resolves a wallet. Bind the API key to a different sandbox organisation, or to the main wallet, with `PUT /config/admin/apikey/{apiKeyId}/sandbox-org`. operationId: configDeleteSandboxOrg parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string responses: '204': description: The service deleted the sandbox organisation. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The given ID is the main wallet, and the service cannot delete it.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete sandbox organisation tags: - Digital Wallet (OpenID4VC) - Sandboxes '/v2/config/sandbox-org/{sandboxOrgId}/name': put: description: |- Updates the name of one sandbox organisation. Give the sandbox organisation ID in the path. The name is mandatory and must be unique in the organisation. Unlike the general update operation, an empty name is an error here, not an instruction to keep the current name. You cannot update the main wallet through this endpoint. If the given ID is the main wallet, the service gives HTTP 400. If the sandbox organisation is deployed, the service also sends the new name to its wallet. operationId: configUpdateDigitalWalletOpenIdSandboxOrgName parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string requestBody: description: The new name of the sandbox organisation. required: true content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: type: object required: - name properties: name: type: string description: New name of the sandbox organisation. The name is mandatory and must be unique in the organisation. example: Acme Test Issuer example: sandboxOrg: name: Acme Test Issuer responses: '200': description: The service updated the name of the sandbox organisation. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain description: The sandbox organisation after the update. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The given ID is the main wallet, the `name` is missing or empty, a different sandbox organisation has the same name, or the service could not send the change to the wallet of the sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update sandbox organisation name tags: - Digital Wallet (OpenID4VC) - Sandboxes '/v2/config/sandbox-org/{sandboxOrgId}/logoimage': put: description: |- Updates the logo image of one sandbox organisation. Give the sandbox organisation ID in the path and send the image as multipart form data in the `logoimage` form field. The service stores the image, sets the new image ID and the new image URL on the sandbox organisation, and sends the change to the wallet of the sandbox organisation when it is deployed. You cannot update the main wallet through this endpoint. If the given ID is the main wallet, the service gives HTTP 400. operationId: configUpdateDigitalWalletOpenIdSandboxOrgLogo parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string requestBody: description: The logo image to store. required: true content: multipart/form-data: encoding: {} schema: type: object required: - logoimage properties: logoimage: type: string format: binary description: The logo image file. responses: '200': description: The service stored the logo image. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain description: The sandbox organisation after the update. The service sets `logoImageId` and `logoImageUrl`. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The given ID is the main wallet, the request has no `logoimage` form field, or the service could not send the change to the wallet of the sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update sandbox organisation logo image tags: - Digital Wallet (OpenID4VC) - Sandboxes '/v2/config/sandbox-org/{sandboxOrgId}/coverimage': put: description: |- Updates the cover image of one sandbox organisation. Give the sandbox organisation ID in the path and send the image as multipart form data in the `coverimage` form field. The service stores the image, sets the new image ID and the new image URL on the sandbox organisation, and sends the change to the wallet of the sandbox organisation when it is deployed. You cannot update the main wallet through this endpoint. If the given ID is the main wallet, the service gives HTTP 400. operationId: configUpdateDigitalWalletOpenIdSandboxOrgCover parameters: - description: Unique identifier of the sandbox organisation. in: path name: sandboxOrgId required: true schema: type: string requestBody: description: The cover image to store. required: true content: multipart/form-data: encoding: {} schema: type: object required: - coverimage properties: coverimage: type: string format: binary description: The cover image file. responses: '200': description: The service stored the cover image. content: application/json: schema: type: object required: - sandboxOrg properties: sandboxOrg: type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain description: The sandbox organisation after the update. The service sets `coverImageId` and `coverImageUrl`. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The given ID is the main wallet, the request has no `coverimage` form field, or the service could not send the change to the wallet of the sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation has no sandbox organisation with this ID. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update sandbox organisation cover image tags: - Digital Wallet (OpenID4VC) - Sandboxes /v2/config/sandbox-orgs: get: description: |- Lists the sandbox organisations of the organisation. The service sorts the list by the time of the last update, and it does not list deleted sandbox organisations. Use the `offset` and the `limit` query parameters to page through the list. Use the `search` query parameter to filter the list, and the `sortOrder` query parameter to change the sort direction. The response gives the sandbox organisation records only. To get the OpenID endpoints of one sandbox organisation, read it with `GET /config/sandbox-org/{sandboxOrgId}`. operationId: configListSandboxOrgs parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc responses: '200': description: The service returns the sandbox organisations and the pagination data. content: application/json: schema: type: object required: - sandboxOrgs - pagination properties: sandboxOrgs: type: array description: The sandbox organisations on the current page. items: type: object properties: id: type: string description: Unique identifier of the sandbox organisation name: type: string description: Display name of the sandbox organisation description: type: string description: Human readable description of the sandbox organisation openIdDeploymentId: type: string description: Identifier of the associated OpenID deployment status: type: integer description: Status code of the sandbox organisation ledgerId: type: integer description: Identifier of the associated ledger infrastructureProvider: type: string description: Name of the infrastructure provider version: type: string description: Version of the sandbox organisation configuration role: type: string description: Role of the sandbox organisation in the ecosystem trustAnchor: type: string description: Trust anchor identifier or DID isWalletProvider: type: boolean description: Indicates whether this sandbox organisation acts as a wallet provider secureVault: type: integer description: Identifier of the primary secure vault secureVaults: type: array nullable: true description: Identifiers of the secure vaults that the sandbox organisation uses. The field holds `null` when the sandbox organisation has no secure vault. items: type: integer logoImageId: type: string description: Identifier of the logo image. The field is absent when the sandbox organisation has no logo image. coverImageId: type: string description: Identifier of the cover image. The field is absent when the sandbox organisation has no cover image. logoImageUrl: type: string description: Public URL for the logo image coverImageUrl: type: string description: Public URL for the cover image createdAt: type: integer description: Timestamp when the sandbox organisation was created updatedAt: type: integer description: Timestamp when the sandbox organisation was last updated isMain: type: boolean description: Indicates whether this is the main organisation required: - id - name - description - openIdDeploymentId - status - ledgerId - infrastructureProvider - version - role - trustAnchor - isWalletProvider - secureVault - logoImageUrl - coverImageUrl - createdAt - updatedAt - isMain pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true example: sandboxOrgs: - id: 6889e1a4c5b2f30001a3d710 name: Acme Test Issuer description: Sandbox organisation for issuance tests openIdDeploymentId: 6889e1a4c5b2f30001a3d711 status: 2 ledgerId: 0 infrastructureProvider: iGrant version: 1.0.0 role: '' trustAnchor: '' isWalletProvider: false secureVault: 0 secureVaults: null logoImageId: 6889e1a4c5b2f30001a3d6f0 coverImageId: 6889e1a4c5b2f30001a3d6f1 logoImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f0/web' coverImageUrl: 'https://demo-api.igrant.io/v2/onboard/image/6889e1a4c5b2f30001a3d6f1/web' createdAt: 1754745764 updatedAt: 1754745764 isMain: false pagination: currentPage: 1 totalItems: 1 totalPages: 1 limit: 10 hasPrevious: false hasNext: false headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List sandbox organisations tags: - Digital Wallet (OpenID4VC) - Sandboxes /v2/config/admin/apikey: post: description: |- Creates an API key for the organisation. Use the key to call the OID4VCI and OpenID4VP endpoints from a server, in place of a bearer access token. Send the key as `Authorization: ApiKey `. Give the key the scopes that it needs. The `config` scope opens the configuration endpoints of the digital wallet, such as credential definitions, presentation definitions, webhooks and keys. The service refuses any scope other than `config`, `audit`, `service` and `onboard` with HTTP 400. The response holds the token in full, in the `apiKey` field. This is the only moment at which you can copy it from a create response, so keep it in a safe place. To bind the key to a sandbox organisation instead of the main wallet, send the identifier of the sandbox organisation in the `sandboxOrgId` field of the body. This field is the only way to bind a key at creation; the `X-SandboxOrgId` header has no effect on this operation. The sandbox organisation must belong to your organisation and must be deployed. operationId: configCreateDigitalWalletOpenIdApiKey requestBody: description: The API key to create. required: true content: application/json: schema: type: object required: - apiKey properties: apiKey: description: The API key to create. type: object title: CreateApiKeyForOpenId required: - scopes properties: name: type: string description: Name of the API key. Use it to tell your keys apart. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. Use `config` for the OID4VCI and OpenID4VP configuration endpoints. items: type: string enum: - config - audit - service - onboard example: - config - service expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment of creation. The service uses 30 days when you leave this field out, or when you send `0` or a negative value.' default: 30 example: 30 sandboxOrgId: type: string description: 'Identifier of the sandbox organisation to bind the API key to. Leave the field out, or send an empty string, to bind the key to the main wallet of the organisation. The sandbox organisation must belong to your organisation and must be deployed; if it does not, the service gives HTTP 400.' example: 6889e1a4c5b2f30001a3d710 example: apiKey: name: Production issuance key scopes: - config - service expiryInDays: 30 responses: '200': description: 'The service created the API key. This operation returns 200, not 201. The `apiKey` field of the returned object holds the signed token.' content: application/json: schema: type: object required: - apiKey properties: apiKey: description: The API key that the service created. type: object title: ApiKeyForOpenId required: - id - name - scopes - apiKey - expiryInDays - timestamp - expiryTimestamp - type - createdBy properties: id: type: string description: Unique identifier of the API key. example: 6889e1a4c5b2f30001a3d720 name: type: string description: Name of the API key. The service does not check this value for uniqueness. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service apiKey: type: string description: 'The signed JSON Web Token. Send it as `Authorization: ApiKey `. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.' example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send `0` or a negative value.' default: 30 example: 30 timestamp: type: string format: date-time description: 'Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.' example: '2026-08-09T10:15:30Z' expiryTimestamp: type: string format: date-time description: 'Moment when the API key expires, in UTC.' example: '2026-09-08T10:15:30Z' type: type: string description: Type of the API key. The list operation returns only keys of type `igrantio`; these are the keys that you create with this group of operations. enum: - igrantio - aip10 example: igrantio sandboxOrgId: type: string description: Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation. example: 6889e1a4c5b2f30001a3d710 createdBy: type: object description: 'The user who created the API key, and the moment of creation. The service keeps this as log metadata.' required: - id - email - at properties: id: type: string description: Identifier of the user who created the API key. The value is an empty string for a key created with an API key. example: 6889e1a4c5b2f30001a3d6e0 email: type: string description: Email address of the user who created the API key. example: admin@example.com at: type: string format: date-time description: 'Moment of creation, in UTC.' example: '2026-08-09T10:15:30Z' example: apiKey: id: 6889e1a4c5b2f30001a3d720 name: Production issuance key scopes: - config - service apiKey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: 30 timestamp: '2026-08-09T10:15:30Z' expiryTimestamp: '2026-09-08T10:15:30Z' type: igrantio createdBy: id: 6889e1a4c5b2f30001a3d6e0 email: admin@example.com at: '2026-08-09T10:15:30Z' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is invalid. The service returns this status when `apiKey` or `scopes` is missing, when `scopes` holds a value other than `config`, `audit`, `service` or `onboard`, when the sandbox organisation of `sandboxOrgId` does not exist, or when that sandbox organisation is not deployed.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '403': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The caller has no permission for this operation. Only an organisation administrator can manage API keys; an API key cannot create another API key. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Create API key tags: - Digital Wallet (OpenID4VC) - API Key '/v2/config/admin/apikey/{apiKeyId}': put: description: |- Updates the name, the scopes and the lifetime of an API key. The service builds a new token on every update. The token that you had before the update stops working, so replace it in every client that uses it. The new lifetime starts at the moment of the update. The service reads only `name`, `scopes` and `expiryInDays` from the request. It keeps the current name when `name` is absent or holds spaces only. It replaces the scopes with the list that you send. This operation does not change the sandbox organisation of the key. To change it, use `PUT /config/admin/apikey/{apiKeyId}/sandbox-org`. operationId: configUpdateDigitalWalletOpenIdApiKey parameters: - description: Unique ID of an object in: path name: apiKeyId required: true schema: type: string requestBody: description: The new values of the API key. required: true content: application/json: schema: type: object required: - apiKey properties: apiKey: description: The new values of the API key. type: object title: UpdateApiKeyForOpenId required: - scopes properties: name: type: string description: New name of the API key. The service keeps the current name when you leave this field out or when you send a value of spaces only. example: Production issuance key scopes: type: array description: New scopes of the API key. The service replaces the current scopes with this list. It refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service expiryInDays: type: integer description: 'New lifetime of the API key in days, counted from the moment of the update. The service uses 30 days when you leave this field out, or when you send `0` or a negative value.' default: 30 example: 90 example: apiKey: name: Production issuance key scopes: - config expiryInDays: 90 responses: '200': description: The service updated the API key. The `apiKey` field of the returned object holds the new signed token. content: application/json: schema: type: object required: - apiKey properties: apiKey: description: The API key after the update. type: object title: ApiKeyForOpenId required: - id - name - scopes - apiKey - expiryInDays - timestamp - expiryTimestamp - type - createdBy properties: id: type: string description: Unique identifier of the API key. example: 6889e1a4c5b2f30001a3d720 name: type: string description: Name of the API key. The service does not check this value for uniqueness. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service apiKey: type: string description: 'The signed JSON Web Token. Send it as `Authorization: ApiKey `. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.' example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send `0` or a negative value.' default: 30 example: 30 timestamp: type: string format: date-time description: 'Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.' example: '2026-08-09T10:15:30Z' expiryTimestamp: type: string format: date-time description: 'Moment when the API key expires, in UTC.' example: '2026-09-08T10:15:30Z' type: type: string description: Type of the API key. The list operation returns only keys of type `igrantio`; these are the keys that you create with this group of operations. enum: - igrantio - aip10 example: igrantio sandboxOrgId: type: string description: Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation. example: 6889e1a4c5b2f30001a3d710 createdBy: type: object description: 'The user who created the API key, and the moment of creation. The service keeps this as log metadata.' required: - id - email - at properties: id: type: string description: Identifier of the user who created the API key. The value is an empty string for a key created with an API key. example: 6889e1a4c5b2f30001a3d6e0 email: type: string description: Email address of the user who created the API key. example: admin@example.com at: type: string format: date-time description: 'Moment of creation, in UTC.' example: '2026-08-09T10:15:30Z' example: apiKey: id: 6889e1a4c5b2f30001a3d720 name: Production issuance key scopes: - config apiKey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: 90 timestamp: '2026-08-09T11:02:11Z' expiryTimestamp: '2026-11-07T11:02:11Z' type: igrantio createdBy: id: 6889e1a4c5b2f30001a3d6e0 email: admin@example.com at: '2026-08-09T10:15:30Z' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is invalid. The service returns this status when `apiKey` or `scopes` is missing, or when `scopes` holds a value other than `config`, `audit`, `service` or `onboard`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '403': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The caller has no permission for this operation. Only an organisation administrator can manage API keys. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Internal server error. The service also returns this status when the API key of `apiKeyId` does not exist, or when it is deleted.' headers: {} security: - BearerAuth: [] summary: Update API key tags: - Digital Wallet (OpenID4VC) - API Key delete: description: |- Deletes an API key. The service marks the key as deleted and stops accepting it. The key no longer shows in the list of API keys. The token itself stays valid in form until its expiry, but the service refuses it, so every client that uses it must move to another key. operationId: configDeleteDigitalWalletOpenIdApiKey parameters: - description: Unique ID of an object in: path name: apiKeyId required: true schema: type: string responses: '200': description: The service deleted the API key and returns the key as it was at the moment of the delete. content: application/json: schema: type: object required: - apiKey properties: apiKey: description: The API key that the service deleted. type: object title: ApiKeyForOpenId required: - id - name - scopes - apiKey - expiryInDays - timestamp - expiryTimestamp - type - createdBy properties: id: type: string description: Unique identifier of the API key. example: 6889e1a4c5b2f30001a3d720 name: type: string description: Name of the API key. The service does not check this value for uniqueness. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service apiKey: type: string description: 'The signed JSON Web Token. Send it as `Authorization: ApiKey `. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.' example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send `0` or a negative value.' default: 30 example: 30 timestamp: type: string format: date-time description: 'Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.' example: '2026-08-09T10:15:30Z' expiryTimestamp: type: string format: date-time description: 'Moment when the API key expires, in UTC.' example: '2026-09-08T10:15:30Z' type: type: string description: Type of the API key. The list operation returns only keys of type `igrantio`; these are the keys that you create with this group of operations. enum: - igrantio - aip10 example: igrantio sandboxOrgId: type: string description: Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation. example: 6889e1a4c5b2f30001a3d710 createdBy: type: object description: 'The user who created the API key, and the moment of creation. The service keeps this as log metadata.' required: - id - email - at properties: id: type: string description: Identifier of the user who created the API key. The value is an empty string for a key created with an API key. example: 6889e1a4c5b2f30001a3d6e0 email: type: string description: Email address of the user who created the API key. example: admin@example.com at: type: string format: date-time description: 'Moment of creation, in UTC.' example: '2026-08-09T10:15:30Z' example: apiKey: id: 6889e1a4c5b2f30001a3d720 name: Production issuance key scopes: - config apiKey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: 30 timestamp: '2026-08-09T12:40:05Z' expiryTimestamp: '2026-09-08T10:15:30Z' type: igrantio createdBy: id: 6889e1a4c5b2f30001a3d6e0 email: admin@example.com at: '2026-08-09T10:15:30Z' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '403': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The caller has no permission for this operation. Only an organisation administrator can manage API keys. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Internal server error. The service also returns this status when the API key of `apiKeyId` does not exist, or when it is already deleted.' headers: {} security: - BearerAuth: [] summary: Delete API key tags: - Digital Wallet (OpenID4VC) - API Key '/v2/config/admin/apikey/{apiKeyId}/sandbox-org': put: description: |- Binds an API key to a sandbox organisation, or binds it back to the main wallet. Send the identifier of the sandbox organisation in the body: `{"sandboxOrgId": "6889e1a4c5b2f30001a3d710"}`. Send an empty string to bind the key back to the main wallet of the organisation. The sandbox organisation must belong to your organisation and must be deployed; if it does not exist, or if it is not deployed, the service gives HTTP 400. The service signs a **new** token for the key, with the new sandbox organisation in its claims. The `apiKey` field of the response holds this new token. The token that you had before this call stops working, so store the new value and replace the old one in every client. After the binding, every call that you make with this key runs in the context of that sandbox organisation. The key then reads and writes the credential definitions, the presentation definitions, the webhooks and the keys of that sandbox organisation, and not those of the main wallet. The service takes the sandbox organisation from the key itself, so a request with this key does not need the `X-SandboxOrgId` header, and the service ignores that header. The service also moves the expiry of the key forward. It sets a new `expiryTimestamp` at the moment of this call plus the current `expiryInDays`, so every call to this operation extends the lifetime of the key. operationId: configUpdateDigitalWalletOpenIdApiKeySandboxOrg parameters: - description: Unique ID of an object in: path name: apiKeyId required: true schema: type: string requestBody: description: The sandbox organisation to bind the API key to. required: true content: application/json: schema: type: object properties: sandboxOrgId: type: string description: 'Identifier of the sandbox organisation to bind the API key to. Send an empty string, or leave the field out, to bind the key back to the main wallet of the organisation.' example: 6889e1a4c5b2f30001a3d710 examples: Bind to a sandbox organisation: value: sandboxOrgId: 6889e1a4c5b2f30001a3d710 Bind back to the main wallet: value: sandboxOrgId: '' responses: '200': description: The service bound the API key and signed a new token. Store the value of the `apiKey` field; the previous token no longer works. content: application/json: schema: type: object required: - apiKey properties: apiKey: description: 'The API key after the binding, with the new token and the new expiry.' type: object title: ApiKeyForOpenId required: - id - name - scopes - apiKey - expiryInDays - timestamp - expiryTimestamp - type - createdBy properties: id: type: string description: Unique identifier of the API key. example: 6889e1a4c5b2f30001a3d720 name: type: string description: Name of the API key. The service does not check this value for uniqueness. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service apiKey: type: string description: 'The signed JSON Web Token. Send it as `Authorization: ApiKey `. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.' example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send `0` or a negative value.' default: 30 example: 30 timestamp: type: string format: date-time description: 'Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.' example: '2026-08-09T10:15:30Z' expiryTimestamp: type: string format: date-time description: 'Moment when the API key expires, in UTC.' example: '2026-09-08T10:15:30Z' type: type: string description: Type of the API key. The list operation returns only keys of type `igrantio`; these are the keys that you create with this group of operations. enum: - igrantio - aip10 example: igrantio sandboxOrgId: type: string description: Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation. example: 6889e1a4c5b2f30001a3d710 createdBy: type: object description: 'The user who created the API key, and the moment of creation. The service keeps this as log metadata.' required: - id - email - at properties: id: type: string description: Identifier of the user who created the API key. The value is an empty string for a key created with an API key. example: 6889e1a4c5b2f30001a3d6e0 email: type: string description: Email address of the user who created the API key. example: admin@example.com at: type: string format: date-time description: 'Moment of creation, in UTC.' example: '2026-08-09T10:15:30Z' example: apiKey: id: 6889e1a4c5b2f30001a3d720 name: Production issuance key scopes: - config - service apiKey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: 30 timestamp: '2026-08-09T13:20:44Z' expiryTimestamp: '2026-09-08T13:20:44Z' type: igrantio sandboxOrgId: 6889e1a4c5b2f30001a3d710 createdBy: id: 6889e1a4c5b2f30001a3d6e0 email: admin@example.com at: '2026-08-09T10:15:30Z' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The sandbox organisation of `sandboxOrgId` does not exist in your organisation, or it is not deployed.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '403': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The caller has no permission for this operation. headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The API key of `apiKeyId` does not exist, or it is deleted.' headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The service could not sign the new token, or could not write the API key.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Bind API key to sandbox organisation tags: - Digital Wallet (OpenID4VC) - API Key /v2/config/admin/apikeys: get: description: |- Lists the API keys of the organisation, with pagination. The service sorts them with the most recently written key first. The list holds only the keys that you create with this group of operations; it leaves out the internal keys of the platform. The list also depends on the sandbox organisation of the request. Without the `X-SandboxOrgId` header the service returns the keys of the main wallet only. With the header it returns the keys that are bound to that sandbox organisation. When you authenticate with an API key, the service takes the sandbox organisation from the key. Every item holds the signed token in its `apiKey` field, so treat the response as a secret. operationId: configListDigitalWalletOpenIdApiKey parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service listed the API keys. content: application/json: schema: type: object required: - apiKeys - pagination properties: apiKeys: type: array description: API keys for the current page. The array is empty when the organisation has no API key for the current sandbox organisation. items: type: object title: ApiKeyForOpenId description: 'An API key of the organisation. The `apiKey` field holds the signed JSON Web Token that you send in the `Authorization` header with the `ApiKey ` prefix. The service returns the token in full on every operation of this group, so keep the response secret.' required: - id - name - scopes - apiKey - expiryInDays - timestamp - expiryTimestamp - type - createdBy properties: id: type: string description: Unique identifier of the API key. example: 6889e1a4c5b2f30001a3d720 name: type: string description: Name of the API key. The service does not check this value for uniqueness. example: Production issuance key scopes: type: array description: Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. items: type: string enum: - config - audit - service - onboard example: - config - service apiKey: type: string description: 'The signed JSON Web Token. Send it as `Authorization: ApiKey `. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.' example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: type: integer description: 'Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send `0` or a negative value.' default: 30 example: 30 timestamp: type: string format: date-time description: 'Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.' example: '2026-08-09T10:15:30Z' expiryTimestamp: type: string format: date-time description: 'Moment when the API key expires, in UTC.' example: '2026-09-08T10:15:30Z' type: type: string description: Type of the API key. The list operation returns only keys of type `igrantio`; these are the keys that you create with this group of operations. enum: - igrantio - aip10 example: igrantio sandboxOrgId: type: string description: Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation. example: 6889e1a4c5b2f30001a3d710 createdBy: type: object description: 'The user who created the API key, and the moment of creation. The service keeps this as log metadata.' required: - id - email - at properties: id: type: string description: Identifier of the user who created the API key. The value is an empty string for a key created with an API key. example: 6889e1a4c5b2f30001a3d6e0 email: type: string description: Email address of the user who created the API key. example: admin@example.com at: type: string format: date-time description: 'Moment of creation, in UTC.' example: '2026-08-09T10:15:30Z' pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true example: apiKeys: - id: 6889e1a4c5b2f30001a3d720 name: Production issuance key scopes: - config - service apiKey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0... expiryInDays: 30 timestamp: '2026-08-09T10:15:30Z' expiryTimestamp: '2026-09-08T10:15:30Z' type: igrantio createdBy: id: 6889e1a4c5b2f30001a3d6e0 email: admin@example.com at: '2026-08-09T10:15:30Z' pagination: currentPage: 1 totalItems: 1 totalPages: 1 limit: 10 hasPrevious: false hasNext: false headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '403': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The caller has no permission for this operation. Only an organisation administrator can manage API keys. headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The service could not read the page of API keys. headers: {} security: - BearerAuth: [] summary: List API keys tags: - Digital Wallet (OpenID4VC) - API Key /v2/config/webhooks/event-types: get: deprecated: false description: | This endpoint lists all the webhook event types that you can subscribe to. Use these values in the `subscribedEvents` field when you create or update a webhook. The list is the same for all organisations. The order of the values in each array changes between calls. Do not depend on the order. operationId: configReadWebhookEventTypes responses: '200': content: application/json: schema: properties: consentManagementWebhookEventTypes: description: 'The event types for consent management. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.' items: type: string title: consentManagementWebhookEventTypes enum: - consent.allowed - consent.auto_expiry - data.delete.initiated - data.update.initiated - data.download.cancelled - data.update.cancelled - data.download.initiated - data.delete.cancelled - consent.disallowed type: array dataMarketplaceWebhookEventTypes: description: The event types for the data marketplace. These events occur when the server creates a data disclosure agreement record. items: type: string title: dataMarketplaceWebhookEventTypes enum: - datamarketplace.data_disclosure_agreement_record type: array digitalWalletWebhookEventTypes: description: 'The event types for the digital wallet. These events occur during a connection, a credential issuance or a credential verification. The list contains the DIDComm event types and the OpenID4VC event types.' items: type: string title: digitalWalletWebhookEventTypes description: A digital wallet event type. The `openid.*` values are the OID4VCI and OpenID4VP event types. The `digitalwallet.*` values belong to the older DIDComm protocol. enum: - digitalwallet.connection.init - digitalwallet.connection.invitation - digitalwallet.connection.request - digitalwallet.connection.response - digitalwallet.connection.active - digitalwallet.connection.error - digitalwallet.connection.inactive - digitalwallet.connection.delete - digitalwallet.credential.proposal_sent - digitalwallet.credential.proposal_received - digitalwallet.credential.offer_sent - digitalwallet.credential.offer_received - digitalwallet.credential.request_sent - digitalwallet.credential.request_received - digitalwallet.credential.credential_issued - digitalwallet.credential.credential_received - digitalwallet.credential.credential_acked - digitalwallet.presentation.proposal_sent - digitalwallet.presentation.proposal_received - digitalwallet.presentation.request_sent - digitalwallet.presentation.request_received - digitalwallet.presentation.presentation_sent - digitalwallet.presentation.presentation_received - digitalwallet.presentation.verified - digitalwallet.presentation.presentation_acked - openid.credential.offer_sent - openid.credential.offer_received - openid.credential.credential_issued - openid.credential.credential_acked - openid.credential.credential_accepted - openid.credential.credential_deleted - openid.credential.issuance_denied - openid.credential.token_issued - openid.holder.credential.credential_pending - openid.holder.credential.credential_acked - openid.holder.credential.credential_accepted - openid.presentation.request_sent.v3 - openid.presentation.request_received.v3 - openid.presentation.presentation_acked.v3 - openid.presentation.presentation_pending.v3 type: array required: - consentManagementWebhookEventTypes - digitalWalletWebhookEventTypes - dataMarketplaceWebhookEventTypes type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read webhook event types tags: - Webhook /v2/config/webhooks/payload/content-types: get: deprecated: false description: 'This endpoint lists the payload content types that a webhook can use. Use one of these values in the `contentType` field when you create or update a webhook. The server posts the payload as a JSON body for `application/json`. For `application/x-www-form-urlencoded`, the server makes a string of the payload and posts it as a form under the `payload` key. Note the capital `C` in the `ContentTypes` response field. The order of the values changes between calls.' operationId: getWebhookPayloadContentTypes responses: '200': content: application/json: schema: properties: ContentTypes: description: The payload content types that a webhook can use. example: - application/json - application/x-www-form-urlencoded items: description: A payload content type. enum: - application/json - application/x-www-form-urlencoded type: string type: array required: - ContentTypes type: object description: OK headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List all webhook content types tags: - Webhook /v2/config/digital-wallet/openid/sdjwt/credential/receive: post: description: 'Processes an OID4VCI Credential Offer and initiates the credential issuance flow. The wallet resolves the issuer''s metadata, performs token exchange, and receives the credential.' operationId: configReceiveDigitalWalletOpenIdCredential requestBody: description: Credential offer and the key material that the wallet uses to receive the credential. required: true content: application/json: schema: type: object properties: credentialOffer: type: string minLength: 1 description: 'Credential Offer that the issuer sends to the holder. Give the full `openid-credential-offer://` URI or the credential offer URI that the issuer publishes. The wallet also accepts the field name `CredentialOffer` with a capital `C`.' example: 'openid-credential-offer://?credential_offer_uri=https://demo-api.igrant.io/v2/organisation/62e29d4c1d75a55b4ecd0e50/service/credential-offer/6650d3c3b8b1c2a1f0d9e4c7' autoPresent: type: boolean description: 'When `true`, the wallet presents this credential automatically if a later OpenID4VP Authorization Request matches it. The default is `false`.' default: false example: false trustAnchor: type: string description: 'Trust anchor that the wallet uses to bind the credential. This value sets the key type or DID method of the holder identifier in the proof of possession. The default is `did:key`.' default: 'did:key' enum: - 'did:key' - x509 example: 'did:key' kid: type: string description: 'Key identifier of the wallet key that signs the proof of possession. If you do not give a value, the wallet uses the default key of the organisation.' example: Ll1eB6xN9yA0y4Yg3xFvJ2r7z0M9pQwXk1sT7uV2nCg required: - credentialOffer responses: '200': description: The wallet received the credential. content: application/json: schema: type: object properties: credential: description: 'Credential that the wallet received. The wallet returns a single object if the credential offer contains one credential. The wallet returns an array if the offer contains more than one credential. The wallet stores the record shortly after this response, so a read of the same credential can fail for a short time.' oneOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation - type: array items: type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential offer is not valid, or the issuer refused the request. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Receive credential tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/receive-deferred': put: description: 'Polls the OID4VCI Deferred Credential Endpoint to retrieve a credential that was not immediately available during issuance. The wallet uses the acceptance token of the credential record to make the request. If the issuer is not ready, the wallet returns the credential record with the status `credential_pending`. This operation has no request body.' operationId: configReceiveDeferredDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string responses: '200': description: The wallet polled the deferred endpoint. The response contains the updated credential record. content: application/json: schema: type: object properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: 'Updated credential record. The field `credentialStatus` shows `credential_acked` if the issuer released the credential, or `credential_pending` if the credential is still not ready. The wallet keeps the stored values of `acceptanceToken`, `deferredEndpoint`, `credentialFormat`, `credentialConfigurations`, `txCode`, `authorizationDetails`, `oAuthFlow` and `authorizationRequest`, and does not refresh them on this operation.' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the deferred endpoint of the issuer returned an error. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Receive deferred credential tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/user-pin': put: description: 'Submits the transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. The wallet sends the transaction code with the pre-authorized code to the Token Endpoint of the issuer, and then requests the credential.' operationId: configReceiveUserPinForDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string requestBody: description: Transaction code that the issuer gave to the holder out of band. required: true content: application/json: schema: type: object properties: userPin: type: string description: 'Transaction code (tx_code) for the OID4VCI Pre-Authorized Code Flow. The wallet removes the leading and trailing spaces, and the remaining value must have 4 to 12 characters. Use `txCode.length` and `txCode.input_mode` of the credential record to find the length and the character set that the issuer expects.' minLength: 4 maxLength: 12 example: '3491' required: - userPin responses: '200': description: The wallet received the credential with the transaction code. content: application/json: schema: type: object properties: credential: description: Credential that the wallet received. The wallet returns a single object if the credential offer contains one credential. The wallet returns an array if the offer contains more than one credential. oneOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation - type: array items: type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the issuer refused the transaction code. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Receive credential with user PIN tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/configure': put: description: 'Configures whether a credential should be automatically presented when a matching OpenID4VP Authorization Request is received. The wallet applies the same setting to the related credentials that the same issuance created, but returns only the credential that you gave in the path.' operationId: configConfigureAutoPresentForDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string requestBody: description: New automatic presentation setting for the credential. required: true content: application/json: schema: type: object properties: autoPresent: type: boolean description: 'When `true`, the wallet presents this credential automatically if an OpenID4VP Authorization Request matches it. When `false`, the holder must approve each presentation.' example: true required: - autoPresent responses: '200': description: The wallet saved the new automatic presentation setting. content: application/json: schema: type: object properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: Updated credential record. The wallet refreshes only the field `autoPresent`. Every other field holds the value that the record had before the request. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the mandatory field `autoPresent` is missing. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Configure auto presentation for the credential tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/revocation-status': get: description: 'Checks the current revocation status of a credential by querying the IETF Token Status List. The wallet reads the status list token of the issuer, updates the stored credential record, and returns the record.' operationId: configReadDigitalWalletOpenIdCredentialRevocationStatus parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet read the revocation status. content: application/json: schema: type: object properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: Updated credential record. The field `revocationStatus` shows the status that the wallet read from the status list of the issuer. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the wallet cannot read the status list of the issuer. When the credential does not support revocation, `errorDescription` holds text that ends with `does not support revocation`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read credential revocation status tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}': get: description: Retrieves a credential stored in the holder's wallet by its ID. operationId: configReadDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string responses: '200': description: The wallet found the credential. content: application/json: schema: type: object properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: Credential record that the wallet holds. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not valid or the credential ID is unknown. Holder operations are also not available for a sandbox organisation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read credential tags: - Digital Wallet (OpenID4VC) - Holder delete: description: 'Deletes a credential from the holder''s wallet. The wallet marks the credential record as deleted, no longer returns it in the credential list, and no longer uses it for presentations. The wallet tells the issuance backend in the background, so the response does not show the result of that step.' operationId: configDeleteDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string responses: '204': description: The wallet deleted the credential. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not valid or the credential ID is unknown. Holder operations are also not available for a sandbox organisation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete credential tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/sdjwt/credential/exchange-code: post: description: Exchanges an authorization code for an access token and receives the credential in the OID4VCI Authorization Code Flow. Call this endpoint after the authorization server redirects the holder back with a code. operationId: configDigitalWalletOpenIdExchangeCodeAndReceiveCredential requestBody: description: Authorization code and state that the authorization server returned in the redirect. required: true content: application/json: schema: type: object properties: code: type: string minLength: 1 description: Authorization code that the authorization server of the issuer returned in the redirect. example: d7f1a2c4-9b83-4f0e-8c21-6a5e0d3b7f19 credentialIds: type: array items: type: string description: Identifier of one credential record that waits for the token exchange. description: 'Identifiers of the credential records to complete. Give the values that the wallet created when it processed the credential offer. If you do not give a value, the wallet uses the credential records that match the `state` value.' example: - 6650d3c3b8b1c2a1f0d9e4c7 state: type: string nullable: true description: State value that the authorization server returned in the redirect. The wallet uses this value to find the matching credential request. Send `null` or leave the field out when the redirect has no state. example: b7c9e2f1-4a58-4d31-9f2c-0e6b8a1d5c73 required: - code responses: '200': description: The wallet exchanged the code and received the credential. content: application/json: schema: type: object properties: credential: description: Credential that the wallet received. The wallet returns a single object if the token exchange gives one credential. The wallet returns an array if the exchange gives more than one credential. oneOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation - type: array items: type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the code is missing or expired, or the token endpoint of the issuer refused the request. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Exchange code and receive credential tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/sdjwt/credentials: get: description: 'Lists all credentials stored in the holder''s wallet with pagination support. The wallet sorts the records by the last update time and leaves out the credentials that you deleted. Use the query parameters to filter the list by status, credential type, expiry, or a search term. The wallet replaces a value that it cannot read with the default value and does not refuse the request.' operationId: configListDigitalWalletOpenIdCredential parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - name: expired in: query description: 'Filter credentials by expiry status. When true, returns expired credentials; when false, returns active credentials.' required: false schema: type: boolean - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - name: credentialStatus in: query description: 'Filter the list by the status of the credential in the wallet. The wallet matches the value exactly. A stored credential normally holds one of the three values `credential_pending`, `credential_acked` or `credential_accepted`.' required: false schema: type: string enum: - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied example: credential_acked - name: vct in: query description: Filter the list by the Verifiable Credential Type (`vct`) of an IETF SD-JWT VC credential. required: false schema: type: string example: 'urn:eu.europa.ec.eudi:pid:1' - name: doctype in: query description: Filter the list by the document type (`doctype`) of an ISO 18013-5 mDoc credential. required: false schema: type: string example: org.iso.18013.5.1.mDL - name: type in: query description: Filter the list by one credential type in the credential definition of a W3C VC credential. required: false schema: type: string example: VerifiableAttestation responses: '200': content: application/json: schema: type: object properties: credential: items: type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation type: array description: Credential records for the current page. The array is empty if the wallet holds no credential that matches the filters. pagination: allOf: - type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Pagination data for the list. description: The wallet returned the credentials. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not valid or a query parameter has a wrong value. Holder operations are also not available for a sandbox organisation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List credential tags: - Digital Wallet (OpenID4VC) - Holder /v3/config/digital-wallet/openid/sdjwt/verification/receive: post: description: | Processes an OpenID4VP Authorization Request (V3) received from a verifier. The wallet resolves the verifier's requirements and identifies matching credentials. The V3 record adds DCQL, transaction data, trust list and response encryption fields. Read `presentationId` from the response. The filter, read and send operations take that value as their path parameter. Read `status` from the response before you go on. When `autoPresent` is `true` the wallet can select the credentials and answer the verifier inside this one call, and the status is then `presentation_acked`. When the wallet finds no credential for the request, it still answers with HTTP 200 and leaves the status at `presentation_pending`. When you call this operation again for an Authorization Request that the wallet already answered, the wallet returns the stored record without a change and without an error. operationId: configReceiveDigitalWalletOpenIdVerificationV3 requestBody: description: 'Authorization Request that the holder scanned or received, and the key material that the wallet uses for the response.' required: true content: application/json: schema: type: object required: - vpTokenQrCode properties: vpTokenQrCode: type: string description: OpenID4VP Authorization Request URI that the holder scanned from the verifier's QR code or received through a deep link. The wallet resolves this URI to get the full Authorization Request. example: 'openid4vp://?client_id=https%3A%2F%2Fverifier.example.com&request_uri=https%3A%2F%2Fverifier.example.com%2Frequest%2F8f2b1c9e' autoPresent: type: boolean description: 'When `true`, the wallet selects the matching credentials and sends the Verifiable Presentation without holder interaction. The wallet skips this step when the Authorization Request asks for an ID Token. Default is `false`.' default: false kid: type: string description: 'Key identifier of the wallet key that signs the Verifiable Presentation. If you do not give a value, the wallet uses the default key for the trust anchor.' trustAnchor: type: string description: 'Trust anchor that identifies the holder to the verifier. The value sets the key type or DID method that the wallet uses to sign the Verifiable Presentation. Default is `did:key`.' default: 'did:key' enum: - 'did:key' - x509 parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet received and resolved the Authorization Request. content: application/json: schema: type: object properties: presentation: allOf: - type: object description: | Presentation record in the wallet of the holder. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) Authorization Request that the holder got, and the presentation that the holder sent back. This V3 shape keeps `vpToken` as an array, so the wallet can send more than one Verifiable Presentation in a single Authorization Response. The wallet returns every property of this schema on every V3 holder operation. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: id: type: string description: Internal record identifier of the presentation. example: 6821b4b0f5b1c2a3d4e5f6a7 presentationId: type: string description: 'Unique identifier of this presentation in the wallet of the holder. Use this identifier to read the record, to send the presentation, or to delete the record.' example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 presentationExchangeId: type: string description: Identifier of the verification exchange at the verifier. It links this presentation to the verification history record of the verifier. example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this presentation record. organisationId: type: string description: Identifier of the organisation that owns the wallet of the holder. presentationSubmission: type: object description: | Presentation Submission object of the DIF Presentation Exchange specification. It maps the credentials of the holder to the requirements of the verifier. DCQL is the only query form that an iGrant.io verifier sends, and a DCQL Authorization Response carries no Presentation Submission, so the wallet returns `null` here for such a request. A value is present only when an outside verifier still sends a DIF Presentation Exchange definition. properties: definition_id: type: string description: Identifier of the presentation definition that this submission fulfils. descriptor_map: description: Descriptor Map entries. Each entry gives the position of one requested credential in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this entry satisfies. path: type: string description: JSONPath expression that points to the credential in the Verifiable Presentation token. path_nested: type: object description: 'Nested path descriptor for credentials in an envelope format, for example a JWT in a VP JWT.' properties: format: type: string description: 'Credential format of the nested credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this nested entry satisfies. path: type: string description: JSONPath expression that points to the credential in the envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier of this Presentation Submission. required: - definition_id - descriptor_map - id vpToken: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent to the verifier. The array holds one entry for each credential that the Authorization Request asked for. The array is empty until the holder sends the presentation. status: type: string enum: - presentation_pending - presentation_acked description: | Lifecycle status of the presentation in the wallet of the holder: 1. `presentation_pending`: The holder must select the matching credentials and send the Verifiable Presentation to the verifier. 2. `presentation_acked`: The wallet sent the Verifiable Presentation and the verifier accepted it. example: presentation_pending verified: type: boolean description: '`true` when the verifier accepted the presentation and the checks of the verifier passed. The receive and send operations always return `false`. The server sets this value later, when the verification webhook reports the result.' presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation. Each entry holds the result of the signature check, the expiry check and the revocation check. The receive and send operations always return `null`. The server sets this value later, when the verification webhook reports the result.' vpRequestState: type: string description: State value of the Authorization Request of the verifier. The wallet returns this value with the Authorization Response so that the verifier can match the two. example: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f clientId: type: string description: 'Client identifier of the verifier from the Authorization Request, for example a URI or a DID.' redirectUri: type: string description: Redirect URI from the Authorization Request. The wallet posts the Authorization Response to this URI. requestUri: type: string description: Request URI of the Authorization Request. The wallet gets the full Authorization Request from this URI when the verifier passes the request by reference. responseRedirectUri: type: string description: Redirect URI that the verifier returned in the Authorization Response. The wallet sends the holder to this URI after the verifier processed the presentation. presentationDefinition: type: string description: 'DIF Presentation Exchange definition of the verifier, as a serialised JSON string. Empty when the verifier sent a DCQL query, which is the only query form that an iGrant.io verifier sends. Read `dcqlQuery` for the credential and claim requirements.' nonce: type: string description: Cryptographic nonce from the Authorization Request. The wallet puts this value in the Key Binding JWT to keep the presentation fresh and to stop replay. example: z4cVLRsq9pKx0NgQ7E3hJg responseType: type: string description: OAuth 2.0 response type of the Authorization Request. It tells the wallet what to send back. enum: - vp_token - id_token - device_response credentialId: type: string description: Identifier of the credential in the wallet that the holder chose for this presentation. clientMetadata: type: object description: Metadata of the verifier from the Authorization Request. The wallet shows this information to the holder before the holder approves the presentation. properties: clientName: type: string description: Display name of the verifier. logoUri: type: string description: URL of the logo of the verifier. location: type: string description: Location or address of the verifier. coverUri: type: string description: URL of the cover image of the verifier. description: type: string description: Description of the verifier. required: - clientName - logoUri - location - coverUri - description presentation: type: array description: Credentials that the Verifiable Presentation holds. The array is empty until the holder sends the presentation. items: type: object properties: id: type: string description: 'Identifier of the DCQL credential query that this credential satisfies. For a request from an outside verifier that still uses Presentation Exchange, this is the Input Descriptor identifier.' credentialId: type: string description: Identifier of the credential in the wallet of the holder. type: type: array items: type: string description: Credential types of the presented W3C Verifiable Credential. The wallet leaves this property out for other credential formats. credentialSubject: type: object additionalProperties: true description: Disclosed claims of a presented W3C VC JWT credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of a presented IETF SD-JWT VC credential. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of a presented ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. claims: type: object additionalProperties: true description: Disclosed claims of a presented SD-JWT VC or mDoc credential. The wallet leaves this property out for other credential formats. required: - id - credentialId transactionData: description: 'Transaction data from the Authorization Request, as the verifier sent it. The value is normally an array of base64url strings. The holder must approve this data before the wallet sends the presentation. Read `transactionDataDecoded` to show the data to the holder.' transactionDataDecoded: type: array items: type: object additionalProperties: true description: Decoded transaction data. The wallet shows these objects to the holder for approval. dataAgreement: type: object additionalProperties: true description: Data agreement from the Authorization Request. It gives the terms that govern this verification exchange. legalPidAttestation: type: string description: Legal Person Identification Data attestation of the verifier. The wallet uses it to check the legal identity of the verifier. legalPidAttestationPop: type: string description: Proof of possession for the Legal Person Identification Data attestation of the verifier. legalPidVerified: type: boolean description: '`true` when the wallet checked the Legal Person Identification Data attestation of the verifier and the check passed.' isVerifiedWithTrustList: type: boolean description: '`true` when the wallet found the verifier in a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Trust Service Provider entry that the wallet used to check the identity of the verifier. trustAnchor: type: string description: 'DID method, or key type, of the trust anchor that the wallet uses for this presentation.' enum: - 'did:key' - x509 kid: type: string description: 'Key identifier of the key that the wallet uses to sign the Key Binding JWT, or to decrypt the Authorization Response.' idToken: type: string description: OpenID Connect ID Token that the wallet sent to the verifier. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token that the wallet sent. clientIdScheme: type: string description: Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash verifierAttestation: type: string description: Verifier Attestation JWT from the verifier. It proves that the verifier may ask for the requested credentials. dcqlQuery: type: object additionalProperties: true description: 'Digital Credentials Query Language (DCQL) query from the Authorization Request. Read `credentials[].id` from this query to build the `credentials` array of the send operation. `null` when the verifier sent a DIF Presentation Exchange definition instead.' encryptionJwk: type: object additionalProperties: true description: Public key of the verifier as a JWK. The wallet uses it to encrypt the Authorization Response when the response mode asks for encryption. encryptedResponseEncValuesSupported: type: array items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM description: JWE content encryption algorithms that the verifier accepts for the encrypted Authorization Response. encryptionAlgorithm: type: string description: JWE key management algorithm that the wallet used to encrypt the Authorization Response. Empty when the response mode does not ask for encryption. enum: - ECDH-ES createdAt: type: number description: Unix timestamp in seconds when the wallet made this record. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the wallet last changed this record. example: 1747011600 required: - id - presentationId - presentationExchangeId - openIdOrganisationId - organisationId - status - verified - vpRequestState - clientId - redirectUri - requestUri - responseRedirectUri - presentationDefinition - nonce - responseType - credentialId - clientMetadata - legalPidAttestation - legalPidAttestationPop - legalPidVerified - isVerifiedWithTrustList - trustAnchor - kid - idToken - clientIdScheme - verifierAttestation - encryptionAlgorithm - createdAt - updatedAt description: Presentation record that the wallet created for this Authorization Request. The record has the status `presentation_pending` until the holder sends the Verifiable Presentation. required: - presentation headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, or the wallet cannot resolve the Authorization Request.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Receive verification tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/verification/{presentationId}/filter': post: description: | Filters the credentials in the wallet of the holder against the request of the verifier and returns the matches. Call this operation after the receive operation, and use the result to build the request body of the send operation. The response holds `credentials` when the verifier sent a DCQL query. DCQL is the only query form that an iGrant.io verifier sends, so this is the usual answer. The response holds `inputDescriptors` in place of it only for a request from an outside verifier that still uses a DIF Presentation Exchange definition. The wallet never returns both keys. The array holds one entry for every credential query, even for a query that no credential in the wallet answers. Read `matchedCredentials` on each entry: an empty array marks a requirement that the holder cannot meet. The request has no body. The wallet discards a body if you send one. There is no V3 version of this operation. Use it together with the V3 receive, read and send operations. operationId: configFilterDigitalWalletOpenIdVerification parameters: - description: 'Unique identifier of the presentation record in the wallet of the holder. This is the `presentationId` property of the record, not its `id` property.' in: path name: presentationId required: true schema: type: string example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 responses: '200': description: The wallet compared the credentials with the verifier's request and returns the matches. content: application/json: schema: type: object properties: credentials: type: array description: 'Matches for each credential query in the DCQL query of the verifier, with one entry for every query. The wallet leaves this property out only when the verifier sent a DIF Presentation Exchange definition. Give the `id` of each entry in the `credentials` array of the send operation.' items: type: object description: | Credentials in the wallet of the holder that match one credential query of the verifier. DCQL is the only query form that an iGrant.io verifier sends. For a DCQL query the wallet returns one entry for **every** credential query, with `id` and `matchedCredentials` only. An entry is present even when the wallet holds no credential for that query; its `matchedCredentials` array is then empty. Read the array length to find the queries that the holder cannot answer. The wallet returns `name` and `purpose` only for a request from an outside verifier that still uses a DIF Presentation Exchange definition. A DCQL query never produces them. properties: id: type: string description: Identifier of the DCQL credential query that these credentials match. Give this value as the `id` of the matching entry in the `credentials` array of the send operation. For a Presentation Exchange request this is the Input Descriptor identifier. example: Person Identification Data - PID name: type: string description: Human-readable name of the credential requirement. Present only for a Presentation Exchange request that holds a name. Never present for a DCQL query. purpose: type: string description: Reason why the verifier asks for this credential. Present only for a Presentation Exchange request that holds a purpose. Never present for a DCQL query. matchedCredentials: type: array description: 'Credentials in the wallet of the holder that agree with this query. The array is empty when the wallet holds no matching credential. The wallet always gives the property, and it is never `null`.' items: type: object properties: credentialId: type: string description: 'Identifier of the matching credential in the wallet of the holder. Give this value as `credentialId`, or in `credentialIds`, in the request body of the send operation.' example: d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11 type: type: array items: type: string description: Credential types of the matching W3C Verifiable Credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of the matching IETF SD-JWT VC. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of the matching ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. match: type: object additionalProperties: true description: | Claims of this credential that agree with the query. The keys are claim path pointers, and they are the values to put in `claimIds` in the request body of the send operation. For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example `org.iso.18013.5.1.family_name`. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace. When the query asks for no single claim, the wallet lists every claim that it can disclose: every `namespace.element` for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole `credentialSubject` for a W3C VC JWT. required: - credentialId - match required: - id - matchedCredentials inputDescriptors: type: array description: 'Matches for each Input Descriptor, for a request from an outside verifier that still uses a DIF Presentation Exchange definition, with one entry for every Input Descriptor. The wallet leaves this property out when the verifier sent a DCQL query.' items: type: object description: | Credentials in the wallet of the holder that match one credential query of the verifier. DCQL is the only query form that an iGrant.io verifier sends. For a DCQL query the wallet returns one entry for **every** credential query, with `id` and `matchedCredentials` only. An entry is present even when the wallet holds no credential for that query; its `matchedCredentials` array is then empty. Read the array length to find the queries that the holder cannot answer. The wallet returns `name` and `purpose` only for a request from an outside verifier that still uses a DIF Presentation Exchange definition. A DCQL query never produces them. properties: id: type: string description: Identifier of the DCQL credential query that these credentials match. Give this value as the `id` of the matching entry in the `credentials` array of the send operation. For a Presentation Exchange request this is the Input Descriptor identifier. example: Person Identification Data - PID name: type: string description: Human-readable name of the credential requirement. Present only for a Presentation Exchange request that holds a name. Never present for a DCQL query. purpose: type: string description: Reason why the verifier asks for this credential. Present only for a Presentation Exchange request that holds a purpose. Never present for a DCQL query. matchedCredentials: type: array description: 'Credentials in the wallet of the holder that agree with this query. The array is empty when the wallet holds no matching credential. The wallet always gives the property, and it is never `null`.' items: type: object properties: credentialId: type: string description: 'Identifier of the matching credential in the wallet of the holder. Give this value as `credentialId`, or in `credentialIds`, in the request body of the send operation.' example: d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11 type: type: array items: type: string description: Credential types of the matching W3C Verifiable Credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of the matching IETF SD-JWT VC. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of the matching ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. match: type: object additionalProperties: true description: | Claims of this credential that agree with the query. The keys are claim path pointers, and they are the values to put in `claimIds` in the request body of the send operation. For an ISO 18013-5 mDoc credential on the DCQL path, each key keeps its namespace, for example `org.iso.18013.5.1.family_name`. Only a request from an outside verifier that still uses Presentation Exchange gives keys without the namespace. When the query asks for no single claim, the wallet lists every claim that it can disclose: every `namespace.element` for an mDoc credential, the disclosed claim set for an IETF SD-JWT VC, and the whole `credentialSubject` for a W3C VC JWT. required: - credentialId - match required: - id - matchedCredentials headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The presentation ID is unknown, or the organisation runs in sandbox mode. Holder operations are not available to sandbox organisations.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Filter verification tags: - Digital Wallet (OpenID4VC) - Holder '/v3/config/digital-wallet/openid/sdjwt/verification/{presentationId}/send': post: description: | Builds the Verifiable Presentation from the credentials that the holder selected and sends it to the verifier. Give `credentials` when the presentation record holds a `dcqlQuery`. Give `inputDescriptors` when it does not, that is when the verifier sent a DIF Presentation Exchange definition. The two properties are mutually exclusive, and you must give one of them. Take the entry identifiers from the filter operation, or from `dcqlQuery.credentials[].id` on the presentation record. After a good answer, read `presentation.responseRedirectUri`. When it is not empty, send the holder to that address to finish the flow at the verifier. operationId: configSendDigitalWalletOpenIdVerificationPresentationV3 parameters: - description: 'Unique identifier of the presentation record in the wallet of the holder. This is the `presentationId` property of the record, not its `id` property.' in: path name: presentationId required: true schema: type: string example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: 'Credential selection for the request of the verifier, and the optional response encryption algorithm.' required: true content: application/json: schema: oneOf: - type: object title: DCQL selection description: Credential selection for a verifier that sent a DCQL query. Use this shape when the presentation record holds a `dcqlQuery`. required: - credentials properties: credentials: type: array description: Credentials that the holder selected for each credential query in the DCQL query. Give one entry for each query identifier that you must answer. items: type: object description: | Credentials that the holder selected for one DCQL credential query. Give `credentialId` for a query that takes one credential, or `credentialIds` for a query with `multiple` set to `true`. Do not give both. properties: id: type: string description: 'Identifier of the DCQL credential query that this entry answers. Use the `id` value that the filter operation returned, or `dcqlQuery.credentials[].id` from the presentation record.' example: Person Identification Data - PID credentialId: type: string description: Identifier of the credential in the wallet of the holder that answers this query. Use this property when the query takes one credential. example: d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11 credentialIds: type: array items: type: string description: Identifiers of the credentials that answer this query. Use this property in place of `credentialId` when the DCQL credential query sets `multiple` to `true`. claimIds: type: array items: type: string description: 'Claim path pointers of the claims to disclose from the selected credential. Give this property only when the DCQL credential query holds `claim_sets`. When you leave it out, the wallet discloses the claims that the query asks for.' required: - id encryptionAlgorithm: type: string description: 'JWE key management algorithm that the wallet uses to encrypt the Authorization Response. Give a value only when the verifier asks for an encrypted response. If you do not give a value, the wallet uses the algorithm that the verifier advertised.' enum: - ECDH-ES - type: object title: Presentation Definition selection (legacy) description: 'Credential selection for an outside verifier that still sends a DIF Presentation Exchange definition. An iGrant.io verifier sends DCQL only, so use this shape only when the presentation record holds no `dcqlQuery`.' required: - inputDescriptors properties: inputDescriptors: type: array description: Credential that the holder selected for each Input Descriptor. Give one entry for each Input Descriptor that the filter operation returned. The wallet reads only `id` and `credentialId` from each entry. items: type: object required: - id - credentialId properties: id: type: string description: Identifier of the Input Descriptor from the Presentation Exchange definition of the verifier. example: input-descriptor-1 credentialId: type: string description: Identifier of the credential in the wallet of the holder that fulfils this Input Descriptor. example: d29a6c1e-4b8f-4a1d-9c3e-7f5b2a0d8e11 encryptionAlgorithm: type: string description: 'JWE key management algorithm that the wallet uses to encrypt the Authorization Response. Give a value only when the verifier asks for an encrypted response. If you do not give a value, the wallet uses the algorithm that the verifier advertised.' enum: - ECDH-ES responses: '200': description: The wallet sent the Verifiable Presentation to the verifier. content: application/json: schema: type: object properties: presentation: allOf: - type: object description: | Presentation record in the wallet of the holder. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) Authorization Request that the holder got, and the presentation that the holder sent back. This V3 shape keeps `vpToken` as an array, so the wallet can send more than one Verifiable Presentation in a single Authorization Response. The wallet returns every property of this schema on every V3 holder operation. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: id: type: string description: Internal record identifier of the presentation. example: 6821b4b0f5b1c2a3d4e5f6a7 presentationId: type: string description: 'Unique identifier of this presentation in the wallet of the holder. Use this identifier to read the record, to send the presentation, or to delete the record.' example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 presentationExchangeId: type: string description: Identifier of the verification exchange at the verifier. It links this presentation to the verification history record of the verifier. example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this presentation record. organisationId: type: string description: Identifier of the organisation that owns the wallet of the holder. presentationSubmission: type: object description: | Presentation Submission object of the DIF Presentation Exchange specification. It maps the credentials of the holder to the requirements of the verifier. DCQL is the only query form that an iGrant.io verifier sends, and a DCQL Authorization Response carries no Presentation Submission, so the wallet returns `null` here for such a request. A value is present only when an outside verifier still sends a DIF Presentation Exchange definition. properties: definition_id: type: string description: Identifier of the presentation definition that this submission fulfils. descriptor_map: description: Descriptor Map entries. Each entry gives the position of one requested credential in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this entry satisfies. path: type: string description: JSONPath expression that points to the credential in the Verifiable Presentation token. path_nested: type: object description: 'Nested path descriptor for credentials in an envelope format, for example a JWT in a VP JWT.' properties: format: type: string description: 'Credential format of the nested credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this nested entry satisfies. path: type: string description: JSONPath expression that points to the credential in the envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier of this Presentation Submission. required: - definition_id - descriptor_map - id vpToken: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent to the verifier. The array holds one entry for each credential that the Authorization Request asked for. The array is empty until the holder sends the presentation. status: type: string enum: - presentation_pending - presentation_acked description: | Lifecycle status of the presentation in the wallet of the holder: 1. `presentation_pending`: The holder must select the matching credentials and send the Verifiable Presentation to the verifier. 2. `presentation_acked`: The wallet sent the Verifiable Presentation and the verifier accepted it. example: presentation_pending verified: type: boolean description: '`true` when the verifier accepted the presentation and the checks of the verifier passed. The receive and send operations always return `false`. The server sets this value later, when the verification webhook reports the result.' presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation. Each entry holds the result of the signature check, the expiry check and the revocation check. The receive and send operations always return `null`. The server sets this value later, when the verification webhook reports the result.' vpRequestState: type: string description: State value of the Authorization Request of the verifier. The wallet returns this value with the Authorization Response so that the verifier can match the two. example: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f clientId: type: string description: 'Client identifier of the verifier from the Authorization Request, for example a URI or a DID.' redirectUri: type: string description: Redirect URI from the Authorization Request. The wallet posts the Authorization Response to this URI. requestUri: type: string description: Request URI of the Authorization Request. The wallet gets the full Authorization Request from this URI when the verifier passes the request by reference. responseRedirectUri: type: string description: Redirect URI that the verifier returned in the Authorization Response. The wallet sends the holder to this URI after the verifier processed the presentation. presentationDefinition: type: string description: 'DIF Presentation Exchange definition of the verifier, as a serialised JSON string. Empty when the verifier sent a DCQL query, which is the only query form that an iGrant.io verifier sends. Read `dcqlQuery` for the credential and claim requirements.' nonce: type: string description: Cryptographic nonce from the Authorization Request. The wallet puts this value in the Key Binding JWT to keep the presentation fresh and to stop replay. example: z4cVLRsq9pKx0NgQ7E3hJg responseType: type: string description: OAuth 2.0 response type of the Authorization Request. It tells the wallet what to send back. enum: - vp_token - id_token - device_response credentialId: type: string description: Identifier of the credential in the wallet that the holder chose for this presentation. clientMetadata: type: object description: Metadata of the verifier from the Authorization Request. The wallet shows this information to the holder before the holder approves the presentation. properties: clientName: type: string description: Display name of the verifier. logoUri: type: string description: URL of the logo of the verifier. location: type: string description: Location or address of the verifier. coverUri: type: string description: URL of the cover image of the verifier. description: type: string description: Description of the verifier. required: - clientName - logoUri - location - coverUri - description presentation: type: array description: Credentials that the Verifiable Presentation holds. The array is empty until the holder sends the presentation. items: type: object properties: id: type: string description: 'Identifier of the DCQL credential query that this credential satisfies. For a request from an outside verifier that still uses Presentation Exchange, this is the Input Descriptor identifier.' credentialId: type: string description: Identifier of the credential in the wallet of the holder. type: type: array items: type: string description: Credential types of the presented W3C Verifiable Credential. The wallet leaves this property out for other credential formats. credentialSubject: type: object additionalProperties: true description: Disclosed claims of a presented W3C VC JWT credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of a presented IETF SD-JWT VC credential. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of a presented ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. claims: type: object additionalProperties: true description: Disclosed claims of a presented SD-JWT VC or mDoc credential. The wallet leaves this property out for other credential formats. required: - id - credentialId transactionData: description: 'Transaction data from the Authorization Request, as the verifier sent it. The value is normally an array of base64url strings. The holder must approve this data before the wallet sends the presentation. Read `transactionDataDecoded` to show the data to the holder.' transactionDataDecoded: type: array items: type: object additionalProperties: true description: Decoded transaction data. The wallet shows these objects to the holder for approval. dataAgreement: type: object additionalProperties: true description: Data agreement from the Authorization Request. It gives the terms that govern this verification exchange. legalPidAttestation: type: string description: Legal Person Identification Data attestation of the verifier. The wallet uses it to check the legal identity of the verifier. legalPidAttestationPop: type: string description: Proof of possession for the Legal Person Identification Data attestation of the verifier. legalPidVerified: type: boolean description: '`true` when the wallet checked the Legal Person Identification Data attestation of the verifier and the check passed.' isVerifiedWithTrustList: type: boolean description: '`true` when the wallet found the verifier in a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Trust Service Provider entry that the wallet used to check the identity of the verifier. trustAnchor: type: string description: 'DID method, or key type, of the trust anchor that the wallet uses for this presentation.' enum: - 'did:key' - x509 kid: type: string description: 'Key identifier of the key that the wallet uses to sign the Key Binding JWT, or to decrypt the Authorization Response.' idToken: type: string description: OpenID Connect ID Token that the wallet sent to the verifier. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token that the wallet sent. clientIdScheme: type: string description: Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash verifierAttestation: type: string description: Verifier Attestation JWT from the verifier. It proves that the verifier may ask for the requested credentials. dcqlQuery: type: object additionalProperties: true description: 'Digital Credentials Query Language (DCQL) query from the Authorization Request. Read `credentials[].id` from this query to build the `credentials` array of the send operation. `null` when the verifier sent a DIF Presentation Exchange definition instead.' encryptionJwk: type: object additionalProperties: true description: Public key of the verifier as a JWK. The wallet uses it to encrypt the Authorization Response when the response mode asks for encryption. encryptedResponseEncValuesSupported: type: array items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM description: JWE content encryption algorithms that the verifier accepts for the encrypted Authorization Response. encryptionAlgorithm: type: string description: JWE key management algorithm that the wallet used to encrypt the Authorization Response. Empty when the response mode does not ask for encryption. enum: - ECDH-ES createdAt: type: number description: Unix timestamp in seconds when the wallet made this record. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the wallet last changed this record. example: 1747011600 required: - id - presentationId - presentationExchangeId - openIdOrganisationId - organisationId - status - verified - vpRequestState - clientId - redirectUri - requestUri - responseRedirectUri - presentationDefinition - nonce - responseType - credentialId - clientMetadata - legalPidAttestation - legalPidAttestationPop - legalPidVerified - isVerifiedWithTrustList - trustAnchor - kid - idToken - clientIdScheme - verifierAttestation - encryptionAlgorithm - createdAt - updatedAt description: 'Updated presentation record. The status changes to `presentation_acked` when the verifier accepts the Verifiable Presentation. The wallet does not refresh `transactionData`, `transactionDataDecoded` and `dataAgreement` here; they keep the values from the receive operation.' required: - presentation headers: {} '400': content: application/json: schema: oneOf: - required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter - type: object title: Digital wallet error description: 'Error body of the digital wallet, forwarded byte-for-byte.' properties: detail: description: Reason the digital wallet refused the Verifiable Presentation. required: - detail description: | The presentation ID is unknown, the request gives both `inputDescriptors` and `credentials` or neither of them, the record holds a `dcqlQuery` and the request gives `inputDescriptors`, an entry has neither `credentialId` nor `credentialIds`, the verifier does not support the requested encryption algorithm, or the verifier refused the Verifiable Presentation. This operation forwards a JSON error body of the digital wallet without a change. The body is therefore the `errorCode` and `errorDescription` shape of the gateway, or the `detail` shape of the digital wallet. Every other holder operation always uses the gateway shape. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Send verification tags: - Digital Wallet (OpenID4VC) - Holder '/v3/config/digital-wallet/openid/sdjwt/verification/{presentationId}': get: description: | Retrieves a presentation record (V3) from the wallet of the holder. The V3 record adds DCQL, transaction data, trust list and response encryption fields. Give the `presentationId` property of the record, not its `id` property. The receive operation returns that value. operationId: configReadDigitalWalletOpenIdVerificationV3 parameters: - description: 'Unique identifier of the presentation record in the wallet of the holder. This is the `presentationId` property of the record, not its `id` property.' in: path name: presentationId required: true schema: type: string example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet returns the presentation record. content: application/json: schema: type: object properties: presentation: allOf: - type: object description: | Presentation record in the wallet of the holder. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) Authorization Request that the holder got, and the presentation that the holder sent back. This V3 shape keeps `vpToken` as an array, so the wallet can send more than one Verifiable Presentation in a single Authorization Response. The wallet returns every property of this schema on every V3 holder operation. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: id: type: string description: Internal record identifier of the presentation. example: 6821b4b0f5b1c2a3d4e5f6a7 presentationId: type: string description: 'Unique identifier of this presentation in the wallet of the holder. Use this identifier to read the record, to send the presentation, or to delete the record.' example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 presentationExchangeId: type: string description: Identifier of the verification exchange at the verifier. It links this presentation to the verification history record of the verifier. example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this presentation record. organisationId: type: string description: Identifier of the organisation that owns the wallet of the holder. presentationSubmission: type: object description: | Presentation Submission object of the DIF Presentation Exchange specification. It maps the credentials of the holder to the requirements of the verifier. DCQL is the only query form that an iGrant.io verifier sends, and a DCQL Authorization Response carries no Presentation Submission, so the wallet returns `null` here for such a request. A value is present only when an outside verifier still sends a DIF Presentation Exchange definition. properties: definition_id: type: string description: Identifier of the presentation definition that this submission fulfils. descriptor_map: description: Descriptor Map entries. Each entry gives the position of one requested credential in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this entry satisfies. path: type: string description: JSONPath expression that points to the credential in the Verifiable Presentation token. path_nested: type: object description: 'Nested path descriptor for credentials in an envelope format, for example a JWT in a VP JWT.' properties: format: type: string description: 'Credential format of the nested credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this nested entry satisfies. path: type: string description: JSONPath expression that points to the credential in the envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier of this Presentation Submission. required: - definition_id - descriptor_map - id vpToken: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent to the verifier. The array holds one entry for each credential that the Authorization Request asked for. The array is empty until the holder sends the presentation. status: type: string enum: - presentation_pending - presentation_acked description: | Lifecycle status of the presentation in the wallet of the holder: 1. `presentation_pending`: The holder must select the matching credentials and send the Verifiable Presentation to the verifier. 2. `presentation_acked`: The wallet sent the Verifiable Presentation and the verifier accepted it. example: presentation_pending verified: type: boolean description: '`true` when the verifier accepted the presentation and the checks of the verifier passed. The receive and send operations always return `false`. The server sets this value later, when the verification webhook reports the result.' presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation. Each entry holds the result of the signature check, the expiry check and the revocation check. The receive and send operations always return `null`. The server sets this value later, when the verification webhook reports the result.' vpRequestState: type: string description: State value of the Authorization Request of the verifier. The wallet returns this value with the Authorization Response so that the verifier can match the two. example: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f clientId: type: string description: 'Client identifier of the verifier from the Authorization Request, for example a URI or a DID.' redirectUri: type: string description: Redirect URI from the Authorization Request. The wallet posts the Authorization Response to this URI. requestUri: type: string description: Request URI of the Authorization Request. The wallet gets the full Authorization Request from this URI when the verifier passes the request by reference. responseRedirectUri: type: string description: Redirect URI that the verifier returned in the Authorization Response. The wallet sends the holder to this URI after the verifier processed the presentation. presentationDefinition: type: string description: 'DIF Presentation Exchange definition of the verifier, as a serialised JSON string. Empty when the verifier sent a DCQL query, which is the only query form that an iGrant.io verifier sends. Read `dcqlQuery` for the credential and claim requirements.' nonce: type: string description: Cryptographic nonce from the Authorization Request. The wallet puts this value in the Key Binding JWT to keep the presentation fresh and to stop replay. example: z4cVLRsq9pKx0NgQ7E3hJg responseType: type: string description: OAuth 2.0 response type of the Authorization Request. It tells the wallet what to send back. enum: - vp_token - id_token - device_response credentialId: type: string description: Identifier of the credential in the wallet that the holder chose for this presentation. clientMetadata: type: object description: Metadata of the verifier from the Authorization Request. The wallet shows this information to the holder before the holder approves the presentation. properties: clientName: type: string description: Display name of the verifier. logoUri: type: string description: URL of the logo of the verifier. location: type: string description: Location or address of the verifier. coverUri: type: string description: URL of the cover image of the verifier. description: type: string description: Description of the verifier. required: - clientName - logoUri - location - coverUri - description presentation: type: array description: Credentials that the Verifiable Presentation holds. The array is empty until the holder sends the presentation. items: type: object properties: id: type: string description: 'Identifier of the DCQL credential query that this credential satisfies. For a request from an outside verifier that still uses Presentation Exchange, this is the Input Descriptor identifier.' credentialId: type: string description: Identifier of the credential in the wallet of the holder. type: type: array items: type: string description: Credential types of the presented W3C Verifiable Credential. The wallet leaves this property out for other credential formats. credentialSubject: type: object additionalProperties: true description: Disclosed claims of a presented W3C VC JWT credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of a presented IETF SD-JWT VC credential. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of a presented ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. claims: type: object additionalProperties: true description: Disclosed claims of a presented SD-JWT VC or mDoc credential. The wallet leaves this property out for other credential formats. required: - id - credentialId transactionData: description: 'Transaction data from the Authorization Request, as the verifier sent it. The value is normally an array of base64url strings. The holder must approve this data before the wallet sends the presentation. Read `transactionDataDecoded` to show the data to the holder.' transactionDataDecoded: type: array items: type: object additionalProperties: true description: Decoded transaction data. The wallet shows these objects to the holder for approval. dataAgreement: type: object additionalProperties: true description: Data agreement from the Authorization Request. It gives the terms that govern this verification exchange. legalPidAttestation: type: string description: Legal Person Identification Data attestation of the verifier. The wallet uses it to check the legal identity of the verifier. legalPidAttestationPop: type: string description: Proof of possession for the Legal Person Identification Data attestation of the verifier. legalPidVerified: type: boolean description: '`true` when the wallet checked the Legal Person Identification Data attestation of the verifier and the check passed.' isVerifiedWithTrustList: type: boolean description: '`true` when the wallet found the verifier in a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Trust Service Provider entry that the wallet used to check the identity of the verifier. trustAnchor: type: string description: 'DID method, or key type, of the trust anchor that the wallet uses for this presentation.' enum: - 'did:key' - x509 kid: type: string description: 'Key identifier of the key that the wallet uses to sign the Key Binding JWT, or to decrypt the Authorization Response.' idToken: type: string description: OpenID Connect ID Token that the wallet sent to the verifier. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token that the wallet sent. clientIdScheme: type: string description: Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash verifierAttestation: type: string description: Verifier Attestation JWT from the verifier. It proves that the verifier may ask for the requested credentials. dcqlQuery: type: object additionalProperties: true description: 'Digital Credentials Query Language (DCQL) query from the Authorization Request. Read `credentials[].id` from this query to build the `credentials` array of the send operation. `null` when the verifier sent a DIF Presentation Exchange definition instead.' encryptionJwk: type: object additionalProperties: true description: Public key of the verifier as a JWK. The wallet uses it to encrypt the Authorization Response when the response mode asks for encryption. encryptedResponseEncValuesSupported: type: array items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM description: JWE content encryption algorithms that the verifier accepts for the encrypted Authorization Response. encryptionAlgorithm: type: string description: JWE key management algorithm that the wallet used to encrypt the Authorization Response. Empty when the response mode does not ask for encryption. enum: - ECDH-ES createdAt: type: number description: Unix timestamp in seconds when the wallet made this record. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the wallet last changed this record. example: 1747011600 required: - id - presentationId - presentationExchangeId - openIdOrganisationId - organisationId - status - verified - vpRequestState - clientId - redirectUri - requestUri - responseRedirectUri - presentationDefinition - nonce - responseType - credentialId - clientMetadata - legalPidAttestation - legalPidAttestationPop - legalPidVerified - isVerifiedWithTrustList - trustAnchor - kid - idToken - clientIdScheme - verifierAttestation - encryptionAlgorithm - createdAt - updatedAt description: Presentation record for the given presentation ID. required: - presentation headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The presentation ID is unknown. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read verification tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/verification/{presentationId}': delete: description: | Deletes a presentation record from the wallet of the holder. The response has no body. The server marks the record as deleted and asks the digital wallet deployment to delete its copy. The list operations leave out a deleted record. The server does not wait for the digital wallet deployment, so a successful answer does not prove that the wallet deleted its copy. There is no V3 version of this operation. Use it also for a record that you made with the V3 receive operation. operationId: configDeleteDigitalWalletOpenIdVerification parameters: - description: 'Unique identifier of the presentation record in the wallet of the holder. This is the `presentationId` property of the record, not its `id` property.' in: path name: presentationId required: true schema: type: string example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 responses: '204': description: The wallet deleted the presentation record. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The presentation ID is unknown, or the organisation runs in sandbox mode. Holder operations are not available to sandbox organisations.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete verification tags: - Digital Wallet (OpenID4VC) - Holder /v3/config/digital-wallet/openid/sdjwt/verifications: get: description: | Lists the presentation records (V3) in the wallet of the holder. You can filter the records by status and by a search term, and set the sort order. The wallet sorts the records by `updatedAt`. `search` matches a part of the credential type, the `vct`, the `doctype` and the display name of the verifier. It does not look at the presentation identifiers. `sortOrder` takes `asc` or `desc`; the wallet uses `desc` for every other value. The wallet does not return a record that a delete operation removed. operationId: configListDigitalWalletOpenIdVerificationV3 parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - description: Filter the presentation records by lifecycle status. in: query name: status required: false schema: type: string enum: - presentation_pending - presentation_acked - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: type: object properties: presentation: type: array description: Presentation records on the requested page. The array is empty when the wallet holds no records. items: type: object description: | Presentation record in the wallet of the holder. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) Authorization Request that the holder got, and the presentation that the holder sent back. This V3 shape keeps `vpToken` as an array, so the wallet can send more than one Verifiable Presentation in a single Authorization Response. The wallet returns every property of this schema on every V3 holder operation. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: id: type: string description: Internal record identifier of the presentation. example: 6821b4b0f5b1c2a3d4e5f6a7 presentationId: type: string description: 'Unique identifier of this presentation in the wallet of the holder. Use this identifier to read the record, to send the presentation, or to delete the record.' example: 3f2a7c18-9b4e-4d0a-8c6f-1e5b2a9d4c73 presentationExchangeId: type: string description: Identifier of the verification exchange at the verifier. It links this presentation to the verification history record of the verifier. example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this presentation record. organisationId: type: string description: Identifier of the organisation that owns the wallet of the holder. presentationSubmission: type: object description: | Presentation Submission object of the DIF Presentation Exchange specification. It maps the credentials of the holder to the requirements of the verifier. DCQL is the only query form that an iGrant.io verifier sends, and a DCQL Authorization Response carries no Presentation Submission, so the wallet returns `null` here for such a request. A value is present only when an outside verifier still sends a DIF Presentation Exchange definition. properties: definition_id: type: string description: Identifier of the presentation definition that this submission fulfils. descriptor_map: description: Descriptor Map entries. Each entry gives the position of one requested credential in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this entry satisfies. path: type: string description: JSONPath expression that points to the credential in the Verifiable Presentation token. path_nested: type: object description: 'Nested path descriptor for credentials in an envelope format, for example a JWT in a VP JWT.' properties: format: type: string description: 'Credential format of the nested credential, for example `jwt_vc_json`, `dc+sd-jwt` or `mso_mdoc`.' id: type: string description: Identifier of the Input Descriptor that this nested entry satisfies. path: type: string description: JSONPath expression that points to the credential in the envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier of this Presentation Submission. required: - definition_id - descriptor_map - id vpToken: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent to the verifier. The array holds one entry for each credential that the Authorization Request asked for. The array is empty until the holder sends the presentation. status: type: string enum: - presentation_pending - presentation_acked description: | Lifecycle status of the presentation in the wallet of the holder: 1. `presentation_pending`: The holder must select the matching credentials and send the Verifiable Presentation to the verifier. 2. `presentation_acked`: The wallet sent the Verifiable Presentation and the verifier accepted it. example: presentation_pending verified: type: boolean description: '`true` when the verifier accepted the presentation and the checks of the verifier passed. The receive and send operations always return `false`. The server sets this value later, when the verification webhook reports the result.' presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation. Each entry holds the result of the signature check, the expiry check and the revocation check. The receive and send operations always return `null`. The server sets this value later, when the verification webhook reports the result.' vpRequestState: type: string description: State value of the Authorization Request of the verifier. The wallet returns this value with the Authorization Response so that the verifier can match the two. example: 5d8f2c9b-c2a4-4f0c-9a7d-1c2b3a4d5e6f clientId: type: string description: 'Client identifier of the verifier from the Authorization Request, for example a URI or a DID.' redirectUri: type: string description: Redirect URI from the Authorization Request. The wallet posts the Authorization Response to this URI. requestUri: type: string description: Request URI of the Authorization Request. The wallet gets the full Authorization Request from this URI when the verifier passes the request by reference. responseRedirectUri: type: string description: Redirect URI that the verifier returned in the Authorization Response. The wallet sends the holder to this URI after the verifier processed the presentation. presentationDefinition: type: string description: 'DIF Presentation Exchange definition of the verifier, as a serialised JSON string. Empty when the verifier sent a DCQL query, which is the only query form that an iGrant.io verifier sends. Read `dcqlQuery` for the credential and claim requirements.' nonce: type: string description: Cryptographic nonce from the Authorization Request. The wallet puts this value in the Key Binding JWT to keep the presentation fresh and to stop replay. example: z4cVLRsq9pKx0NgQ7E3hJg responseType: type: string description: OAuth 2.0 response type of the Authorization Request. It tells the wallet what to send back. enum: - vp_token - id_token - device_response credentialId: type: string description: Identifier of the credential in the wallet that the holder chose for this presentation. clientMetadata: type: object description: Metadata of the verifier from the Authorization Request. The wallet shows this information to the holder before the holder approves the presentation. properties: clientName: type: string description: Display name of the verifier. logoUri: type: string description: URL of the logo of the verifier. location: type: string description: Location or address of the verifier. coverUri: type: string description: URL of the cover image of the verifier. description: type: string description: Description of the verifier. required: - clientName - logoUri - location - coverUri - description presentation: type: array description: Credentials that the Verifiable Presentation holds. The array is empty until the holder sends the presentation. items: type: object properties: id: type: string description: 'Identifier of the DCQL credential query that this credential satisfies. For a request from an outside verifier that still uses Presentation Exchange, this is the Input Descriptor identifier.' credentialId: type: string description: Identifier of the credential in the wallet of the holder. type: type: array items: type: string description: Credential types of the presented W3C Verifiable Credential. The wallet leaves this property out for other credential formats. credentialSubject: type: object additionalProperties: true description: Disclosed claims of a presented W3C VC JWT credential. The wallet leaves this property out for other credential formats. vct: type: string description: Verifiable Credential Type of a presented IETF SD-JWT VC credential. The wallet leaves this property out for other credential formats. doctype: type: string description: Document type of a presented ISO 18013-5 mDoc credential. The wallet leaves this property out for other credential formats. claims: type: object additionalProperties: true description: Disclosed claims of a presented SD-JWT VC or mDoc credential. The wallet leaves this property out for other credential formats. required: - id - credentialId transactionData: description: 'Transaction data from the Authorization Request, as the verifier sent it. The value is normally an array of base64url strings. The holder must approve this data before the wallet sends the presentation. Read `transactionDataDecoded` to show the data to the holder.' transactionDataDecoded: type: array items: type: object additionalProperties: true description: Decoded transaction data. The wallet shows these objects to the holder for approval. dataAgreement: type: object additionalProperties: true description: Data agreement from the Authorization Request. It gives the terms that govern this verification exchange. legalPidAttestation: type: string description: Legal Person Identification Data attestation of the verifier. The wallet uses it to check the legal identity of the verifier. legalPidAttestationPop: type: string description: Proof of possession for the Legal Person Identification Data attestation of the verifier. legalPidVerified: type: boolean description: '`true` when the wallet checked the Legal Person Identification Data attestation of the verifier and the check passed.' isVerifiedWithTrustList: type: boolean description: '`true` when the wallet found the verifier in a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Trust Service Provider entry that the wallet used to check the identity of the verifier. trustAnchor: type: string description: 'DID method, or key type, of the trust anchor that the wallet uses for this presentation.' enum: - 'did:key' - x509 kid: type: string description: 'Key identifier of the key that the wallet uses to sign the Key Binding JWT, or to decrypt the Authorization Response.' idToken: type: string description: OpenID Connect ID Token that the wallet sent to the verifier. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token that the wallet sent. clientIdScheme: type: string description: Client ID scheme of the Authorization Request. It sets how the verifier identifies itself to the wallet. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash verifierAttestation: type: string description: Verifier Attestation JWT from the verifier. It proves that the verifier may ask for the requested credentials. dcqlQuery: type: object additionalProperties: true description: 'Digital Credentials Query Language (DCQL) query from the Authorization Request. Read `credentials[].id` from this query to build the `credentials` array of the send operation. `null` when the verifier sent a DIF Presentation Exchange definition instead.' encryptionJwk: type: object additionalProperties: true description: Public key of the verifier as a JWK. The wallet uses it to encrypt the Authorization Response when the response mode asks for encryption. encryptedResponseEncValuesSupported: type: array items: type: string enum: - A128CBC-HS256 - A128GCM - A256GCM description: JWE content encryption algorithms that the verifier accepts for the encrypted Authorization Response. encryptionAlgorithm: type: string description: JWE key management algorithm that the wallet used to encrypt the Authorization Response. Empty when the response mode does not ask for encryption. enum: - ECDH-ES createdAt: type: number description: Unix timestamp in seconds when the wallet made this record. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the wallet last changed this record. example: 1747011600 required: - id - presentationId - presentationExchangeId - openIdOrganisationId - organisationId - status - verified - vpRequestState - clientId - redirectUri - requestUri - responseRedirectUri - presentationDefinition - nonce - responseType - credentialId - clientMetadata - legalPidAttestation - legalPidAttestationPop - legalPidVerified - isVerifiedWithTrustList - trustAnchor - kid - idToken - clientIdScheme - verifierAttestation - encryptionAlgorithm - createdAt - updatedAt pagination: allOf: - type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Page details for the returned presentation records. executionTime: type: number format: double description: Time in seconds that the server used to build this response. example: 0.042 presentationStats: type: object description: 'Counts of the presentation records for the organisation. The counts cover all records, not only the records on this page, and the status filter does not change them.' properties: total: type: integer format: int64 description: Total number of presentation records in the holder's wallet. example: 24 presentationShared: type: integer format: int64 description: Number of presentation records with the status `presentation_acked`. example: 18 presentationPending: type: integer format: int64 description: Number of presentation records with the status `presentation_pending`. example: 6 required: - total - presentationShared - presentationPending required: - presentation - pagination - executionTime - presentationStats description: The wallet returns the presentation records. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the wallet is not deployed for the organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List verification tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid: post: description: |- Deploys the OID4VC digital wallet for the organisation. The service registers the organisation with the OpenID wallet backend and returns the endpoints of the new deployment. Call this operation once, before you create a global configuration, a credential definition or a presentation definition. The organisation must have no deployment yet. If a deployment exists or a deployment request is open, the service answers with HTTP 400. There is no operation that removes a deployment, so you cannot deploy the wallet a second time. operationId: configDeployDigitalWalletOpenId requestBody: description: Optional seed for the key material of the wallet. Send an empty body to let the service make the deployment without a seed. required: false content: application/json: schema: type: object properties: cryptographicSeed: type: string description: 'Seed that the service uses for the key material of the wallet. This field is optional. The service uses the value only when it holds one character or more, and it sends no seed when you give an empty value or leave the field out. Treat this value as a secret: keep it out of logs and out of version control.' example: 0d1f2a3b4c5d6e7f8091a2b3c4d5e6f7 example: cryptographicSeed: 0d1f2a3b4c5d6e7f8091a2b3c4d5e6f7 responses: '200': description: The service deployed the OpenID digital wallet and returned the deployment details. content: application/json: schema: type: object properties: agentServiceEndpoint: type: string description: Base URL of the OID4VCI and OpenID4VP service of the organisation. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service' credentialOfferEndpoint: type: string description: URL of the OID4VCI Credential Offer endpoint. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/credential-offer' version: type: string description: Software version of the deployed agent. example: 1.0.0 status: type: integer description: 'Deployment status of the agent. A successful deploy always sets the status to Deployed, so this operation always gives `2`.' enum: - 2 example: 2 statusStr: type: string description: Deployment status of the agent as text. This operation always gives `Deployed`. enum: - Deployed example: Deployed ledgerName: type: string description: Name of the distributed ledger that the agent uses for DID registration. example: European Blockchain Services Infrastructure ledgerURL: type: string description: URL of the distributed ledger. example: 'https://hub.ebsi.eu/' ledgerID: type: integer description: Identifier of the ledger network. The service does not set this field and always returns `0`. example: 0 infrastructureProvider: type: string description: Infrastructure provider that hosts the agent. example: iGrant.io deploymentRegion: type: string description: Geographic region of the agent deployment. example: 'Europe: Frankfurt' isWalletProvider: type: boolean description: 'When `true`, the organisation is a wallet provider and can issue Wallet Unit Attestations. A new deployment always returns `false`. Use the update operation on this path to enable the capability.' example: false required: - agentServiceEndpoint - credentialOfferEndpoint - version - status - statusStr - ledgerName - ledgerURL - ledgerID - infrastructureProvider - deploymentRegion - isWalletProvider headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the organisation already has a deployment, a deployment request is already open, or the wallet backend refused the registration.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Deploy digital wallet tags: - Digital Wallet (OpenID4VC) - Wallet Provider get: description: |- Reads the OID4VC digital wallet deployment of the organisation. The response gives the deployment status, the service endpoints, and the well-known metadata URLs that wallets and verifiers use. The service answers with HTTP 200 even when the organisation has no deployment. In that case `status` is `0`, `statusStr` is `Not Configured`, `secureVaults` is `null`, and every endpoint and metadata URL is an empty string. Read `status` before you use the URLs. operationId: configReadDigitalWalletOpenId responses: '200': description: The service returned the OpenID digital wallet deployment details. content: application/json: schema: type: object properties: agentServiceEndpoint: type: string description: Base URL of the OID4VCI and OpenID4VP service of the organisation. The value is an empty string when the organisation has no deployment. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service' credentialOfferEndpoint: type: string description: URL of the OID4VCI Credential Offer endpoint. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/credential-offer' version: type: string description: Software version of the deployed agent. example: 1.0.0 status: type: integer description: 'Deployment status of the agent. This operation gives `0` (Not Configured) or `2` (Deployed) only. It reports every status other than Deployed as `0`, so it never gives `1` (Requested).' enum: - 0 - 2 example: 2 statusStr: type: string description: 'Deployment status of the agent as text. This operation gives `Not Configured` or `Deployed` only, for the same reason as `status`.' enum: - Not Configured - Deployed example: Deployed ledgerName: type: string description: Name of the distributed ledger that the agent uses for DID registration. The service returns this constant value also when the organisation has no deployment. example: European Blockchain Services Infrastructure ledgerURL: type: string description: URL of the distributed ledger. The service returns this constant value also when the organisation has no deployment. example: 'https://hub.ebsi.eu/' ledgerID: type: integer description: Identifier of the ledger network. The service does not set this field and always returns `0`. example: 0 infrastructureProvider: type: string description: Infrastructure provider that hosts the agent. The service returns `iGrant.io` also when the organisation has no deployment. example: iGrant.io deploymentRegion: type: string description: Geographic region of the agent deployment. The service returns this constant value also when the organisation has no deployment. example: 'Europe: Frankfurt' isWalletProvider: type: boolean description: 'When `true`, the organisation is a wallet provider and can issue Wallet Unit Attestations.' example: false secureVaults: type: array nullable: true description: Key management backends that the organisation configured. The value is `null` when the organisation configured none. items: type: integer description: Identifier of a key management backend. `0` is Not Configured. `1` is the iGrant.io vault. `2` is HashiCorp Vault. `3` is a Qualified Trust Service Provider (QTSP). `4` is the database-backed vault. enum: - 0 - 1 - 2 - 3 - 4 example: - 1 credentialIssuerMetadata: type: string description: URL of the OID4VCI Credential Issuer Metadata document. The value is an empty string when the organisation has no deployment. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/.well-known/openid-credential-issuer' authorizationServerMetadata: type: string description: URL of the OAuth 2.0 Authorization Server Metadata document. The value is an empty string when the organisation has no deployment. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/.well-known/oauth-authorization-server' notificationEndpoint: type: string description: URL of the OID4VCI Notification Endpoint. The value is an empty string when the organisation has no deployment. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/notification' jwksEndpoint: type: string description: URL of the JSON Web Key Set of the organisation. The value is an empty string when the organisation has no deployment. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/jwks' required: - agentServiceEndpoint - credentialOfferEndpoint - version - status - statusStr - ledgerName - ledgerURL - ledgerID - infrastructureProvider - deploymentRegion - isWalletProvider - secureVaults - credentialIssuerMetadata - authorizationServerMetadata - notificationEndpoint - jwksEndpoint headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The service cannot read the organisation. This operation reports an unknown organisation with this status, not with HTTP 400.' headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read digital wallet deployment tags: - Digital Wallet (OpenID4VC) - Wallet Provider put: description: 'Enables the wallet provider capability for the organisation. Send `isWalletProvider` with the value `true`. The service then registers the organisation as a wallet provider and the organisation can register wallet units and issue Wallet Unit Attestations. If you send `false`, the service keeps the current value and returns the deployment details.' operationId: configUpdateDigitalWalletOpenId requestBody: description: The wallet provider capability to set for the organisation. required: true content: application/json: schema: type: object properties: isWalletProvider: type: boolean description: Set to `true` to enable the wallet provider capability. The service ignores the value `false` and keeps the current setting. example: true example: isWalletProvider: true parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service returned the OpenID digital wallet deployment details. content: application/json: schema: type: object properties: agentServiceEndpoint: type: string description: Base URL of the OID4VCI and OpenID4VP service of the organisation. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service' credentialOfferEndpoint: type: string description: URL of the OID4VCI Credential Offer endpoint. example: 'https://api.igrant.io/v2/organisation/62d9e0b9e5b1a80001d0f8b1/service/credential-offer' version: type: string description: Software version of the deployed agent. example: 1.0.0 status: type: integer description: Deployment status of the agent. `0` is Not Configured. `1` is Requested. `2` is Deployed. enum: - 0 - 1 - 2 example: 2 statusStr: type: string description: Deployment status of the agent as text. enum: - Not Configured - Requested - Deployed example: Deployed ledgerName: type: string description: Name of the distributed ledger that the agent uses for DID registration. example: European Blockchain Services Infrastructure ledgerURL: type: string description: URL of the distributed ledger. example: 'https://hub.ebsi.eu/' ledgerID: type: integer description: Identifier of the ledger network. The service does not set this field and always returns `0`. example: 0 infrastructureProvider: type: string description: Infrastructure provider that hosts the agent. example: iGrant.io deploymentRegion: type: string description: Geographic region of the agent deployment. example: 'Europe: Frankfurt' isWalletProvider: type: boolean description: 'When `true`, the organisation is a wallet provider and can issue Wallet Unit Attestations.' example: true required: - agentServiceEndpoint - credentialOfferEndpoint - version - status - statusStr - ledgerName - ledgerURL - ledgerID - infrastructureProvider - deploymentRegion - isWalletProvider headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is already a wallet provider, or the service cannot resolve the wallet deployment.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Enable wallet provider tags: - Digital Wallet (OpenID4VC) - Wallet Provider /v2/config/digital-wallet/openid/wallet-provider/wallet-unit: post: description: |- Registers a new wallet unit with the wallet provider. The wallet provider uses this registration to issue a Wallet Unit Attestation (WUA) to the wallet instance. The organisation must have the wallet provider capability enabled. To enable it, use `PUT /v2/config/digital-wallet/openid`. The response holds the `assertionToken` of the new wallet unit. This token is secret. Send it only to the wallet instance. operationId: configCreateDigitalWalletOpenIdWalletUnit requestBody: description: Details of the wallet unit to register. required: true content: application/json: schema: type: object title: CreateWalletUnit properties: clientId: type: string description: Client identifier for the new wallet unit (DID or URL). clientUrl: type: string description: URL endpoint of the wallet instance. Optional. clientPublicKey: type: object additionalProperties: true description: Public key JWK of the wallet instance for cryptographic verification. The service refuses the request when this object is empty. isAuthorised: type: boolean default: false description: Set to `true` to authorize this wallet unit upon creation. Only an authorised wallet unit can get a Wallet Unit Attestation. required: - clientId - clientPublicKey example: clientId: 'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbsEYvdrjxMjQ4tpnje9BDBTzuNDP3knn6qLZErzd4bJ5go2CChoPjd5GAH3zpFJP5fuwSk66U5Pq6EhF4nKnHzDnznEP8fX99nZGgwbAh1o7Gj1X52Tdhf7U4KHBFNNQ' clientUrl: 'https://wallet.example.com' clientPublicKey: kty: EC crv: P-256 x: 8Yf3vHFbnJfLpFbnkPZ8Gk8Yr1nQqf0dQ3Xl1kNfQvY 'y': 4Kk9Fw2h1Lm6bBcQeR7sT0uV3wXyZaBcDeFgHiJkLmN isAuthorised: true parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: The wallet provider registered the wallet unit. content: application/json: schema: type: object properties: walletUnit: description: The wallet unit record that the wallet provider created. type: object title: WalletUnit properties: id: type: string description: Unique identifier for the wallet unit record. Use this value as the `walletUnitId` path parameter. clientId: type: string description: 'Client identifier of the wallet instance, typically a DID or URL. Used to identify the wallet during OID4VCI and OpenID4VP protocol interactions.' clientUrl: type: string description: 'URL endpoint of the wallet instance, used for direct communication.' clientPublicKey: type: object additionalProperties: true nullable: true description: 'Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.' isAuthorised: type: boolean description: 'When `true`, this wallet unit is authorized to interact with the Wallet Provider''s services.' assertionToken: type: string description: 'Client assertion JWT of the wallet unit, used for OAuth 2.0 client authentication. This value is secret. Treat it as a credential and do not write it to logs.' assertionTokenType: type: string description: Type of the client assertion token. createdAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit was registered. updatedAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit record was last modified. walletUnitDevicePlatform: type: string description: 'Device platform of the wallet unit. The known values are `ios`, `android` and `organisation`. The service does not check the value.' example: ios walletUnitIntegrityToken: type: string description: 'Device integrity token supplied by the wallet unit during registration, for example an App Attest or Play Integrity token.' walletUnitKeyId: type: string description: Identifier of the cryptographic key that the wallet unit registered for attestation. walletUnitMetadata: type: object additionalProperties: true nullable: true description: Additional metadata that the wallet unit supplied during registration. required: - id - clientId - clientUrl - clientPublicKey - isAuthorised - assertionToken - assertionTokenType - createdAt - updatedAt - walletUnitDevicePlatform - walletUnitIntegrityToken - walletUnitKeyId - walletUnitMetadata required: - walletUnit headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, `clientPublicKey` is empty, or the organisation is not a wallet provider.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create wallet unit tags: - Digital Wallet (OpenID4VC) - Wallet Provider '/v2/config/digital-wallet/openid/wallet-provider/wallet-unit/{walletUnitId}': get: description: Reads one wallet unit that the wallet provider manages. Give the wallet unit identifier in the path. The organisation must have the wallet provider capability enabled. operationId: configReadDigitalWalletOpenIdWalletUnit parameters: - description: Unique identifier of a wallet unit registration managed by the Wallet Provider. in: path name: walletUnitId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet provider returned the wallet unit. content: application/json: schema: type: object properties: walletUnit: description: The wallet unit record. type: object title: WalletUnit properties: id: type: string description: Unique identifier for the wallet unit record. Use this value as the `walletUnitId` path parameter. clientId: type: string description: 'Client identifier of the wallet instance, typically a DID or URL. Used to identify the wallet during OID4VCI and OpenID4VP protocol interactions.' clientUrl: type: string description: 'URL endpoint of the wallet instance, used for direct communication.' clientPublicKey: type: object additionalProperties: true nullable: true description: 'Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.' isAuthorised: type: boolean description: 'When `true`, this wallet unit is authorized to interact with the Wallet Provider''s services.' assertionToken: type: string description: 'Client assertion JWT of the wallet unit, used for OAuth 2.0 client authentication. This value is secret. Treat it as a credential and do not write it to logs.' assertionTokenType: type: string description: Type of the client assertion token. createdAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit was registered. updatedAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit record was last modified. walletUnitDevicePlatform: type: string description: 'Device platform of the wallet unit. The known values are `ios`, `android` and `organisation`. The service does not check the value.' example: ios walletUnitIntegrityToken: type: string description: 'Device integrity token supplied by the wallet unit during registration, for example an App Attest or Play Integrity token.' walletUnitKeyId: type: string description: Identifier of the cryptographic key that the wallet unit registered for attestation. walletUnitMetadata: type: object additionalProperties: true nullable: true description: Additional metadata that the wallet unit supplied during registration. required: - id - clientId - clientUrl - clientPublicKey - isAuthorised - assertionToken - assertionTokenType - createdAt - updatedAt - walletUnitDevicePlatform - walletUnitIntegrityToken - walletUnitKeyId - walletUnitMetadata required: - walletUnit headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The wallet unit does not exist, or the organisation is not a wallet provider.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read wallet unit tags: - Digital Wallet (OpenID4VC) - Wallet Provider put: description: 'Updates one wallet unit that the wallet provider manages. All fields in the body are optional, but `isAuthorised` behaves differently from the others: the service always forwards it, so if you do not give `isAuthorised`, the service sets it to `false` and the wallet unit loses its authorisation. Always send the value that you want to keep. If you leave out `clientId`, `clientUrl` or `clientPublicKey`, the service keeps the stored value. The organisation must have the wallet provider capability enabled.' operationId: configUpdateDigitalWalletOpenIdWalletUnit parameters: - description: Unique identifier of a wallet unit registration managed by the Wallet Provider. in: path name: walletUnitId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: New values for the wallet unit. required: true content: application/json: schema: type: object properties: clientId: type: string description: Client identifier of the wallet instance. This is a DID or a URL. The wallet provider uses it to identify the wallet during OID4VCI and OpenID4VP flows. The service keeps the stored value when you send an empty string. example: 'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbsEYvdrjxMjQ4tpnje9BDBTzuNDP3knn6qLZErzd4bJ5go2CChoPjd5GAH3zpFJP5fuwSk66U5Pq6EhF4nKnHzDnznEP8fX99nZGgwbAh1o7Gj1X52Tdhf7U4KHBFNNQ' clientUrl: type: string description: URL endpoint of the wallet instance. example: 'https://wallet.example.com' clientPublicKey: type: object additionalProperties: true description: Public key of the wallet instance in JWK format. The wallet provider uses this key to verify the Wallet Unit Attestation Proof of Possession. isAuthorised: type: boolean default: false description: 'Set to `true` to authorise the wallet unit. An authorised wallet unit can request a Wallet Unit Attestation. The service forwards this field with every update request, so leaving it out sets it to `false`.' example: true example: clientUrl: 'https://wallet.example.com' isAuthorised: true responses: '200': description: The wallet provider updated the wallet unit. content: application/json: schema: type: object properties: walletUnit: description: The wallet unit record after the update. type: object title: WalletUnit properties: id: type: string description: Unique identifier for the wallet unit record. Use this value as the `walletUnitId` path parameter. clientId: type: string description: 'Client identifier of the wallet instance, typically a DID or URL. Used to identify the wallet during OID4VCI and OpenID4VP protocol interactions.' clientUrl: type: string description: 'URL endpoint of the wallet instance, used for direct communication.' clientPublicKey: type: object additionalProperties: true nullable: true description: 'Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.' isAuthorised: type: boolean description: 'When `true`, this wallet unit is authorized to interact with the Wallet Provider''s services.' assertionToken: type: string description: 'Client assertion JWT of the wallet unit, used for OAuth 2.0 client authentication. This value is secret. Treat it as a credential and do not write it to logs.' assertionTokenType: type: string description: Type of the client assertion token. createdAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit was registered. updatedAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit record was last modified. walletUnitDevicePlatform: type: string description: 'Device platform of the wallet unit. The known values are `ios`, `android` and `organisation`. The service does not check the value.' example: ios walletUnitIntegrityToken: type: string description: 'Device integrity token supplied by the wallet unit during registration, for example an App Attest or Play Integrity token.' walletUnitKeyId: type: string description: Identifier of the cryptographic key that the wallet unit registered for attestation. walletUnitMetadata: type: object additionalProperties: true nullable: true description: Additional metadata that the wallet unit supplied during registration. required: - id - clientId - clientUrl - clientPublicKey - isAuthorised - assertionToken - assertionTokenType - createdAt - updatedAt - walletUnitDevicePlatform - walletUnitIntegrityToken - walletUnitKeyId - walletUnitMetadata required: - walletUnit headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, the wallet unit does not exist, or the organisation is not a wallet provider.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update wallet unit tags: - Digital Wallet (OpenID4VC) - Wallet Provider delete: description: Deletes one wallet unit that the wallet provider manages. The organisation must have the wallet provider capability enabled. The response body is empty. operationId: configDeleteDigitalWalletOpenIdWalletUnit parameters: - description: Unique identifier of a wallet unit registration managed by the Wallet Provider. in: path name: walletUnitId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet provider deleted the wallet unit. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The wallet unit does not exist, or the organisation is not a wallet provider.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete wallet unit tags: - Digital Wallet (OpenID4VC) - Wallet Provider /v2/config/digital-wallet/openid/wallet-provider/wallet-units: get: description: |- Lists the wallet units that the wallet provider manages. Use the query parameters to filter by holder DID or by device platform, and to page through the results. The organisation must have the wallet provider capability enabled. The service replaces an `offset` that is less than 0 and a `limit` that is 0 or less with the default value. If `offset` is larger than the number of results, the service returns the last page. operationId: configListDigitalWalletOpenIdWalletUnit parameters: - description: Filter by the holder's Decentralized Identifier (DID). in: query name: holderDid schema: type: string - description: 'Filter by the device platform of the wallet unit. The known values are `ios`, `android` and `organisation`. The service does not check the value, so an unknown value matches no wallet unit.' in: query name: platform required: false schema: type: string example: ios - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet provider returned the wallet units. content: application/json: schema: type: object properties: walletUnit: type: array description: The wallet units on the current page. The list is empty if no wallet unit agrees with the filters. items: allOf: - type: object title: WalletUnit description: 'A wallet unit registration that the wallet provider holds. The service always sends every field of this object. A field that has no value is an empty string, `0`, `false` or `null`.' properties: id: type: string description: Unique identifier for the wallet unit record. Use this value as the `walletUnitId` path parameter. clientId: type: string description: 'Client identifier of the wallet instance, typically a DID or URL. Used to identify the wallet during OID4VCI and OpenID4VP protocol interactions.' clientUrl: type: string description: 'URL endpoint of the wallet instance, used for direct communication.' clientPublicKey: type: object additionalProperties: true nullable: true description: 'Public key JWK of the wallet instance, used to verify Wallet Unit Attestation Proof of Possession.' isAuthorised: type: boolean description: 'When `true`, this wallet unit is authorized to interact with the Wallet Provider''s services.' assertionToken: type: string description: 'Client assertion JWT of the wallet unit, used for OAuth 2.0 client authentication. This value is secret. Treat it as a credential and do not write it to logs.' assertionTokenType: type: string description: Type of the client assertion token. createdAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit was registered. updatedAt: type: integer format: int64 description: Unix timestamp (in seconds) when this wallet unit record was last modified. walletUnitDevicePlatform: type: string description: 'Device platform of the wallet unit. The known values are `ios`, `android` and `organisation`. The service does not check the value.' example: ios walletUnitIntegrityToken: type: string description: 'Device integrity token supplied by the wallet unit during registration, for example an App Attest or Play Integrity token.' walletUnitKeyId: type: string description: Identifier of the cryptographic key that the wallet unit registered for attestation. walletUnitMetadata: type: object additionalProperties: true nullable: true description: Additional metadata that the wallet unit supplied during registration. required: - id - clientId - clientUrl - clientPublicKey - isAuthorised - assertionToken - assertionTokenType - createdAt - updatedAt - walletUnitDevicePlatform - walletUnitIntegrityToken - walletUnitKeyId - walletUnitMetadata - type: object properties: totalCountOfCredentialHistory: type: integer format: int64 description: Number of Wallet Unit Attestation issuance records that belong to this wallet unit. example: 3 required: - totalCountOfCredentialHistory pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Page details for the result set. required: - walletUnit - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not a wallet provider. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List wallet units tags: - Digital Wallet (OpenID4VC) - Wallet Provider /v2/config/digital-wallet/openid/wallet-provider/organisation-wallet-units: get: description: |- Lists the organisation wallet units that the wallet provider manages. For each organisation, the response gives the status of the Legal Person Identification Data (LPID) credential, the status of the Wallet Unit Attestation (WUA), and usage counts. The organisation must have the wallet provider capability enabled. The service replaces an `offset` that is less than 0 and a `limit` that is 0 or less with the default value. If `offset` is larger than the number of results, the service returns the last page. operationId: configListDigitalWalletOpenIdOrganisationWalletUnit parameters: - description: 'Filter by Legal Person Identification Data (LPID) credential status. The service compares the value exactly, so an unknown value matches no organisation.' in: query name: lpidStatus required: false schema: type: string enum: - inactive - active - expired - revoked - description: 'Filter by Wallet Unit Attestation (WUA) lifecycle status. The service compares the value exactly, so an unknown value matches no organisation.' in: query name: wuaStatus required: false schema: type: string enum: - unauthorised - authorised - active - expired - revoked - description: Filter by organisation name. in: query name: organisationName required: false schema: type: string - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet provider returned the organisation wallet units. content: application/json: schema: type: object properties: organisationWalletUnit: type: array description: The organisation wallet units on the current page. The list is empty if no organisation wallet unit agrees with the filters. items: type: object title: OrganisationWalletUnit description: Wallet unit summary for 1 organisation under the wallet provider. The service always sends every field of this object. properties: organisationName: type: string description: Name of the organisation. lpidStatus: type: string description: Status of the Legal Person Identification Data (LPID) credential. The value is an empty string when the lookup fails. enum: - '' - inactive - active - expired - revoked example: active lpidExpiry: type: integer description: Unix timestamp (in seconds) when the LPID credential expires. The value is `0` when the organisation has no LPID credential. wuaStatus: type: string description: Lifecycle status of the Wallet Unit Attestation (WUA). `unauthorised` means the wallet unit is not authorised. `authorised` means the wallet unit is authorised but has no Wallet Unit Attestation yet. The value is an empty string when the lookup fails. enum: - '' - unauthorised - authorised - active - expired - revoked example: active wuaExpiry: type: integer description: Unix timestamp (in seconds) when the Wallet Unit Attestation expires. The value is `0` when the organisation has no Wallet Unit Attestation. issuedCredentials: type: integer format: int64 description: Total number of credentials that the organisation issued. verifications: type: integer format: int64 description: Total number of verifications that the organisation performed. lastActivity: type: string description: Time of the last issuance or verification activity of the organisation. The value is an empty string when the service recorded no activity. required: - organisationName - lpidStatus - lpidExpiry - wuaStatus - wuaExpiry - issuedCredentials - verifications - lastActivity pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Page details for the result set. required: - organisationWalletUnit - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not a wallet provider. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List organisation wallet units tags: - Digital Wallet (OpenID4VC) - Wallet Provider /v2/config/digital-wallet/openid/wallet-unit/status: get: description: Reads the wallet unit status from the holder's point of view. The status follows the Wallet Unit Attestation (WUA) lifecycle and the presence of a Legal Person Identification Data (LPID) credential in the wallet. operationId: configReadDigitalWalletOpenIdWalletUnitStatus parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server returns the wallet unit status. content: application/json: schema: type: object properties: status: type: string description: | Wallet unit status: 1. `not_installed`: The organisation has no wallet deployment. 2. `installed`: The wallet is deployed, but it holds no valid Wallet Unit Attestation. 3. `operational`: The wallet holds a valid Wallet Unit Attestation, but no LPID credential. 4. `valid`: The wallet holds a valid Wallet Unit Attestation and an LPID credential. enum: - not_installed - installed - operational - valid example: operational headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The server cannot read the wallet unit status for the organisation. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is unknown. headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read wallet unit status tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/global-configuration: post: description: |- Creates the global configuration of the OID4VCI issuer. The configuration gives the default branding, the default validity, and the Credential Issuer Metadata settings that all credential definitions of the organisation use. An organisation can hold one issuer global configuration. A second create request fails with HTTP 400. Use the update operation to change the configuration. operationId: configCreateDigitalWalletOpenIdGlobalConfiguration requestBody: required: true description: 'Default issuance settings for the issuer. All fields are optional, but the service replaces the full configuration, so a field that you leave out goes back to its default value.' content: application/json: schema: type: object description: |- Default issuance settings for the OID4VCI issuer. Each credential definition can override `credentialExpirationInDays` and `credentialBindingMethods`. All fields are optional, but the service replaces the full configuration on each request. A field that you leave out goes back to its default value. Read the configuration first and send all fields that you want to keep. The service always sets `credentialBranding.logo.uri` and `credentialBranding.backgroundImage.uri` itself, and it ignores those two fields in the request body. Use the logo image and cover image operations to change them. properties: credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when you give `0` or leave this field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Employee Badge locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). example: en-GB description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' example: true authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array description: 'Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. When you leave this field out on an update, the service uses `did:key`, `jwk`, `kid` and `x5c`.' items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Controls the OID4VCI Notification Endpoint per specification version. Set a version to `true` to publish the endpoint for wallets that use that version. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings for the OID4VCI Credential Issuer Metadata. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' example: false cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. Send `null` when `signedMetadataEnabled` is `false`. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. Send `null` when `signedMetadataEnabled` is `false`. The service does not check this value.' example: credentialExpirationInDays: 30 credentialBranding: name: Employee Badge description: Employee badge of Example Organisation backgroundColor: '#FFFFFF' textColor: '#000000' credentialRequestEncryptionRequired: true authorizationRequestExpiry: 300 credentialBindingMethods: - 'did:key' - jwk credentialResponseInterval: 5 issuerMetadata: signedMetadataEnabled: false cryptographicKeyIdentifier: null cryptographicKeyFormat: null parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: The issuer created the global configuration. content: application/json: schema: properties: globalConfiguration: description: The global configuration that the issuer created. type: object properties: id: type: string description: 'Record identifier of the global configuration. The service makes this value when it saves the record. It is not the same value as `globalConfigurationId`. Use `globalConfigurationId` in the path of the read, update and delete operations.' example: 665f2b8c9a1d4e0012ab34cd globalConfigurationId: type: string description: 'Unique identifier of the issuer global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this configuration. credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when the request gives `0` or leaves the field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. The service always returns this object. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). The service omits this field when it holds no value. description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: Logo that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: 'URL of the default logo displayed on credential cards in wallet UIs. The service sets this URL to the organisation logo, and it changes the URL to the configuration logo after an upload to the logo image operation.' altText: type: string description: 'Alt text for the logo image, used for accessibility.' required: - uri - altText backgroundImage: type: object description: Background image that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: URL of the default background image for credential cards. required: - uri required: - name - description - backgroundColor - textColor - logo - backgroundImage credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array nullable: true description: Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The value is `null` when the configuration holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Shows for which OID4VCI specification versions the issuer publishes the Notification Endpoint. The service omits this field when the configuration holds no value. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings of the OID4VCI Credential Issuer Metadata. The service omits this field when the configuration holds no value. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. The service omits this field when signed metadata is off. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. The service does not check this value.' required: - signedMetadataEnabled createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - globalConfigurationId - openIdOrganisationId - credentialExpirationInDays - credentialBranding - credentialRequestEncryptionRequired - authorizationRequestExpiry - credentialBindingMethods - credentialResponseInterval - createdAt - updatedAt required: - globalConfiguration type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, the organisation already holds a global configuration, a value in `credentialBindingMethods` is not valid, or the issuer cannot save the configuration.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create global configuration tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/global-configuration/{globalConfigurationId}': get: description: Reads the global configuration of the OID4VCI issuer. Give the value of `globalConfigurationId` in the path. The organisation must have a deployed digital wallet. operationId: configReadDigitalWalletOpenIdGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server returns the requested global configuration. content: application/json: schema: properties: globalConfiguration: description: The global configuration for the given `globalConfigurationId`. type: object properties: id: type: string description: 'Record identifier of the global configuration. The service makes this value when it saves the record. It is not the same value as `globalConfigurationId`. Use `globalConfigurationId` in the path of the read, update and delete operations.' example: 665f2b8c9a1d4e0012ab34cd globalConfigurationId: type: string description: 'Unique identifier of the issuer global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this configuration. credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when the request gives `0` or leaves the field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. The service always returns this object. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). The service omits this field when it holds no value. description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: Logo that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: 'URL of the default logo displayed on credential cards in wallet UIs. The service sets this URL to the organisation logo, and it changes the URL to the configuration logo after an upload to the logo image operation.' altText: type: string description: 'Alt text for the logo image, used for accessibility.' required: - uri - altText backgroundImage: type: object description: Background image that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: URL of the default background image for credential cards. required: - uri required: - name - description - backgroundColor - textColor - logo - backgroundImage credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array nullable: true description: Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The value is `null` when the configuration holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Shows for which OID4VCI specification versions the issuer publishes the Notification Endpoint. The service omits this field when the configuration holds no value. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings of the OID4VCI Credential Issuer Metadata. The service omits this field when the configuration holds no value. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. The service omits this field when signed metadata is off. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. The service does not check this value.' required: - signedMetadataEnabled createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - globalConfigurationId - openIdOrganisationId - credentialExpirationInDays - credentialBranding - credentialRequestEncryptionRequired - authorizationRequestExpiry - credentialBindingMethods - credentialResponseInterval - createdAt - updatedAt required: - globalConfiguration type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the OpenID wallet is not deployed, or no global configuration matches `globalConfigurationId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read global configuration tags: - Digital Wallet (OpenID4VC) - Issuer put: description: |- Updates the global configuration of the OID4VCI issuer. The service replaces the full configuration. A field that you leave out goes back to its default value, so read the configuration first and send all fields that you want to keep. The service keeps the current logo and cover image of `credentialBranding`, and it ignores those two URLs in the request body. operationId: configUpdateDigitalWalletOpenIdGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: 'New default issuance settings for the issuer. All fields are optional, but the service replaces the full configuration.' content: application/json: schema: type: object description: |- Default issuance settings for the OID4VCI issuer. Each credential definition can override `credentialExpirationInDays` and `credentialBindingMethods`. All fields are optional, but the service replaces the full configuration on each request. A field that you leave out goes back to its default value. Read the configuration first and send all fields that you want to keep. The service always sets `credentialBranding.logo.uri` and `credentialBranding.backgroundImage.uri` itself, and it ignores those two fields in the request body. Use the logo image and cover image operations to change them. properties: credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when you give `0` or leave this field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' example: Employee Badge locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). example: en-GB description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' example: true authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array description: 'Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. When you leave this field out on an update, the service uses `did:key`, `jwk`, `kid` and `x5c`.' items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Controls the OID4VCI Notification Endpoint per specification version. Set a version to `true` to publish the endpoint for wallets that use that version. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings for the OID4VCI Credential Issuer Metadata. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' example: false cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. Send `null` when `signedMetadataEnabled` is `false`. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. Send `null` when `signedMetadataEnabled` is `false`. The service does not check this value.' example: credentialExpirationInDays: 30 credentialBranding: name: Employee Badge description: Employee badge of Example Organisation backgroundColor: '#FFFFFF' textColor: '#000000' credentialRequestEncryptionRequired: true authorizationRequestExpiry: 300 credentialBindingMethods: - 'did:key' - jwk credentialResponseInterval: 5 issuerMetadata: signedMetadataEnabled: false cryptographicKeyIdentifier: null cryptographicKeyFormat: null responses: '200': description: The issuer updated the global configuration. content: application/json: schema: properties: globalConfiguration: description: The global configuration after the update. type: object properties: id: type: string description: 'Record identifier of the global configuration. The service makes this value when it saves the record. It is not the same value as `globalConfigurationId`. Use `globalConfigurationId` in the path of the read, update and delete operations.' example: 665f2b8c9a1d4e0012ab34cd globalConfigurationId: type: string description: 'Unique identifier of the issuer global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this configuration. credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when the request gives `0` or leaves the field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. The service always returns this object. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). The service omits this field when it holds no value. description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: Logo that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: 'URL of the default logo displayed on credential cards in wallet UIs. The service sets this URL to the organisation logo, and it changes the URL to the configuration logo after an upload to the logo image operation.' altText: type: string description: 'Alt text for the logo image, used for accessibility.' required: - uri - altText backgroundImage: type: object description: Background image that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: URL of the default background image for credential cards. required: - uri required: - name - description - backgroundColor - textColor - logo - backgroundImage credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array nullable: true description: Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The value is `null` when the configuration holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Shows for which OID4VCI specification versions the issuer publishes the Notification Endpoint. The service omits this field when the configuration holds no value. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings of the OID4VCI Credential Issuer Metadata. The service omits this field when the configuration holds no value. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. The service omits this field when signed metadata is off. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. The service does not check this value.' required: - signedMetadataEnabled createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - globalConfigurationId - openIdOrganisationId - credentialExpirationInDays - credentialBranding - credentialRequestEncryptionRequired - authorizationRequestExpiry - credentialBindingMethods - credentialResponseInterval - createdAt - updatedAt required: - globalConfiguration type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no global configuration matches `globalConfigurationId`, or the issuer cannot save the configuration.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update global configuration tags: - Digital Wallet (OpenID4VC) - Issuer delete: description: Deletes a global configuration for the OID4VCI issuer. operationId: configDeleteDigitalWalletOpenIdGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The issuer deleted the global configuration. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, no global configuration matches `globalConfigurationId`, or the issuer cannot delete the configuration.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete global configuration tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/global-configurations: get: description: 'Lists the global configurations of the OID4VCI issuer. The service sorts them by `updatedAt`, newest first. An organisation holds one issuer global configuration, so the array holds zero or one record.' operationId: configListDigitalWalletOpenIdGlobalConfiguration parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server returns the global configurations for the current page. content: application/json: schema: properties: globalConfiguration: description: Global configurations for the current page. The array is empty when the organisation has no configuration. items: type: object description: Default issuance settings of the OID4VCI issuer. An organisation has one issuer global configuration. properties: id: type: string description: 'Record identifier of the global configuration. The service makes this value when it saves the record. It is not the same value as `globalConfigurationId`. Use `globalConfigurationId` in the path of the read, update and delete operations.' example: 665f2b8c9a1d4e0012ab34cd globalConfigurationId: type: string description: 'Unique identifier of the issuer global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the OpenID wallet deployment that holds this configuration. credentialExpirationInDays: type: number description: Default expiration period (in days) for all credentials issued under this configuration. Individual credential definitions can override this value. The service uses 30 when the request gives `0` or leaves the field out. example: 30 credentialBranding: type: object description: Default display properties of the credential card in wallet UIs. The service always returns this object. properties: name: type: string description: 'Default display name for credentials in wallet UIs, as specified in the OID4VCI Credential Issuer Metadata.' locale: type: string description: BCP47 language tag for the display properties (e.g. `en-GB`). The service omits this field when it holds no value. description: type: string description: Default human-readable description for credentials displayed in wallet UIs. backgroundColor: type: string description: Default hex color code for the credential card background (e.g. `#FFFFFF`). example: '#FFFFFF' textColor: type: string description: Default hex color code for text on the credential card (e.g. `#000000`). example: '#000000' logo: type: object description: Logo that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: 'URL of the default logo displayed on credential cards in wallet UIs. The service sets this URL to the organisation logo, and it changes the URL to the configuration logo after an upload to the logo image operation.' altText: type: string description: 'Alt text for the logo image, used for accessibility.' required: - uri - altText backgroundImage: type: object description: Background image that wallets show on the credential card. The service sets `uri` and ignores the value in the request body. properties: uri: type: string description: URL of the default background image for credential cards. required: - uri required: - name - description - backgroundColor - textColor - logo - backgroundImage credentialRequestEncryptionRequired: type: boolean description: 'When `true`, the wallet must encrypt the OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Request using the issuer''s encryption key.' authorizationRequestExpiry: type: integer description: 'Time-to-live (in seconds) for the OID4VCI Authorization Request. After this period, the credential offer expires.' example: 300 credentialBindingMethods: type: array nullable: true description: Default cryptographic key binding methods that the issuer publishes in the OID4VCI Credential Issuer Metadata. The value is `null` when the configuration holds no binding method. items: type: string enum: - 'did:key' - jwk - cose_key example: - 'did:key' - jwk credentialResponseInterval: type: number description: Minimum polling interval (in seconds) for the wallet when using the OID4VCI Deferred Credential Endpoint. example: 5 notificationEndpointEnabled: type: object description: Shows for which OID4VCI specification versions the issuer publishes the Notification Endpoint. The service omits this field when the configuration holds no value. properties: draft_13: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 13.' draft_15: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 15.' draft_17: type: boolean description: 'When `true`, the issuer publishes the Notification Endpoint for wallets that use OID4VCI draft 17.' issuerMetadata: type: object description: Signing settings of the OID4VCI Credential Issuer Metadata. The service omits this field when the configuration holds no value. properties: signedMetadataEnabled: type: boolean description: 'When `true`, the issuer publishes the Credential Issuer Metadata as a signed JWT.' cryptographicKeyIdentifier: type: string nullable: true description: Key identifier of the key that signs the Credential Issuer Metadata. The service omits this field when signed metadata is off. cryptographicKeyFormat: type: string nullable: true description: 'Format of the signing key, for example `kid`, `jwk` or `x509`. The service does not check this value.' required: - signedMetadataEnabled createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - globalConfigurationId - openIdOrganisationId - credentialExpirationInDays - credentialBranding - credentialRequestEncryptionRequired - authorizationRequestExpiry - credentialBindingMethods - credentialResponseInterval - createdAt - updatedAt type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true required: - globalConfiguration - pagination type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is unknown or the OpenID wallet is not deployed. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List global configuration tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/transaction-data: post: description: | Validates the transaction data that a holder approved during an OID4VCI credential issuance. The server reads the key binding JWT of `paymentWalletAttestation`, calculates the hash of the transaction data, and compares it with the hashes in the key binding JWT. It then stores the result. Read `transactionDataVerified` of the answer to see the result. Rules that the server applies: - Send the payload in `transactionData` or in `transactionDataBase64`, but not in both. - `transactionDataHashesAlg` must hold exactly one value, and that value must be `sha-256`. - The organisation must have a key. operationId: configDigitalWalletOpenIdValidateTransactionData requestBody: required: true description: Transaction data and the Payment Authenticator presentation that proves the holder agreed to the transaction. content: application/json: schema: type: object properties: paymentWalletAttestation: type: string description: Payment Authenticator Verifiable Presentation token that the holder sent. The token must hold a key binding JWT with the transaction data hashes. transactionDataHashesAlg: type: array minItems: 1 maxItems: 1 description: 'Hash algorithm that the key binding JWT uses for the transaction data hashes. Give exactly one value, and the only supported value is `sha-256`.' items: type: string enum: - sha-256 transactionData: type: object additionalProperties: true description: 'Transaction data payload in plain JSON. Send this property or `transactionDataBase64`, but not both.' transactionDataBase64: type: string description: 'Transaction data payload as a base64url encoded string, in the form that the OpenID4VP Authorization Request carries. Send this property or `transactionData`, but not both.' required: - paymentWalletAttestation - transactionDataHashesAlg parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The issuer validated the transaction data and stored the result. content: application/json: schema: properties: transactionDataHistory: description: The stored transaction data record. Read `transactionDataVerified` to see the validation result. type: object properties: id: type: string description: Internal record identifier of the transaction data record. It is not the same value as `transactionDataId`. Always use `transactionDataId` to address the record. transactionDataId: type: string description: Unique identifier that the server gives to the transaction data record. Use this identifier in the path of the read endpoint. credentialExchangeId: type: string description: Identifier of the credential issuance history record that this transaction data belongs to. The value is an empty string when the record belongs to no credential issuance. openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that validated the transaction data. transactionDataBase64s: type: array description: Base64url encoded transaction data strings that the issuer verified against the key binding JWT. The value is `null` when the issuer verified no string. items: type: string paymentWalletAttestation: type: string description: Payment Authenticator Verifiable Presentation token that the holder sent. transactionData: type: object additionalProperties: true description: 'Transaction data payload in plain JSON, for example the payee and the amount of a payment. The value is `null` when the request gave the payload as `transactionDataBase64`.' transactionDataVerified: type: boolean description: '`true` when the issuer verified the transaction data hashes against the key binding JWT.' vpTokenDecoded: type: object additionalProperties: true description: Decoded payload of the Verifiable Presentation token that the holder sent. The value is `null` when the issuer could not decode the token. createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this record.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this record.' required: - id - transactionDataId - credentialExchangeId - openIdOrganisationId - paymentWalletAttestation - transactionDataVerified - createdAt - updatedAt type: object required: - transactionDataHistory headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request is not valid. The server returns this status when `paymentWalletAttestation` or `transactionDataHashesAlg` is missing, when the body holds both `transactionData` and `transactionDataBase64` or none of them, when `transactionDataHashesAlg` does not hold exactly one `sha-256` value, when the organisation has no key, or when the validation fails.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Validate transaction data tags: - Digital Wallet (OpenID4VC) - Issuer '/v2/config/digital-wallet/openid/sdjwt/transaction-data/{transactionDataId}': get: description: | Reads one transaction data record by its `transactionDataId`. The digital wallet of the organisation must be deployed. If it is not, the server answers with HTTP 400. operationId: configReadDigitalWalletOpenIdTransactionData parameters: - description: Unique identifier of a transaction data record associated with a credential exchange. in: path name: transactionDataId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server returns the requested transaction data record. content: application/json: schema: properties: transactionDataHistory: description: The transaction data record. type: object properties: id: type: string description: Internal record identifier of the transaction data record. It is not the same value as `transactionDataId`. Always use `transactionDataId` to address the record. transactionDataId: type: string description: Unique identifier that the server gives to the transaction data record. Use this identifier in the path of the read endpoint. credentialExchangeId: type: string description: Identifier of the credential issuance history record that this transaction data belongs to. The value is an empty string when the record belongs to no credential issuance. openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that validated the transaction data. transactionDataBase64s: type: array description: Base64url encoded transaction data strings that the issuer verified against the key binding JWT. The value is `null` when the issuer verified no string. items: type: string paymentWalletAttestation: type: string description: Payment Authenticator Verifiable Presentation token that the holder sent. transactionData: type: object additionalProperties: true description: 'Transaction data payload in plain JSON, for example the payee and the amount of a payment. The value is `null` when the request gave the payload as `transactionDataBase64`.' transactionDataVerified: type: boolean description: '`true` when the issuer verified the transaction data hashes against the key binding JWT.' vpTokenDecoded: type: object additionalProperties: true description: Decoded payload of the Verifiable Presentation token that the holder sent. The value is `null` when the issuer could not decode the token. createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this record.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this record.' required: - id - transactionDataId - credentialExchangeId - openIdOrganisationId - paymentWalletAttestation - transactionDataVerified - createdAt - updatedAt type: object required: - transactionDataHistory headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the OpenID wallet is not deployed, or no transaction data record matches `transactionDataId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read transaction data tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/transaction-datas: get: description: | Lists the transaction data records of the organisation. The server sorts them by the last modification time, and puts the newest record first. Give `credentialExchangeId` to read only the records of one credential issuance. operationId: configListDigitalWalletOpenIdTransactionData parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Filter by credential exchange record identifier to retrieve a specific OID4VCI issuance history entry. in: query name: credentialExchangeId schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: 'The server returns the transaction data records for the current page, sorted by the last modification time.' content: application/json: schema: properties: transactionDataHistory: description: Transaction data records for the current page. The array is empty when no record matches. items: type: object description: 'Transaction data record that the issuer validated against a Payment Authenticator presentation, as defined in the OpenID4VP transaction data extension.' properties: id: type: string description: Internal record identifier of the transaction data record. It is not the same value as `transactionDataId`. Always use `transactionDataId` to address the record. transactionDataId: type: string description: Unique identifier that the server gives to the transaction data record. Use this identifier in the path of the read endpoint. credentialExchangeId: type: string description: Identifier of the credential issuance history record that this transaction data belongs to. The value is an empty string when the record belongs to no credential issuance. openIdOrganisationId: type: string description: Identifier of the OpenID4VC deployment that validated the transaction data. transactionDataBase64s: type: array description: Base64url encoded transaction data strings that the issuer verified against the key binding JWT. The value is `null` when the issuer verified no string. items: type: string paymentWalletAttestation: type: string description: Payment Authenticator Verifiable Presentation token that the holder sent. transactionData: type: object additionalProperties: true description: 'Transaction data payload in plain JSON, for example the payee and the amount of a payment. The value is `null` when the request gave the payload as `transactionDataBase64`.' transactionDataVerified: type: boolean description: '`true` when the issuer verified the transaction data hashes against the key binding JWT.' vpTokenDecoded: type: object additionalProperties: true description: Decoded payload of the Verifiable Presentation token that the holder sent. The value is `null` when the issuer could not decode the token. createdAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server created this record.' updatedAt: type: number description: 'Unix timestamp, in seconds, of the moment that the server last changed this record.' required: - id - transactionDataId - credentialExchangeId - openIdOrganisationId - paymentWalletAttestation - transactionDataVerified - createdAt - updatedAt type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true type: object required: - transactionDataHistory - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is unknown or the wallet is not deployed. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List transaction data tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/sdjwt/transaction-data-definitions: get: description: | Lists the transaction data templates that the digital wallet supports. Each template gives a `type` and the JSON Schema for that type. Set the `type` as the `transactionDataDefinitionType` of a presentation definition. The `transactionData` that you then send with a verification request must follow the JSON Schema of that type. The list is fixed and is the same for every organisation. The response has no pagination. The server keeps the answer in a cache, so a change in the digital wallet is not visible until the cache entry expires. operationId: configListDigitalWalletOpenIdTransactionDataTemplates parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server listed the transaction data templates. content: application/json: schema: type: object properties: transactionDataDefinitions: description: Transaction data templates that the digital wallet supports. items: type: object description: Transaction data template. The template gives the JSON Schema that the `transactionData` of a verification request must follow when the presentation definition uses this type. properties: label: type: string description: Human-readable name of the transaction data template. example: Payment Data type: type: string description: Type identifier of the transaction data template. Use this value as the `transactionDataDefinitionType` of a presentation definition. enum: - payment_data - data_agreement_record - data_disclosure_agreement_record - qes_data - payment - login_risk_transaction - account_access - emandate - login_risk_transaction_non_ts12 example: payment_data schema: type: object additionalProperties: true description: JSON Schema that gives the structure and the validation rules of the transaction data of this type. required: - label - type - schema type: array required: - transactionDataDefinitions headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, or the digital wallet did not answer.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List transaction data templates tags: - Digital Wallet (OpenID4VC) - Verifier /v2/config/digital-wallet/openid/sdjwt/credential-definition/templates: get: description: | Lists the pre-defined credential schema templates that you can use to create a credential definition. The platform returns only the latest version of each schema. A claim path pointer schema has one entry for each credential format, so the same `name` and `version` can appear more than once. When the platform cannot read the schema repository, it returns an empty `templates` array and no `pagination` object. operationId: configListDigitalWalletOpenIdCredentialDefinitionTemplates parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 responses: '200': content: application/json: schema: properties: templates: description: Credential schema templates for the current page. items: allOf: - type: object description: | Pre-defined credential schema that you can use as a template for a new credential definition. The platform reads the templates from the public credential schema repository. A claim path pointer schema has one entry for each credential format, so the same `name` and `version` can appear more than once in the list. properties: name: type: string description: Schema identifier. This value is the folder name of the schema in the credential schema repository. example: LegalPersonIdentificationData type: type: string description: | Dialect of the schema document, and the field that tells you how to use it. `claimPathPointer` is a claim path pointer document, which is the dialect of OpenID4VCI 1.0. `jsonSchema` is a JSON Schema document that earlier versions of this API used; do not use it for a new credential definition. enum: - jsonSchema - claimPathPointer version: type: string description: Semantic version of the schema. The platform returns only the latest version of each schema. example: 1.0.0 schema: type: object additionalProperties: true description: | The schema document. For a `claimPathPointer` template, copy this object into `credentialDefinitions[].claims` when the credential format is `dc+sd-jwt` or `mso_mdoc`, and into `credentialDefinitions[].credentialDefinition` when the credential format is `jwt_vc_json`. metadata: type: object properties: id: type: string description: Schema identifier example: WgWxqztrNooG92RXvxSTWv credentialType: type: string description: Schema name example: LegalPersonIdentificationData isJwt: type: boolean description: Is W3C VC(JWT) format supported example: true isMsoMdoc: type: boolean description: Is ISO 18013-5 mdoc/mDL format supported example: true isSdJwt: type: boolean description: Is IETF SD-JWT VC format supported example: true title: type: string description: Title of schema example: Legal Person Identification Data (LPID) isClaimPathPointer: type: boolean description: 'When `true`, `schema` is a claim path pointer document. The platform always sets this field.' example: true doctype: type: string description: Document type identifier to use when the credential format is `mso_mdoc`. example: org.iso.18013.5.1.mDL namespace: type: string description: 'mDoc namespace of the schema. For OpenID4VCI 1.0, it is the first element of each claim path.' example: org.iso.18013.5.1 versionSupported: type: array items: type: string description: Versions of the OID4VCI specification that this schema supports. example: - version_01 required: - name - type - version - schema - metadata type: array pagination: type: object description: Offset based pagination for the template list. This operation does not use the page based pagination of the other list operations. properties: offset: type: integer description: Number of templates that the server skipped. example: 0 limit: type: integer description: Maximum number of templates per page. Defaults to 10. example: 10 totalItems: type: integer description: Total number of templates available. example: 12 hasPrevious: type: boolean description: Indicates whether a previous page exists. example: false hasNext: type: boolean description: Indicates whether a next page exists. example: true type: object description: Credential definition templates listed successfully headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List credential definition templates tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/wallet-provider/statistics: get: description: |- Reads the performance statistics of a wallet provider. The statistics give the OID4VCI issuance totals, the OpenID4VP verification totals, the monthly issuance history, and the counts of individual and organisation wallet units. The service caches the statistics and refreshes them in the background. The organisation must have the wallet provider capability enabled. The service can return statistics from its cache while it refreshes them in the background, so the values can be a few minutes old. operationId: configListDigitalWalletOpenIdPerformanceStatistics parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': content: application/json: schema: type: object properties: performanceStatistics: description: The performance statistics of the wallet provider. type: object properties: oid4vc: allOf: - type: object description: Issuance and verification totals. properties: totalCredentialTypes: type: integer example: 15 description: Number of credential types. totalIssuedCredentials: type: integer example: 16 description: Number of issued credentials. totalVerifications: type: integer example: 7 description: Number of verifications. required: - totalCredentialTypes - totalIssuedCredentials - totalVerifications description: OID4VCI issuance totals and OpenID4VP verification totals of the organisation wallets under the wallet provider. totalCredentialIssuanceHistory: allOf: - type: object description: 'Monthly credential issuance and verification history. Each field holds an array with one record per month, newest first.' properties: currentMonth: type: array description: Data for the current month. The array holds one record. items: type: object description: Issuance and verification totals for one month. properties: month: type: string example: january-2026 description: 'Month of the data, in the format `-`.' totalCredentialTypes: type: integer example: 15 description: Number of credential types in the month. totalIssuedCredentials: type: integer example: 16 description: Number of credentials issued in the month. totalVerifications: type: integer example: 7 description: Number of verifications in the month. required: - month - totalCredentialTypes - totalIssuedCredentials - totalVerifications last3Months: type: array description: Data for each of the last 3 months. items: type: object description: Issuance and verification totals for one month. properties: month: type: string example: january-2026 description: 'Month of the data, in the format `-`.' totalCredentialTypes: type: integer example: 15 description: Number of credential types in the month. totalIssuedCredentials: type: integer example: 16 description: Number of credentials issued in the month. totalVerifications: type: integer example: 7 description: Number of verifications in the month. required: - month - totalCredentialTypes - totalIssuedCredentials - totalVerifications last6Months: type: array description: Data for each of the last 6 months. items: type: object description: Issuance and verification totals for one month. properties: month: type: string example: january-2026 description: 'Month of the data, in the format `-`.' totalCredentialTypes: type: integer example: 15 description: Number of credential types in the month. totalIssuedCredentials: type: integer example: 16 description: Number of credentials issued in the month. totalVerifications: type: integer example: 7 description: Number of verifications in the month. required: - month - totalCredentialTypes - totalIssuedCredentials - totalVerifications last12Months: type: array description: Data for each of the last 12 months. items: type: object description: Issuance and verification totals for one month. properties: month: type: string example: january-2026 description: 'Month of the data, in the format `-`.' totalCredentialTypes: type: integer example: 15 description: Number of credential types in the month. totalIssuedCredentials: type: integer example: 16 description: Number of credentials issued in the month. totalVerifications: type: integer example: 7 description: Number of verifications in the month. required: - month - totalCredentialTypes - totalIssuedCredentials - totalVerifications cumulative: allOf: - type: object description: Issuance and verification totals. properties: totalCredentialTypes: type: integer example: 15 description: Number of credential types. totalIssuedCredentials: type: integer example: 16 description: Number of issued credentials. totalVerifications: type: integer example: 7 description: Number of verifications. required: - totalCredentialTypes - totalIssuedCredentials - totalVerifications description: 'Totals over all months. The service does not calculate this object today, so every count is `0`.' required: - currentMonth - last3Months - last6Months - last12Months - cumulative description: Monthly credential issuance history of the organisation wallets under the wallet provider. individualWalletUnit: allOf: - type: object description: Counts of wallet units of one kind. properties: total: type: integer example: 120 description: Number of wallet units. active: type: integer example: 114 description: Number of wallet units with a valid Wallet Unit Attestation. revoked: type: integer example: 6 description: Number of revoked wallet units. The service makes this value from `total` minus `active`. required: - total - active - revoked description: Counts of the individual wallet units under the wallet provider. organisationWalletUnit: allOf: - type: object description: Counts of wallet units of one kind. properties: total: type: integer example: 120 description: Number of wallet units. active: type: integer example: 114 description: Number of wallet units with a valid Wallet Unit Attestation. revoked: type: integer example: 6 description: Number of revoked wallet units. The service makes this value from `total` minus `active`. required: - total - active - revoked description: Counts of the organisation wallet units under the wallet provider. required: - oid4vc - totalCredentialIssuanceHistory - individualWalletUnit - organisationWalletUnit required: - performanceStatistics description: The service returned the performance statistics. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The organisation is not a wallet provider. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Performance statistics of a wallet provider tags: - Digital Wallet (OpenID4VC) - Wallet Provider /v2/config/digital-wallet/openid/key-management: post: description: | Configures the secure vaults that hold the cryptographic keys for OID4VCI and OpenID4VP operations. The iGrant.io vault must stay enabled. If you enable the Hashicorp vault, you must give the username, the password, the address and the namespace. If you enable the QTSP vault, you must give the CSC URL, the client ID, the client secret and the user ID. Send the full configuration on every call. The service forwards only the `enabled` flag of a vault that has `enabled: false`, so it erases the stored credentials of that vault. To keep the credentials of a vault, keep the vault enabled. operationId: configDigitalWalletOpenIdConfigureSecureVault requestBody: description: Secure vault configuration to apply to the organisation. required: true content: application/json: schema: type: object description: Set of vault configurations. Each vault has an `enabled` flag. The service enables the vault only when the flag is `true`. properties: hashicorpVault: type: object description: Hashicorp Vault configuration for external key storage. properties: enabled: type: boolean description: Set to `true` to enable the Hashicorp vault. example: false vaultUsername: type: string description: User name for Hashicorp Vault authentication. Required when `enabled` is `true`. example: vault-user vaultPassword: type: string description: Password for Hashicorp Vault authentication. Required when `enabled` is `true`. example: vaultAddress: type: string description: Base address of the Hashicorp Vault server. Required when `enabled` is `true`. example: 'https://vault.example.com' vaultNamespace: type: string description: Namespace in Hashicorp Vault. Required when `enabled` is `true`. example: admin required: - enabled igrantioVault: type: object description: iGrant.io managed vault configuration. This vault is always active and you cannot disable it. properties: enabled: type: boolean description: Set to `true` to enable the iGrant.io vault. The request fails if you send `false`. example: true required: - enabled qtsp: type: object description: Qualified Trust Service Provider (QTSP) configuration for remote qualified electronic signatures through the Cloud Signature Consortium (CSC) API. properties: enabled: type: boolean description: Set to `true` to enable the QTSP vault. example: false cscUrl: type: string description: Base URL of the CSC service. Required when `enabled` is `true`. example: 'https://csc.example.com/csc' clientId: type: string description: Client ID for QTSP authentication. Required when `enabled` is `true`. example: clientSecret: type: string description: Client secret for QTSP authentication. Required when `enabled` is `true`. example: userID: type: string description: User ID registered with the QTSP. Required when `enabled` is `true`. example: cscApiVersion: type: string description: CSC API version to use. Use `v1` for CSC 1.0.4.0 and `v2` for CSC 2.2.0.0. The service uses `v1` when you do not send this field. enum: - v1 - v2 example: v1 required: - enabled dbBackedVault: type: object description: Database backed vault configuration. This vault keeps the keys in the wallet database. properties: enabled: type: boolean description: Set to `true` to enable the database backed vault. example: false required: - enabled required: - hashicorpVault - igrantioVault - qtsp parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: Secure vault configured successfully. content: application/json: schema: type: object properties: secureVault: type: array nullable: true description: IDs of the vaults that are now enabled for the organisation. The value is `null` when no vault is enabled. items: type: integer description: 'Secure vault ID. `1` for the iGrant.io vault, `2` for the Hashicorp vault, `3` for the QTSP vault, `4` for the database backed vault.' enum: - 1 - 2 - 3 - 4 example: - 1 headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, the iGrant.io vault is disabled, or a vault configuration is incomplete.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Configure secure vault tags: - Digital Wallet (OpenID4VC) - Key Management get: description: | Reads the current secure vault configuration of the organisation. The response shows each vault and tells you if it is enabled. The service does not send a field that has no value. The response holds the stored vault credentials in clear text, which includes `hashicorpVault.vaultPassword` and `qtsp.clientSecret`. Protect the response as you protect the credentials. The QTSP user PIN is the only secret that the service never sends back. The response status code of this operation is `201`, not `200`. operationId: configDigitalWalletOpenIdReadSecureVault parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: Secure vault configuration read successfully. content: application/json: schema: type: object description: Current configuration of each secure vault. The service does not return a credential field when it has no value. properties: hashicorpVault: type: object description: Hashicorp Vault configuration. properties: enabled: type: boolean description: Shows `true` when the Hashicorp vault is enabled. example: false vaultUsername: type: string description: User name for Hashicorp Vault authentication. example: vault-user vaultPassword: type: string description: Password for Hashicorp Vault authentication. example: vaultAddress: type: string description: Base address of the Hashicorp Vault server. example: 'https://vault.example.com' vaultNamespace: type: string description: Namespace in Hashicorp Vault. example: admin required: - enabled igrantioVault: type: object description: iGrant.io managed vault configuration. properties: enabled: type: boolean description: Shows `true` when the iGrant.io vault is enabled. example: true required: - enabled qtsp: type: object description: Qualified Trust Service Provider (QTSP) configuration. properties: enabled: type: boolean description: Shows `true` when the QTSP vault is enabled. example: false cscUrl: type: string description: Base URL of the CSC service. example: 'https://csc.example.com/csc' clientId: type: string description: Client ID for QTSP authentication. example: clientSecret: type: string description: Client secret for QTSP authentication. example: userID: type: string description: User ID registered with the QTSP. example: credentialId: type: string description: ID of the QTSP signing credential that is in use. Set this value with the configure QTSP credential operation. example: cscApiVersion: type: string description: CSC API version in use. `v1` is CSC 1.0.4.0 and `v2` is CSC 2.2.0.0. enum: - v1 - v2 example: v1 required: - enabled dbBackedVault: type: object description: Database backed vault configuration. properties: enabled: type: boolean description: Shows `true` when the database backed vault is enabled. example: false required: - enabled required: - hashicorpVault - igrantioVault - qtsp - dbBackedVault headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, or the wallet is not deployed.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read secure vault tags: - Digital Wallet (OpenID4VC) - Key Management put: description: | Updates the secure vaults that hold the cryptographic keys for OID4VCI and OpenID4VP operations. Send the full configuration. The iGrant.io vault must stay enabled. If you enable the Hashicorp vault, you must give the username, the password, the address and the namespace. If you enable the QTSP vault, you must give the CSC URL, the client ID, the client secret and the user ID. The service forwards only the `enabled` flag of a vault that has `enabled: false`, so it erases the stored credentials of that vault. To keep the credentials of a vault, keep the vault enabled. The response status code of this operation is `201`, not `200`. operationId: configDigitalWalletOpenIdUpdateSecureVault requestBody: description: New secure vault configuration for the organisation. required: true content: application/json: schema: type: object description: Set of vault configurations. Each vault has an `enabled` flag. The service enables the vault only when the flag is `true`. properties: hashicorpVault: type: object description: Hashicorp Vault configuration for external key storage. properties: enabled: type: boolean description: Set to `true` to enable the Hashicorp vault. example: false vaultUsername: type: string description: User name for Hashicorp Vault authentication. Required when `enabled` is `true`. example: vault-user vaultPassword: type: string description: Password for Hashicorp Vault authentication. Required when `enabled` is `true`. example: vaultAddress: type: string description: Base address of the Hashicorp Vault server. Required when `enabled` is `true`. example: 'https://vault.example.com' vaultNamespace: type: string description: Namespace in Hashicorp Vault. Required when `enabled` is `true`. example: admin required: - enabled igrantioVault: type: object description: iGrant.io managed vault configuration. This vault is always active and you cannot disable it. properties: enabled: type: boolean description: Set to `true` to enable the iGrant.io vault. The request fails if you send `false`. example: true required: - enabled qtsp: type: object description: Qualified Trust Service Provider (QTSP) configuration for remote qualified electronic signatures through the Cloud Signature Consortium (CSC) API. properties: enabled: type: boolean description: Set to `true` to enable the QTSP vault. example: false cscUrl: type: string description: Base URL of the CSC service. Required when `enabled` is `true`. example: 'https://csc.example.com/csc' clientId: type: string description: Client ID for QTSP authentication. Required when `enabled` is `true`. example: clientSecret: type: string description: Client secret for QTSP authentication. Required when `enabled` is `true`. example: userID: type: string description: User ID registered with the QTSP. Required when `enabled` is `true`. example: cscApiVersion: type: string description: CSC API version to use. Use `v1` for CSC 1.0.4.0 and `v2` for CSC 2.2.0.0. The service uses `v1` when you do not send this field. enum: - v1 - v2 example: v1 required: - enabled dbBackedVault: type: object description: Database backed vault configuration. This vault keeps the keys in the wallet database. properties: enabled: type: boolean description: Set to `true` to enable the database backed vault. example: false required: - enabled required: - hashicorpVault - igrantioVault - qtsp parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: Secure vault updated successfully. content: application/json: schema: type: object properties: secureVault: type: array nullable: true description: IDs of the vaults that are now enabled for the organisation. The value is `null` when no vault is enabled. items: type: integer description: 'Secure vault ID. `1` for the iGrant.io vault, `2` for the Hashicorp vault, `3` for the QTSP vault, `4` for the database backed vault.' enum: - 1 - 2 - 3 - 4 example: - 1 - 4 headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, the iGrant.io vault is disabled, or a vault configuration is incomplete.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update secure vault tags: - Digital Wallet (OpenID4VC) - Key Management /v2/config/digital-wallet/openid/key-management/qtsp: post: description: | Selects the Qualified Trust Service Provider (QTSP) signing credential that the wallet uses for remote qualified electronic signatures. Configure and enable the QTSP vault before you call this operation. The service returns an empty body. The service stores `userPin` and never sends it back. To see the selected credential ID, use the read secure vault operation and read `qtsp.credentialId`. operationId: configDigitalWalletOpenIdConfigureQtspCredential requestBody: description: QTSP credential to activate for the organisation. required: true content: application/json: schema: type: object properties: credentialId: type: string minLength: 3 description: ID of the QTSP signing credential. Use the list QTSP credentials operation to get the available IDs. example: userPin: type: string minLength: 3 description: PIN that unlocks the QTSP signing credential. example: required: - credentialId - userPin parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: QTSP credential configured successfully. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body is not valid, the QTSP vault is not configured, or the credential ID is not known.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Configure Qualified Trust Service Provider (QTSP) credential tags: - Digital Wallet (OpenID4VC) - Key Management '/v2/config/digital-wallet/openid/key-management/qtsp/{credentialId}': get: description: | Reads the details of 1 Qualified Trust Service Provider (QTSP) signing credential. The wallet reads the details from the QTSP through the Cloud Signature Consortium (CSC) API. Configure and enable the QTSP vault before you call this operation. The QTSP controls the members of the `credentialInfo` object, so the members can change between providers. You cannot read a credential whose ID is the literal string `credentials`. That path goes to the list QTSP credentials operation. operationId: configDigitalWalletOpenIdReadQtspCredential parameters: - name: credentialId in: path required: true description: ID of the QTSP signing credential. Use the list QTSP credentials operation to get the available IDs. schema: type: string example: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: QTSP credential read successfully. content: application/json: schema: type: object title: ReadQtspCredential properties: credentialInfo: type: object nullable: true additionalProperties: true description: 'The `credentials/info` response of the Qualified Trust Service Provider (QTSP). The wallet sends the response of the QTSP without a change, so the QTSP controls the members of this object. The members below are the usual members of a Cloud Signature Consortium (CSC) response. The value is `null` when the QTSP sends no information.' properties: OTP: type: object additionalProperties: true properties: presence: type: string description: Tells you if the QTSP needs a one time password. PIN: type: object additionalProperties: true properties: format: type: string description: Format of the PIN. presence: type: string description: Tells you if the QTSP needs a PIN. authMode: type: string description: Authentication mode of the credential. cert: type: object additionalProperties: true properties: certificates: type: array items: type: string description: 'Certificate chain of the credential, in base64 format.' issuerDN: type: string description: Distinguished name of the certificate issuer. serialNumber: type: string description: Serial number of the certificate. status: type: string description: Status of the certificate. subjectDN: type: string description: Distinguished name of the certificate subject. validFrom: type: string description: Start of the certificate validity period. validTo: type: string description: End of the certificate validity period. description: type: string description: Description of the credential. key: type: object additionalProperties: true properties: algo: type: array items: type: string description: Signature algorithms that the key supports. curve: type: string description: Elliptic curve of the key. len: type: integer description: 'Length of the key, in bits.' status: type: string description: Status of the key. multisign: type: integer description: Number of signatures that the credential can make in 1 operation. required: - credentialInfo headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The QTSP vault is not configured, or the QTSP refused the request.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read Qualified Trust Service Provider (QTSP) credential tags: - Digital Wallet (OpenID4VC) - Key Management /v2/config/digital-wallet/openid/key-management/qtsp/credentials: get: description: Lists the Qualified Trust Service Provider (QTSP) signing credentials that the organisation can use. The wallet reads the list from the QTSP through the Cloud Signature Consortium (CSC) API. Configure and enable the QTSP vault before you call this operation. operationId: configDigitalWalletOpenIdListQtspCredential parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: QTSP credentials listed successfully. content: application/json: schema: type: object properties: credentials: type: array nullable: true description: IDs of the QTSP signing credentials. Use 1 of these IDs in the configure QTSP credential operation. The value is `null` when the QTSP holds no credential for the organisation. items: type: string description: ID of a QTSP signing credential. example: - required: - credentials headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The QTSP vault is not configured, or the QTSP refused the request.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List Qualified Trust Service Provider (QTSP) Credentials tags: - Digital Wallet (OpenID4VC) - Key Management /v2/config/digital-wallet/openid/key-management/keys: get: description: | Lists the signing keys of the organisation, grouped by secure vault. The wallet uses these keys to sign OID4VCI credentials and OpenID4VP responses. The response gives one entry for each secure vault that the organisation configured, with the public key and the DIDs of each key. This operation returns public key material only. It never returns the private part of a key. This operation has no query parameters and no pagination. It returns every key of every vault. operationId: configDigitalWalletOpenIdListKeys parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service returned the keys of the organisation. content: application/json: schema: type: object properties: keyManagementServices: type: array nullable: true description: One entry for each secure vault of the organisation. The value is `null` when the organisation has no vault. items: type: object description: Keys of one secure vault. properties: id: type: integer description: 'Secure vault ID. `1` for the iGrant.io vault, `2` for the Hashicorp vault, `3` for the QTSP vault, `4` for the database backed vault.' enum: - 1 - 2 - 3 - 4 example: 1 name: type: string description: Name of the secure vault. enum: - igrantioVault - hashicorpVault - qtsp - dbBackedVault example: igrantioVault keys: type: array nullable: true description: Keys that the vault holds. The list is empty when the vault holds no key. items: type: object description: One key and the DIDs that come from it. properties: isDefault: type: boolean description: Shows `true` when the wallet signs with this key by default. example: true jwk: type: object additionalProperties: false description: 'Public key in JSON Web Key (JWK) format. The service sends only the members below. It removes every other member that the vault holds, which includes the private key member `d`.' properties: kty: type: string description: 'Key type. The service always sends this member. The vault creates elliptic curve keys, so the value is `EC`.' example: EC crv: type: string description: Elliptic curve identifier. The usual value is `P-256`. A key that the organisation imported can also use `secp256k1`. example: P-256 x: type: string description: 'X coordinate of the elliptic curve point, in base64url format.' example: 'y': type: string description: 'Y coordinate of the elliptic curve point, in base64url format.' example: kid: type: string description: Key identifier. example: 3f2a91c47b8d4e6fa0c5d7e18b924f30 alg: type: string description: Signature algorithm for the key. The vault sets `ES256` for a P-256 key. example: ES256 x5c: type: array description: 'Certificate chain of the key, in leaf to root order. Each item is a base64 encoded DER certificate. The service adds this member only when a certificate chain is linked to the key.' items: type: string description: One base64 encoded DER certificate. x5t: type: string description: SHA-1 thumbprint of the leaf certificate. The service adds this member only when a certificate chain is linked to the key. example: x5t#S256: type: string description: SHA-256 thumbprint of the leaf certificate. Note the `#` in the member name. The upload certificate chain operation gives the same value as `x5t_s256`. example: required: - kty dids: type: array nullable: true description: DIDs that come from this key. items: type: string description: One decentralised identifier (DID). example: - 'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqZ...' - 'did:web:demo-api.igrant.io:organisation:5f9a1b2c3d4e5f60718293a4' required: - isDefault - jwk - dids required: - id - name - keys required: - keyManagementServices headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, or the organisation has no key management record.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List keys tags: - Digital Wallet (OpenID4VC) - Key Management post: description: | Creates a new ECDSA P-256 key in a secure vault. The wallet uses the key to sign OID4VCI credentials and OpenID4VP responses. The vault sets the key type, the curve and the algorithm, so there is no parameter for them. Enable the vault before you create a key in it. operationId: configDigitalWalletOpenIdCreateKey requestBody: description: Vault that stores the new key. Send an empty object to use the iGrant.io vault. required: false content: application/json: schema: type: object properties: vaultType: type: integer description: 'ID of the vault that stores the key. `1` is the iGrant.io vault, `2` is the Hashicorp vault, `3` is the QTSP vault and `4` is the database backed vault. Use `1` or `4` for normal key creation. The service uses the iGrant.io vault when you do not send this field.' enum: - 1 - 2 - 3 - 4 default: 1 example: 1 parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: Key created successfully. content: application/json: schema: type: object properties: keyId: type: string description: Unique identifier of the new key. example: 3f2a91c47b8d4e6fa0c5d7e18b924f30 jwk: type: object description: Public key of the new key pair in JSON Web Key (JWK) format. additionalProperties: true properties: kty: type: string description: 'Key type. The vault creates elliptic curve keys, so the value is `EC`.' example: EC crv: type: string description: Elliptic curve identifier. The vault uses the P-256 curve. example: P-256 x: type: string description: 'X coordinate of the elliptic curve point, in base64url format.' example: 'y': type: string description: 'Y coordinate of the elliptic curve point, in base64url format.' example: kid: type: string description: Key identifier. The value is the same as `keyId`. example: 3f2a91c47b8d4e6fa0c5d7e18b924f30 alg: type: string description: Signature algorithm for the key. The vault sets `ES256`. example: ES256 required: - keyId - jwk headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The vault type is not valid, or the vault is not configured.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create key tags: - Digital Wallet (OpenID4VC) - Key Management '/v2/config/digital-wallet/openid/key-management/keys/{keyId}': delete: description: | Deletes a key from the secure vault. This operation needs a request body: send `{"confirm": "DELETE"}`. The service refuses the request when the body is missing. operationId: configDigitalWalletOpenIdDeleteKey parameters: - description: Unique identifier of the key in: path name: keyId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: Confirmation of the delete operation. required: true content: application/json: schema: type: object properties: confirm: type: string description: Confirmation string. Set the value to `DELETE`. enum: - DELETE example: DELETE required: - confirm responses: '204': description: Key deleted successfully. The response body is empty. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The key ID is missing, the request body is missing, or the confirmation string is not `DELETE`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete key tags: - Digital Wallet (OpenID4VC) - Key Management '/v2/config/digital-wallet/openid/key-management/keys/{keyId}/csr': post: description: 'Generates a Certificate Signing Request (CSR) for a key in the secure vault. Send the CSR to a Certificate Authority, then upload the signed certificate chain with the upload certificate chain operation.' operationId: configDigitalWalletOpenIdGenerateCsr parameters: - description: Unique identifier of the key in: path name: keyId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: Subject and Subject Alternative Name (SAN) data for the CSR. required: true content: application/json: schema: type: object properties: commonName: type: string description: Common name (CN) of the certificate subject. Use the organisation name or the service name. example: wallet.example.com organization: type: string description: Organisation (O) of the certificate subject. Optional. example: Example Organisation AB country: type: string description: Two letter country code (C) of the certificate subject. Optional. example: SE sanDns: type: array description: DNS entries for the Subject Alternative Name (SAN) extension. Optional. items: type: string description: One DNS name. example: - wallet.example.com sanUri: type: array description: URI entries for the Subject Alternative Name (SAN) extension. Optional. items: type: string description: One URI. example: - 'https://wallet.example.com' required: - commonName responses: '200': description: CSR generated successfully. content: application/json: schema: type: object properties: csr: type: string description: Certificate Signing Request in PEM format. example: | -----BEGIN CERTIFICATE REQUEST----- -----END CERTIFICATE REQUEST----- required: - csr headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The key ID is missing, the key does not exist, or the request body is not valid.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Generate CSR tags: - Digital Wallet (OpenID4VC) - Key Management '/v2/config/digital-wallet/openid/key-management/keys/{keyId}/certificate-chain': post: description: | Uploads a certificate chain and links it to a key in the secure vault. The wallet then adds the chain as the `x5c` value of the key. The file must be UTF-8 text in PEM format. Put the leaf certificate first, then the intermediate certificates, then the root certificate. The service refuses the file when it holds a private key, when the leaf certificate does not use the P-256 curve, when a certificate is expired or not yet valid, or when a chain signature is not correct. operationId: configDigitalWalletOpenIdUploadCertificateChain parameters: - description: Unique identifier of the key in: path name: keyId required: true schema: type: string - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: PEM file that holds the certificate chain. required: true content: multipart/form-data: schema: type: object properties: certificate_file: type: string format: binary description: 'PEM file that holds the certificate chain in leaf, intermediate and root order. The file must not hold a private key.' required: - certificate_file responses: '200': description: Certificate chain uploaded successfully. content: application/json: schema: type: object properties: key_id: type: string description: Unique identifier of the key that the certificate chain belongs to. example: 3f2a91c47b8d4e6fa0c5d7e18b924f30 certificates_count: type: integer description: Number of certificates in the uploaded chain. example: 3 x5t: type: string description: 'SHA-1 thumbprint of the leaf certificate, in base64url format.' example: x5t_s256: type: string description: 'SHA-256 thumbprint of the leaf certificate, in base64url format.' example: required: - key_id - certificates_count - x5t - x5t_s256 headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The key ID is missing, the file is not valid PEM, the file holds a private key, the leaf certificate does not use the P-256 curve, a certificate is expired, or a chain signature is not correct.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Upload certificate chain tags: - Digital Wallet (OpenID4VC) - Key Management /v2/config/digital-wallet/openid/key-managements: get: description: | Lists the secure vaults that you can configure for OID4VCI and OpenID4VP key storage. The organisation must have a deployed OpenID digital wallet. This list is the same for every organisation. It tells you which vaults the platform supports, not which vaults the organisation uses. To read the configuration of the organisation, use the read secure vault operation. The response status code of this operation is `201`, not `200`. operationId: configListDigitalWalletOpenIdListSecureVaults responses: '201': content: application/json: schema: type: object properties: secureVault: type: array description: Secure vaults that the platform supports. items: type: object description: One supported secure vault. properties: id: type: integer description: 'Secure vault ID. `1` for the iGrant.io vault, `2` for the Hashicorp vault, `3` for the QTSP vault, `4` for the database backed vault.' enum: - 1 - 2 - 3 - 4 example: 1 name: type: string description: Display name of the secure vault. enum: - iGrant.io Secure Vault - Hashicorp Secure Vault - Qualified Trust Service Provider - DB-Backed Secure Vault example: iGrant.io Secure Vault isEnabled: type: boolean description: Shows `true` when you can select the vault. The service returns `true` for every listed vault. example: true required: - id - name - isEnabled required: - secureVault description: Secure vaults listed successfully headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, or the OpenID digital wallet is not deployed.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List secure vaults tags: - Digital Wallet (OpenID4VC) - Key Management /v2/config/digital-wallet/openid/sdjwt/credential-offer: post: description: 'Creates an OID4VCI Credential Offer that can be presented to a holder via QR code or deep link. OpenID4VCI 1.0 offers are not yet supported on this operation - the service refuses `version_01` with a 400 - so use `draft_13` until the backend adds 1.0 support. The wallet builds a Credential Offer by value with the Authorization Code Flow. The mandatory fields depend on the version of the OID4VCI specification. Version `draft_13` needs `credentialConfigurationIds`. Version `draft_17` needs `scope`, and does not accept `credentialConfigurationIds`. The offer always uses the Authorization Code Flow with an empty `issuer_state`. This operation does not create a Pre-Authorized Code Flow offer and does not add a `tx_code`.' operationId: configDigitalWalletOpenIdHolderCreateCredentialOffer requestBody: description: Credential issuer and the credentials that the offer must contain. required: true content: application/json: schema: type: object properties: credentialIssuer: type: string description: Credential Issuer Identifier that the offer points to. The holder uses this URL to read the Credential Issuer Metadata. example: 'https://demo-api.igrant.io/v2/organisation/62e29d4c1d75a55b4ecd0e50/service' version: type: string description: Version of the OID4VCI draft specification that the offer follows. The default is `draft_13`. OpenID4VCI 1.0 offers are not yet supported on this operation - the service refuses `version_01` with a 400 - so use `draft_13` until the backend adds 1.0 support. default: draft_13 enum: - draft_13 - draft_17 example: draft_13 credentialConfigurationIds: type: array items: type: string description: Key of one entry in the `credential_configurations_supported` object of the Credential Issuer Metadata. description: Identifiers of the credential configurations that the offer contains. Use this field with version `draft_13`. Version `draft_17` does not accept this field. example: - PhotoIdCredential scope: type: string description: Scope that selects the credential configurations for the offer. Use this field with version `draft_17`. The wallet finds every credential definition of the organisation that has this scope. example: photoid required: - credentialIssuer responses: '200': description: The wallet created the credential offer. content: application/json: schema: type: object properties: credentialOffer: type: string description: Credential Offer URI that the holder opens. The wallet returns the offer by value in the `credential_offer` query parameter. example: 'openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fdemo-api.igrant.io%2Fv2%2Forganisation%2F62e29d4c1d75a55b4ecd0e50%2Fservice%22%2C%22credential_configuration_ids%22%3A%5B%22PhotoIdCredential%22%5D%2C%22grants%22%3A%7B%22authorization_code%22%3A%7B%22issuer_state%22%3A%22%22%7D%7D%7D' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the version is not supported, or a field that the version needs is missing. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create credential offer tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/credential-issuer: get: description: 'Retrieves the OID4VCI Credential Issuer Metadata for a credential issuer. The wallet reads the `.well-known/openid-credential-issuer` document of the given credential issuer, checks it against the metadata model of the selected version, and returns the checked result. The wallet removes the keys that the model does not define, including `signed_metadata`, and returns the optional keys that the issuer left out with the value `null`. Each entry of `display` gets the default values `Not Discoverable` for `name` and `description` when the issuer gives no value. The wallet does not change the contents of `credential_configurations_supported`.' operationId: configDigitalWalletOpenIdReadIssuerMetadata parameters: - name: credentialIssuer in: query description: Credential Issuer Identifier. The wallet reads the Credential Issuer Metadata from this URL. required: true schema: type: string minLength: 1 example: 'https://demo-api.igrant.io/v2/organisation/62e29d4c1d75a55b4ecd0e50/service' - name: version in: query description: Version of the OID4VCI specification that the wallet uses to read the metadata. The default is `draft_13`. This operation accepts only these three values. required: false schema: type: string default: draft_13 enum: - draft_13 - draft_15 - draft_17 example: draft_13 responses: '200': content: application/json: schema: type: object properties: credentialIssuerMetadata: type: object additionalProperties: true description: 'Credential Issuer Metadata of the issuer, as defined in OID4VCI. The object holds the endpoints of the issuer and the credential configurations that the issuer supports.' description: The wallet read the issuer metadata. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the parameter `credentialIssuer` is missing, the version is not supported, or the wallet cannot read the metadata of the issuer. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read credential issuer metadata tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/sdjwt/presentation-definition/templates: get: description: | Lists the presentation definition templates of the platform schema repository. Use a template as the starting point for a new presentation definition. The server returns one entry for each template, with the newest version only. The list holds the DCQL query templates and also older templates that the verifier no longer accepts. Read `metadata.isDcqlQuery` to tell them apart. This endpoint always answers with HTTP 200. When the server cannot read the schema repository, it returns an empty `templates` array and no `pagination` object. The `pagination` object of this endpoint is not the standard pagination object. It holds `offset`, `limit`, `totalItems`, `hasPrevious` and `hasNext`. Read `metadata.isDcqlQuery` of a format entry to see which templates you can use. Only a template with `isDcqlQuery` set to `true` gives a DCQL query for the `dcqlQuery` of a presentation definition. operationId: configListDigitalWalletOpenIdPresentationDefinitionTemplates parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 responses: '200': content: application/json: schema: type: object properties: templates: description: Presentation definition templates for the current page. The array is empty when the server cannot read the schema repository. items: type: object description: | Presentation definition template from the platform schema repository. The server returns the newest version of each template. Each credential format holds a `schema` and a `metadata` object. Both are `null` when the schema repository has no file for that format. The same `name` can be in the list two times, because the schema repository holds one tree of DCQL query templates and one tree of older templates. Read `metadata.isDcqlQuery` to tell them apart. properties: name: type: string description: Identifier of the template in the schema repository. example: LegalPersonIdentificationData version: type: string description: Semantic version of the template. The server returns the newest version that the repository holds. example: 1.0.0 dc+sd-jwt: type: object description: Template for the IETF SD-JWT VC credential format. properties: schema: type: object additionalProperties: true description: Credential query for this credential format. Use it as the `dcqlQuery` of a new presentation definition when `metadata.isDcqlQuery` is `true`. The value is `null` when the schema repository has no file for this format. metadata: description: Descriptive metadata of the template for this credential format. type: object properties: id: type: string description: Identifier of the template in the schema repository. example: WgWxqztrNooG92RXvxSTWv credentialType: type: string description: 'Credential type that this template asks for. Use it as the `vct_values`, the `type_values` or the `doctype_value` of the credential query.' example: LegalPersonIdentificationData name: type: string description: Human-readable name of the credential type. example: Legal Person Identification Data (LPID) purpose: type: string description: Human-readable purpose of the template. The dashboard shows this text in the template list. isDcqlQuery: type: boolean description: '`true` when the `schema` of this format entry is a DCQL query. Use only a template with `true` here for the `dcqlQuery` of a presentation definition.' example: true isScaCredential: type: boolean description: '`true` when the template asks for a Strong Customer Authentication (SCA) attestation. The server then writes the address of the platform in `credentialType`.' example: false jwt_vc_json: type: object description: Template for the W3C VC JWT credential format. properties: schema: type: object additionalProperties: true description: Credential query for this credential format. The value is `null` when the schema repository has no file for this format. metadata: description: Descriptive metadata of the template for this credential format. type: object properties: id: type: string description: Identifier of the template in the schema repository. example: WgWxqztrNooG92RXvxSTWv credentialType: type: string description: 'Credential type that this template asks for. Use it as the `vct_values`, the `type_values` or the `doctype_value` of the credential query.' example: LegalPersonIdentificationData name: type: string description: Human-readable name of the credential type. example: Legal Person Identification Data (LPID) purpose: type: string description: Human-readable purpose of the template. The dashboard shows this text in the template list. isDcqlQuery: type: boolean description: '`true` when the `schema` of this format entry is a DCQL query. Use only a template with `true` here for the `dcqlQuery` of a presentation definition.' example: true isScaCredential: type: boolean description: '`true` when the template asks for a Strong Customer Authentication (SCA) attestation. The server then writes the address of the platform in `credentialType`.' example: false mso_mdoc: type: object description: Template for the ISO 18013-5 mDoc credential format. properties: schema: type: object additionalProperties: true description: Credential query for this credential format. The value is `null` when the schema repository has no file for this format. metadata: description: Descriptive metadata of the template for this credential format. type: object properties: id: type: string description: Identifier of the template in the schema repository. example: WgWxqztrNooG92RXvxSTWv credentialType: type: string description: 'Credential type that this template asks for. Use it as the `vct_values`, the `type_values` or the `doctype_value` of the credential query.' example: LegalPersonIdentificationData name: type: string description: Human-readable name of the credential type. example: Legal Person Identification Data (LPID) purpose: type: string description: Human-readable purpose of the template. The dashboard shows this text in the template list. isDcqlQuery: type: boolean description: '`true` when the `schema` of this format entry is a DCQL query. Use only a template with `true` here for the `dcqlQuery` of a presentation definition.' example: true isScaCredential: type: boolean description: '`true` when the template asks for a Strong Customer Authentication (SCA) attestation. The server then writes the address of the platform in `credentialType`.' example: false mso_mdoc_v1: type: object description: Template for the version 1 variant of the ISO 18013-5 mDoc credential format. The server returns this property only for DCQL query templates. properties: schema: type: object additionalProperties: true description: DCQL query for this credential format. The value is `null` when the schema repository has no file for this format. metadata: description: Descriptive metadata of the template for this credential format. type: object properties: id: type: string description: Identifier of the template in the schema repository. example: WgWxqztrNooG92RXvxSTWv credentialType: type: string description: 'Credential type that this template asks for. Use it as the `vct_values`, the `type_values` or the `doctype_value` of the credential query.' example: LegalPersonIdentificationData name: type: string description: Human-readable name of the credential type. example: Legal Person Identification Data (LPID) purpose: type: string description: Human-readable purpose of the template. The dashboard shows this text in the template list. isDcqlQuery: type: boolean description: '`true` when the `schema` of this format entry is a DCQL query. Use only a template with `true` here for the `dcqlQuery` of a presentation definition.' example: true isScaCredential: type: boolean description: '`true` when the template asks for a Strong Customer Authentication (SCA) attestation. The server then writes the address of the platform in `credentialType`.' example: false required: - name - version type: array pagination: type: object description: Page information for this list. The server leaves this property out when it cannot read the schema repository. properties: offset: type: integer description: Number of templates that the server skipped. The default is `0`. The server clamps a value that is larger than `totalItems`. example: 0 limit: type: integer description: Maximum number of templates on one page. The default is `10`. example: 10 totalItems: type: integer description: Number of templates in the schema repository. example: 24 hasPrevious: type: boolean description: '`true` when `offset` is larger than `0`.' example: false hasNext: type: boolean description: '`true` when more templates follow this page.' example: true required: - offset - limit - totalItems - hasPrevious - hasNext required: - templates description: The server listed the presentation definition templates. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List presentation definition templates tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}/revalidate': post: description: | Revalidates a verification exchange that the holder already answered. The digital wallet checks the credential signatures, the revocation status and the trust chain again. The server then writes the new `presentationValidity` and `verified` values to the record and returns the full record. The other properties of the record do not change. The request has no body. The server discards a body if you send one. The path of this operation is `/v2`, but the response holds the V3 verification exchange record: `vpTokenResponse` is an array, `presentation` is an array, and the V3-only properties are present. This is the only V2 verification operation that answers with the V3 shape. The server does not compute `requestExpired` on this operation. Read the record with `GET /v3/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}` to get a current value. operationId: configRevalidateDigitalWalletOpenIdVerification parameters: - description: 'Unique identifier of the verification exchange record. This is the `presentationExchangeId` property of the record, not its `id` property.' in: path name: presentationExchangeId required: true schema: type: string example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The digital wallet revalidated the presentation. The response holds the record with the new `presentationValidity` and `verified` values. content: application/json: schema: type: object properties: verificationHistory: type: object description: | Verification exchange record. The record tracks one OpenID for Verifiable Presentation (OpenID4VP) verification, from the Authorization Request to the verification result. The server returns every property of this schema on every operation, except `dcApiRequest` and `dcApiProtocol`. A property that has no value yet holds the empty value for its type: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array. properties: presentationExchangeId: type: string description: 'Unique identifier of the verification exchange. Give this value as the `presentationExchangeId` path parameter to read, delete or revalidate the record, and to receive a DC API response for it.' example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e id: type: string description: Internal record identifier that the server makes when it stores the record. No operation accepts this value. Use `presentationExchangeId` to address the record. example: 6821b4b0f5b1c2a3d4e5f6a7 vpTokenQrCode: type: string description: OpenID4VP Authorization Request URI encoded for QR code display or deep link. The holder's wallet scans or clicks this to initiate the presentation flow. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). vpTokenRequestState: type: string description: 'State parameter for the OpenID4VP Authorization Request, used to correlate the request with the response.' vpTokenRequest: type: string description: Full OpenID4VP Authorization Request URI or payload. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). presentationSubmission: type: object description: | Wrapper that holds the Presentation Submission object of the wallet. DCQL is the only supported query form, and a DCQL Authorization Response carries no Presentation Submission, so the server returns `null` here for every verification that a current presentation definition starts. A value is present only on an old record that a DIF Presentation Exchange definition made. Read `presentation` to get the credentials of the holder. properties: presentation_submission: type: object description: DIF Presentation Exchange Submission object that maps the credentials of the holder to the requirements of the verifier. Kept for old records only. properties: definition_id: type: string description: Identifier of the Presentation Definition that this submission fulfills. descriptor_map: description: Array of Descriptor Map entries mapping each requested credential to its location in the Verifiable Presentation. type: array items: type: object properties: format: type: string description: 'Credential format of the matched credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this entry satisfies. path: type: string description: JSONPath expression pointing to the Verifiable Credential within the Verifiable Presentation token. path_nested: type: object description: Nested path descriptor for credentials wrapped in envelope formats (e.g. JWT inside a VP JWT). properties: format: type: string description: 'Credential format of the nested credential (e.g. `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`).' id: type: string description: Identifier of the Input Descriptor from the Presentation Definition that this nested entry satisfies. path: type: string description: JSONPath expression pointing to the credential within the nested envelope. required: - format - id - path required: - format - id - path id: type: string description: Unique identifier for this Presentation Submission. required: - definition_id - descriptor_map - id status: type: string enum: - request_sent - request_received - presentation_pending - presentation_acked description: | Lifecycle status of the verification exchange: 1. `request_sent`: The server made the OpenID4VP Authorization Request. The exchange waits for the holder. 2. `request_received`: The wallet of the holder got, or scanned, the Authorization Request. 3. `presentation_pending`: The wallet started the response but the verifier did not get a complete Authorization Response yet. 4. `presentation_acked`: The holder sent the Verifiable Presentation and the verifier processed it. example: request_sent verified: type: boolean description: 'Result of the verification of the Verifiable Presentation. The server checks the cryptographic signatures, the credential status and the presented claims against the DCQL query of the presentation definition.' createdAt: type: number description: Unix timestamp (in seconds) when this verification record was created. updatedAt: type: number description: Unix timestamp (in seconds) when this verification record was last modified. presentationDefinitionId: type: string description: Identifier of the presentation definition used for this verification request. openIdOrganisationId: type: string description: Identifier of the OpenID4VP organisation that initiated this verification request. holder: description: 'Contains the metadata describing a holder. For e.g. Name, location, logo e.t.c' type: object properties: name: type: string description: Identifier of the holder. For .e.g. DID or Name obtained from client metadata if available. required: - name presentation: type: array items: type: object additionalProperties: true description: Decoded credentials that the holder presented. The shape of each entry follows the credential format. `null` until the holder answers. vpTokenResponse: type: array items: type: string description: Verifiable Presentation tokens that the wallet sent. The array holds one entry for each credential that the Authorization Request asked for. `null` until the wallet answers. transactionData: type: object additionalProperties: true description: Transaction data confirmed by the holder during the presentation flow. transactionDataBase64: type: string description: Base64url encoding of the transaction data that the Authorization Request holds. credentialExchangeId: type: string description: 'Identifier of the credential issuance exchange that this verification started, if the flow issues a credential after the verification. Always empty on the response of the send operation. The server fills it in later, when the issuance flow starts.' responseType: type: string description: OAuth 2.0 response type of the Authorization Request. enum: - vp_token - id_token - device_response idToken: type: string description: OpenID Connect ID Token from the holder. Present only when `responseType` is `id_token`. idTokenDecoded: type: object additionalProperties: true description: Decoded payload of the ID Token of the holder. dataAgreementId: type: string description: Identifier of the data agreement record that this verification exchange created. userId: type: string description: Identifier of the dashboard user or individual that started this verification request. requestExpired: type: boolean description: '`true` when the `exp` claim of `vpTokenRequest` is in the past. The wallet cannot use an expired Authorization Request. The read and list operations compute this value when they answer. The send and revalidate operations always return `false`.' requestExpiryTime: type: number description: Unix timestamp in seconds when the Authorization Request expires. The server reads this value from the `exp` claim of `vpTokenRequest`. `0` when the request has no expiry. example: 1747015200 presentationValidity: type: array items: type: object additionalProperties: true description: 'Validation result for each credential in the presentation, with the signature check, the expiry check and the revocation status. The revalidate operation writes a new value here. `null` until the holder answers.' clientIdScheme: type: string description: Client ID scheme used by the verifier in the OpenID4VP Authorization Request. enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash directPostRedirectUri: type: string description: URI the wallet redirects to after posting the Authorization Response. Empty when using DC API response modes (`dc_api` or `dc_api.jwt`). responseMode: type: string description: | OpenID4VP response mode determining how the Authorization Response is delivered: - `direct_post`: Response sent via HTTP POST to the verifier's `redirect_uri` without encryption. - `direct_post.jwt`: Response sent via HTTP POST encrypted as a JWE. - `dc_api`: Response delivered over the W3C Digital Credentials API transport without JWE encryption. Compatible with both `signed` and `unsigned` `dcApiRequestType` values. - `dc_api.jwt`: Response delivered over the W3C Digital Credentials API transport encrypted as a JWE. - `iar-post`: Response sent through the Interactive Authorisation Request transport without encryption. - `iar-post.jwt`: Response sent through the Interactive Authorisation Request transport encrypted as a JWE. enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt - iar-post - iar-post.jwt verifierAttestation: type: string description: 'Verifier Attestation JWT sent to the holder, proving the verifier''s authorization.' individualId: type: string description: Identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `individualId`. mapperId: type: string description: External identifier of the individual that the server sent the Authorization Request to with a push notification. Empty when the send request did not set `mapperId`. dataAgreement: type: object additionalProperties: true description: Data agreement that gives the terms for this verification exchange. nonce: type: string description: Cryptographic nonce used in the OpenID4VP Authorization Request to ensure freshness and prevent replay attacks. dcApiProtocol: type: string description: | Digital Credentials API exchange protocol identifier returned when the presentation definition is configured for DC API response modes. Identifies the protocol variant used with the W3C Digital Credentials API (`navigator.credentials.get()`): - `openid4vp-v1-unsigned`: The Authorization Request is passed unencrypted to the browser's DC API. The browser can inspect the request for risk analysis. Use for development/testing only. - `openid4vp-v1-signed`: The Authorization Request is signed by the verifier's key and passed as an opaque string to the browser's DC API. Provides verifier authentication. Recommended for production. - `org-iso-mdoc`: The Authorization Request follows ISO 18013-7 Annex C. The wallet answers with an encrypted CBOR `EncryptedResponse`. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. enum: - openid4vp-v1-unsigned - openid4vp-v1-signed - org-iso-mdoc dcApiRequest: type: object description: | Request object for the W3C Digital Credentials API, structured for browser invocation via `navigator.credentials.get()`. Contains browser-specific request formats for Chrome and Safari. Only present when `responseMode` is `dc_api` or `dc_api.jwt`. properties: chrome: type: object description: Digital Credentials API request format for Chromium-based browsers. Uses the `providers` structure per the W3C Digital Credentials API specification. properties: digital: type: object description: Digital credential request options for Chromium-based browsers. properties: providers: type: array description: 'Array of credential request providers, each specifying a protocol and request data.' items: type: object properties: protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' request: type: object description: | The OpenID4VP Authorization Request payload. Structure varies by protocol: - For `openid4vp-v1-signed`: Contains `{ "request": "" }`, a JWT signed by the verifier's key. - For `openid4vp-v1-unsigned`: Contains the full Authorization Request object with `client_metadata`, `dcql_query`, `nonce`, `response_mode`, `response_type`. additionalProperties: true safari: type: object description: Digital Credentials API request format for Safari-based browsers. Uses the `requests` structure. properties: digital: type: object description: Digital credential request options for Safari-based browsers. properties: requests: type: array description: 'Array of credential requests for Safari, each containing data and protocol.' items: type: object properties: data: type: string description: | JSON-stringified Authorization Request payload (Safari's DC API expects a string, not an object). Decoding it yields the same structure that Chrome receives in `request`: - For `openid4vp-v1-signed`: `{ "request": "" }`. - For `openid4vp-v1-unsigned`: the full inline Authorization Request object (`response_type`, `response_mode`, `nonce`, `dcql_query`, `client_metadata`, …). protocol: type: string description: 'Digital Credentials API exchange protocol identifier (e.g. `openid4vp-v1-signed`, `openid4vp-v1-unsigned`).' requiresEncryption: type: boolean description: Indicates whether the OpenID4VP Authorization Response must be encrypted as a JWE. `true` when `responseMode` is `direct_post.jwt` or `dc_api.jwt`. `false` when `responseMode` is `direct_post` or `dc_api`. signatureStamp: type: boolean description: 'When `false`, the signature stamp is hidden in signed PDFs.' signatureCoordinate: type: array description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points.' items: type: integer minItems: 4 maxItems: 4 example: - 100 - 100 - 200 - 150 files: type: array description: 'List of files generated during the verification, including signed and unsigned PDF documents.' items: type: object properties: credentialId: type: string description: Identifier of the credential associated with this file. error: type: string nullable: true description: 'Error code if signing failed, null otherwise.' errorDescription: type: string nullable: true description: 'Detailed error message if signing failed, null otherwise.' signedFile: type: string format: uri description: URL of the signed PDF file. unsignedFile: type: string format: uri description: URL of the unsigned PDF file. required: - id - presentationExchangeId - openIdOrganisationId - presentationDefinitionId - vpTokenRequestState - vpTokenRequest - vpTokenQrCode - status - verified - holder - createdAt - updatedAt - credentialExchangeId - transactionDataBase64 - nonce - responseType - idToken - clientIdScheme - responseMode - verifierAttestation - directPostRedirectUri - requiresEncryption - individualId - mapperId - signatureStamp - dataAgreementId - userId - requestExpired - requestExpiryTime required: - verificationHistory headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, no verification exchange record has the supplied `presentationExchangeId`, or the digital wallet refused the revalidation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Revalidate verification tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}/receive': post: description: | Receives an OpenID4VP Authorization Response delivered over the W3C Digital Credentials API (DC API) transport for a previously created verification request. The verifier frontend invokes the browser's `navigator.credentials.get()` with the request returned in `dcApiRequest`. The browser routes the request to the holder's wallet, which produces a credential response. The frontend forwards that response to this endpoint. This endpoint is a transparent gateway: it authenticates the caller, looks up the verification record by `presentationExchangeId`, then proxies the request body byte-for-byte to the underlying digital wallet deployment, where JWE decryption (when `responseMode` is `dc_api.jwt`), VP Token parsing per OID4VP 1.0 §8.1, DCQL structure validation, and persistence are performed. The wallet's response body and HTTP status are returned to the caller unchanged. Use this endpoint only when the verification request was created with `responseMode` set to `dc_api` or `dc_api.jwt`. For `direct_post` and `direct_post.jwt` flows the wallet posts the response directly to the verifier's `redirect_uri` and this endpoint is not used. operationId: configReceiveDigitalWalletOpenIdDcApiResponse parameters: - description: 'Unique identifier of the verification exchange record. This is the `presentationExchangeId` property of the record, not its `id` property.' in: path name: presentationExchangeId required: true schema: type: string example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: | The body must hold `response`, `vp_token`, or both. The field names are case-sensitive and lowercase. The digital wallet ignores all other fields. Do not send the presentation submission: the wallet derives it from the DCQL query and from the structure of `vp_token`. For `responseMode` = `dc_api.jwt`, the wallet searches for the JWE in `response` and in `vp_token`, and it also unwraps a JSON string that holds one of these keys. For `responseMode` = `dc_api`, the wallet reads `vp_token` first and falls back to `response`. content: application/json: schema: anyOf: - title: response (string) description: | JWE compact serialization or JSON-encoded string. Use this variant for `responseMode` = `dc_api.jwt` (encrypted JWE response) or `dc_api` with a JSON-string payload. type: object required: - response properties: response: type: string description: | For `responseMode` = `dc_api.jwt`: JWE compact serialization (five base64url segments separated by `.`) returned by the wallet. The downstream wallet decrypts it with the encryption key minted for this verification record and extracts `vp_token` from the decrypted payload. For `responseMode` = `dc_api` (alternative form): a JSON-encoded string whose decoded form is `{"vp_token": { ... }}`. - title: vp_token (object) description: | Direct VP token object. Use this variant for `responseMode` = `dc_api` when the browser returns the parsed JSON object directly. type: object required: - vp_token properties: vp_token: description: | Map of input descriptor / DCQL credential ID to the wallet's Verifiable Presentation(s). Encoding of each VP depends on credential format (`dc+sd-jwt`, `mso_mdoc`, `jwt_vc_json`). May be supplied as a parsed JSON object or as a JSON-encoded string; the wallet parses string values automatically. type: object additionalProperties: true examples: 'PID - IETF SD-JWT VC (DC API, Unsigned)': value: vp_token: Person Identification Data - PID: - eyJhbGciOiJFUzI1NiIsImtpZCI6IjEiLCJ0eXAiOiJkYytzZC1qd3QifQ.eyJ2Y3QiOiJQZXJzb25JZGVudGlmaWNhdGlvbkRhdGEiLCJfc2QiOlsiX2hhc2gxXyIsIl9oYXNoMl8iXX0.signature~WyJzYWx0IiwiZmFtaWx5X25hbWUiLCJEb2UiXQ~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkphbmUiXQ~ 'PID - IETF SD-JWT VC (DC API, Unsigned via response string)': value: response: '{"vp_token":{"Person Identification Data - PID":["eyJhbGciOiJFUzI1NiIsImtpZCI6IjEiLCJ0eXAiOiJkYytzZC1qd3QifQ...~"]}}' 'PID - IETF SD-JWT VC (DC API JWT, Signed)': value: response: eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTI1NkdDTSIsImtpZCI6InZlcmlmaWVyLWtleS0xIn0.encryptedKey.iv.ciphertext.tag responses: '200': description: | The digital wallet processed the DC API response. The body is the answer of the wallet, forwarded byte-for-byte. **This body is not the verification history shape that the other verifier endpoints return.** It is the raw verification record of the digital wallet. The token properties use snake_case (`vp_token_request`, `vp_token_response`, …) and `organisationId` is the identifier of the wallet deployment, not of the gateway organisation. To read the record in the usual shape, call `GET /v3/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId}` after this call. content: application/json: schema: type: object description: Verification record of the digital wallet after it processed the DC API response. properties: id: type: string format: uuid description: Identifier of the verification record in the digital wallet. This value equals the `presentationExchangeId` of the gateway. organisationId: type: string format: uuid description: Identifier of the organisation in the digital wallet deployment. presentationDefinitionId: type: string format: uuid nullable: true description: Identifier of the presentation definition that this verification uses. vp_token_request_state: type: string nullable: true description: State value of the Authorization Request. vp_token_request: type: string nullable: true description: 'Full Authorization Request. This is a signed JWT, or a URI with the request parameters.' vp_token_qr_code: type: string nullable: true description: Authorization Request URI for a QR code or a deep link. Empty for DC API response modes. vp_token_response: type: array nullable: true items: type: string description: Verifiable Presentation tokens that the wallet sent. presentationSubmission: type: object additionalProperties: true nullable: true description: Presentation Submission that the server derived from the DCQL query and the structure of the VP Token. status: type: string enum: - request_sent - request_received - presentation_acked description: Lifecycle status of the verification exchange. The value is `presentation_acked` after a good DC API response. verified: type: boolean description: Result of the verification of the Verifiable Presentation. holder: type: object additionalProperties: true nullable: true description: 'Metadata about the holder, for example the name from the client metadata.' presentation: type: array nullable: true items: type: object additionalProperties: true description: Decoded credentials that the holder presented. presentationValidity: type: array nullable: true items: type: object additionalProperties: true description: Validation result for each credential in the presentation. credentialExchangeId: type: string nullable: true description: Identifier of the credential issuance exchange that this verification started. transactionData: type: object additionalProperties: true nullable: true description: Transaction data that the holder approved. transactionDataBase64: type: string nullable: true description: Base64url encoding of the transaction data that the Authorization Request holds. nonce: type: string nullable: true description: Cryptographic nonce of the Authorization Request. responseType: type: string nullable: true enum: - vp_token - id_token - device_response description: OAuth 2.0 response type of the Authorization Request. idToken: type: string nullable: true description: OpenID Connect ID Token from the holder. idTokenDecoded: type: object additionalProperties: true nullable: true description: Decoded payload of the ID Token of the holder. clientIdScheme: type: string nullable: true enum: - redirect_uri - did - verifier_attestation - x509_san_dns - x509_hash description: Client ID scheme of the Authorization Request. responseMode: type: string nullable: true enum: - direct_post - direct_post.jwt - dc_api - dc_api.jwt - iar-post - iar-post.jwt description: Response mode of the Authorization Request. This endpoint accepts only `dc_api` and `dc_api.jwt`. verifierAttestation: type: string nullable: true description: Verifier Attestation JWT that the server sent to the holder. directPostRedirectUri: type: string nullable: true description: URI that the wallet opens after it posts the Authorization Response. Not used for DC API response modes. encryptionPrivateKey: type: string nullable: true description: Internal field of the digital wallet. Do not use it. The wallet deletes the one-shot response encryption key after it decrypts a `dc_api.jwt` response. requiresEncryption: type: boolean nullable: true description: '`true` when the wallet must encrypt the Authorization Response as a JWE.' iarAuthSession: type: string nullable: true description: Session identifier for the Interactive Authorisation Request flow. Empty for DC API flows. version: type: string nullable: true enum: - draft_14 - draft_18 - draft_23 - version_01 - iso18013_7_annex_c description: OpenID4VP profile version that the presentation definition uses. files: type: array nullable: true items: type: object additionalProperties: true description: 'Files that the verification made, for example signed and unsigned PDF documents.' dcApiRequest: type: object additionalProperties: true nullable: true description: 'Request object for the W3C Digital Credentials API, with one shape for Chrome and one for Safari.' dcApiProtocol: type: string nullable: true enum: - openid4vp-v1-unsigned - openid4vp-v1-signed description: Exchange protocol identifier for the W3C Digital Credentials API. signatureStamp: type: boolean nullable: true description: '`true` when the signed PDF holds a visible signature stamp.' signatureCoordinate: type: array nullable: true items: type: integer minItems: 4 maxItems: 4 description: 'Page coordinates of the signature in the signed PDF, as `[x1, y1, x2, y2]` in points.' dataAgreement: type: object additionalProperties: true nullable: true description: Data agreement that gives the terms for this verification exchange. requestExpired: type: boolean description: '`true` when the `exp` claim of `vp_token_request` is in the past.' createdAt: type: number description: Unix timestamp in seconds when the wallet made this record. updatedAt: type: number description: Unix timestamp in seconds when the wallet last changed this record. required: - id - organisationId - status - createdAt - updatedAt headers: {} '400': description: | The gateway could not resolve the organisation or the wallet deployment, or it could not read the body. The gateway also forwards a rejection of the digital wallet with this status: the response mode of the record is not a DC API mode, `response` and `vp_token` are both missing or unreadable, no encryption key belongs to the record, the JWE decryption failed, or the VP Token structure or validation failed. Errors of the gateway use the `errorCode` and `errorDescription` shape. Errors that the gateway forwards from the digital wallet keep the body of the wallet, which uses a single `detail` string. content: application/json: schema: oneOf: - required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter - type: object title: Digital wallet error description: 'Error body of the digital wallet, forwarded byte-for-byte.' properties: detail: type: string description: Reason the digital wallet refused the DC API response. example: 'Verification record response mode is direct_post, not a DC API mode' required: - detail headers: {} '401': description: Unauthorized. content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter headers: {} '404': description: No verification exchange record has the supplied `presentationExchangeId`. content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter headers: {} '500': description: 'Internal server error (failed to create the upstream request, or to read the wallet response body).' content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter headers: {} '502': description: Failed to forward the DC API response to the digital wallet deployment. content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Receive DC API verification response tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/request': put: description: 'Requests reissuance of an expired or near-expiry credential via the OID4VCI protocol. The wallet uses the stored refresh token of the credential to get a new access token, and then asks the issuer for a new credential. Reissuance is not applicable to a Wallet Unit Attestation. This operation has no request body.' operationId: configRequestDigitalWalletOpenIdCredentialReissuance parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string responses: '200': description: 'The wallet requested the reissuance. If the credential is a Wallet Unit Attestation, the wallet does nothing and returns a message.' content: application/json: schema: oneOf: - type: object title: Reissued credential properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: 'Updated credential record. The field `credentialToken` holds the new credential, and the field `expiredCredentialTokens` holds the previous ones. The wallet keeps the stored values of `autoPresent`, `requiresEncryption`, `isVerifiedWithTrustList`, `trustServiceProvider`, `oAuthFlow`, `authorizationRequest` and `isWalletUnitAttestation`, and does not refresh them on this operation.' - type: object title: Reissuance not applicable properties: message: type: string description: Reason why the wallet did not request a new credential. example: Reissuance is not applicable for wallet unit attestation credentials headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the issuer refused the reissuance request. When the credential does not support reissuance, `errorDescription` holds the text `Credential does not support reissuance`. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Request credential re-issuance tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/sdjwt/credential/{credentialId}/accept': put: description: Accepts a received credential in the holder's wallet. The wallet changes the credential status to `credential_accepted` and sends an OID4VCI notification to the issuer. This operation has no request body. operationId: configAcceptDigitalWalletOpenIdCredential parameters: - description: Unique identifier of a credential stored in the holder's wallet. in: path name: credentialId required: true schema: type: string responses: '200': description: The holder accepted the credential. content: application/json: schema: type: object properties: credential: allOf: - type: object description: 'Credential record that the holder wallet stores. The wallet always returns every field. A field that has no value is returned with its empty value: `""` for a string, `0` for a number, `false` for a boolean and `null` for an object or an array.' properties: id: type: string description: Unique identifier of the credential record. This field holds the same value as `credentialId`. credentialId: type: string description: Unique identifier for the credential stored in the holder's wallet. credentialExchangeId: type: string description: Identifier of the credential exchange that produced this credential. credentialToken: type: string description: 'The raw JWT, SD-JWT, or mDoc token of the issued Verifiable Credential as received from the issuer''s OpenID for Verifiable Credentials Issuance (OID4VCI) Credential Endpoint.' credential: type: object additionalProperties: true description: 'Decoded payload of the Verifiable Credential token. Contains the parsed claims from the W3C VC (JWT), IETF SD-JWT VC, or ISO 18013-5 mDoc/mDL credential. The field is `null` while the wallet waits for the credential.' credentialStatus: type: string enum: - '' - offer_sent - offer_received - token_issued - credential_issued - credential_pending - credential_acked - credential_accepted - credential_deleted - issuance_denied description: 'Current status of the credential in the holder''s wallet. A stored credential normally holds one of three values. `credential_pending` means the credential needs more steps, for example a transaction code or a call to the OID4VCI Deferred Credential Endpoint. `credential_acked` means the wallet received and stored the credential. `credential_accepted` means the holder accepted the credential. The other values come from the issuance lifecycle and can appear while the exchange is in progress.' acceptanceToken: type: string description: Acceptance token (transaction_id in OID4VCI) returned for deferred issuance. The wallet uses this to poll the Deferred Credential Endpoint. deferredEndpoint: type: string description: URL of the OID4VCI Deferred Credential Endpoint. Present for deferred issuance. credentialIssuer: type: string description: Credential Issuer Identifier as defined in OID4VCI. Typically the issuer's base URL used to resolve the Credential Issuer Metadata. preAuthorisedCode: type: string description: Pre-authorized code from the credential offer. Present for the OID4VCI Pre-Authorized Code Flow. userPin: type: string description: Transaction code (tx_code) required for the OID4VCI Pre-Authorized Code Flow. createdAt: type: integer description: Unix timestamp (in seconds) when this credential record was created. example: 1750000000 updatedAt: type: integer description: Unix timestamp (in seconds) when this credential record was last modified. example: 1750000600 openIdOrganisationId: type: string description: Unique identifier of the OpenID organisation (digital wallet deployment) that holds this credential. organisationId: type: string description: Unique identifier of the organisation that holds this credential. userPinRequired: type: boolean description: 'When `true`, the holder must provide a transaction code (tx_code) to complete the OID4VCI Pre-Authorized Code Flow Token Request.' credentialFormat: type: string enum: - '' - vc+sd-jwt - vp+sd-jwt - dc+sd-jwt - jwt_vc_json - jwt_vc - mso_mdoc description: 'Format of the received credential as defined in OID4VCI. `jwt_vc_json` and `jwt_vc` are W3C VC (JWT) formats, `vc+sd-jwt`, `vp+sd-jwt`, and `dc+sd-jwt` are IETF SD-JWT VC formats, and `mso_mdoc` is the ISO 18013-5 mDoc/mDL format. The field is empty until the wallet knows the format.' presentationId: type: string description: 'Identifier linking this credential to a presentation exchange, if received as part of a dynamic issuance flow involving OpenID for Verifiable Presentation (OpenID4VP).' issuer: type: object description: 'Display information about the credential issuer, resolved from the Credential Issuer Metadata of the issuer. The wallet always returns the five fields, with empty strings when it cannot resolve the metadata.' required: - name - location - cover - logo - description properties: name: type: string description: Display name of the issuer. location: type: string description: Location of the issuer. cover: type: string description: URL of the issuer's cover image. logo: type: string description: URL of the issuer's logo image. description: type: string description: Description of the issuer. credentialConfigurations: type: object additionalProperties: true description: 'Credential configuration from the Credential Issuer Metadata of the issuer that applies to this credential. The keys follow the OID4VCI metadata format, for example `vct`, `doctype`, `credential_definition` and `display`.' txCode: type: object description: 'Transaction code (`tx_code`) parameters taken from the OID4VCI Credential Offer. The keys use snake case because they mirror the OID4VCI wire format. The wallet returns `{"length": 0, "input_mode": "", "description": ""}` when the offer has no transaction code.' properties: length: type: integer description: Number of characters that the transaction code has. The value is `0` when the offer has no transaction code. example: 4 input_mode: type: string description: 'Input method for the transaction code, as defined in OID4VCI. `numeric` accepts digits only. `text` accepts alphanumeric characters. The wallet stores the value that the issuer sends and does not check it. The value is empty when the offer has no transaction code.' example: numeric description: type: string description: Instruction for the holder that explains how to get the transaction code. required: - length - input_mode - description authorizationDetails: type: array description: Authorization details that the issuer returned in the OID4VCI Token Response. The field is `null` for the Pre-Authorized Code Flow. items: type: object description: 'OAuth 2.0 authorization detail used for OID4VCI credential issuance, as defined in RFC 9396. The keys use snake case because they mirror the OID4VCI wire format.' properties: type: type: string description: Authorization detail type. The value is `openid_credential` for an OID4VCI credential issuance request. example: openid_credential credential_configuration_id: type: string description: Identifier of the credential configuration in the Credential Issuer Metadata of the issuer. example: PhotoIdCredential credential_identifiers: type: array items: type: string description: Credential identifiers that the issuer returned in the OID4VCI Token Response. The wallet sends one of these values in the Credential Request. required: - type - credential_configuration_id - credential_identifiers revocationStatus: type: string description: 'Current revocation status. `Operational` means valid, `Revoked` means permanently invalidated, `Suspended` means temporarily invalidated. The field is empty when the wallet never checked the status, or when the credential does not support revocation.' enum: - '' - Operational - Revoked - Suspended legalPidAttestation: type: string description: 'Legal Person Identification (LPID) attestation credential of the issuer, used to verify the issuer''s legal identity in the EUDI Wallet ecosystem.' legalPidAttestationPop: type: string description: 'Proof of Possession (PoP) for the issuer''s LPID attestation, proving the issuer controls the associated private key.' legalPidVerified: type: boolean description: Indicates whether the issuer's LPID attestation has been successfully verified. autoPresent: type: boolean description: 'When `true`, the wallet automatically presents this credential when a matching OpenID4VP Authorization Request is received.' version: type: string description: Version of the OID4VCI issuance protocol used for this credential. The default is `draft_13`. enum: - '' - draft_13 - draft_15 - draft_17 - version_01 kid: type: string description: Key Identifier (kid) of the cryptographic key used to sign or bind the credential. trustAnchor: type: string description: 'DID method or key type used as the trust anchor for verifying the issuer''s identity. The default is `did:key`.' enum: - '' - 'did:key' - x509 expiredCredentialTokens: type: array items: type: string description: Array of previously issued credential tokens that have expired. expiredCredentials: type: array items: type: object additionalProperties: true description: Array of decoded expired credential payloads. requiresEncryption: type: boolean description: 'When `true`, the issuer requires encrypted OID4VCI Credential Responses for this credential.' isVerifiedWithTrustList: type: boolean description: 'When `true`, the issuer of this credential was verified against a configured trust list.' trustServiceProvider: type: object additionalProperties: true description: Details of the trust service provider entry that matched the issuer during trust list verification. The field is `null` when the wallet found no match. oAuthFlow: type: string description: 'OAuth 2.0 flow used for credential issuance. `frontchannel` uses browser redirects, `backchannel` uses server-to-server communication. The field is empty for the Pre-Authorized Code Flow.' enum: - '' - frontchannel - backchannel authorizationRequest: type: string description: OAuth 2.0 authorization request URL for the Authorization Code Flow. isWalletUnitAttestation: type: boolean description: 'When `true`, this credential is a Wallet Unit Attestation (WUA) and not a regular credential. Reissuance requests are not applicable to it.' required: - id - credentialId - credentialExchangeId - credentialToken - credential - credentialStatus - acceptanceToken - deferredEndpoint - credentialIssuer - preAuthorisedCode - userPin - createdAt - updatedAt - openIdOrganisationId - organisationId - userPinRequired - credentialFormat - presentationId - issuer - credentialConfigurations - txCode - authorizationDetails - revocationStatus - legalPidAttestation - legalPidAttestationPop - legalPidVerified - autoPresent - version - trustAnchor - kid - expiredCredentialTokens - expiredCredentials - requiresEncryption - isVerifiedWithTrustList - trustServiceProvider - oAuthFlow - authorizationRequest - isWalletUnitAttestation description: 'Updated credential record. The wallet refreshes only the field `credentialStatus`, which then shows `credential_accepted`. Every other field holds the value that the record had before the request.' headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is not valid, the credential ID is unknown, or the issuer refused the notification. Holder operations are also not available for a sandbox organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Accept credential tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/holder/global-configuration: post: description: |- Creates a global configuration for the holder wallet. The configuration sets credential encryption support, the credential status refresh interval, and the redirect URL for OID4VCI and OpenID4VP flows. The service ignores `redirectUrl` in a create request and stores an empty string. Use the update operation to set the redirect URL. operationId: configCreateDigitalWalletOpenIdHolderGlobalConfiguration requestBody: description: Settings that the holder wallet applies to all OID4VCI and OpenID4VP flows. required: true content: application/json: schema: type: object required: - supportCredentialEncryption properties: supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses. You must give this field.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. Use `0` to stop the automatic checks. example: 3600 redirectUrl: type: string description: Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. The service ignores this field in a create request. Use the update operation to set it. example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR) for the OID4VCI Authorization Code flow. The service uses `false` when you leave this field out.' default: false example: supportCredentialEncryption: true refreshCredentialStatusInterval: 3600 requirePushedAuthorizationRequests: false parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: The wallet created the holder global configuration. content: application/json: schema: type: object properties: holderGlobalConfiguration: allOf: - type: object description: Global configuration of the holder wallet. It holds the settings that every OID4VCI and OpenID4VP flow of the organisation uses. properties: id: type: string description: Record identifier of the holder global configuration. The service makes this value when it saves the record. It is not the same value as `holderGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd holderGlobalConfigurationId: type: string description: 'Unique identifier of the holder global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. example: 3600 redirectUrl: type: string description: 'Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. The create operation always returns an empty string, because the service sets this value only through the update operation.' example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR, RFC 9126) for the OID4VCI Authorization Code flow. The read, update and list operations can return the value from before the last update. See the update operation.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - holderGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - refreshCredentialStatusInterval - redirectUrl - requirePushedAuthorizationRequests - createdAt - updatedAt description: Holder global configuration that the wallet saved. `redirectUrl` is always an empty string here. required: - holderGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body does not give `supportCredentialEncryption`, or the wallet is not deployed for the organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create holder global configuration tags: - Digital Wallet (OpenID4VC) - Holder '/v2/config/digital-wallet/openid/holder/global-configuration/{globalConfigurationId}': get: description: Retrieves a holder global configuration by its ID for OID4VCI and OpenID4VP flows. operationId: configReadDigitalWalletOpenIdHolderGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet returns the holder global configuration. content: application/json: schema: type: object properties: holderGlobalConfiguration: allOf: - type: object description: Global configuration of the holder wallet. It holds the settings that every OID4VCI and OpenID4VP flow of the organisation uses. properties: id: type: string description: Record identifier of the holder global configuration. The service makes this value when it saves the record. It is not the same value as `holderGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd holderGlobalConfigurationId: type: string description: 'Unique identifier of the holder global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. example: 3600 redirectUrl: type: string description: 'Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. The create operation always returns an empty string, because the service sets this value only through the update operation.' example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR, RFC 9126) for the OID4VCI Authorization Code flow. The read, update and list operations can return the value from before the last update. See the update operation.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - holderGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - refreshCredentialStatusInterval - redirectUrl - requirePushedAuthorizationRequests - createdAt - updatedAt description: Holder global configuration for the given configuration ID. required: - holderGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The configuration ID is unknown, or the wallet is not deployed for the organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read holder global configuration tags: - Digital Wallet (OpenID4VC) - Holder put: description: |- Updates a holder global configuration for OID4VCI and OpenID4VP flows. The wallet replaces all settings with the values in the request body, so send every field that you want to keep. This is the only operation that sets `redirectUrl`. The wallet stores a new value of `requirePushedAuthorizationRequests`, but the response and the later read and list operations can still give the value from before this update. operationId: configUpdateDigitalWalletOpenIdHolderGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: 'New settings for the holder global configuration. Give all fields, because the wallet replaces the full configuration.' required: true content: application/json: schema: type: object required: - supportCredentialEncryption properties: supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses. You must give this field.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. Use `0` to stop the automatic checks. example: 3600 redirectUrl: type: string description: Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR) for the OID4VCI Authorization Code flow. The service uses `false` when you leave this field out.' default: false example: supportCredentialEncryption: true refreshCredentialStatusInterval: 3600 redirectUrl: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: false responses: '200': description: The wallet updated the holder global configuration. content: application/json: schema: type: object properties: holderGlobalConfiguration: allOf: - type: object description: Global configuration of the holder wallet. It holds the settings that every OID4VCI and OpenID4VP flow of the organisation uses. properties: id: type: string description: Record identifier of the holder global configuration. The service makes this value when it saves the record. It is not the same value as `holderGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd holderGlobalConfigurationId: type: string description: 'Unique identifier of the holder global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. example: 3600 redirectUrl: type: string description: 'Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. The create operation always returns an empty string, because the service sets this value only through the update operation.' example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR, RFC 9126) for the OID4VCI Authorization Code flow. The read, update and list operations can return the value from before the last update. See the update operation.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - holderGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - refreshCredentialStatusInterval - redirectUrl - requirePushedAuthorizationRequests - createdAt - updatedAt description: Holder global configuration after the update. `requirePushedAuthorizationRequests` can still hold the value from before the update. required: - holderGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The request body does not give `supportCredentialEncryption`, or the configuration ID is unknown.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update holder global configuration tags: - Digital Wallet (OpenID4VC) - Holder delete: description: Deletes a holder global configuration for OID4VCI and OpenID4VP flows. The wallet keeps no response body. operationId: configDeleteDigitalWalletOpenIdHolderGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The wallet deleted the holder global configuration. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The configuration ID is unknown. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete holder global configuration tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/holder/global-configurations: get: description: 'Lists the holder global configurations for OID4VCI and OpenID4VP flows. The wallet sorts the configurations by last update time, newest first.' operationId: configListDigitalWalletOpenIdHolderGlobalConfiguration parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet returns the holder global configurations. content: application/json: schema: type: object properties: holderGlobalConfiguration: type: array description: Holder global configurations on the requested page. The array is empty when the wallet holds no configurations. items: type: object description: Global configuration of the holder wallet. It holds the settings that every OID4VCI and OpenID4VP flow of the organisation uses. properties: id: type: string description: Record identifier of the holder global configuration. The service makes this value when it saves the record. It is not the same value as `holderGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd holderGlobalConfigurationId: type: string description: 'Unique identifier of the holder global configuration. Give this value in the path of the read, update and delete operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the wallet accepts encrypted OID4VCI Credential Responses.' example: true refreshCredentialStatusInterval: type: integer description: Interval in seconds between two credential revocation status checks. example: 3600 redirectUrl: type: string description: 'Redirect URL that the wallet sends in the OAuth 2.0 Authorization Request during OID4VCI credential issuance. The create operation always returns an empty string, because the service sets this value only through the update operation.' example: 'https://wallet.example.com/callback' requirePushedAuthorizationRequests: type: boolean description: 'When `true`, the wallet uses a Pushed Authorization Request (PAR, RFC 9126) for the OID4VCI Authorization Code flow. The read, update and list operations can return the value from before the last update. See the update operation.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this configuration was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this configuration was last modified. example: 1747011600 required: - id - holderGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - refreshCredentialStatusInterval - redirectUrl - requirePushedAuthorizationRequests - createdAt - updatedAt pagination: allOf: - type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Page details for the returned configurations. required: - holderGlobalConfiguration - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the wallet is not deployed for the organisation.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List holder global configuration tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/verifier/global-configuration: post: description: | Creates the global configuration of the OpenID4VP verifier. The configuration sets whether the verifier accepts an encrypted Authorization Response, and how long an Authorization Request stays valid. operationId: configCreateDigitalWalletOpenIdVerifierGlobalConfiguration requestBody: required: true description: Settings of the new verifier global configuration. content: application/json: schema: type: object properties: supportCredentialEncryption: type: boolean description: 'Set to `true` when the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`. This property is mandatory.' example: true presentationRequestExpiresIn: type: integer minimum: 3600 default: 3600 description: Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600. The server uses 3600 when you leave this property out. example: 3600 required: - supportCredentialEncryption example: supportCredentialEncryption: true presentationRequestExpiresIn: 3600 parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: The server created the verifier global configuration. content: application/json: schema: type: object properties: verifierGlobalConfiguration: type: object description: Global configuration of the OpenID4VP verifier. It holds the settings that every verification request of the organisation uses. properties: id: type: string description: Record identifier of the verifier global configuration. The server makes this value when it saves the record. It is not the same value as `verifierGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd verifierGlobalConfigurationId: type: string description: 'Unique identifier of the verifier global configuration. Use this identifier to read, update or delete the record.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`.' example: true presentationRequestExpiresIn: type: number description: 'Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600, and the default is 3600.' example: 3600 createdAt: type: number description: Unix timestamp in seconds when the server made this configuration. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the server last changed this configuration. example: 1747011600 required: - id - verifierGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - presentationRequestExpiresIn - createdAt - updatedAt required: - verifierGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The body has no `supportCredentialEncryption`, `presentationRequestExpiresIn` is smaller than 3600, the organisation is unknown, the digital wallet deployment is not resolved, or the digital wallet refused the configuration.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create verifier global configuration tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/verifier/global-configuration/{globalConfigurationId}': get: description: | Reads the global configuration of the OpenID4VP verifier by its identifier. The organisation must have a deployed digital wallet. If it has none, the server answers with HTTP 400. operationId: configReadDigitalWalletOpenIdVerifierGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server found the verifier global configuration. content: application/json: schema: type: object properties: verifierGlobalConfiguration: type: object description: Global configuration of the OpenID4VP verifier. It holds the settings that every verification request of the organisation uses. properties: id: type: string description: Record identifier of the verifier global configuration. The server makes this value when it saves the record. It is not the same value as `verifierGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd verifierGlobalConfigurationId: type: string description: 'Unique identifier of the verifier global configuration. Use this identifier to read, update or delete the record.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`.' example: true presentationRequestExpiresIn: type: number description: 'Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600, and the default is 3600.' example: 3600 createdAt: type: number description: Unix timestamp in seconds when the server made this configuration. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the server last changed this configuration. example: 1747011600 required: - id - verifierGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - presentationRequestExpiresIn - createdAt - updatedAt required: - verifierGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the organisation has no deployed digital wallet, the digital wallet deployment is not resolved, or no configuration has the supplied `globalConfigurationId`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read verifier global configuration tags: - Digital Wallet (OpenID4VC) - Verifier put: description: | Updates the global configuration of the OpenID4VP verifier. Send the full set of settings. `supportCredentialEncryption` is mandatory in every update request. Always send `presentationRequestExpiresIn` too. If you leave it out, the server sets the lifetime of the Authorization Request to 0 seconds instead of the default 3600. operationId: configUpdateDigitalWalletOpenIdVerifierGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true description: New settings of the verifier global configuration. content: application/json: schema: type: object properties: supportCredentialEncryption: type: boolean description: 'Set to `true` when the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`. This property is mandatory.' example: true presentationRequestExpiresIn: type: integer minimum: 3600 description: 'Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600. If you leave this property out, the server stores 0 instead of the default.' example: 3600 required: - supportCredentialEncryption example: supportCredentialEncryption: true presentationRequestExpiresIn: 3600 responses: '200': description: The server updated the verifier global configuration. content: application/json: schema: type: object properties: verifierGlobalConfiguration: type: object description: Global configuration of the OpenID4VP verifier. It holds the settings that every verification request of the organisation uses. properties: id: type: string description: Record identifier of the verifier global configuration. The server makes this value when it saves the record. It is not the same value as `verifierGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd verifierGlobalConfigurationId: type: string description: 'Unique identifier of the verifier global configuration. Use this identifier to read, update or delete the record.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`.' example: true presentationRequestExpiresIn: type: number description: 'Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600, and the default is 3600.' example: 3600 createdAt: type: number description: Unix timestamp in seconds when the server made this configuration. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the server last changed this configuration. example: 1747011600 required: - id - verifierGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - presentationRequestExpiresIn - createdAt - updatedAt required: - verifierGlobalConfiguration headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The body has no `supportCredentialEncryption`, `presentationRequestExpiresIn` is smaller than 3600, the organisation is unknown, the digital wallet deployment is not resolved, no configuration has the supplied `globalConfigurationId`, or the digital wallet refused the update.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update verifier global configuration tags: - Digital Wallet (OpenID4VC) - Verifier delete: description: Deletes the global configuration of the OpenID4VP verifier. operationId: configDeleteDigitalWalletOpenIdVerifierGlobalConfiguration parameters: - description: 'Unique identifier of the global configuration. Give `globalConfigurationId` for the issuer operations, `holderGlobalConfigurationId` for the holder operations, and `verifierGlobalConfigurationId` for the verifier operations. Do not give the `id` field of the record.' in: path name: globalConfigurationId required: true schema: type: string example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The server deleted the verifier global configuration. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the digital wallet deployment is not resolved, no configuration has the supplied `globalConfigurationId`, or the digital wallet refused the delete.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete verifier global configuration tags: - Digital Wallet (OpenID4VC) - Verifier /v2/config/digital-wallet/openid/verifier/global-configurations: get: description: | Lists the global configurations of the OpenID4VP verifier. The server sorts them by `updatedAt`, newest first. An organisation normally has one verifier global configuration. The organisation must have a deployed digital wallet. If it has none, the server answers with HTTP 400. operationId: configListDigitalWalletOpenIdVerifierGlobalConfiguration parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server listed the verifier global configurations. content: application/json: schema: type: object properties: verifierGlobalConfiguration: description: Verifier global configurations for the current page. The array is empty when the organisation has no configuration. items: type: object description: Global configuration of the OpenID4VP verifier. It holds the settings that every verification request of the organisation uses. properties: id: type: string description: Record identifier of the verifier global configuration. The server makes this value when it saves the record. It is not the same value as `verifierGlobalConfigurationId`. example: 665f2b8c9a1d4e0012ab34cd verifierGlobalConfigurationId: type: string description: 'Unique identifier of the verifier global configuration. Use this identifier to read, update or delete the record.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 openIdOrganisationId: type: string description: Identifier of the digital wallet deployment that holds this configuration. supportCredentialEncryption: type: boolean description: 'When `true`, the verifier accepts an encrypted OpenID4VP Authorization Response, that is a response mode of `direct_post.jwt` or `dc_api.jwt`.' example: true presentationRequestExpiresIn: type: number description: 'Lifetime of an Authorization Request in seconds. The server writes this value to the `exp` claim of the request. The smallest value is 3600, and the default is 3600.' example: 3600 createdAt: type: number description: Unix timestamp in seconds when the server made this configuration. example: 1747011600 updatedAt: type: number description: Unix timestamp in seconds when the server last changed this configuration. example: 1747011600 required: - id - verifierGlobalConfigurationId - openIdOrganisationId - supportCredentialEncryption - presentationRequestExpiresIn - createdAt - updatedAt type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true required: - verifierGlobalConfiguration - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the organisation has no deployed digital wallet, or the digital wallet deployment is not resolved.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The server could not read the page of verifier global configurations. headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List verifier global configuration tags: - Digital Wallet (OpenID4VC) - Verifier '/v2/config/digital-wallet/openid/notification/{notificationId}': get: description: Retrieves a wallet notification by its ID. The wallet creates a notification for each OID4VCI credential lifecycle event. operationId: configReadDigitalWalletOpenIdNotification parameters: - description: Unique identifier of an OID4VCI credential lifecycle notification. The value must be a UUID. in: path name: notificationId required: true schema: type: string format: uuid example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet returns the notification. content: application/json: schema: type: object properties: notification: allOf: - type: object description: A wallet notification for an OID4VCI credential lifecycle event. properties: id: type: string description: Unique identifier of the notification. example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 notificationType: type: string description: 'Type of the OID4VCI notification event. `credential_pending` (deferred issuance in progress), `credential_acked` (the holder acknowledged the credential), `credential_revoked` (the issuer revoked the credential), `credential_expired` (the credential expired).' enum: - credential_pending - credential_acked - credential_revoked - credential_expired example: credential_acked notificationTypeRelatedId: type: string description: 'Identifier of the resource that the notification is about, for example the credential identifier.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 notificationContent: description: 'Payload of the notification. The wallet gives an array of objects that hold the `credential`, `credentialConfigurations` and `issuer` details. The value is `null` when the wallet holds no payload.' oneOf: - type: array items: type: object additionalProperties: true - type: object additionalProperties: true status: type: string description: 'Read status of the notification. A new notification has the status `unread`. The update operation sets the status to `read`, and a notification cannot go back to `unread`.' enum: - read - unread example: unread createdAt: type: number description: Unix timestamp (in seconds) when the notification was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when the notification was last modified. example: 1747011600 required: - id - notificationType - notificationTypeRelatedId - notificationContent - status - createdAt - updatedAt description: Notification for the given notification ID. required: - notification headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The notification ID is unknown. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read notification tags: - Digital Wallet (OpenID4VC) - Holder put: description: 'Marks a wallet notification as read. The wallet accepts only the value `read`, because a notification cannot go back to the `unread` state.' operationId: configUpdateDigitalWalletOpenIdNotification parameters: - description: Unique identifier of an OID4VCI credential lifecycle notification. The value must be a UUID. in: path name: notificationId required: true schema: type: string format: uuid example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: New read status for the notification. required: true content: application/json: schema: type: object required: - status properties: status: type: string description: New status of the notification. The wallet accepts only `read` and refuses all other values. enum: - read example: read responses: '200': description: The wallet marked the notification as read. content: application/json: schema: type: object properties: notification: allOf: - type: object description: A wallet notification for an OID4VCI credential lifecycle event. properties: id: type: string description: Unique identifier of the notification. example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 notificationType: type: string description: 'Type of the OID4VCI notification event. `credential_pending` (deferred issuance in progress), `credential_acked` (the holder acknowledged the credential), `credential_revoked` (the issuer revoked the credential), `credential_expired` (the credential expired).' enum: - credential_pending - credential_acked - credential_revoked - credential_expired example: credential_acked notificationTypeRelatedId: type: string description: 'Identifier of the resource that the notification is about, for example the credential identifier.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 notificationContent: description: 'Payload of the notification. The wallet gives an array of objects that hold the `credential`, `credentialConfigurations` and `issuer` details. The value is `null` when the wallet holds no payload.' oneOf: - type: array items: type: object additionalProperties: true - type: object additionalProperties: true status: type: string description: 'Read status of the notification. A new notification has the status `unread`. The update operation sets the status to `read`, and a notification cannot go back to `unread`.' enum: - read - unread example: unread createdAt: type: number description: Unix timestamp (in seconds) when the notification was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when the notification was last modified. example: 1747011600 required: - id - notificationType - notificationTypeRelatedId - notificationContent - status - createdAt - updatedAt description: Notification after the update. required: - notification headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The notification ID is unknown, or the status is not `read`.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update notification tags: - Digital Wallet (OpenID4VC) - Holder delete: description: 'Deletes a wallet notification. When the notification has the type `credential_acked` and the related credential is still in the state `credential_acked`, the wallet also deletes that credential. The wallet keeps no response body.' operationId: configDeleteDigitalWalletOpenIdNotification parameters: - description: Unique identifier of an OID4VCI credential lifecycle notification. The value must be a UUID. in: path name: notificationId required: true schema: type: string format: uuid example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The wallet deleted the notification. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The notification ID is unknown. headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete notification tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/notifications: get: description: |- Lists the wallet notifications for OID4VCI credential lifecycle events. You can filter the notifications by read status, by notification type and by a search term. The `search` term matches the credential type (`vct`), the last W3C credential type, the mDoc `docType`, the display names of the credential configuration, and the issuer name. The service always sorts the notifications by `updatedAt`, newest first. The `sortOrder` parameter has no effect on this operation. operationId: configListDigitalWalletOpenIdNotification parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Filter notifications by read or unread status. in: query name: status schema: type: string enum: - read - unread - description: Filter notifications by OID4VCI credential lifecycle event type. in: query name: notificationType schema: type: string enum: - credential_pending - credential_acked - credential_revoked - credential_expired - description: Search term to filter results by in: query name: search required: false schema: type: string - description: Sort order for the returned records (ascending or descending). in: query name: sortOrder required: false schema: type: string enum: - desc - asc default: desc - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The wallet returns the notifications. content: application/json: schema: type: object properties: notification: type: array description: Notifications on the requested page. The array is empty when the wallet holds no notifications. items: type: object description: A wallet notification for an OID4VCI credential lifecycle event. properties: id: type: string description: Unique identifier of the notification. example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 notificationType: type: string description: 'Type of the OID4VCI notification event. `credential_pending` (deferred issuance in progress), `credential_acked` (the holder acknowledged the credential), `credential_revoked` (the issuer revoked the credential), `credential_expired` (the credential expired).' enum: - credential_pending - credential_acked - credential_revoked - credential_expired example: credential_acked notificationTypeRelatedId: type: string description: 'Identifier of the resource that the notification is about, for example the credential identifier.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 notificationContent: description: 'Payload of the notification. The wallet gives an array of objects that hold the `credential`, `credentialConfigurations` and `issuer` details. The value is `null` when the wallet holds no payload.' oneOf: - type: array items: type: object additionalProperties: true - type: object additionalProperties: true status: type: string description: 'Read status of the notification. A new notification has the status `unread`. The update operation sets the status to `read`, and a notification cannot go back to `unread`.' enum: - read - unread example: unread createdAt: type: number description: Unix timestamp (in seconds) when the notification was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when the notification was last modified. example: 1747011600 required: - id - notificationType - notificationTypeRelatedId - notificationContent - status - createdAt - updatedAt pagination: allOf: - type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true description: Page details for the returned notifications. required: - notification - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the wallet cannot list the notifications.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List notification tags: - Digital Wallet (OpenID4VC) - Holder delete: description: 'Deletes all wallet notifications for the organisation. There is no filter and no confirmation parameter. Unlike the delete operation for one notification, this operation keeps the credentials that the notifications refer to. The wallet keeps no response body.' operationId: configDeleteAllDigitalWalletOpenIdNotification parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '204': description: The wallet deleted all notifications. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, or the wallet cannot delete the notifications.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete all notifications tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/notifications/sse: get: description: |- Streams wallet notifications for OID4VCI credential lifecycle events over Server-Sent Events. The server keeps the connection open and writes one frame for each new notification. ### Authentication The browser `EventSource` API cannot set request headers. The server therefore reads the `Authorization` header first, and it falls back to the `authorization` query parameter only when that header is empty. Give the scheme prefix and the space in the value, that is `ApiKey ` or `Bearer `. The server accepts both schemes on this operation. ### Response headers `Content-Type: text/event-stream`, `Cache-Control: no-cache`, `Connection: keep-alive`. ### Frames that the server writes 1. `retry: 30000` - the server writes this frame first, before it checks the organisation. It tells the client to wait 30 seconds before it reconnects. 2. `event: connected` with the data `{}` - the server writes this frame after the subscription is live. 3. `event: notification` - one frame for each new notification. The frame holds an `id` field with the stream sequence number, and a `data` field with the notification object. 4. `: keep-alive` - an SSE comment line every 15 seconds. It carries no event, and clients ignore it. 5. `event: error` - the server writes this frame when it cannot find the organisation or cannot resolve the wallet, and it then closes the stream. The data holds one field, `error`. The status line is already sent at that point, so this frame arrives with HTTP 200, not with a 4xx status. ### Payload of a notification frame The `data` field holds the notification object with **no envelope**, unlike the read and update operations, which wrap the object in `notification`. The object always holds these eight fields: `id`, `organisationId`, `notificationType`, `notificationTypeRelatedId`, `notificationContent`, `status`, `createdAt` and `updatedAt`. Note `organisationId`, which the read, update and list operations do not return. The status of a new notification is always `unread`, and `createdAt` and `updatedAt` are Unix timestamps in seconds. ### Behaviour The server writes a frame only when it creates a notification. A status change and a deletion produce no frame. The server does not replay frames that the client missed: a reconnection starts from live traffic, and `Last-Event-ID` is not supported. Use the list operation to read the notifications that the wallet holds already. When a client reads the stream too slowly, the server drops frames for that client rather than blocking the other clients, so the `id` sequence can hold gaps. This operation takes no filter parameters. The server ignores `status`, `limit` and `offset` on this path. Use the list operation to filter notifications. operationId: configListDigitalWalletOpenIdNotificationSse parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 - description: 'Authorization value with its scheme prefix, for example `ApiKey ` or `Bearer `. Use this parameter when the client cannot send the `Authorization` header, for example the browser `EventSource` API. The server reads the header first and uses this parameter only when the header is empty.' in: query name: authorization required: false schema: type: string example: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIn0.signature responses: '200': description: The server opened the Server-Sent Events stream. The response stays open until the client closes the connection or the server closes the channel. content: text/event-stream: schema: type: string description: 'Server-Sent Events stream. It holds the `connected`, `notification` and `error` named events, and the keep-alive comment lines. The `data` field of a `notification` event holds a JSON object with the fields of `NotificationSseEvent` below.' contentMediaType: application/json contentSchema: type: object title: NotificationSseEvent description: Payload of the `data` field of a `notification` event. properties: id: type: string format: uuid description: Unique identifier of the notification. example: 6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9 organisationId: type: string format: uuid description: 'Identifier of the organisation that owns the notification. Only the stream gives this field; the read, update and list operations drop it.' example: 0f9b1c2d-3e4a-5b6c-7d8e-9f0a1b2c3d4e notificationType: type: string description: Type of the OID4VCI notification event. enum: - credential_pending - credential_acked - credential_revoked - credential_expired example: credential_acked notificationTypeRelatedId: type: string format: uuid description: 'Identifier of the resource that the notification is about, for example the credential identifier.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 notificationContent: description: 'Payload of the notification. The wallet gives an array of objects that hold the `credential`, `credentialConfigurations` and `issuer` details. The value is `null` when the wallet holds no payload.' oneOf: - type: array items: type: object additionalProperties: true - type: object additionalProperties: true status: type: string description: 'Read status of the notification. A new notification always has the status `unread`, so the stream always gives `unread`.' enum: - read - unread example: unread createdAt: type: number description: Unix timestamp (in seconds) when the notification was created. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when the notification was last modified. example: 1747011600 required: - id - organisationId - notificationType - notificationTypeRelatedId - notificationContent - status - createdAt - updatedAt example: | retry: 30000 event: connected data: {} id: 4711 event: notification data: {"id":"6d0a1f3e-2b7c-4c8a-9f11-3ab5c6d7e8f9","organisationId":"0f9b1c2d-3e4a-5b6c-7d8e-9f0a1b2c3d4e","notificationType":"credential_acked","notificationTypeRelatedId":"b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45","notificationContent":[{"credential":{"vct":"EmployeeBadge"},"issuer":{"name":"Example Organisation"}}],"status":"unread","createdAt":1747011600,"updatedAt":1747011600} : keep-alive id: 4712 event: notification data: {"id":"1c2d3e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f","organisationId":"0f9b1c2d-3e4a-5b6c-7d8e-9f0a1b2c3d4e","notificationType":"credential_revoked","notificationTypeRelatedId":"5f6a7b8c-9d0e-4f1a-2b3c-4d5e6f7a8b9c","notificationContent":null,"status":"unread","createdAt":1747015200,"updatedAt":1747015200} event: error data: {"error":"Failed to resolve wallet: no deployment for organisation"} headers: Cache-Control: description: The server always sends `no-cache`. schema: type: string example: no-cache Connection: description: The server always sends `keep-alive`. schema: type: string example: keep-alive '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The `Authorization` header and the `authorization` query parameter are both empty, or the value has no `ApiKey ` or `Bearer ` prefix.' headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: The server does not support response streaming. headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Stream notifications (SSE) tags: - Digital Wallet (OpenID4VC) - Holder /v2/config/digital-wallet/openid/sdjwt/scopes: get: description: | Lists the OAuth 2.0 scopes available for OID4VCI credential issuance, as published in the Credential Issuer Metadata. Use a value from this list in `credentialDefinitions[].scope` of a create or update credential definition request, when `authorizationRequestType` is `scope_based`. operationId: configListDigitalWalletOpenIdScopes parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The server returns the scopes for the current page. content: application/json: schema: properties: scope: description: Scopes for the current page. Each scope maps to a credential configuration in the OID4VCI Credential Issuer Metadata. items: type: object properties: id: type: string description: Unique identifier for the scope record. scope: type: string description: OAuth 2.0 scope value mapped to a credential type in the OID4VCI Credential Issuer Metadata. createdAt: type: number description: Unix timestamp (in seconds) when the scope was created. updatedAt: type: number description: Unix timestamp (in seconds) when the scope was last modified. required: - id - scope - createdAt - updatedAt type: array pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation is unknown, the wallet is not deployed, or the issuer cannot read the scopes.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List scope tags: - Digital Wallet (OpenID4VC) - Issuer /v2/config/digital-wallet/openid/trust-authority: post: description: Creates a trust authority for the organisation. A trust authority points to a trust list. The service uses the trust lists to validate issuers and verifiers in OID4VCI and OpenID4VP flows. operationId: configCreateDigitalWalletOpenIdTrustAuthority requestBody: description: The trust list to add to the organisation. required: true content: application/json: schema: type: object required: - type - value properties: type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` only. `ETSI_TL` is an ETSI Trusted List in XML format. The service changes the value to upper case. example: ETSI_TL value: type: string minLength: 1 maxLength: 2048 description: 'Location of the trust list. For the `ETSI_TL` type, give an HTTP or HTTPS URL that returns the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string maxLength: 255 description: 'Name of the trust authority. The service shows this name in the dashboard. This field is optional, and the service stores an empty string when you leave it out.' example: EU Trust List example: type: ETSI_TL value: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: EU Trust List parameters: - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '201': description: The service created the trust authority. content: application/json: schema: type: object properties: trustAuthority: description: The trust authority that the service created. type: object properties: id: type: string description: 'Unique identifier of the trust authority record. Records that the organisation created have a UUID. The two built-in trust lists have the identifiers `0` and `1`, and you cannot read, update, toggle or delete them with the per-identifier operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` (ETSI TS 119 612 trusted list) only. example: ETSI_TL value: type: string description: 'Location of the trust list. For the `ETSI_TL` type, this is the HTTP or HTTPS URL of the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string description: Name of the trust authority. The value is an empty string when the create or update request gave no name. example: EU Trust List disabled: type: boolean description: 'When `true`, this trust authority is disabled and not used for credential or verifier trust validation. The two built-in trust lists always return `false`.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this trust authority was registered. The two built-in trust lists always return `0`. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this trust authority was last modified. The two built-in trust lists always return `0`. example: 1747011600 required: - id - type - value - name - createdAt - updatedAt - disabled required: - trustAuthority headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation ID is not valid, the wallet is not resolved, the `type` is not `ETSI_TL`, or the `value` is not a URL.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Create trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor '/v2/config/digital-wallet/openid/trust-authority/{trustAuthorityId}': get: description: 'Reads one trust authority of the organisation. Give the trust authority ID in the path. The ID must be a UUID, so this operation does not read the two built-in trust lists that the list operation returns with the IDs `0` and `1`.' operationId: configReadDigitalWalletOpenIdTrustAuthority parameters: - description: 'Unique identifier of a trust authority of the organisation. The value must be a UUID, so the identifiers `0` and `1` of the two built-in trust lists are not valid here.' in: path name: trustAuthorityId required: true schema: type: string format: uuid example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service found the trust authority. content: application/json: schema: type: object properties: trustAuthority: description: The trust authority for the given ID. type: object properties: id: type: string description: 'Unique identifier of the trust authority record. Records that the organisation created have a UUID. The two built-in trust lists have the identifiers `0` and `1`, and you cannot read, update, toggle or delete them with the per-identifier operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` (ETSI TS 119 612 trusted list) only. example: ETSI_TL value: type: string description: 'Location of the trust list. For the `ETSI_TL` type, this is the HTTP or HTTPS URL of the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string description: Name of the trust authority. The value is an empty string when the create or update request gave no name. example: EU Trust List disabled: type: boolean description: 'When `true`, this trust authority is disabled and not used for credential or verifier trust validation. The two built-in trust lists always return `false`.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this trust authority was registered. The two built-in trust lists always return `0`. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this trust authority was last modified. The two built-in trust lists always return `0`. example: 1747011600 required: - id - type - value - name - createdAt - updatedAt - disabled required: - trustAuthority headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation ID is not valid, the wallet is not resolved, or the organisation has no trust authority with this ID.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor put: description: 'Updates one trust authority of the organisation. Give the trust authority ID in the path. Send all three fields with valid values. The service forwards each field, and it rejects an empty field.' operationId: configUpdateDigitalWalletOpenIdTrustAuthority parameters: - description: 'Unique identifier of a trust authority of the organisation. The value must be a UUID, so the identifiers `0` and `1` of the two built-in trust lists are not valid here.' in: path name: trustAuthorityId required: true schema: type: string format: uuid example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: description: The new values of the trust authority. required: true content: application/json: schema: type: object required: - type - value - name properties: type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` only. `ETSI_TL` is an ETSI Trusted List in XML format. The service changes the value to upper case. example: ETSI_TL value: type: string minLength: 1 maxLength: 2048 description: 'Location of the trust list. For the `ETSI_TL` type, give an HTTP or HTTPS URL that returns the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string minLength: 1 maxLength: 255 description: 'Name of the trust authority. The service shows this name in the dashboard. A partial update is not possible, so give a name here even when the name does not change.' example: EU Trust List example: type: ETSI_TL value: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: EU Trust List responses: '200': description: The service updated the trust authority. content: application/json: schema: type: object properties: trustAuthority: description: The trust authority after the update. type: object properties: id: type: string description: 'Unique identifier of the trust authority record. Records that the organisation created have a UUID. The two built-in trust lists have the identifiers `0` and `1`, and you cannot read, update, toggle or delete them with the per-identifier operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` (ETSI TS 119 612 trusted list) only. example: ETSI_TL value: type: string description: 'Location of the trust list. For the `ETSI_TL` type, this is the HTTP or HTTPS URL of the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string description: Name of the trust authority. The value is an empty string when the create or update request gave no name. example: EU Trust List disabled: type: boolean description: 'When `true`, this trust authority is disabled and not used for credential or verifier trust validation. The two built-in trust lists always return `false`.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this trust authority was registered. The two built-in trust lists always return `0`. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this trust authority was last modified. The two built-in trust lists always return `0`. example: 1747011600 required: - id - type - value - name - createdAt - updatedAt - disabled required: - trustAuthority headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation ID is not valid, the wallet is not resolved, a field is empty or not valid, or the organisation has no trust authority with this ID.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor delete: description: 'Deletes one trust authority of the organisation. Give the trust authority ID in the path. The ID must be a UUID, so this operation does not delete the two built-in trust lists. After deletion, the service no longer uses this trust list to validate issuers and verifiers.' operationId: configDeleteDigitalWalletOpenIdTrustAuthority parameters: - description: 'Unique identifier of a trust authority of the organisation. The value must be a UUID, so the identifiers `0` and `1` of the two built-in trust lists are not valid here.' in: path name: trustAuthorityId required: true schema: type: string format: uuid example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service deleted the trust authority. The response has no body. headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation ID is not valid, the wallet is not resolved, or the organisation has no trust authority with this ID.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Delete trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor '/v2/config/digital-wallet/openid/trust-authority/{trustAuthorityId}/disable': put: description: 'Enables or disables a trust authority. A disabled trust authority is not used for credential or verifier trust validation. Give the wanted end state in `disabled`. The ID in the path must be a UUID, so this operation does not change the two built-in trust lists.' operationId: configToggleDigitalWalletOpenIdTrustAuthority parameters: - description: 'Unique identifier of a trust authority of the organisation. The value must be a UUID, so the identifiers `0` and `1` of the two built-in trust lists are not valid here.' in: path name: trustAuthorityId required: true schema: type: string format: uuid example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 requestBody: required: true content: application/json: schema: type: object required: - disabled properties: disabled: type: boolean description: 'When `true`, the trust authority is disabled. When `false`, it is enabled.' example: true responses: '200': description: The updated trust authority record. content: application/json: schema: properties: trustAuthority: description: The trust authority after the change. type: object properties: id: type: string description: 'Unique identifier of the trust authority record. Records that the organisation created have a UUID. The two built-in trust lists have the identifiers `0` and `1`, and you cannot read, update, toggle or delete them with the per-identifier operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` (ETSI TS 119 612 trusted list) only. example: ETSI_TL value: type: string description: 'Location of the trust list. For the `ETSI_TL` type, this is the HTTP or HTTPS URL of the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string description: Name of the trust authority. The value is an empty string when the create or update request gave no name. example: EU Trust List disabled: type: boolean description: 'When `true`, this trust authority is disabled and not used for credential or verifier trust validation. The two built-in trust lists always return `false`.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this trust authority was registered. The two built-in trust lists always return `0`. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this trust authority was last modified. The two built-in trust lists always return `0`. example: 1747011600 required: - id - type - value - name - createdAt - updatedAt - disabled required: - trustAuthority type: object headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'Bad request. The `disabled` field is missing, the organisation or wallet cannot be resolved, or the trust authority does not exist.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Toggle trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor /v2/config/digital-wallet/openid/trust-authorities: get: description: |- Lists the trust authorities of the organisation. The service uses these trust lists to validate issuers and verifiers in OID4VCI and OpenID4VP flows. The list starts with two built-in trust lists that the service returns for every organisation. They have the IDs `0` and `1`, and `disabled`, `createdAt` and `updatedAt` always hold `false`, `0` and `0` for them. The trust authorities that the organisation created come after them. `pagination.totalItems` counts the two built-in records, and they fill the first page. The largest value of `limit` is 100. A larger value gives HTTP 400. operationId: configListDigitalWalletOpenIdTrustAuthority parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: |- Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet. The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with `PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org` instead. `X-SubwalletId` is the deprecated name of this header. The service continues to accept it, but `X-SandboxOrgId` wins if you send both headers. The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400. in: header name: X-SandboxOrgId required: false schema: type: string example: 6889e1a4c5b2f30001a3d710 responses: '200': description: The service returns the trust authorities and the pagination data. content: application/json: schema: type: object properties: trustAuthority: type: array description: 'The trust authorities on the current page. The first two records are the built-in trust lists, which have the IDs `0` and `1`.' items: type: object description: A trust authority of the organisation. It points to a trust list that the service uses to validate issuers and verifiers. properties: id: type: string description: 'Unique identifier of the trust authority record. Records that the organisation created have a UUID. The two built-in trust lists have the identifiers `0` and `1`, and you cannot read, update, toggle or delete them with the per-identifier operations.' example: b7d1f4a2-8c3e-4a91-9f52-0d3c6e7a1b45 type: type: string enum: - ETSI_TL description: Type of the trust list. The service accepts `ETSI_TL` (ETSI TS 119 612 trusted list) only. example: ETSI_TL value: type: string description: 'Location of the trust list. For the `ETSI_TL` type, this is the HTTP or HTTPS URL of the trusted list document.' example: 'https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml' name: type: string description: Name of the trust authority. The value is an empty string when the create or update request gave no name. example: EU Trust List disabled: type: boolean description: 'When `true`, this trust authority is disabled and not used for credential or verifier trust validation. The two built-in trust lists always return `false`.' example: false createdAt: type: number description: Unix timestamp (in seconds) when this trust authority was registered. The two built-in trust lists always return `0`. example: 1747011600 updatedAt: type: number description: Unix timestamp (in seconds) when this trust authority was last modified. The two built-in trust lists always return `0`. example: 1747011600 required: - id - type - value - name - createdAt - updatedAt - disabled pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true required: - trustAuthority - pagination headers: {} '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: 'The organisation ID is not valid, the wallet is not resolved, or `limit` is larger than 100.' headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: List trust authority tags: - Digital Wallet (OpenID4VC) - Trust Anchor /v2/onboard/organisation/admin: post: description: |- Creates an admin in the organisation. The dashboard uses this operation on the Manage Team page. The new admin gets an invitation. The `pendingInvitation` field of the admin stays `true` until the admin logs in for the first time. Set `passwordlessLoginEnabled` to `true` to let the admin log in with an EUDI Wallet in place of a password. operationId: configCreateOrganisationAdmin requestBody: description: The admin to create. required: true content: application/json: schema: type: object required: - email - name properties: email: type: string description: The email address of the admin. name: type: string description: The full name of the admin. passwordlessLoginEnabled: type: boolean description: 'When `true`, the admin can log in with an EUDI Wallet (passwordless login).' example: email: jane.smith@example.com name: Jane Smith passwordlessLoginEnabled: true responses: '201': description: The service created the admin. content: application/json: schema: type: object properties: admin: type: object required: - id - email - name - phone - roleId - roleName - authentication - pendingInvitation properties: id: type: string description: Unique identifier for the admin email: type: string format: email description: Admin's email address name: type: string description: Full name of the admin phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID roleId: type: integer description: Numeric ID of the assigned role roleName: type: string description: Human-readable name of the role authentication: type: object description: Configuration for authentication methods properties: password: type: object description: Configuration for password authentication properties: enabled: type: boolean oidcPasswordless: type: object description: Configuration for Passwordless Login with EUDI Wallet properties: enabled: type: boolean description: Whether Passwordless Login is enabled for the user linked: type: boolean description: Whether the user has linked their EUDI Wallet for Passwordless Login authenticatorCredentialExchangeId: type: string description: Credential Exchange ID of the issued iGrant.io Authenticator credential pendingInvitation: type: boolean description: Indicates if the admin account has a pending invitation organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Create organisation admin tags: - Digital Wallet (OpenID4VC) - Team Management '/v2/onboard/organisation/admin/{adminId}': get: description: Reads one admin of the organisation. operationId: configReadOrganisationAdmin parameters: - name: adminId in: path description: Unique ID of an Admin required: true schema: type: string responses: '200': description: The admin. content: application/json: schema: type: object properties: admin: type: object required: - id - email - name - phone - roleId - roleName - authentication - pendingInvitation properties: id: type: string description: Unique identifier for the admin email: type: string format: email description: Admin's email address name: type: string description: Full name of the admin phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID roleId: type: integer description: Numeric ID of the assigned role roleName: type: string description: Human-readable name of the role authentication: type: object description: Configuration for authentication methods properties: password: type: object description: Configuration for password authentication properties: enabled: type: boolean oidcPasswordless: type: object description: Configuration for Passwordless Login with EUDI Wallet properties: enabled: type: boolean description: Whether Passwordless Login is enabled for the user linked: type: boolean description: Whether the user has linked their EUDI Wallet for Passwordless Login authenticatorCredentialExchangeId: type: string description: Credential Exchange ID of the issued iGrant.io Authenticator credential pendingInvitation: type: boolean description: Indicates if the admin account has a pending invitation organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Resource not found headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Read organisation admin tags: - Digital Wallet (OpenID4VC) - Team Management delete: description: Deletes an admin from the organisation. The service gives the admin as it was at the moment of the delete. operationId: configDeleteOrganisationAdmin parameters: - name: adminId in: path description: Unique ID of an Admin required: true schema: type: string responses: '200': description: The service deleted the admin. content: application/json: schema: type: object properties: admin: type: object required: - id - email - name - phone - roleId - roleName - authentication - pendingInvitation properties: id: type: string description: Unique identifier for the admin email: type: string format: email description: Admin's email address name: type: string description: Full name of the admin phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID roleId: type: integer description: Numeric ID of the assigned role roleName: type: string description: Human-readable name of the role authentication: type: object description: Configuration for authentication methods properties: password: type: object description: Configuration for password authentication properties: enabled: type: boolean oidcPasswordless: type: object description: Configuration for Passwordless Login with EUDI Wallet properties: enabled: type: boolean description: Whether Passwordless Login is enabled for the user linked: type: boolean description: Whether the user has linked their EUDI Wallet for Passwordless Login authenticatorCredentialExchangeId: type: string description: Credential Exchange ID of the issued iGrant.io Authenticator credential pendingInvitation: type: boolean description: Indicates if the admin account has a pending invitation organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Resource not found headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Delete organisation admin tags: - Digital Wallet (OpenID4VC) - Team Management /v2/onboard/organisation/admins: get: description: 'Lists the admins of the organisation, with pages. Use the `search` parameter to filter the admins by name or email address. The dashboard uses this operation for the table on the Manage Team page.' operationId: configListOrganisationAdmins parameters: - description: Number of records to skip for pagination. A negative or unreadable value falls back to `0`. in: query name: offset required: false schema: type: integer default: 0 minimum: 0 - name: limit in: query description: Maximum number of records to return per page. required: false schema: type: integer default: 10 - description: Search term to filter results by in: query name: search required: false schema: type: string responses: '200': description: The admins of the organisation. content: application/json: schema: type: object required: - admins properties: admins: type: array description: The admins of the organisation. items: type: object properties: admin: type: object required: - id - email - name - phone - roleId - roleName - authentication - pendingInvitation properties: id: type: string description: Unique identifier for the admin email: type: string format: email description: Admin's email address name: type: string description: Full name of the admin phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID roleId: type: integer description: Numeric ID of the assigned role roleName: type: string description: Human-readable name of the role authentication: type: object description: Configuration for authentication methods properties: password: type: object description: Configuration for password authentication properties: enabled: type: boolean oidcPasswordless: type: object description: Configuration for Passwordless Login with EUDI Wallet properties: enabled: type: boolean description: Whether Passwordless Login is enabled for the user linked: type: boolean description: Whether the user has linked their EUDI Wallet for Passwordless Login authenticatorCredentialExchangeId: type: string description: Credential Exchange ID of the issued iGrant.io Authenticator credential pendingInvitation: type: boolean description: Indicates if the admin account has a pending invitation organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization pagination: type: object title: Pagination properties: currentPage: type: integer description: Current page number example: 1 totalItems: type: integer description: Total number of items available example: 25 totalPages: type: integer description: Total number of pages based on limit example: 3 limit: type: integer description: Number of items per page example: 10 hasPrevious: type: boolean description: Indicates if there's a previous page example: false hasNext: type: boolean description: Indicates if there's a next page example: true '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: List organisation admins tags: - Digital Wallet (OpenID4VC) - Team Management '/v3/config/admin/authentication/oidc/user/{adminId}': put: description: 'Enables or disables passwordless login with EUDI Wallet for one admin of the organisation. When passwordless login is enabled, the admin can link a wallet and log in with a PID (Person Identification Data) credential or an iGrant.io Authenticator credential in place of a password.' operationId: configSetPasswordlessLoginForAdmin parameters: - name: adminId in: path description: Unique ID of an Admin required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: enabled: type: boolean default: true description: 'When `true`, passwordless login is enabled for the admin.' example: enabled: true responses: '200': description: The service updated the passwordless login configuration. content: application/json: schema: type: object properties: enabled: type: boolean description: The new state of passwordless login for the admin. '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '404': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Resource not found headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Enable or disable passwordless login for an admin tags: - Digital Wallet (OpenID4VC) - Team Management /v2/onboard/admin: get: description: Reads the profile of the admin that owns the access token. The dashboard uses this operation on the Manage User page and after login. operationId: configReadAdminProfile responses: '200': description: The profile of the admin. content: application/json: schema: type: object properties: organisationAdmin: type: object title: OrganisationAdmin x-not-in-database: false required: - name properties: id: type: string format: '' example: '' description: '' email: type: string description: Email name: type: string description: Name avatarImageId: type: string description: Avatar image ID avatarImageUrl: type: string description: Avatar image Url lastVisited: type: string description: Last visited date time roleId: type: integer description: Role ID roleName: type: string description: Role name phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read admin profile tags: - Digital Wallet (OpenID4VC) - User Management put: description: 'Updates the profile of the admin that owns the access token, for example the name or the phone number.' operationId: configUpdateAdminProfile requestBody: required: true content: application/json: schema: type: object required: - organisationAdmin properties: organisationAdmin: type: object title: OrganisationAdmin x-not-in-database: false required: - name properties: id: type: string format: '' example: '' description: '' email: type: string description: Email name: type: string description: Name avatarImageId: type: string description: Avatar image ID avatarImageUrl: type: string description: Avatar image Url lastVisited: type: string description: Last visited date time roleId: type: integer description: Role ID roleName: type: string description: Role name phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization description: The profile fields to update. responses: '200': description: The service updated the profile of the admin. content: application/json: schema: type: object properties: organisationAdmin: type: object title: OrganisationAdmin x-not-in-database: false required: - name properties: id: type: string format: '' example: '' description: '' email: type: string description: Email name: type: string description: Name avatarImageId: type: string description: Avatar image ID avatarImageUrl: type: string description: Avatar image Url lastVisited: type: string description: Last visited date time roleId: type: integer description: Role ID roleName: type: string description: Role name phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update admin profile tags: - Digital Wallet (OpenID4VC) - User Management /v2/onboard/admin/avatarimage: get: description: Reads the avatar image of the admin that owns the access token. The service gives the binary image data. operationId: configReadAdminAvatar responses: '200': description: 'The avatar image of the admin, as binary image data.' content: image/jpeg: schema: type: string format: binary '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read admin avatar image tags: - Digital Wallet (OpenID4VC) - User Management put: description: Updates the avatar image of the admin that owns the access token. Send the image as `multipart/form-data` in the `avatarimage` field. operationId: configUpdateAdminAvatar requestBody: required: true content: multipart/form-data: schema: type: object required: - avatarimage properties: avatarimage: type: string format: binary description: The new avatar image. responses: '200': description: The service updated the avatar image. content: application/json: schema: type: object properties: organisationAdmin: type: object title: OrganisationAdmin x-not-in-database: false required: - name properties: id: type: string format: '' example: '' description: '' email: type: string description: Email name: type: string description: Name avatarImageId: type: string description: Avatar image ID avatarImageUrl: type: string description: Avatar image Url lastVisited: type: string description: Last visited date time roleId: type: integer description: Role ID roleName: type: string description: Role name phone: type: string description: Admin's phone number imageId: type: string description: Unique identifier for the admin's image imageUrl: type: string description: URL to the admin's image externalId: type: string description: External identifier for the admin identityProviderId: type: string description: Identity provider ID organizationId: type: string description: Unique identifier for the organization organizationName: type: string description: Name of the organization '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Update admin avatar image tags: - Digital Wallet (OpenID4VC) - User Management /v2/onboard/password/reset: put: description: Changes the password of the admin that owns the access token. The admin must give the current password and the new password. operationId: configResetAdminPassword requestBody: required: true content: application/json: schema: type: object required: - currentPassword - newPassword properties: currentPassword: type: string description: The current password of the admin. newPassword: type: string description: The new password of the admin. responses: '200': description: The service changed the password. content: {} headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - BearerAuth: [] summary: Reset admin password tags: - Digital Wallet (OpenID4VC) - User Management /v3/config/admin/authentication/user: get: description: 'Reads the authentication configuration of the admin that owns the access token. The answer shows if password login is enabled, if passwordless login with EUDI Wallet is enabled, and if the admin has linked a wallet.' operationId: configReadAdminAuthentication responses: '200': description: The authentication configuration of the admin. content: application/json: schema: type: object properties: authentication: type: object description: Configuration for authentication methods properties: password: type: object description: Configuration for password authentication properties: enabled: type: boolean oidcPasswordless: type: object description: Configuration for Passwordless Login with EUDI Wallet properties: enabled: type: boolean description: Whether Passwordless Login is enabled for the user linked: type: boolean description: Whether the user has linked their EUDI Wallet for Passwordless Login authenticatorCredentialExchangeId: type: string description: Credential Exchange ID of the issued iGrant.io Authenticator credential '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Read admin authentication configuration tags: - Digital Wallet (OpenID4VC) - User Management /v3/config/admin/authentication/oidc/user/verify: get: description: Starts a verification of the admin with a PID (Person Identification Data) credential from an EUDI Wallet. The service gives a QR code. The admin scans the QR code with the wallet and presents the PID credential. A successful presentation links the wallet to the admin for passwordless login. Monitor the result with the SSE operation on `/v3/config/admin/authentication/oidc/user/verify/sse`. operationId: configPasswordlessLoginVerifyPid responses: '200': description: The service started the verification. content: application/json: schema: type: object properties: vpTokenQrCode: type: string description: The QR code that the admin scans with the EUDI Wallet. presentationExchangeId: type: string description: The presentation exchange identifier of the verification. '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Verify admin with PID credential for passwordless login tags: - Digital Wallet (OpenID4VC) - User Management delete: description: 'Removes the PID (Person Identification Data) passwordless login method of the admin that owns the access token. After this operation, the admin cannot log in with the PID credential.' operationId: configPasswordlessLoginUnlinkPid responses: '204': description: The service removed the PID passwordless login method. '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Remove PID passwordless login method tags: - Digital Wallet (OpenID4VC) - User Management /v3/config/admin/authentication/oidc/user/verify/sse: get: description: 'Establishes a Server-Sent Events (SSE) connection to monitor the PID (Person Identification Data) verification for passwordless login. The connection stays alive with `: keep-alive` comments and closes automatically on success or timeout.' operationId: configPasswordlessLoginVerifyPidSSE responses: '200': description: SSE connection established. content: text/event-stream: schema: type: string example: | event: message data: {"verified": true} : keep-alive '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Stream PID verification status (SSE) tags: - Digital Wallet (OpenID4VC) - User Management /v3/config/admin/authentication/oidc/user/authenticator: get: description: Issues an iGrant.io Authenticator credential to the EUDI Wallet of the admin that owns the access token. The service gives a credential offer and a one-time PIN. The admin scans the credential offer with the wallet and enters the PIN to accept the credential. Monitor the result with the SSE operation on `/v3/config/admin/authentication/oidc/user/authenticator/sse`. operationId: configPasswordlessLoginIssueAuthenticator responses: '200': description: The service started the credential issuance. content: application/json: schema: type: object properties: credentialOffer: type: string description: The credential offer URI that the admin presents to the wallet. credentialExchangeId: type: string description: The credential exchange identifier of the issuance. pin: type: string description: The one-time PIN that the admin enters in the wallet to accept the credential offer. '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Issue iGrant.io Authenticator credential for passwordless login tags: - Digital Wallet (OpenID4VC) - User Management delete: description: 'Removes the iGrant.io Authenticator passwordless login method of the admin that owns the access token. After this operation, the admin cannot log in with the Authenticator credential.' operationId: configPasswordlessLoginRemoveAuthenticator responses: '204': description: The service removed the Authenticator passwordless login method. '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Remove iGrant.io Authenticator passwordless login method tags: - Digital Wallet (OpenID4VC) - User Management /v3/config/admin/authentication/oidc/user/authenticator/sse: get: description: 'Establishes a Server-Sent Events (SSE) connection to monitor the iGrant.io Authenticator credential issuance. The connection stays alive with `: keep-alive` comments and closes automatically on success or timeout.' operationId: configPasswordlessLoginIssueAuthenticatorSSE responses: '200': description: SSE connection established. content: text/event-stream: schema: type: string example: | event: message data: {"accepted": true} : keep-alive '400': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Bad request headers: {} '401': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Unauthorized headers: {} '500': content: application/json: schema: required: - errorCode - errorDescription type: object properties: errorCode: type: integer example: 400 errorDescription: type: string example: Bad input parameter description: Internal server error headers: {} security: - ApiKey: [] - BearerAuth: [] summary: Stream Authenticator issuance status (SSE) tags: - Digital Wallet (OpenID4VC) - User Management servers: - description: Demo server url: 'https://demo-api.igrant.io' - description: Production server url: 'https://api.igrant.io' - description: Staging server url: 'https://staging-api.igrant.io' tags: - description: 'APIs for credential issuance using the OpenID for Verifiable Credentials Issuance (OID4VCI) protocol. Includes credential definition management, credential offer creation, and issuance lifecycle management.' name: Issuer x-tag-expanded: true - description: 'APIs for the holder''s wallet operations. Includes receiving credentials via OID4VCI, managing stored credentials, and responding to OpenID for Verifiable Presentation (OpenID4VP) verification requests.' name: Holder x-tag-expanded: true - description: 'APIs for credential verification using the OpenID for Verifiable Presentation (OpenID4VP) protocol. Includes presentation definition management, verification request creation, and verification result retrieval.' name: Verifier x-tag-expanded: true - description: APIs for configuring webhook endpoints to receive real-time notifications about OID4VCI credential issuance and OpenID4VP verification events. name: Webhook x-tag-expanded: true - description: 'APIs for managing the trust authorities that the wallet accepts, including creation, update, activation toggle and deletion.' name: Trust Anchor x-tag-expanded: true - description: 'APIs for Wallet Provider operations, including managing wallet unit registrations, issuing Wallet Unit Attestations, and monitoring wallet ecosystem statistics.' name: Wallet Provider x-tag-expanded: true - description: 'APIs for configuring cryptographic key management backends used for OID4VCI credential signing. Supports iGrant.io managed vault, HashiCorp Vault, and Qualified Trust Service Provider (QTSP) integrations.' name: Key Management x-tag-expanded: true - description: 'APIs for managing sandbox organisations. A sandbox organisation is a separate wallet inside your organisation with its own credential definitions, presentation definitions, webhooks and keys, so you can test issuance and verification flows without a change to the main wallet. To run any other API call in a sandbox organisation''s context, bind your API key to the sandbox organisation with the API key sandbox operation.' name: Sandboxes x-tag-expanded: true - description: 'APIs for managing the API keys of the organisation. An API key authenticates a server to server call to the OID4VCI and OpenID4VP endpoints, in place of a bearer access token. Only an organisation administrator can create, update, delete or list API keys.' name: API Key x-tag-expanded: true - description: 'APIs for managing the admins of the organisation, as on the Manage Team page of the dashboard. Includes create, read, delete and list operations for organisation admins, and the operation that enables or disables passwordless login with EUDI Wallet for an admin.' name: Team Management x-tag-expanded: true - description: 'APIs for the account of the signed-in admin, as on the Manage User page of the dashboard. Includes the profile, the avatar image, the password, the authentication configuration, and the passwordless login methods (PID verification and iGrant.io Authenticator credential) with SSE status streams.' name: User Management x-tag-expanded: true info: contact: email: support@igrant.io name: iGrant.io url: 'https://igrant.io' description: 'iGrant.io provides a complete implementation of the OpenID for Verifiable Credentials Issuance (OID4VCI) and OpenID for Verifiable Presentation (OpenID4VP) protocols. This API enables organizations to issue, hold, and verify digital credentials using standards-compliant flows with support for W3C VC (JWT), IETF SD-JWT VC, and ISO 18013-5 mDoc/mDL credential formats.' license: name: Apache 2.0 url: 'https://www.apache.org/licenses/LICENSE-2.0' title: iGrant.io API documentation version: 2024.3.1