Management API¶
EUDIPLO Management API main¶
API for managing credentials, sessions, keys, and configurations. All endpoints require OAuth2 authentication.
App¶
GET /api/version¶
Get service version
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
GET /api/frontend-config¶
Get frontend runtime configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Authentication¶
POST /api/oauth2/token¶
OAuth2 Token endpoint - supports client credentials flow only Accepts client credentials either in Authorization header (Basic auth) or request body
Request body
Responses
Tenant¶
GET /api/tenant¶
Get all tenants
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
}
]
POST /api/tenant¶
Initialize a tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"sessionConfig": null,
"roles": [
"presentation:manage"
]
}
Schema of the request body
{
"type": "object",
"properties": {
"statusListConfig": {
"nullable": true,
"description": "Status list configuration for this tenant. Only affects newly created status lists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/StatusListConfig"
}
]
},
"id": {
"type": "string",
"description": "The unique identifier for the tenant."
},
"name": {
"type": "string",
"description": "The name of the tenant."
},
"description": {
"type": "string",
"description": "The description of the tenant."
},
"sessionConfig": {
"description": "Session storage configuration. Controls TTL and cleanup behavior.",
"allOf": [
{
"$ref": "#/components/schemas/SessionStorageConfig"
}
]
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
}
},
"required": [
"id",
"name"
]
}
Responses
GET /api/tenant/{id}¶
Get a tenant by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
}
Schema of the response body
{
"type": "object",
"properties": {
"sessionConfig": {
"nullable": true,
"description": "Session storage configuration for this tenant. Controls TTL and cleanup behavior.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/SessionStorageConfig"
}
]
},
"statusListConfig": {
"nullable": true,
"description": "Status list configuration for this tenant. Only affects newly created status lists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/StatusListConfig"
}
]
},
"id": {
"type": "string",
"description": "The unique identifier for the tenant."
},
"name": {
"type": "string",
"description": "The name of the tenant."
},
"description": {
"type": "string",
"description": "The description of the tenant."
},
"status": {
"type": "string",
"description": "The current status of the tenant."
},
"clients": {
"description": "The clients associated with the tenant.",
"type": "array",
"items": {
"$ref": "#/components/schemas/ClientEntity"
}
}
},
"required": [
"id",
"name",
"status",
"clients"
]
}
PATCH /api/tenant/{id}¶
Update a tenant by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"statusListConfig": {},
"name": "string",
"description": "string",
"sessionConfig": null,
"roles": [
"presentation:manage"
]
}
Schema of the request body
{
"type": "object",
"properties": {
"statusListConfig": {
"nullable": true,
"description": "Status list configuration for this tenant. Only affects newly created status lists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/StatusListConfig"
}
]
},
"name": {
"type": "string",
"description": "The name of the tenant."
},
"description": {
"type": "string",
"description": "The description of the tenant."
},
"sessionConfig": {
"description": "Session storage configuration. Controls TTL and cleanup behavior.",
"allOf": [
{
"$ref": "#/components/schemas/SessionStorageConfig"
}
]
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
}
}
}
Responses
{
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
}
Schema of the response body
{
"type": "object",
"properties": {
"sessionConfig": {
"nullable": true,
"description": "Session storage configuration for this tenant. Controls TTL and cleanup behavior.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/SessionStorageConfig"
}
]
},
"statusListConfig": {
"nullable": true,
"description": "Status list configuration for this tenant. Only affects newly created status lists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/StatusListConfig"
}
]
},
"id": {
"type": "string",
"description": "The unique identifier for the tenant."
},
"name": {
"type": "string",
"description": "The name of the tenant."
},
"description": {
"type": "string",
"description": "The description of the tenant."
},
"status": {
"type": "string",
"description": "The current status of the tenant."
},
"clients": {
"description": "The clients associated with the tenant.",
"type": "array",
"items": {
"$ref": "#/components/schemas/ClientEntity"
}
}
},
"required": [
"id",
"name",
"status",
"clients"
]
}
DELETE /api/tenant/{id}¶
Deletes a tenant by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
Audit Log¶
GET /api/admin/audit-logs¶
Get recent audit log entries for the current tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
limit |
query | number | No | Maximum number of entries to return (1–500) |
Responses
[
{
"id": "string",
"tenantId": "string",
"actionType": "tenant_created",
"actorType": "user",
"actorId": "string",
"actorDisplay": "string",
"changedFields": [
"string"
],
"before": {},
"after": {},
"requestId": "string",
"timestamp": "2022-04-13T15:42:05.901Z"
}
]
Client¶
GET /api/client¶
Get all clients for a user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
POST /api/client¶
Create a new client
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"description": "string",
"roles": [
"presentation:manage"
]
}
Schema of the request body
{
"type": "object",
"properties": {
"allowedPresentationConfigs": {
"nullable": true,
"description": "List of presentation config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"age-verification",
"kyc-basic"
],
"type": "array",
"items": {
"type": "string"
}
},
"allowedIssuanceConfigs": {
"nullable": true,
"description": "List of issuance config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"pid",
"mdl"
],
"type": "array",
"items": {
"type": "string"
}
},
"clientId": {
"type": "string",
"description": "The unique identifier for the client."
},
"secret": {
"type": "string",
"description": "The secret key for the client."
},
"description": {
"type": "string",
"description": "The description of the client."
},
"roles": {
"description": "The roles assigned to the client.",
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
}
},
"required": [
"clientId",
"roles"
]
}
Responses
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
Schema of the response body
{
"type": "object",
"properties": {
"allowedPresentationConfigs": {
"nullable": true,
"description": "List of presentation config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"age-verification",
"kyc-basic"
],
"type": "array",
"items": {
"type": "string"
}
},
"allowedIssuanceConfigs": {
"nullable": true,
"description": "List of issuance config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"pid",
"mdl"
],
"type": "array",
"items": {
"type": "string"
}
},
"clientId": {
"type": "string",
"description": "The unique identifier for the client."
},
"secret": {
"type": "string",
"description": "The secret key for the client."
},
"tenantId": {
"type": "string",
"description": "The unique identifier for the tenant that the client belongs to. Only null for accounts that manage tenants, that do not belong to a client"
},
"description": {
"type": "string",
"description": "The description of the client."
},
"roles": {
"description": "The roles assigned to the client.",
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"tenant": {
"description": "The tenant that the client belongs to.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
}
},
"required": [
"clientId",
"roles"
]
}
GET /api/client/{id}¶
Get a client by its id
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
Schema of the response body
{
"type": "object",
"properties": {
"allowedPresentationConfigs": {
"nullable": true,
"description": "List of presentation config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"age-verification",
"kyc-basic"
],
"type": "array",
"items": {
"type": "string"
}
},
"allowedIssuanceConfigs": {
"nullable": true,
"description": "List of issuance config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"pid",
"mdl"
],
"type": "array",
"items": {
"type": "string"
}
},
"clientId": {
"type": "string",
"description": "The unique identifier for the client."
},
"secret": {
"type": "string",
"description": "The secret key for the client."
},
"tenantId": {
"type": "string",
"description": "The unique identifier for the tenant that the client belongs to. Only null for accounts that manage tenants, that do not belong to a client"
},
"description": {
"type": "string",
"description": "The description of the client."
},
"roles": {
"description": "The roles assigned to the client.",
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"tenant": {
"description": "The tenant that the client belongs to.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
}
},
"required": [
"clientId",
"roles"
]
}
PATCH /api/client/{id}¶
Update a client by its id
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"description": "string",
"roles": [
"presentation:manage"
]
}
Schema of the request body
{
"type": "object",
"properties": {
"allowedPresentationConfigs": {
"nullable": true,
"description": "List of presentation config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"age-verification",
"kyc-basic"
],
"type": "array",
"items": {
"type": "string"
}
},
"allowedIssuanceConfigs": {
"nullable": true,
"description": "List of issuance config IDs this client can use. If empty/null, all configs are allowed.",
"example": [
"pid",
"mdl"
],
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string",
"description": "The description of the client."
},
"roles": {
"description": "The roles assigned to the client.",
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
}
},
"required": [
"roles"
]
}
Responses
DELETE /api/client/{id}¶
Get a client by its id
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/client/{id}/secret¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
POST /api/client/{id}/rotate-secret¶
Rotate (regenerate) a client's secret. Returns the new secret for one-time display - save it immediately!
Users with tenants:manage role can rotate secrets for any client.
Users with clients:manage role can only rotate secrets for clients in their tenant.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
status-list-config¶
GET /api/status-list-config¶
Get status list configuration
Description
Returns the current status list configuration for the tenant. Fields not set use global defaults.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"capacity": {
"type": "number",
"description": "The capacity of the status list. If not set, uses global STATUS_CAPACITY.",
"example": 10000,
"minimum": 100
},
"bits": {
"type": "number",
"description": "Bits per status entry: 1 (valid/revoked), 2 (with suspended), 4/8 (extended). If not set, uses global STATUS_BITS.",
"enum": [
1,
2,
4,
8
],
"default": 1
},
"ttl": {
"type": "number",
"description": "TTL in seconds for the status list JWT. If not set, uses global STATUS_TTL.",
"example": 3600,
"minimum": 60
},
"immediateUpdate": {
"type": "boolean",
"description": "If true, regenerate JWT immediately on status changes. If false (default), use lazy regeneration on TTL expiry.",
"default": false
},
"enableAggregation": {
"type": "boolean",
"description": "If true, include aggregation_uri in status list JWTs for pre-fetching support (default: true).",
"default": true
}
}
}
PUT /api/status-list-config¶
Update status list configuration
Description
Update the status list configuration. Changes only affect newly created status lists. Set a field to null to reset to global default.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"capacity": {
"type": "number",
"nullable": true,
"description": "The capacity of the status list. Set to null to reset to global default.",
"minimum": 100,
"example": 10000
},
"bits": {
"nullable": true,
"description": "Bits per status entry. Set to null to reset to global default.",
"enum": [
1,
2,
4,
8
],
"type": "number"
},
"ttl": {
"type": "number",
"nullable": true,
"description": "TTL in seconds for the status list JWT. Set to null to reset to global default.",
"minimum": 60,
"example": 3600
},
"immediateUpdate": {
"type": "boolean",
"nullable": true,
"description": "If true, regenerate JWT on every status change. Set to null to reset to default (false)."
},
"enableAggregation": {
"type": "boolean",
"nullable": true,
"description": "If true, include aggregation_uri in status list JWTs for pre-fetching support. Set to null to reset to default (true)."
}
}
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"capacity": {
"type": "number",
"description": "The capacity of the status list. If not set, uses global STATUS_CAPACITY.",
"example": 10000,
"minimum": 100
},
"bits": {
"type": "number",
"description": "Bits per status entry: 1 (valid/revoked), 2 (with suspended), 4/8 (extended). If not set, uses global STATUS_BITS.",
"enum": [
1,
2,
4,
8
],
"default": 1
},
"ttl": {
"type": "number",
"description": "TTL in seconds for the status list JWT. If not set, uses global STATUS_TTL.",
"example": 3600,
"minimum": 60
},
"immediateUpdate": {
"type": "boolean",
"description": "If true, regenerate JWT immediately on status changes. If false (default), use lazy regeneration on TTL expiry.",
"default": false
},
"enableAggregation": {
"type": "boolean",
"description": "If true, include aggregation_uri in status list JWTs for pre-fetching support (default: true).",
"default": true
}
}
}
DELETE /api/status-list-config¶
Reset status list configuration
Description
Reset the status list configuration to global defaults. Only affects newly created status lists.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
status-lists¶
GET /api/status-lists¶
List all status lists
Description
Returns all status lists for the tenant, including their capacity and usage.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"tenantId": "root",
"credentialConfigurationId": "org.iso.18013.5.1.mDL",
"keyChainId": "my-status-list-keychain",
"bits": 1,
"capacity": 10000,
"usedEntries": 150,
"availableEntries": 9850,
"uri": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2024-01-15T10:30:00.000Z",
"expiresAt": "2024-01-15T11:30:00.000Z"
}
]
POST /api/status-lists¶
Create a status list
Description
Creates a new status list. Optionally bind it to a specific credential configuration and/or certificate.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"credentialConfigurationId": "org.iso.18013.5.1.mDL",
"keyChainId": "my-status-list-keychain",
"bits": 1,
"capacity": 100000
}
Schema of the request body
{
"type": "object",
"properties": {
"credentialConfigurationId": {
"type": "string",
"description": "Credential configuration ID to bind this list exclusively to. Leave empty for a shared list.",
"example": "org.iso.18013.5.1.mDL"
},
"keyChainId": {
"type": "string",
"description": "Key chain ID to use for signing. Leave empty to use the tenant's default StatusList key chain.",
"example": "my-status-list-keychain"
},
"bits": {
"description": "Bits per status value. More bits allow more status states. Defaults to tenant configuration.",
"enum": [
1,
2,
4,
8
],
"type": "number",
"example": 1
},
"capacity": {
"type": "number",
"description": "Maximum number of credential status entries. Defaults to tenant configuration.",
"minimum": 1000,
"example": 100000
}
}
}
Responses
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"tenantId": "root",
"credentialConfigurationId": "org.iso.18013.5.1.mDL",
"keyChainId": "my-status-list-keychain",
"bits": 1,
"capacity": 10000,
"usedEntries": 150,
"availableEntries": 9850,
"uri": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2024-01-15T10:30:00.000Z",
"expiresAt": "2024-01-15T11:30:00.000Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the status list",
"example": "550e8400-e29b-41d4-a716-446655440000"
},
"tenantId": {
"type": "string",
"description": "The tenant ID",
"example": "root"
},
"credentialConfigurationId": {
"type": "string",
"nullable": true,
"description": "Credential configuration ID this list is bound to. Null means shared.",
"example": "org.iso.18013.5.1.mDL"
},
"keyChainId": {
"type": "string",
"nullable": true,
"description": "Key chain ID used for signing. Null means using the tenant's default.",
"example": "my-status-list-keychain"
},
"bits": {
"description": "Bits per status value",
"enum": [
1,
2,
4,
8
],
"type": "number",
"example": 1
},
"capacity": {
"type": "number",
"description": "Total capacity of the status list",
"example": 10000
},
"usedEntries": {
"type": "number",
"description": "Number of entries in use",
"example": 150
},
"availableEntries": {
"type": "number",
"description": "Number of available entries",
"example": 9850
},
"uri": {
"type": "string",
"description": "The public URI for this status list",
"example": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000"
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "Creation timestamp",
"example": "2024-01-15T10:30:00.000Z"
},
"expiresAt": {
"format": "date-time",
"type": "string",
"nullable": true,
"description": "JWT expiration timestamp. Null if JWT has not been generated yet.",
"example": "2024-01-15T11:30:00.000Z"
}
},
"required": [
"id",
"tenantId",
"bits",
"capacity",
"usedEntries",
"availableEntries",
"uri",
"createdAt"
]
}
GET /api/status-lists/{listId}¶
Get a status list
Description
Returns details for a specific status list.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
listId |
path | string | No | The status list ID |
Responses
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"tenantId": "root",
"credentialConfigurationId": "org.iso.18013.5.1.mDL",
"keyChainId": "my-status-list-keychain",
"bits": 1,
"capacity": 10000,
"usedEntries": 150,
"availableEntries": 9850,
"uri": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2024-01-15T10:30:00.000Z",
"expiresAt": "2024-01-15T11:30:00.000Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the status list",
"example": "550e8400-e29b-41d4-a716-446655440000"
},
"tenantId": {
"type": "string",
"description": "The tenant ID",
"example": "root"
},
"credentialConfigurationId": {
"type": "string",
"nullable": true,
"description": "Credential configuration ID this list is bound to. Null means shared.",
"example": "org.iso.18013.5.1.mDL"
},
"keyChainId": {
"type": "string",
"nullable": true,
"description": "Key chain ID used for signing. Null means using the tenant's default.",
"example": "my-status-list-keychain"
},
"bits": {
"description": "Bits per status value",
"enum": [
1,
2,
4,
8
],
"type": "number",
"example": 1
},
"capacity": {
"type": "number",
"description": "Total capacity of the status list",
"example": 10000
},
"usedEntries": {
"type": "number",
"description": "Number of entries in use",
"example": 150
},
"availableEntries": {
"type": "number",
"description": "Number of available entries",
"example": 9850
},
"uri": {
"type": "string",
"description": "The public URI for this status list",
"example": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000"
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "Creation timestamp",
"example": "2024-01-15T10:30:00.000Z"
},
"expiresAt": {
"format": "date-time",
"type": "string",
"nullable": true,
"description": "JWT expiration timestamp. Null if JWT has not been generated yet.",
"example": "2024-01-15T11:30:00.000Z"
}
},
"required": [
"id",
"tenantId",
"bits",
"capacity",
"usedEntries",
"availableEntries",
"uri",
"createdAt"
]
}
PATCH /api/status-lists/{listId}¶
Update a status list
Description
Update a status list's credential configuration binding and/or certificate.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
listId |
path | string | No | The status list ID |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"credentialConfigurationId": {
"type": "string",
"nullable": true,
"description": "Credential configuration ID to bind this list exclusively to. Set to null to make this a shared list.",
"example": "org.iso.18013.5.1.mDL"
},
"keyChainId": {
"type": "string",
"nullable": true,
"description": "Key chain ID to use for signing. Set to null to use the tenant's default StatusList key chain.",
"example": "my-status-list-keychain"
}
}
}
Responses
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"tenantId": "root",
"credentialConfigurationId": "org.iso.18013.5.1.mDL",
"keyChainId": "my-status-list-keychain",
"bits": 1,
"capacity": 10000,
"usedEntries": 150,
"availableEntries": 9850,
"uri": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2024-01-15T10:30:00.000Z",
"expiresAt": "2024-01-15T11:30:00.000Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the status list",
"example": "550e8400-e29b-41d4-a716-446655440000"
},
"tenantId": {
"type": "string",
"description": "The tenant ID",
"example": "root"
},
"credentialConfigurationId": {
"type": "string",
"nullable": true,
"description": "Credential configuration ID this list is bound to. Null means shared.",
"example": "org.iso.18013.5.1.mDL"
},
"keyChainId": {
"type": "string",
"nullable": true,
"description": "Key chain ID used for signing. Null means using the tenant's default.",
"example": "my-status-list-keychain"
},
"bits": {
"description": "Bits per status value",
"enum": [
1,
2,
4,
8
],
"type": "number",
"example": 1
},
"capacity": {
"type": "number",
"description": "Total capacity of the status list",
"example": 10000
},
"usedEntries": {
"type": "number",
"description": "Number of entries in use",
"example": 150
},
"availableEntries": {
"type": "number",
"description": "Number of available entries",
"example": 9850
},
"uri": {
"type": "string",
"description": "The public URI for this status list",
"example": "https://example.com/demo/status-management/status-list/550e8400-e29b-41d4-a716-446655440000"
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "Creation timestamp",
"example": "2024-01-15T10:30:00.000Z"
},
"expiresAt": {
"format": "date-time",
"type": "string",
"nullable": true,
"description": "JWT expiration timestamp. Null if JWT has not been generated yet.",
"example": "2024-01-15T11:30:00.000Z"
}
},
"required": [
"id",
"tenantId",
"bits",
"capacity",
"usedEntries",
"availableEntries",
"uri",
"createdAt"
]
}
DELETE /api/status-lists/{listId}¶
Delete a status list
Description
Delete a status list. Only allowed if no credentials are using it.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
listId |
path | string | No | The status list ID |
Responses
Session¶
GET /api/session¶
Get sessions (paginated)
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
page |
query | number | 1 | No | Page number (1-based) |
pageSize |
query | number | 25 | No | Number of items per page |
sortBy |
query | string | No | Field to sort by | |
sortOrder |
query | string | No | Sort direction | |
status |
query | string | No | Filter by session status | |
type |
query | string | No | Filter by session type |
Responses
{
"items": [
{
"status": "active",
"id": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"expiresAt": "2022-04-13T15:42:05.901Z",
"useDcApi": true,
"dcApiProtocol": "string",
"browserOrigin": "string",
"tenantId": "string",
"tenant": null,
"authorization_code": "string",
"refresh_token": "string",
"refresh_token_expires_at": "2022-04-13T15:42:05.901Z",
"request_uri": "string",
"auth_queries": null,
"offer": {},
"offerUrl": "string",
"credentialPayload": null,
"webhookEndpointId": "string",
"notifications": [
{}
],
"requestId": "string",
"requestUrl": "string",
"requestObject": "string",
"responseEncryptionPrivateJwk": {},
"credentials": [
{}
],
"vp_nonce": "string",
"clientId": "string",
"walletNonce": "string",
"responseCode": "string",
"responseUri": "string",
"redirectUri": "string",
"parsedWebhook": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"skewSeconds": 10.12,
"externalIssuer": "string",
"externalSubject": "string",
"errorReason": "string",
"txCodeFailedAttempts": 10.12,
"consumed": true,
"consumedAt": "2022-04-13T15:42:05.901Z"
}
],
"total": 10.12,
"page": 10.12,
"pageSize": 10.12,
"totalPages": 10.12
}
Schema of the response body
{
"type": "object",
"properties": {
"items": {
"description": "The sessions for the current page.",
"type": "array",
"items": {
"$ref": "#/components/schemas/Session"
}
},
"total": {
"type": "number",
"description": "Total number of sessions matching the query"
},
"page": {
"type": "number",
"description": "Current page number (1-based)"
},
"pageSize": {
"type": "number",
"description": "Number of items per page"
},
"totalPages": {
"type": "number",
"description": "Total number of pages"
}
},
"required": [
"items",
"total",
"page",
"pageSize",
"totalPages"
]
}
GET /api/session/{id}¶
Retrieves the session information for a given session ID.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | The session ID |
Responses
{
"status": "active",
"id": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"expiresAt": "2022-04-13T15:42:05.901Z",
"useDcApi": true,
"dcApiProtocol": "string",
"browserOrigin": "string",
"tenantId": "string",
"tenant": null,
"authorization_code": "string",
"refresh_token": "string",
"refresh_token_expires_at": "2022-04-13T15:42:05.901Z",
"request_uri": "string",
"auth_queries": null,
"offer": {},
"offerUrl": "string",
"credentialPayload": null,
"webhookEndpointId": "string",
"notifications": [
{}
],
"requestId": "string",
"requestUrl": "string",
"requestObject": "string",
"responseEncryptionPrivateJwk": {},
"credentials": [
{}
],
"vp_nonce": "string",
"clientId": "string",
"walletNonce": "string",
"responseCode": "string",
"responseUri": "string",
"redirectUri": "string",
"parsedWebhook": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"skewSeconds": 10.12,
"externalIssuer": "string",
"externalSubject": "string",
"errorReason": "string",
"txCodeFailedAttempts": 10.12,
"consumed": true,
"consumedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"status": {
"description": "Status of the session.",
"enum": [
"active",
"fetched",
"completed",
"expired",
"failed"
],
"type": "string"
},
"id": {
"type": "string",
"description": "Unique identifier for the session."
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the request was last updated."
},
"expiresAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the request is set to expire."
},
"useDcApi": {
"type": "boolean",
"description": "Flag indicating whether to use the DC API for the presentation request."
},
"dcApiProtocol": {
"type": "string",
"description": "DC API sub-protocol: \"oid4vp\" (OpenID4VP via DC API) or \"iso-18013-7\" (org.iso.mdoc).\nNull/undefined means the standard OID4VP flow (useDcApi=false)."
},
"browserOrigin": {
"type": "string",
"description": "Browser page origin recorded at offer time for BrowserHandover session transcript.\nUsed exclusively by the ISO 18013-7 Annex C flow."
},
"tenantId": {
"type": "string",
"description": "Tenant ID for multi-tenancy support."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"authorization_code": {
"type": "string"
},
"refresh_token": {
"type": "string",
"description": "Refresh token for the session - used to obtain a new access token."
},
"refresh_token_expires_at": {
"format": "date-time",
"type": "string",
"description": "Expiration timestamp for the refresh token.\nUsed to validate refresh_token grant requests."
},
"request_uri": {
"type": "string",
"description": "Request URI from the authorization request."
},
"auth_queries": {
"description": "Authorization queries associated with the session.\nEncrypted at rest.",
"allOf": [
{
"$ref": "#/components/schemas/AuthorizeQueries"
}
]
},
"offer": {
"nullable": true,
"description": "Credential offer object containing details about the credential offer or presentation request.\nEncrypted at rest.",
"type": "object"
},
"offerUrl": {
"type": "string",
"description": "Offer URL for the credential offer."
},
"credentialPayload": {
"description": "Credential payload containing the offer request details.\nEncrypted at rest - may contain sensitive claim data.",
"allOf": [
{
"$ref": "#/components/schemas/OfferRequestDto"
}
]
},
"webhookEndpointId": {
"type": "string",
"description": "ID of the webhook endpoint to notify about issuance status."
},
"notifications": {
"description": "Notifications associated with the session.",
"type": "array",
"items": {
"type": "object"
}
},
"requestId": {
"type": "string"
},
"requestUrl": {
"type": "string",
"description": "The URL of the presentation auth request."
},
"requestObject": {
"type": "string",
"description": "Signed presentation auth request."
},
"responseEncryptionPrivateJwk": {
"type": "object",
"description": "Per-authorization-request private encryption key used to decrypt\nwallet responses. Encrypted at rest."
},
"credentials": {
"description": "Verified credentials from the presentation process.\nEncrypted at rest - contains personal information.",
"type": "array",
"items": {
"type": "object"
}
},
"vp_nonce": {
"type": "string",
"description": "Nonce from the Verifiable Presentation request."
},
"clientId": {
"type": "string",
"description": "Client ID used in the OID4VP authorization request."
},
"walletNonce": {
"type": "string",
"description": "Cryptographic random nonce used in wallet-facing URLs (response_uri, request_uri, state).\nPer OID4VP spec Section 13.3, this separates the wallet-facing identifier (request-id)\nfrom the frontend-facing session ID (transaction-id) to prevent session fixation."
},
"responseCode": {
"type": "string",
"description": "Cryptographic random code generated after successful VP Token processing.\nPer OID4VP spec Section 13.3, included in redirect_uri so only the legitimate\nfrontend (which receives the redirect) can confirm the session completed."
},
"responseUri": {
"type": "string",
"description": "Response URI used in the OID4VP authorization request."
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed."
},
"parsedWebhook": {
"description": "Where to send the claims webhook response.",
"allOf": [
{
"$ref": "#/components/schemas/WebhookConfig"
}
]
},
"transaction_data": {
"description": "Transaction data to include in the OID4VP authorization request.\nCan be overridden per-request from the presentation configuration.",
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"skewSeconds": {
"type": "number",
"description": "Per-session clock skew tolerance for presentation credential JWT time validation."
},
"externalIssuer": {
"type": "string"
},
"externalSubject": {
"type": "string",
"description": "The subject (sub) from the external authorization server token.\nUsed to identify the user at the external AS."
},
"errorReason": {
"type": "string",
"description": "Error reason if the session failed.\nStores the error message when status is 'failed'."
},
"txCodeFailedAttempts": {
"type": "number",
"description": "Number of failed tx_code (transaction code) validation attempts.\nUsed to enforce brute-force protection in the pre-authorized code flow.\nReset implicitly when the session is consumed successfully."
},
"consumed": {
"type": "boolean",
"description": "Flag indicating whether the session offer has been consumed.\nPrevents replay attacks by ensuring each offer can only be used once.\nFor OID4VCI: set after successful token exchange.\nFor OID4VP: set after successful response validation."
},
"consumedAt": {
"format": "date-time",
"type": "string",
"description": "Timestamp of the first consumption event for the session offer.\nFor OID4VCI this can be URI resolution or later flow completion.\nNull if no consumption event has happened yet."
}
},
"required": [
"status",
"id",
"createdAt",
"updatedAt",
"useDcApi",
"tenantId",
"tenant",
"notifications",
"txCodeFailedAttempts",
"consumed"
]
}
DELETE /api/session/{id}¶
Deletes a session by its ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/session/{id}/logs¶
Get session log entries
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | The session ID |
Responses
POST /api/session/revoke¶
Update the status of the credentials of a specific session.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"sessionId": {
"type": "string",
"description": "The session ID of the user"
},
"credentialConfigurationId": {
"type": "string",
"description": "The ID of the credential configuration\nThis is optional, if not provided, all credentials will be revoked of the session."
},
"status": {
"type": "number",
"description": "The status of the credential\n0 = valid, 1 = revoked, 2 = suspended"
}
},
"required": [
"sessionId",
"status"
]
}
Responses
GET /api/session-config¶
Get session storage configuration
Description
Returns the session storage configuration for the current tenant.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"ttlSeconds": {
"type": "number",
"description": "Time-to-live for sessions in seconds. If not set, uses global SESSION_TTL.",
"example": 86400,
"minimum": 60
},
"cleanupMode": {
"type": "string",
"description": "Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII.",
"enum": [
"full",
"anonymize"
],
"default": "full"
}
}
}
PUT /api/session-config¶
Update session storage configuration
Description
Updates the session storage configuration for the current tenant.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"ttlSeconds": {
"type": "number",
"nullable": true,
"description": "Time-to-live for sessions in seconds. Set to null to use global default.",
"minimum": 60,
"example": 86400
},
"cleanupMode": {
"description": "Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII.",
"enum": [
"full",
"anonymize"
],
"type": "string",
"default": "full"
}
}
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"ttlSeconds": {
"type": "number",
"description": "Time-to-live for sessions in seconds. If not set, uses global SESSION_TTL.",
"example": 86400,
"minimum": 60
},
"cleanupMode": {
"type": "string",
"description": "Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII.",
"enum": [
"full",
"anonymize"
],
"default": "full"
}
}
}
DELETE /api/session-config¶
Reset session storage configuration
Description
Resets the session storage configuration to use global defaults.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
Session Events¶
GET /api/session/{id}/events¶
Subscribe to session status updates
Description
Server-Sent Events endpoint for real-time session status updates. Requires JWT authentication via query parameter.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
id |
path | string | No | Session ID to subscribe to | |
token |
query | string | No | JWT access token for authentication |
Responses
User¶
GET /api/user¶
Get all managed users for the current tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"id": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1",
"username": "alice",
"email": "alice@example.com",
"enabled": true,
"roles": [
"presentation:manage"
],
"tenantId": "tenant-a",
"temporaryPassword": "Ab3!zK8pQ2"
}
]
POST /api/user¶
Create a new managed user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"username": "alice",
"email": "alice@example.com",
"roles": [
"presentation:manage"
],
"temporaryPassword": "Ab3!zK8pQ2",
"enabled": true
}
Schema of the request body
{
"type": "object",
"properties": {
"username": {
"type": "string",
"minLength": 1,
"example": "alice"
},
"email": {
"type": "string",
"example": "alice@example.com"
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"temporaryPassword": {
"type": "string",
"example": "Ab3!zK8pQ2",
"description": "One-time temporary password returned only on user creation."
},
"enabled": {
"type": "boolean",
"example": true
}
},
"required": [
"username",
"roles"
]
}
Responses
{
"id": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1",
"username": "alice",
"email": "alice@example.com",
"enabled": true,
"roles": [
"presentation:manage"
],
"tenantId": "tenant-a",
"temporaryPassword": "Ab3!zK8pQ2"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"example": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1"
},
"username": {
"type": "string",
"example": "alice"
},
"email": {
"type": "string",
"example": "alice@example.com"
},
"enabled": {
"type": "boolean",
"example": true
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"tenantId": {
"type": "string",
"example": "tenant-a"
},
"temporaryPassword": {
"type": "string",
"example": "Ab3!zK8pQ2",
"description": "One-time temporary password returned only on user creation."
}
},
"required": [
"id",
"username",
"enabled",
"roles"
]
}
GET /api/user/{id}¶
Get a managed user by id
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1",
"username": "alice",
"email": "alice@example.com",
"enabled": true,
"roles": [
"presentation:manage"
],
"tenantId": "tenant-a",
"temporaryPassword": "Ab3!zK8pQ2"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"example": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1"
},
"username": {
"type": "string",
"example": "alice"
},
"email": {
"type": "string",
"example": "alice@example.com"
},
"enabled": {
"type": "boolean",
"example": true
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"tenantId": {
"type": "string",
"example": "tenant-a"
},
"temporaryPassword": {
"type": "string",
"example": "Ab3!zK8pQ2",
"description": "One-time temporary password returned only on user creation."
}
},
"required": [
"id",
"username",
"enabled",
"roles"
]
}
PATCH /api/user/{id}¶
Update a managed user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"username": "alice",
"email": "alice@example.com",
"roles": [
"presentation:manage"
],
"temporaryPassword": "Ab3!zK8pQ2",
"enabled": true,
"password": "S3cur3P@ssword"
}
Schema of the request body
{
"type": "object",
"properties": {
"username": {
"type": "string",
"minLength": 1,
"example": "alice"
},
"email": {
"type": "string",
"example": "alice@example.com"
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"temporaryPassword": {
"type": "string",
"example": "Ab3!zK8pQ2",
"description": "One-time temporary password returned only on user creation."
},
"enabled": {
"type": "boolean",
"example": true
},
"password": {
"type": "string",
"minLength": 8,
"example": "S3cur3P@ssword"
}
}
}
Responses
{
"id": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1",
"username": "alice",
"email": "alice@example.com",
"enabled": true,
"roles": [
"presentation:manage"
],
"tenantId": "tenant-a",
"temporaryPassword": "Ab3!zK8pQ2"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"example": "5a3412a4-9ccf-41aa-b79c-f7e2a8a9b0d1"
},
"username": {
"type": "string",
"example": "alice"
},
"email": {
"type": "string",
"example": "alice@example.com"
},
"enabled": {
"type": "boolean",
"example": true
},
"roles": {
"type": "array",
"items": {
"type": "string",
"enum": [
"presentation:manage",
"presentation:request",
"issuance:manage",
"issuance:offer",
"clients:manage",
"users:manage",
"tenants:manage",
"registrar:manage"
]
}
},
"tenantId": {
"type": "string",
"example": "tenant-a"
},
"temporaryPassword": {
"type": "string",
"example": "Ab3!zK8pQ2",
"description": "One-time temporary password returned only on user creation."
}
},
"required": [
"id",
"username",
"enabled",
"roles"
]
}
DELETE /api/user/{id}¶
Delete a managed user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
Issuer¶
GET /api/issuer/config¶
Returns the issuance configurations for this tenant. Creates a default one if it does not exist.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
{
"walletProviderTrustLists": [
{
"url": "string",
"verifierKey": {},
"verifierX509Der": "string"
}
],
"signingKeyId": "string",
"authorizationServers": [
null
],
"federation": {},
"registrationCertificate": {},
"registrationCertificateCache": {},
"credentialResponseEncryption": true,
"credentialRequestEncryption": true,
"txCodeMaxAttempts": 10.12,
"tenant": null,
"batchSize": 10.12,
"dPopRequired": true,
"walletAttestationRequired": true,
"display": [
{
"name": "string",
"locale": "string",
"logo": {
"uri": "string",
"alt_text": "string"
}
}
],
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"walletProviderTrustLists": {
"description": "Trust lists containing trusted wallet providers.\nEach entry MUST include either `verifierKey` or `verifierX509Der`.",
"type": "array",
"items": {
"$ref": "#/components/schemas/WalletProviderTrustListRefDto"
}
},
"signingKeyId": {
"type": "string",
"description": "Key ID for signing access tokens. If unset, the default signing key is used."
},
"authorizationServers": {
"type": "array",
"description": "Dedicated managed authorization servers hosted by this issuer. At least one entry is required.",
"minItems": 1,
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/ExternalAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/Oid4VpAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/ChainedAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"external": "#/components/schemas/ExternalAuthorizationServerConfig",
"oid4vp": "#/components/schemas/Oid4VpAuthorizationServerConfig",
"chained": "#/components/schemas/ChainedAuthorizationServerConfig",
"built-in": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
}
}
},
"federation": {
"nullable": true,
"description": "Optional OpenID Federation configuration used for trust evaluation.\nWhen omitted, trust checks rely on existing LoTE trust-list behavior.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/FederationConfig"
}
]
},
"registrationCertificate": {
"nullable": true,
"description": "Optional registration certificate configuration for issuer metadata (`issuer_info`).\nSupports importing an existing JWT or generating one via registrar.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateConfig"
}
]
},
"registrationCertificateCache": {
"nullable": true,
"description": "Server-managed cache for generated issuer registration certificates.",
"readOnly": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateCache"
}
]
},
"credentialResponseEncryption": {
"type": "boolean",
"description": "Whether `credential_response_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"credentialRequestEncryption": {
"type": "boolean",
"description": "Whether `credential_request_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"txCodeMaxAttempts": {
"type": "number",
"description": "Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.",
"default": 5,
"nullable": true
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"batchSize": {
"type": "number",
"description": "Value to determine the amount of credentials that are issued in a batch.\nDefault is 1."
},
"dPopRequired": {
"type": "boolean",
"description": "Indicates whether DPoP is required for the issuance process. Default value is true."
},
"walletAttestationRequired": {
"type": "boolean",
"description": "Indicates whether wallet attestation is required for the token endpoint.\nWhen enabled, wallets must provide OAuth-Client-Attestation headers.\nDefault value is false."
},
"display": {
"type": "array",
"items": {
"$ref": "#/components/schemas/DisplayInfo"
}
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was last updated."
}
},
"required": [
"authorizationServers",
"tenant",
"display",
"createdAt",
"updatedAt"
]
}
POST /api/issuer/config¶
Stores the issuance configuration for this tenant.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"walletProviderTrustLists": [
{
"url": "string",
"verifierKey": {},
"verifierX509Der": "string"
}
],
"signingKeyId": "string",
"authorizationServers": [
null
],
"federation": {},
"registrationCertificate": {},
"registrationCertificateCache": {},
"credentialResponseEncryption": true,
"credentialRequestEncryption": true,
"txCodeMaxAttempts": 10.12,
"batchSize": 10.12,
"dPopRequired": true,
"walletAttestationRequired": true,
"display": [
{
"name": "string",
"locale": "string",
"logo": {
"uri": "string",
"alt_text": "string"
}
}
]
}
Schema of the request body
{
"type": "object",
"properties": {
"walletProviderTrustLists": {
"description": "Trust lists containing trusted wallet providers.\nEach entry MUST include either `verifierKey` or `verifierX509Der`.",
"type": "array",
"items": {
"$ref": "#/components/schemas/WalletProviderTrustListRefDto"
}
},
"signingKeyId": {
"type": "string",
"description": "Key ID for signing access tokens. If unset, the default signing key is used."
},
"authorizationServers": {
"type": "array",
"description": "Dedicated managed authorization servers hosted by this issuer. At least one entry is required.",
"minItems": 1,
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/ExternalAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/Oid4VpAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/ChainedAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"external": "#/components/schemas/ExternalAuthorizationServerConfig",
"oid4vp": "#/components/schemas/Oid4VpAuthorizationServerConfig",
"chained": "#/components/schemas/ChainedAuthorizationServerConfig",
"built-in": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
}
}
},
"federation": {
"nullable": true,
"description": "Optional OpenID Federation configuration used for trust evaluation.\nWhen omitted, trust checks rely on existing LoTE trust-list behavior.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/FederationConfig"
}
]
},
"registrationCertificate": {
"nullable": true,
"description": "Optional registration certificate configuration for issuer metadata (`issuer_info`).\nSupports importing an existing JWT or generating one via registrar.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateConfig"
}
]
},
"registrationCertificateCache": {
"nullable": true,
"description": "Server-managed cache for generated issuer registration certificates.",
"readOnly": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateCache"
}
]
},
"credentialResponseEncryption": {
"type": "boolean",
"description": "Whether `credential_response_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"credentialRequestEncryption": {
"type": "boolean",
"description": "Whether `credential_request_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"txCodeMaxAttempts": {
"type": "number",
"description": "Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.",
"default": 5,
"nullable": true
},
"batchSize": {
"type": "number",
"description": "Value to determine the amount of credentials that are issued in a batch.\nDefault is 1."
},
"dPopRequired": {
"type": "boolean",
"description": "Indicates whether DPoP is required for the issuance process. Default value is true."
},
"walletAttestationRequired": {
"type": "boolean",
"description": "Indicates whether wallet attestation is required for the token endpoint.\nWhen enabled, wallets must provide OAuth-Client-Attestation headers.\nDefault value is false."
},
"display": {
"type": "array",
"items": {
"$ref": "#/components/schemas/DisplayInfo"
}
}
}
}
Responses
POST /api/issuer/config/registration-cert/reissue¶
Reissue issuer registration certificate
Description
Bypasses and refreshes the issuer registration certificate cache, revoking the previous active certificate when replaced.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
{
"walletProviderTrustLists": [
{
"url": "string",
"verifierKey": {},
"verifierX509Der": "string"
}
],
"signingKeyId": "string",
"authorizationServers": [
null
],
"federation": {},
"registrationCertificate": {},
"registrationCertificateCache": {},
"credentialResponseEncryption": true,
"credentialRequestEncryption": true,
"txCodeMaxAttempts": 10.12,
"tenant": null,
"batchSize": 10.12,
"dPopRequired": true,
"walletAttestationRequired": true,
"display": [
{
"name": "string",
"locale": "string",
"logo": {
"uri": "string",
"alt_text": "string"
}
}
],
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"walletProviderTrustLists": {
"description": "Trust lists containing trusted wallet providers.\nEach entry MUST include either `verifierKey` or `verifierX509Der`.",
"type": "array",
"items": {
"$ref": "#/components/schemas/WalletProviderTrustListRefDto"
}
},
"signingKeyId": {
"type": "string",
"description": "Key ID for signing access tokens. If unset, the default signing key is used."
},
"authorizationServers": {
"type": "array",
"description": "Dedicated managed authorization servers hosted by this issuer. At least one entry is required.",
"minItems": 1,
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/ExternalAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/Oid4VpAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/ChainedAuthorizationServerConfig"
},
{
"$ref": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"external": "#/components/schemas/ExternalAuthorizationServerConfig",
"oid4vp": "#/components/schemas/Oid4VpAuthorizationServerConfig",
"chained": "#/components/schemas/ChainedAuthorizationServerConfig",
"built-in": "#/components/schemas/BuiltInAuthorizationServerConfig"
}
}
}
},
"federation": {
"nullable": true,
"description": "Optional OpenID Federation configuration used for trust evaluation.\nWhen omitted, trust checks rely on existing LoTE trust-list behavior.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/FederationConfig"
}
]
},
"registrationCertificate": {
"nullable": true,
"description": "Optional registration certificate configuration for issuer metadata (`issuer_info`).\nSupports importing an existing JWT or generating one via registrar.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateConfig"
}
]
},
"registrationCertificateCache": {
"nullable": true,
"description": "Server-managed cache for generated issuer registration certificates.",
"readOnly": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/IssuerRegistrationCertificateCache"
}
]
},
"credentialResponseEncryption": {
"type": "boolean",
"description": "Whether `credential_response_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"credentialRequestEncryption": {
"type": "boolean",
"description": "Whether `credential_request_encryption` should be advertised in the credential issuer metadata.",
"default": false
},
"txCodeMaxAttempts": {
"type": "number",
"description": "Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.",
"default": 5,
"nullable": true
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"batchSize": {
"type": "number",
"description": "Value to determine the amount of credentials that are issued in a batch.\nDefault is 1."
},
"dPopRequired": {
"type": "boolean",
"description": "Indicates whether DPoP is required for the issuance process. Default value is true."
},
"walletAttestationRequired": {
"type": "boolean",
"description": "Indicates whether wallet attestation is required for the token endpoint.\nWhen enabled, wallets must provide OAuth-Client-Attestation headers.\nDefault value is false."
},
"display": {
"type": "array",
"items": {
"$ref": "#/components/schemas/DisplayInfo"
}
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was last updated."
}
},
"required": [
"authorizationServers",
"tenant",
"display",
"createdAt",
"updatedAt"
]
}
GET /api/issuer/credentials¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"vct": null,
"iaeActions": "",
"schemaMeta": {},
"embeddedDisclosurePolicy": null,
"id": "string",
"description": "string",
"tenant": null,
"config": {
"keyAttestationsRequired": null,
"proofTypesSupported": [
"attestation",
"jwt"
],
"format": "mso_mdoc",
"display": [
{
"name": "string",
"description": "string",
"locale": "string",
"background_color": "string",
"text_color": "string",
"background_image": {
"uri": "string"
},
"logo": null
}
],
"scope": "string",
"docType": "string"
},
"fields": [
{
"path": [
"address",
"locality"
],
"type": "string",
"defaultValue": null,
"mandatory": true,
"disclosable": true,
"namespace": "eu.europa.ec.eudi.pid.1",
"display": [
{
"locale": "en-US",
"name": "Given Name",
"description": "Primary first name"
}
],
"constraints": {},
"children": null
}
],
"attributeProviderId": "string",
"attributeProvider": {
"auth": null,
"id": "string",
"tenantId": "string",
"tenant": {
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
},
"name": "string",
"description": "string",
"url": "string"
},
"webhookEndpointId": "string",
"webhookEndpoint": {
"id": "string",
"auth": null,
"tenantId": "string",
"tenant": null,
"name": "string",
"description": "string",
"url": "string"
},
"keyBinding": true,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"statusManagement": true,
"sdJwtTrustFormat": "x5c",
"lifeTime": 10.12
}
]
POST /api/issuer/credentials¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"vct": null,
"iaeActions": "",
"schemaMeta": {},
"embeddedDisclosurePolicy": null,
"id": "string",
"description": "string",
"config": {
"keyAttestationsRequired": null,
"proofTypesSupported": [
"attestation",
"jwt"
],
"format": "mso_mdoc",
"display": [
{
"name": "string",
"description": "string",
"locale": "string",
"background_color": "string",
"text_color": "string",
"background_image": {
"uri": "string"
},
"logo": null
}
],
"scope": "string",
"docType": "string"
},
"fields": [
{
"path": [
"address",
"locality"
],
"type": "string",
"defaultValue": null,
"mandatory": true,
"disclosable": true,
"namespace": "eu.europa.ec.eudi.pid.1",
"display": [
{
"locale": "en-US",
"name": "Given Name",
"description": "Primary first name"
}
],
"constraints": {},
"children": null
}
],
"attributeProviderId": "string",
"webhookEndpointId": "string",
"keyBinding": true,
"keyChainId": "string",
"statusManagement": true,
"sdJwtTrustFormat": "x5c",
"lifeTime": 10.12
}
Schema of the request body
{
"type": "object",
"properties": {
"vct": {
"description": "VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT",
"anyOf": [
{
"type": "string",
"description": "VCT URI string"
},
{
"$ref": "#/components/schemas/VCT"
},
{
"type": "null"
}
]
},
"iaeActions": {
"type": "array",
"nullable": true,
"description": "List of IAE actions to execute before credential issuance",
"example": "",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/IaeActionOpenid4vpPresentation"
},
{
"$ref": "#/components/schemas/IaeActionRedirectToWeb"
}
]
}
},
"schemaMeta": {
"nullable": true,
"description": "TS11 schema metadata configuration for EUDI Catalogue of Attestations.\n\nWhen present, EUDIPLO can generate a SchemaMeta object per the TS11 spec\nusing the GET /issuer/credentials/:id/schema-metadata endpoint.\n\n The underlying TS11 specification is not yet finalized.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"embeddedDisclosurePolicy": {
"nullable": true,
"description": "Embedded disclosure policy (discriminated union by `policy`).\nThe discriminator makes class-transformer instantiate the right subclass,\nand then class-validator runs that subclass’s rules.",
"oneOf": [
{
"$ref": "#/components/schemas/AttestationBasedPolicy"
},
{
"$ref": "#/components/schemas/NoneTrustPolicy"
},
{
"$ref": "#/components/schemas/AllowListPolicy"
},
{
"$ref": "#/components/schemas/RootOfTrustPolicy"
}
],
"allOf": [
{
"$ref": "#/components/schemas/EmbeddedDisclosurePolicy"
}
]
},
"id": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"config": {
"$ref": "#/components/schemas/IssuerMetadataCredentialConfig"
},
"fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ClaimFieldDefinitionDto"
}
},
"attributeProviderId": {
"type": "string",
"nullable": true,
"description": "Reference to the attribute provider used for fetching claims.\nOptional: if set, claims will be fetched from this provider during issuance."
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"keyBinding": {
"type": "boolean"
},
"keyChainId": {
"type": "string",
"description": "Reference to the key chain used for signing.\nOptional: if not specified, the default attestation key chain will be used."
},
"statusManagement": {
"type": "boolean"
},
"sdJwtTrustFormat": {
"nullable": true,
"description": "For SD-JWT credentials: determines whether to include certificate chain (x5c)\nor use federation-based trust (iss claim).\nDefault: \"x5c\" (federation must be explicitly selected)",
"enum": [
"x5c",
"federation"
],
"type": "string"
},
"lifeTime": {
"type": "number"
}
},
"required": [
"id",
"config",
"fields"
]
}
Responses
GET /api/issuer/credentials/{id}¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"vct": null,
"iaeActions": "",
"schemaMeta": {},
"embeddedDisclosurePolicy": null,
"id": "string",
"description": "string",
"tenant": null,
"config": {
"keyAttestationsRequired": null,
"proofTypesSupported": [
"attestation",
"jwt"
],
"format": "mso_mdoc",
"display": [
{
"name": "string",
"description": "string",
"locale": "string",
"background_color": "string",
"text_color": "string",
"background_image": {
"uri": "string"
},
"logo": null
}
],
"scope": "string",
"docType": "string"
},
"fields": [
{
"path": [
"address",
"locality"
],
"type": "string",
"defaultValue": null,
"mandatory": true,
"disclosable": true,
"namespace": "eu.europa.ec.eudi.pid.1",
"display": [
{
"locale": "en-US",
"name": "Given Name",
"description": "Primary first name"
}
],
"constraints": {},
"children": null
}
],
"attributeProviderId": "string",
"attributeProvider": {
"auth": null,
"id": "string",
"tenantId": "string",
"tenant": {
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
},
"name": "string",
"description": "string",
"url": "string"
},
"webhookEndpointId": "string",
"webhookEndpoint": {
"id": "string",
"auth": null,
"tenantId": "string",
"tenant": null,
"name": "string",
"description": "string",
"url": "string"
},
"keyBinding": true,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"statusManagement": true,
"sdJwtTrustFormat": "x5c",
"lifeTime": 10.12
}
Schema of the response body
{
"type": "object",
"properties": {
"vct": {
"description": "VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT",
"anyOf": [
{
"type": "string",
"description": "VCT URI string"
},
{
"$ref": "#/components/schemas/VCT"
},
{
"type": "null"
}
]
},
"iaeActions": {
"type": "array",
"nullable": true,
"description": "List of IAE actions to execute before credential issuance",
"example": "",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/IaeActionOpenid4vpPresentation"
},
{
"$ref": "#/components/schemas/IaeActionRedirectToWeb"
}
]
}
},
"schemaMeta": {
"nullable": true,
"description": "TS11 schema metadata configuration for EUDI Catalogue of Attestations.\n\nWhen present, EUDIPLO can generate a SchemaMeta object per the TS11 spec\nusing the GET /issuer/credentials/:id/schema-metadata endpoint.\n\n The underlying TS11 specification is not yet finalized.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"embeddedDisclosurePolicy": {
"nullable": true,
"description": "Embedded disclosure policy (discriminated union by `policy`).\nThe discriminator makes class-transformer instantiate the right subclass,\nand then class-validator runs that subclass’s rules.",
"oneOf": [
{
"$ref": "#/components/schemas/AttestationBasedPolicy"
},
{
"$ref": "#/components/schemas/NoneTrustPolicy"
},
{
"$ref": "#/components/schemas/AllowListPolicy"
},
{
"$ref": "#/components/schemas/RootOfTrustPolicy"
}
],
"allOf": [
{
"$ref": "#/components/schemas/EmbeddedDisclosurePolicy"
}
]
},
"id": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"config": {
"$ref": "#/components/schemas/IssuerMetadataCredentialConfig"
},
"fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ClaimFieldDefinitionDto"
}
},
"attributeProviderId": {
"type": "string",
"nullable": true,
"description": "Reference to the attribute provider used for fetching claims.\nOptional: if set, claims will be fetched from this provider during issuance."
},
"attributeProvider": {
"$ref": "#/components/schemas/AttributeProviderEntity"
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"webhookEndpoint": {
"$ref": "#/components/schemas/WebhookEndpointEntity"
},
"keyBinding": {
"type": "boolean"
},
"keyChainId": {
"type": "string",
"description": "Reference to the key chain used for signing.\nOptional: if not specified, the default attestation key chain will be used."
},
"keyChain": {
"$ref": "#/components/schemas/KeyChainEntity"
},
"statusManagement": {
"type": "boolean"
},
"sdJwtTrustFormat": {
"nullable": true,
"description": "For SD-JWT credentials: determines whether to include certificate chain (x5c)\nor use federation-based trust (iss claim).\nDefault: \"x5c\" (federation must be explicitly selected)",
"enum": [
"x5c",
"federation"
],
"type": "string"
},
"lifeTime": {
"type": "number"
}
},
"required": [
"id",
"tenant",
"config",
"fields"
]
}
PATCH /api/issuer/credentials/{id}¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"vct": null,
"iaeActions": "",
"schemaMeta": {},
"embeddedDisclosurePolicy": null,
"id": "string",
"description": "string",
"config": {
"keyAttestationsRequired": null,
"proofTypesSupported": [
"attestation",
"jwt"
],
"format": "mso_mdoc",
"display": [
{
"name": "string",
"description": "string",
"locale": "string",
"background_color": "string",
"text_color": "string",
"background_image": {
"uri": "string"
},
"logo": null
}
],
"scope": "string",
"docType": "string"
},
"fields": [
{
"path": [
"address",
"locality"
],
"type": "string",
"defaultValue": null,
"mandatory": true,
"disclosable": true,
"namespace": "eu.europa.ec.eudi.pid.1",
"display": [
{
"locale": "en-US",
"name": "Given Name",
"description": "Primary first name"
}
],
"constraints": {},
"children": null
}
],
"attributeProviderId": "string",
"webhookEndpointId": "string",
"keyBinding": true,
"keyChainId": "string",
"statusManagement": true,
"sdJwtTrustFormat": "x5c",
"lifeTime": 10.12
}
Schema of the request body
{
"type": "object",
"properties": {
"vct": {
"description": "VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT",
"anyOf": [
{
"type": "string",
"description": "VCT URI string"
},
{
"$ref": "#/components/schemas/VCT"
},
{
"type": "null"
}
]
},
"iaeActions": {
"type": "array",
"nullable": true,
"description": "List of IAE actions to execute before credential issuance",
"example": "",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/IaeActionOpenid4vpPresentation"
},
{
"$ref": "#/components/schemas/IaeActionRedirectToWeb"
}
]
}
},
"schemaMeta": {
"nullable": true,
"description": "TS11 schema metadata configuration for EUDI Catalogue of Attestations.\n\nWhen present, EUDIPLO can generate a SchemaMeta object per the TS11 spec\nusing the GET /issuer/credentials/:id/schema-metadata endpoint.\n\n The underlying TS11 specification is not yet finalized.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"embeddedDisclosurePolicy": {
"nullable": true,
"description": "Embedded disclosure policy (discriminated union by `policy`).\nThe discriminator makes class-transformer instantiate the right subclass,\nand then class-validator runs that subclass’s rules.",
"oneOf": [
{
"$ref": "#/components/schemas/AttestationBasedPolicy"
},
{
"$ref": "#/components/schemas/NoneTrustPolicy"
},
{
"$ref": "#/components/schemas/AllowListPolicy"
},
{
"$ref": "#/components/schemas/RootOfTrustPolicy"
}
],
"allOf": [
{
"$ref": "#/components/schemas/EmbeddedDisclosurePolicy"
}
]
},
"id": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"config": {
"$ref": "#/components/schemas/IssuerMetadataCredentialConfig"
},
"fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ClaimFieldDefinitionDto"
}
},
"attributeProviderId": {
"type": "string",
"nullable": true,
"description": "Reference to the attribute provider used for fetching claims.\nOptional: if set, claims will be fetched from this provider during issuance."
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"keyBinding": {
"type": "boolean"
},
"keyChainId": {
"type": "string",
"description": "Reference to the key chain used for signing.\nOptional: if not specified, the default attestation key chain will be used."
},
"statusManagement": {
"type": "boolean"
},
"sdJwtTrustFormat": {
"nullable": true,
"description": "For SD-JWT credentials: determines whether to include certificate chain (x5c)\nor use federation-based trust (iss claim).\nDefault: \"x5c\" (federation must be explicitly selected)",
"enum": [
"x5c",
"federation"
],
"type": "string"
},
"lifeTime": {
"type": "number"
}
}
}
Responses
DELETE /api/issuer/credentials/{id}¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/issuer/attribute-providers¶
List all attribute providers
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
POST /api/issuer/attribute-providers¶
Create a new attribute provider
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"auth": {
"oneOf": [
{
"$ref": "#/components/schemas/WebHookAuthConfigNone"
},
{
"$ref": "#/components/schemas/WebHookAuthConfigHeader"
}
]
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"url": {
"type": "string"
}
},
"required": [
"auth",
"id",
"name",
"url"
]
}
Responses
GET /api/issuer/attribute-providers/{id}¶
Get an attribute provider by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
PATCH /api/issuer/attribute-providers/{id}¶
Update an attribute provider
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"auth": {
"oneOf": [
{
"$ref": "#/components/schemas/WebHookAuthConfigNone"
},
{
"$ref": "#/components/schemas/WebHookAuthConfigHeader"
}
]
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"url": {
"type": "string"
}
}
}
Responses
DELETE /api/issuer/attribute-providers/{id}¶
Delete an attribute provider
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/issuer/webhook-endpoints¶
List all webhook endpoints for the tenant.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"id": "string",
"auth": null,
"tenantId": "string",
"tenant": {
"sessionConfig": {},
"statusListConfig": {},
"id": "string",
"name": "string",
"description": "string",
"status": "string",
"clients": [
{
"allowedPresentationConfigs": [
"age-verification",
"kyc-basic"
],
"allowedIssuanceConfigs": [
"pid",
"mdl"
],
"clientId": "string",
"secret": "string",
"tenantId": "string",
"description": "string",
"roles": [
"presentation:manage"
],
"tenant": null
}
]
},
"name": "string",
"description": "string",
"url": "string"
}
]
POST /api/issuer/webhook-endpoints¶
Create a new webhook endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the webhook endpoint"
},
"auth": {
"oneOf": [
{
"$ref": "#/components/schemas/WebHookAuthConfigNone"
},
{
"$ref": "#/components/schemas/WebHookAuthConfigHeader"
}
]
},
"name": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"url": {
"type": "string"
}
},
"required": [
"id",
"auth",
"name",
"url"
]
}
Responses
GET /api/issuer/webhook-endpoints/{id}¶
Get a webhook endpoint by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
PATCH /api/issuer/webhook-endpoints/{id}¶
Update a webhook endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the webhook endpoint"
},
"auth": {
"oneOf": [
{
"$ref": "#/components/schemas/WebHookAuthConfigNone"
},
{
"$ref": "#/components/schemas/WebHookAuthConfigHeader"
}
]
},
"name": {
"type": "string"
},
"description": {
"type": "string",
"nullable": true
},
"url": {
"type": "string"
}
}
}
Responses
DELETE /api/issuer/webhook-endpoints/{id}¶
Delete a webhook endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
POST /api/trust-list¶
Creates a new trust list for the tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"description": "string",
"data": {},
"entities": [
null
],
"id": "string",
"keyChainId": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"description": {
"type": "string"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entities": {
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/InternalTrustListEntity"
},
{
"$ref": "#/components/schemas/ExternalTrustListEntity"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"internal": "#/components/schemas/InternalTrustListEntity",
"external": "#/components/schemas/ExternalTrustListEntity"
}
}
}
},
"id": {
"type": "string"
},
"keyChainId": {
"type": "string"
}
},
"required": [
"entities"
]
}
Responses
{
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the trust list"
},
"description": {
"type": "string"
},
"tenantId": {
"type": "string",
"description": "The tenant ID for which the VP request is made."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"keyChainId": {
"type": "string"
},
"keyChain": {
"$ref": "#/components/schemas/KeyChainEntity"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entityConfig": {
"description": "The original entity configuration used to create this trust list.\nStored for round-tripping when editing.",
"type": "array",
"items": {
"type": "object"
}
},
"sequenceNumber": {
"type": "number",
"description": "The sequence number for versioning (incremented on updates)"
},
"jwt": {
"type": "string",
"description": "The signed JWT representation of this trust list"
},
"createdAt": {
"format": "date-time",
"type": "string"
},
"updatedAt": {
"format": "date-time",
"type": "string"
}
},
"required": [
"id",
"tenantId",
"tenant",
"keyChainId",
"keyChain",
"sequenceNumber",
"jwt",
"createdAt",
"updatedAt"
]
}
GET /api/trust-list¶
Returns all trust lists for the tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
]
GET /api/trust-list/{id}¶
Returns the trust list by id for the tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the trust list"
},
"description": {
"type": "string"
},
"tenantId": {
"type": "string",
"description": "The tenant ID for which the VP request is made."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"keyChainId": {
"type": "string"
},
"keyChain": {
"$ref": "#/components/schemas/KeyChainEntity"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entityConfig": {
"description": "The original entity configuration used to create this trust list.\nStored for round-tripping when editing.",
"type": "array",
"items": {
"type": "object"
}
},
"sequenceNumber": {
"type": "number",
"description": "The sequence number for versioning (incremented on updates)"
},
"jwt": {
"type": "string",
"description": "The signed JWT representation of this trust list"
},
"createdAt": {
"format": "date-time",
"type": "string"
},
"updatedAt": {
"format": "date-time",
"type": "string"
}
},
"required": [
"id",
"tenantId",
"tenant",
"keyChainId",
"keyChain",
"sequenceNumber",
"jwt",
"createdAt",
"updatedAt"
]
}
PUT /api/trust-list/{id}¶
Updates a trust list with new entities Creates a new version for audit and regenerates the JWT
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"description": "string",
"data": {},
"entities": [
null
],
"id": "string",
"keyChainId": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"description": {
"type": "string"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entities": {
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/InternalTrustListEntity"
},
{
"$ref": "#/components/schemas/ExternalTrustListEntity"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"internal": "#/components/schemas/InternalTrustListEntity",
"external": "#/components/schemas/ExternalTrustListEntity"
}
}
}
},
"id": {
"type": "string"
},
"keyChainId": {
"type": "string"
}
},
"required": [
"entities"
]
}
Responses
{
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the trust list"
},
"description": {
"type": "string"
},
"tenantId": {
"type": "string",
"description": "The tenant ID for which the VP request is made."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"keyChainId": {
"type": "string"
},
"keyChain": {
"$ref": "#/components/schemas/KeyChainEntity"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entityConfig": {
"description": "The original entity configuration used to create this trust list.\nStored for round-tripping when editing.",
"type": "array",
"items": {
"type": "object"
}
},
"sequenceNumber": {
"type": "number",
"description": "The sequence number for versioning (incremented on updates)"
},
"jwt": {
"type": "string",
"description": "The signed JWT representation of this trust list"
},
"createdAt": {
"format": "date-time",
"type": "string"
},
"updatedAt": {
"format": "date-time",
"type": "string"
}
},
"required": [
"id",
"tenantId",
"tenant",
"keyChainId",
"keyChain",
"sequenceNumber",
"jwt",
"createdAt",
"updatedAt"
]
}
DELETE /api/trust-list/{id}¶
Deletes a trust list
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/trust-list/{id}/export¶
Exports the trust list in LoTE format
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"description": "string",
"data": {},
"entities": [
null
],
"id": "string",
"keyChainId": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"description": {
"type": "string"
},
"data": {
"type": "object",
"description": "The full trust list JSON (generated LoTE structure)"
},
"entities": {
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/InternalTrustListEntity"
},
{
"$ref": "#/components/schemas/ExternalTrustListEntity"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"internal": "#/components/schemas/InternalTrustListEntity",
"external": "#/components/schemas/ExternalTrustListEntity"
}
}
}
},
"id": {
"type": "string"
},
"keyChainId": {
"type": "string"
}
},
"required": [
"entities"
]
}
GET /api/trust-list/{id}/versions¶
Returns the version history for a trust list
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
[
{
"id": "string",
"trustListId": "string",
"trustList": {
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"tenantId": "string",
"sequenceNumber": 10.12,
"data": {},
"entityConfig": {},
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z"
}
]
GET /api/trust-list/{id}/versions/{versionId}¶
Returns a specific version of a trust list
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | ||
versionId |
path | string | No |
Responses
{
"id": "string",
"trustListId": "string",
"trustList": {
"id": "string",
"description": "string",
"tenantId": "string",
"tenant": null,
"keyChainId": "string",
"keyChain": {
"id": "string",
"tenantId": "string",
"tenant": null,
"description": "string",
"usageType": "access",
"usage": "sign",
"kmsProvider": "string",
"externalKeyId": "string",
"rootExternalKeyId": "string",
"rootJwk": {},
"rootCertificate": "string",
"activeJwk": {},
"activeCertificate": "string",
"rotationEnabled": true,
"rotationIntervalDays": 10.12,
"certValidityDays": 10.12,
"lastRotatedAt": "2022-04-13T15:42:05.901Z",
"previousJwk": {},
"previousCertificate": "string",
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"data": {},
"entityConfig": [
{}
],
"sequenceNumber": 10.12,
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
},
"tenantId": "string",
"sequenceNumber": 10.12,
"data": {},
"entityConfig": {},
"jwt": "string",
"createdAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"trustListId": {
"type": "string"
},
"trustList": {
"$ref": "#/components/schemas/TrustList"
},
"tenantId": {
"type": "string"
},
"sequenceNumber": {
"type": "number",
"description": "The sequence number at the time this version was created"
},
"data": {
"type": "object",
"description": "The full trust list JSON at this version"
},
"entityConfig": {
"type": "object",
"description": "The entity configuration at this version"
},
"jwt": {
"type": "string",
"description": "The signed JWT at this version"
},
"createdAt": {
"format": "date-time",
"type": "string"
}
},
"required": [
"id",
"trustListId",
"trustList",
"tenantId",
"sequenceNumber",
"data",
"jwt",
"createdAt"
]
}
POST /api/issuer/offer¶
Create an offer for a credential.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
Schema of the request body
{
"type": "object",
"properties": {
"response_type": {
"enum": [
"uri",
"dc-api",
"iso-18013-7"
],
"type": "string",
"examples": [
{
"value": "qrcode"
}
],
"description": "The type of response expected for the offer request."
},
"authorization_server": {
"type": "string",
"description": "Authorization server id from issuer configuration. If omitted, the first enabled server is used.",
"example": "issuer-built-in"
},
"credentialClaims": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"inline"
]
},
"claims": {
"type": "object",
"additionalProperties": true
}
},
"required": [
"type",
"claims"
]
},
{
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"attributeProvider"
]
},
"attributeProviderId": {
"type": "string"
}
},
"required": [
"type",
"attributeProviderId"
]
},
{
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"webhook"
]
},
"webhook": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"auth": {
"type": "object"
}
},
"required": [
"url"
]
}
},
"required": [
"type",
"webhook"
]
}
]
},
"description": "Credential claims configuration per credential. Keys must match credentialConfigurationIds.",
"example": {
"citizen": {
"type": "inline",
"claims": {
"given_name": "John",
"family_name": "Doe"
}
}
}
},
"flow": {
"description": "The flow type for the offer request.",
"enum": [
"authorization_code",
"pre_authorized_code"
],
"type": "string"
},
"tx_code": {
"type": "string",
"description": "Transaction code for pre-authorized code flow."
},
"tx_code_description": {
"type": "string",
"description": "Description for the transaction code (e.g., \"Please enter the PIN sent to your email\")."
},
"credentialConfigurationIds": {
"description": "List of credential configuration ids to be included in the offer.",
"type": "array",
"items": {
"type": "string"
}
},
"webhookEndpointId": {
"type": "string",
"description": "ID of the webhook endpoint to notify about the status of the issuance process."
}
},
"required": [
"response_type",
"flow",
"credentialConfigurationIds"
]
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
POST /api/issuer/deferred/{transactionId}/complete¶
Complete a deferred credential transaction
Description
Completes a pending deferred credential transaction by providing the claims. The credential will be generated and marked as ready for wallet retrieval.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
transactionId |
path | string | No |
Request body
Schema of the request body
{
"type": "object",
"properties": {
"claims": {
"type": "object",
"additionalProperties": true,
"description": "Claims to include in the credential. The structure should match the credential configuration's expected claims.",
"example": {
"given_name": "John",
"family_name": "Doe",
"birthdate": "1990-01-15"
}
}
},
"required": [
"claims"
]
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"transactionId": {
"type": "string",
"description": "The transaction ID"
},
"status": {
"description": "The new status of the transaction",
"enum": [
"pending",
"ready",
"retrieved",
"expired",
"failed"
],
"type": "string"
},
"message": {
"type": "string",
"description": "Optional message"
}
},
"required": [
"transactionId",
"status"
]
}
POST /api/issuer/deferred/{transactionId}/fail¶
Fail a deferred credential transaction
Description
Marks a deferred credential transaction as failed. The wallet will receive an invalid_transaction_id error when attempting retrieval.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
transactionId |
path | string | No |
Request body
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"transactionId": {
"type": "string",
"description": "The transaction ID"
},
"status": {
"description": "The new status of the transaction",
"enum": [
"pending",
"ready",
"retrieved",
"expired",
"failed"
],
"type": "string"
},
"message": {
"type": "string",
"description": "Optional message"
}
},
"required": [
"transactionId",
"status"
]
}
Schema Metadata¶
POST /api/schema-metadata/publish¶
Publish TS11 schema metadata via registrar
Description
Builds multipart schema metadata input (metadata JSON + rulebook + schema files) and submits it to the registrar, which builds and signs the final schema metadata.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"config": {
"description": "The schema metadata configuration to submit. Registrar builds and signs the final schema metadata.",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"credentialConfigId": {
"type": "string",
"description": "ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID."
},
"pinMode": {
"enum": [
"keep_current",
"update_to_new_version",
"replace_id"
],
"type": "string",
"description": "How to update credential config pinning after publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to a different schema id.",
"default": "keep_current"
}
},
"required": [
"config"
]
}
Responses
POST /api/schema-metadata/sign¶
Deprecated alias for publish endpoint
Description
Deprecated. Use POST /schema-metadata/publish instead.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"config": {
"description": "The schema metadata configuration to submit. Registrar builds and signs the final schema metadata.",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"credentialConfigId": {
"type": "string",
"description": "ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID."
},
"pinMode": {
"enum": [
"keep_current",
"update_to_new_version",
"replace_id"
],
"type": "string",
"description": "How to update credential config pinning after publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to a different schema id.",
"default": "keep_current"
}
},
"required": [
"config"
]
}
Responses
POST /api/schema-metadata/publish-version¶
Publish a new version of an existing schema metadata entry
Description
Submits schema metadata input values for a new version under an existing schema ID. Registrar builds and signs the resulting schema metadata.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"config": {
"description": "The schema metadata configuration to submit as a new version. Must include the existing id.",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"credentialConfigId": {
"type": "string",
"description": "Optional credential config to update pinning for after successful version publish."
},
"pinMode": {
"enum": [
"keep_current",
"update_to_new_version",
"replace_id"
],
"type": "string",
"description": "How to update credential config pinning after version publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to config.id.",
"default": "keep_current"
}
},
"required": [
"config"
]
}
Responses
POST /api/schema-metadata/sign-version¶
Deprecated alias for publish-version endpoint
Description
Deprecated. Use POST /schema-metadata/publish-version instead.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"config": {
"description": "The schema metadata configuration to submit as a new version. Must include the existing id.",
"allOf": [
{
"$ref": "#/components/schemas/SchemaMetaConfig"
}
]
},
"credentialConfigId": {
"type": "string",
"description": "Optional credential config to update pinning for after successful version publish."
},
"pinMode": {
"enum": [
"keep_current",
"update_to_new_version",
"replace_id"
],
"type": "string",
"description": "How to update credential config pinning after version publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to config.id.",
"default": "keep_current"
}
},
"required": [
"config"
]
}
Responses
GET /api/schema-metadata/vocabularies¶
Get predefined schema metadata vocabularies
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
{
"version": "string",
"categories": [
{
"code": "string",
"label": "string",
"status": "active",
"replacedBy": "string"
}
],
"tags": null
}
Schema of the response body
{
"type": "object",
"properties": {
"version": {
"type": "string",
"description": "Vocabulary publication version for cache invalidation."
},
"categories": {
"description": "Allowed category values that can be used when updating schema metadata category.",
"type": "array",
"items": {
"$ref": "#/components/schemas/VocabularyEntryDto"
}
},
"tags": {
"description": "Allowed tag values that can be used when updating schema metadata tags.",
"type": "array",
"items": {
"$ref": "#/components/schemas/VocabularyEntryDto"
}
}
},
"required": [
"version",
"categories",
"tags"
]
}
GET /api/schema-metadata¶
List schema metadata
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
attestationId |
query | string | No | ||
version |
query | string | No |
Responses
[
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
]
GET /api/schema-metadata/mine¶
List schema metadata controlled by the user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
]
GET /api/schema-metadata/{id}¶
Get schema metadata by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique, server-assigned identifier (UUID) for the schema metadata"
},
"version": {
"type": "string",
"description": "Version of this schema metadata (SemVer)"
},
"rulebookURI": {
"type": "string",
"description": "URI of the human-readable Rulebook document"
},
"rulebookIntegrity": {
"type": "string",
"description": "Subresource Integrity hash for the rulebook URI"
},
"attestationLoS": {
"enum": [
"iso_18045_high",
"iso_18045_moderate",
"iso_18045_enhanced-basic",
"iso_18045_basic"
],
"type": "string",
"description": "Level of security (LoS) of this attestation"
},
"bindingType": {
"enum": [
"claim",
"key",
"biometric",
"none"
],
"type": "string",
"description": "Required binding type between attestation and holder"
},
"supportedFormats": {
"type": "array",
"items": {
"type": "string",
"enum": [
"dc+sd-jwt",
"mso_mdoc"
]
},
"description": "Credential formats in which this attestation is available"
},
"schemaURIs": {
"description": "Format-specific schema URIs for this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/MetadataSchemaDto"
}
},
"trustedAuthorities": {
"description": "Trust frameworks / trust anchors applicable to this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/TrustAuthorityDto"
}
},
"category": {
"enum": [
"identity",
"health",
"finance",
"education",
"mobility",
"employment",
"other"
],
"type": "string",
"description": "Domain category for filtering"
},
"tags": {
"description": "Free-form tags for filtering and search",
"type": "array",
"items": {
"type": "string"
}
},
"displayName": {
"type": "string",
"description": "Optional human-readable schema name for UI display and filtering."
},
"issuerOffers": {
"description": "Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description.",
"type": "array",
"items": {
"$ref": "#/components/schemas/IssuerOfferEntryDto"
}
},
"signedJwt": {
"type": "string",
"description": "The original signed JWT"
},
"issuer": {
"type": "string",
"description": "Issuer from the JWT (`iss` claim)"
},
"signerCertificate": {
"description": "The access certificate used to sign this schema metadata",
"allOf": [
{
"$ref": "#/components/schemas/AccessCertificateRefDto"
}
]
},
"issuedAt": {
"type": "string",
"description": "Timestamp when the JWT was issued (from the `iat` claim)"
},
"createdAt": {
"type": "string",
"description": "Server creation timestamp"
},
"updatedAt": {
"type": "string",
"description": "Last update timestamp"
},
"deprecated": {
"type": "boolean",
"description": "Whether this version is deprecated"
},
"deprecationMessage": {
"type": "string",
"description": "Deprecation message shown to consumers"
},
"supersededByVersion": {
"type": "string",
"description": "The version that supersedes this one"
},
"deprecatedAt": {
"type": "string",
"description": "Timestamp when this version was marked as deprecated"
}
},
"required": [
"id",
"version",
"attestationLoS",
"bindingType",
"supportedFormats",
"schemaURIs",
"trustedAuthorities",
"issuerOffers",
"signedJwt",
"issuer",
"issuedAt",
"createdAt",
"updatedAt",
"deprecated"
]
}
PATCH /api/schema-metadata/{id}/versions/{version}¶
Update schema metadata attributes
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | ||
version |
path | string | No |
Request body
{
"category": "identity",
"tags": [
"pid"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
]
}
Schema of the request body
{
"type": "object",
"properties": {
"category": {
"enum": [
"identity",
"health",
"finance",
"education",
"mobility",
"employment",
"other"
],
"type": "string",
"description": "Domain category for filtering"
},
"tags": {
"type": "array",
"items": {
"type": "string",
"enum": [
"pid",
"eudi",
"kyc",
"aml",
"age-verification",
"residency",
"membership",
"education",
"employment",
"mobility"
]
},
"description": "Predefined tags for filtering and search"
},
"displayName": {
"type": "string",
"description": "Optional human-readable schema name for UI display and search"
},
"issuerOffers": {
"description": "Issuer offer entries shown to users, each with credential-offer URL and description",
"type": "array",
"items": {
"$ref": "#/components/schemas/UpdateIssuerOfferDto"
}
}
}
}
Responses
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique, server-assigned identifier (UUID) for the schema metadata"
},
"version": {
"type": "string",
"description": "Version of this schema metadata (SemVer)"
},
"rulebookURI": {
"type": "string",
"description": "URI of the human-readable Rulebook document"
},
"rulebookIntegrity": {
"type": "string",
"description": "Subresource Integrity hash for the rulebook URI"
},
"attestationLoS": {
"enum": [
"iso_18045_high",
"iso_18045_moderate",
"iso_18045_enhanced-basic",
"iso_18045_basic"
],
"type": "string",
"description": "Level of security (LoS) of this attestation"
},
"bindingType": {
"enum": [
"claim",
"key",
"biometric",
"none"
],
"type": "string",
"description": "Required binding type between attestation and holder"
},
"supportedFormats": {
"type": "array",
"items": {
"type": "string",
"enum": [
"dc+sd-jwt",
"mso_mdoc"
]
},
"description": "Credential formats in which this attestation is available"
},
"schemaURIs": {
"description": "Format-specific schema URIs for this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/MetadataSchemaDto"
}
},
"trustedAuthorities": {
"description": "Trust frameworks / trust anchors applicable to this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/TrustAuthorityDto"
}
},
"category": {
"enum": [
"identity",
"health",
"finance",
"education",
"mobility",
"employment",
"other"
],
"type": "string",
"description": "Domain category for filtering"
},
"tags": {
"description": "Free-form tags for filtering and search",
"type": "array",
"items": {
"type": "string"
}
},
"displayName": {
"type": "string",
"description": "Optional human-readable schema name for UI display and filtering."
},
"issuerOffers": {
"description": "Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description.",
"type": "array",
"items": {
"$ref": "#/components/schemas/IssuerOfferEntryDto"
}
},
"signedJwt": {
"type": "string",
"description": "The original signed JWT"
},
"issuer": {
"type": "string",
"description": "Issuer from the JWT (`iss` claim)"
},
"signerCertificate": {
"description": "The access certificate used to sign this schema metadata",
"allOf": [
{
"$ref": "#/components/schemas/AccessCertificateRefDto"
}
]
},
"issuedAt": {
"type": "string",
"description": "Timestamp when the JWT was issued (from the `iat` claim)"
},
"createdAt": {
"type": "string",
"description": "Server creation timestamp"
},
"updatedAt": {
"type": "string",
"description": "Last update timestamp"
},
"deprecated": {
"type": "boolean",
"description": "Whether this version is deprecated"
},
"deprecationMessage": {
"type": "string",
"description": "Deprecation message shown to consumers"
},
"supersededByVersion": {
"type": "string",
"description": "The version that supersedes this one"
},
"deprecatedAt": {
"type": "string",
"description": "Timestamp when this version was marked as deprecated"
}
},
"required": [
"id",
"version",
"attestationLoS",
"bindingType",
"supportedFormats",
"schemaURIs",
"trustedAuthorities",
"issuerOffers",
"signedJwt",
"issuer",
"issuedAt",
"createdAt",
"updatedAt",
"deprecated"
]
}
DELETE /api/schema-metadata/{id}/versions/{version}¶
Delete schema metadata
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | ||
version |
path | string | No |
Responses
GET /api/schema-metadata/{id}/latest¶
Get latest version of schema metadata by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique, server-assigned identifier (UUID) for the schema metadata"
},
"version": {
"type": "string",
"description": "Version of this schema metadata (SemVer)"
},
"rulebookURI": {
"type": "string",
"description": "URI of the human-readable Rulebook document"
},
"rulebookIntegrity": {
"type": "string",
"description": "Subresource Integrity hash for the rulebook URI"
},
"attestationLoS": {
"enum": [
"iso_18045_high",
"iso_18045_moderate",
"iso_18045_enhanced-basic",
"iso_18045_basic"
],
"type": "string",
"description": "Level of security (LoS) of this attestation"
},
"bindingType": {
"enum": [
"claim",
"key",
"biometric",
"none"
],
"type": "string",
"description": "Required binding type between attestation and holder"
},
"supportedFormats": {
"type": "array",
"items": {
"type": "string",
"enum": [
"dc+sd-jwt",
"mso_mdoc"
]
},
"description": "Credential formats in which this attestation is available"
},
"schemaURIs": {
"description": "Format-specific schema URIs for this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/MetadataSchemaDto"
}
},
"trustedAuthorities": {
"description": "Trust frameworks / trust anchors applicable to this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/TrustAuthorityDto"
}
},
"category": {
"enum": [
"identity",
"health",
"finance",
"education",
"mobility",
"employment",
"other"
],
"type": "string",
"description": "Domain category for filtering"
},
"tags": {
"description": "Free-form tags for filtering and search",
"type": "array",
"items": {
"type": "string"
}
},
"displayName": {
"type": "string",
"description": "Optional human-readable schema name for UI display and filtering."
},
"issuerOffers": {
"description": "Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description.",
"type": "array",
"items": {
"$ref": "#/components/schemas/IssuerOfferEntryDto"
}
},
"signedJwt": {
"type": "string",
"description": "The original signed JWT"
},
"issuer": {
"type": "string",
"description": "Issuer from the JWT (`iss` claim)"
},
"signerCertificate": {
"description": "The access certificate used to sign this schema metadata",
"allOf": [
{
"$ref": "#/components/schemas/AccessCertificateRefDto"
}
]
},
"issuedAt": {
"type": "string",
"description": "Timestamp when the JWT was issued (from the `iat` claim)"
},
"createdAt": {
"type": "string",
"description": "Server creation timestamp"
},
"updatedAt": {
"type": "string",
"description": "Last update timestamp"
},
"deprecated": {
"type": "boolean",
"description": "Whether this version is deprecated"
},
"deprecationMessage": {
"type": "string",
"description": "Deprecation message shown to consumers"
},
"supersededByVersion": {
"type": "string",
"description": "The version that supersedes this one"
},
"deprecatedAt": {
"type": "string",
"description": "Timestamp when this version was marked as deprecated"
}
},
"required": [
"id",
"version",
"attestationLoS",
"bindingType",
"supportedFormats",
"schemaURIs",
"trustedAuthorities",
"issuerOffers",
"signedJwt",
"issuer",
"issuedAt",
"createdAt",
"updatedAt",
"deprecated"
]
}
GET /api/schema-metadata/{id}/versions¶
List all versions of a schema metadata entry
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
[
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
]
GET /api/schema-metadata/{id}/versions/{version}/jwt¶
Get signed schema metadata JWT
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | ||
version |
path | string | No |
Responses
GET /api/schema-metadata/{id}/versions/{version}/schemas/{format}¶
Get schema content for a specific format
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
format |
path | string | No | ||
id |
path | string | No | ||
version |
path | string | No |
Responses
PATCH /api/schema-metadata/{id}/versions/{version}/deprecation¶
Deprecate a schema metadata version
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No | ||
version |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"deprecated": {
"type": "boolean",
"description": "Whether to mark this version as deprecated"
},
"message": {
"type": "string",
"description": "Deprecation message shown to consumers"
},
"supersededByVersion": {
"type": "string",
"description": "The version that supersedes this one"
}
},
"required": [
"deprecated"
]
}
Responses
{
"id": "string",
"version": "string",
"rulebookURI": "string",
"rulebookIntegrity": "string",
"attestationLoS": "iso_18045_high",
"bindingType": "claim",
"supportedFormats": [
"dc+sd-jwt"
],
"schemaURIs": [
{
"id": "string",
"formatIdentifier": "dc+sd-jwt",
"uri": "string",
"meta": {},
"integrity": "string"
}
],
"trustedAuthorities": [
{
"id": "string",
"frameworkType": "etsi_tl",
"value": "string",
"verificationMethod": {}
}
],
"category": "identity",
"tags": [
"string"
],
"displayName": "string",
"issuerOffers": [
{
"credentialOfferUrl": "string",
"description": "string"
}
],
"signedJwt": "string",
"issuer": "string",
"signerCertificate": null,
"issuedAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deprecated": true,
"deprecationMessage": "string",
"supersededByVersion": "string",
"deprecatedAt": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique, server-assigned identifier (UUID) for the schema metadata"
},
"version": {
"type": "string",
"description": "Version of this schema metadata (SemVer)"
},
"rulebookURI": {
"type": "string",
"description": "URI of the human-readable Rulebook document"
},
"rulebookIntegrity": {
"type": "string",
"description": "Subresource Integrity hash for the rulebook URI"
},
"attestationLoS": {
"enum": [
"iso_18045_high",
"iso_18045_moderate",
"iso_18045_enhanced-basic",
"iso_18045_basic"
],
"type": "string",
"description": "Level of security (LoS) of this attestation"
},
"bindingType": {
"enum": [
"claim",
"key",
"biometric",
"none"
],
"type": "string",
"description": "Required binding type between attestation and holder"
},
"supportedFormats": {
"type": "array",
"items": {
"type": "string",
"enum": [
"dc+sd-jwt",
"mso_mdoc"
]
},
"description": "Credential formats in which this attestation is available"
},
"schemaURIs": {
"description": "Format-specific schema URIs for this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/MetadataSchemaDto"
}
},
"trustedAuthorities": {
"description": "Trust frameworks / trust anchors applicable to this schema metadata",
"type": "array",
"items": {
"$ref": "#/components/schemas/TrustAuthorityDto"
}
},
"category": {
"enum": [
"identity",
"health",
"finance",
"education",
"mobility",
"employment",
"other"
],
"type": "string",
"description": "Domain category for filtering"
},
"tags": {
"description": "Free-form tags for filtering and search",
"type": "array",
"items": {
"type": "string"
}
},
"displayName": {
"type": "string",
"description": "Optional human-readable schema name for UI display and filtering."
},
"issuerOffers": {
"description": "Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description.",
"type": "array",
"items": {
"$ref": "#/components/schemas/IssuerOfferEntryDto"
}
},
"signedJwt": {
"type": "string",
"description": "The original signed JWT"
},
"issuer": {
"type": "string",
"description": "Issuer from the JWT (`iss` claim)"
},
"signerCertificate": {
"description": "The access certificate used to sign this schema metadata",
"allOf": [
{
"$ref": "#/components/schemas/AccessCertificateRefDto"
}
]
},
"issuedAt": {
"type": "string",
"description": "Timestamp when the JWT was issued (from the `iat` claim)"
},
"createdAt": {
"type": "string",
"description": "Server creation timestamp"
},
"updatedAt": {
"type": "string",
"description": "Last update timestamp"
},
"deprecated": {
"type": "boolean",
"description": "Whether this version is deprecated"
},
"deprecationMessage": {
"type": "string",
"description": "Deprecation message shown to consumers"
},
"supersededByVersion": {
"type": "string",
"description": "The version that supersedes this one"
},
"deprecatedAt": {
"type": "string",
"description": "Timestamp when this version was marked as deprecated"
}
},
"required": [
"id",
"version",
"attestationLoS",
"bindingType",
"supportedFormats",
"schemaURIs",
"trustedAuthorities",
"issuerOffers",
"signedJwt",
"issuer",
"issuedAt",
"createdAt",
"updatedAt",
"deprecated"
]
}
Cache Management¶
GET /api/cache/stats¶
Get cache statistics
Description
Returns statistics about the trust list and status list caches.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
DELETE /api/cache¶
Clear all caches
Description
Clears both trust list and status list caches. Next verification will fetch fresh data.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
DELETE /api/cache/trust-list¶
Clear trust list cache
Description
Clears the trust list cache. Next verification will fetch fresh trust lists.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
DELETE /api/cache/status-list¶
Clear status list cache
Description
Clears the status list (revocation) cache. Next status check will fetch fresh status lists.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
Verifier¶
GET /api/verifier/config¶
Returns the presentation request configurations.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
[
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"registrationCertCache": "",
"id": "string",
"tenant": null,
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
]
POST /api/verifier/config¶
Store a presentation request configuration. If it already exists, it will be updated.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"id": "string",
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"skewSeconds": {
"type": "number",
"description": "Clock skew tolerance for credential JWT time validation, in seconds.",
"minimum": 0,
"default": 60
},
"statusCheckMode": {
"description": "Status list verification mode for presentations: strict (default), best_effort, or disabled.",
"enum": [
"strict",
"best_effort",
"disabled"
],
"type": "string",
"default": "strict"
},
"id": {
"type": "string",
"description": "Unique identifier for the VP request."
},
"description": {
"type": "string",
"nullable": true,
"description": "Description of the presentation configuration."
},
"lifeTime": {
"type": "number",
"description": "Lifetime how long the presentation request is valid after creation, in seconds."
},
"dcql_query": {
"description": "The DCQL query to be used for the VP request.",
"allOf": [
{
"$ref": "#/components/schemas/DCQL"
}
]
},
"transaction_data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"registration_cert": {
"nullable": true,
"description": "The registration certificate request containing the necessary details.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateRequest"
}
]
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"attached": {
"nullable": true,
"description": "Attestation that should be attached",
"type": "array",
"items": {
"$ref": "#/components/schemas/PresentationAttachment"
}
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"accessKeyChainId": {
"type": "string",
"nullable": true,
"description": "Optional ID of the access certificate to use for signing the presentation request.\nIf not provided, the default access certificate for the tenant will be used.\n\nNote: This is intentionally NOT a TypeORM relationship because CertEntity uses\na composite primary key (id + tenantId), and SQLite cannot create foreign keys\nthat reference only part of a composite primary key. The relationship is handled\nat the application level in the service layer."
}
},
"required": [
"id",
"dcql_query"
]
}
Responses
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"registrationCertCache": "",
"id": "string",
"tenant": null,
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"skewSeconds": {
"type": "number",
"description": "Clock skew tolerance for credential JWT time validation, in seconds.",
"minimum": 0,
"default": 60
},
"statusCheckMode": {
"description": "Status list verification mode for presentations: strict (default), best_effort, or disabled.",
"enum": [
"strict",
"best_effort",
"disabled"
],
"type": "string",
"default": "strict"
},
"registrationCertCache": {
"type": "object",
"nullable": true,
"description": "Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored.",
"example": "",
"readOnly": true,
"additionalProperties": true
},
"id": {
"type": "string",
"description": "Unique identifier for the VP request."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"description": {
"type": "string",
"nullable": true,
"description": "Description of the presentation configuration."
},
"lifeTime": {
"type": "number",
"description": "Lifetime how long the presentation request is valid after creation, in seconds."
},
"dcql_query": {
"description": "The DCQL query to be used for the VP request.",
"allOf": [
{
"$ref": "#/components/schemas/DCQL"
}
]
},
"transaction_data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"registration_cert": {
"nullable": true,
"description": "The registration certificate request containing the necessary details.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateRequest"
}
]
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was last updated."
},
"attached": {
"nullable": true,
"description": "Attestation that should be attached",
"type": "array",
"items": {
"$ref": "#/components/schemas/PresentationAttachment"
}
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"accessKeyChainId": {
"type": "string",
"nullable": true,
"description": "Optional ID of the access certificate to use for signing the presentation request.\nIf not provided, the default access certificate for the tenant will be used.\n\nNote: This is intentionally NOT a TypeORM relationship because CertEntity uses\na composite primary key (id + tenantId), and SQLite cannot create foreign keys\nthat reference only part of a composite primary key. The relationship is handled\nat the application level in the service layer."
}
},
"required": [
"id",
"tenant",
"dcql_query",
"createdAt",
"updatedAt"
]
}
POST /api/verifier/config/issuer-metadata/resolve¶
Resolve external issuer metadata
Description
Fetches OpenID4VCI credential issuer metadata from an external issuer URL on the server side.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Responses
POST /api/verifier/config/schema-metadata/resolve¶
Resolve external schema metadata
Description
Fetches schema metadata from an external URL, extracts signedJwt, validates the JWT payload shape and returns normalized fields for presentation config import.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"schemaMetadataUrl": "https://registrar.example.com/schema-metadata/5c0d7dbb-ef2e-448b-b84f-b8103575947b"
}
Schema of the request body
{
"type": "object",
"properties": {
"schemaMetadataUrl": {
"type": "string",
"format": "uri",
"description": "Schema metadata URL to resolve server-side. The response must contain a signedJwt field.",
"example": "https://registrar.example.com/schema-metadata/5c0d7dbb-ef2e-448b-b84f-b8103575947b"
}
},
"required": [
"schemaMetadataUrl"
]
}
Responses
POST /api/verifier/config/schema-metadata/resolve-jwt¶
Resolve schema metadata JWT
Description
Validates and resolves a signed schema metadata JWT directly, building DCQL and resolving schema references. Useful for resolving catalog entries without requiring external URL accessibility.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"signedJwt": "eyJ0eXAiOiJhdHRlc3RhdGlvbi1zY2hlbWErand0IiwiYWxnIjoiRVMyNTYiLCJ4NWMiOlsiTUlJQ01qQ0NBZGlnQXdJQkFnSVVDa0hwaTlPWHQ0QUJTY2NWbEl3UlJRdlE5cU1Rd0NnWUlLb1pJemowRUF3SXdLREVMTUFrR0ExVUVCaE1DUkVVeEdUQVhCZ05WQkFNTUVFZGxjbTFoYmlCU1pXZHBjM1J5WVhJd0hoY05Nall3TVRFMk1UQXdOVEE0V2hjTk1qZ3dNVEUyTVRBd05UQTRXakFvTVFzd0NRWURWUVFHRXdKRVJURVpNQmNHQTFVRUF3d1FSMlZ5YldGdUlGSmxaMmx6ZEhKaGNqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBUXQrK1dGQnJkVVJjYXkycmtyMG9pdW9zMDE2dlVLT2tsWVNJUVF4K1cvclcyOVc4bkE3SFMrNHMrNW0zWW5tUmRRcXphYWZDT3ZHYXhjSUd5UXFjQ2pnZDh3Z2R3d0hRWURWUjBPQkJZRUZQNGwyNXhUZWxBbnNEa0U2QXFlc09zd3pxWWxNQjhHQTFVZEl3UVlNQmFBRlA0bDI1eFRlbEFuc0RrRTZBcWVzT3N3enFZbE1CSUdBMVVkRXdFQi93UUlNQVlCQWY4Q0FRQXdEZ1lEVlIwUEFRSC9CQVFEQWdFR01Dd0dBMVVkRWdRbE1DT0dJV2gwZEhCek9pOHZjbVZuYVhOMGNtRnlMbVYxWkdrdGQyRnNiR1YwTG1SbGRqQklCZ05WSFI4RVFUQS9NRDJnTzZBNWhqZG9kSFJ3Y3pvdkwzSmxaMmx6ZEhKaGNpNWxkV1JwTFhkaGJHeGxkQzVrWlhZdmMzUmhkSFZ6TFcxaGJtRm5aVzFsYm5RdlkzSnNNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJRFcxTXA0ZDc3a2oxWVVIWHlhVU1mMmNpbGtxTmpkL2RpdWpud3A4Ti9ISkFpRUF2WXlaK1IyUXFuUUJJUnZBL281aEVjVHJuNTNMQ2ZEQWZnWGt1OWxzZUIwPSJdIn0.eyJpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMS9zY2hlbWEtbWV0YWRhdGEvNWMzNzFhMjEtZWIxOC00NzY3LTk4MTktMGIwMGY2NTQzY2QzIiwidmVyc2lvbiI6IjEuMC4wIn0.signature"
}
Schema of the request body
{
"type": "object",
"properties": {
"signedJwt": {
"type": "string",
"description": "Signed schema metadata JWT to resolve server-side. The JWT will be verified, resolved, and converted to DCQL.",
"example": "eyJ0eXAiOiJhdHRlc3RhdGlvbi1zY2hlbWErand0IiwiYWxnIjoiRVMyNTYiLCJ4NWMiOlsiTUlJQ01qQ0NBZGlnQXdJQkFnSVVDa0hwaTlPWHQ0QUJTY2NWbEl3UlJRdlE5cU1Rd0NnWUlLb1pJemowRUF3SXdLREVMTUFrR0ExVUVCaE1DUkVVeEdUQVhCZ05WQkFNTUVFZGxjbTFoYmlCU1pXZHBjM1J5WVhJd0hoY05Nall3TVRFMk1UQXdOVEE0V2hjTk1qZ3dNVEUyTVRBd05UQTRXakFvTVFzd0NRWURWUVFHRXdKRVJURVpNQmNHQTFVRUF3d1FSMlZ5YldGdUlGSmxaMmx6ZEhKaGNqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBUXQrK1dGQnJkVVJjYXkycmtyMG9pdW9zMDE2dlVLT2tsWVNJUVF4K1cvclcyOVc4bkE3SFMrNHMrNW0zWW5tUmRRcXphYWZDT3ZHYXhjSUd5UXFjQ2pnZDh3Z2R3d0hRWURWUjBPQkJZRUZQNGwyNXhUZWxBbnNEa0U2QXFlc09zd3pxWWxNQjhHQTFVZEl3UVlNQmFBRlA0bDI1eFRlbEFuc0RrRTZBcWVzT3N3enFZbE1CSUdBMVVkRXdFQi93UUlNQVlCQWY4Q0FRQXdEZ1lEVlIwUEFRSC9CQVFEQWdFR01Dd0dBMVVkRWdRbE1DT0dJV2gwZEhCek9pOHZjbVZuYVhOMGNtRnlMbVYxWkdrdGQyRnNiR1YwTG1SbGRqQklCZ05WSFI4RVFUQS9NRDJnTzZBNWhqZG9kSFJ3Y3pvdkwzSmxaMmx6ZEhKaGNpNWxkV1JwTFhkaGJHeGxkQzVrWlhZdmMzUmhkSFZ6TFcxaGJtRm5aVzFsYm5RdlkzSnNNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJRFcxTXA0ZDc3a2oxWVVIWHlhVU1mMmNpbGtxTmpkL2RpdWpud3A4Ti9ISkFpRUF2WXlaK1IyUXFuUUJJUnZBL281aEVjVHJuNTNMQ2ZEQWZnWGt1OWxzZUIwPSJdIn0.eyJpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMS9zY2hlbWEtbWV0YWRhdGEvNWMzNzFhMjEtZWIxOC00NzY3LTk4MTktMGIwMGY2NTQzY2QzIiwidmVyc2lvbiI6IjEuMC4wIn0.signature"
}
},
"required": [
"signedJwt"
]
}
Responses
GET /api/verifier/config/schema-metadata/catalog¶
List schema metadata from the registrar catalog
Description
Returns all schema metadata entries from the configured registrar. Returns an empty array when no registrar is configured.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
GET /api/verifier/config/{id}¶
Get a presentation request configuration by its ID.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"registrationCertCache": "",
"id": "string",
"tenant": null,
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"skewSeconds": {
"type": "number",
"description": "Clock skew tolerance for credential JWT time validation, in seconds.",
"minimum": 0,
"default": 60
},
"statusCheckMode": {
"description": "Status list verification mode for presentations: strict (default), best_effort, or disabled.",
"enum": [
"strict",
"best_effort",
"disabled"
],
"type": "string",
"default": "strict"
},
"registrationCertCache": {
"type": "object",
"nullable": true,
"description": "Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored.",
"example": "",
"readOnly": true,
"additionalProperties": true
},
"id": {
"type": "string",
"description": "Unique identifier for the VP request."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"description": {
"type": "string",
"nullable": true,
"description": "Description of the presentation configuration."
},
"lifeTime": {
"type": "number",
"description": "Lifetime how long the presentation request is valid after creation, in seconds."
},
"dcql_query": {
"description": "The DCQL query to be used for the VP request.",
"allOf": [
{
"$ref": "#/components/schemas/DCQL"
}
]
},
"transaction_data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"registration_cert": {
"nullable": true,
"description": "The registration certificate request containing the necessary details.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateRequest"
}
]
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was last updated."
},
"attached": {
"nullable": true,
"description": "Attestation that should be attached",
"type": "array",
"items": {
"$ref": "#/components/schemas/PresentationAttachment"
}
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"accessKeyChainId": {
"type": "string",
"nullable": true,
"description": "Optional ID of the access certificate to use for signing the presentation request.\nIf not provided, the default access certificate for the tenant will be used.\n\nNote: This is intentionally NOT a TypeORM relationship because CertEntity uses\na composite primary key (id + tenantId), and SQLite cannot create foreign keys\nthat reference only part of a composite primary key. The relationship is handled\nat the application level in the service layer."
}
},
"required": [
"id",
"tenant",
"dcql_query",
"createdAt",
"updatedAt"
]
}
PATCH /api/verifier/config/{id}¶
Update a presentation request configuration by its ID.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"id": "string",
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"skewSeconds": {
"type": "number",
"description": "Clock skew tolerance for credential JWT time validation, in seconds.",
"minimum": 0,
"default": 60
},
"statusCheckMode": {
"description": "Status list verification mode for presentations: strict (default), best_effort, or disabled.",
"enum": [
"strict",
"best_effort",
"disabled"
],
"type": "string",
"default": "strict"
},
"id": {
"type": "string",
"description": "Unique identifier for the VP request."
},
"description": {
"type": "string",
"nullable": true,
"description": "Description of the presentation configuration."
},
"lifeTime": {
"type": "number",
"description": "Lifetime how long the presentation request is valid after creation, in seconds."
},
"dcql_query": {
"description": "The DCQL query to be used for the VP request.",
"allOf": [
{
"$ref": "#/components/schemas/DCQL"
}
]
},
"transaction_data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"registration_cert": {
"nullable": true,
"description": "The registration certificate request containing the necessary details.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateRequest"
}
]
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"attached": {
"nullable": true,
"description": "Attestation that should be attached",
"type": "array",
"items": {
"$ref": "#/components/schemas/PresentationAttachment"
}
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"accessKeyChainId": {
"type": "string",
"nullable": true,
"description": "Optional ID of the access certificate to use for signing the presentation request.\nIf not provided, the default access certificate for the tenant will be used.\n\nNote: This is intentionally NOT a TypeORM relationship because CertEntity uses\na composite primary key (id + tenantId), and SQLite cannot create foreign keys\nthat reference only part of a composite primary key. The relationship is handled\nat the application level in the service layer."
}
}
}
Responses
{
"skewSeconds": 10.12,
"statusCheckMode": "strict",
"registrationCertCache": "",
"id": "string",
"tenant": null,
"description": "string",
"lifeTime": 10.12,
"dcql_query": null,
"transaction_data": [
{
"type": "string",
"credential_ids": [
"string"
]
}
],
"registration_cert": {},
"webhookEndpointId": "string",
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z",
"attached": [
{
"format": "string",
"data": {},
"credential_ids": [
"string"
]
}
],
"redirectUri": "https://example.com/callback?session={sessionId}",
"accessKeyChainId": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"skewSeconds": {
"type": "number",
"description": "Clock skew tolerance for credential JWT time validation, in seconds.",
"minimum": 0,
"default": 60
},
"statusCheckMode": {
"description": "Status list verification mode for presentations: strict (default), best_effort, or disabled.",
"enum": [
"strict",
"best_effort",
"disabled"
],
"type": "string",
"default": "strict"
},
"registrationCertCache": {
"type": "object",
"nullable": true,
"description": "Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored.",
"example": "",
"readOnly": true,
"additionalProperties": true
},
"id": {
"type": "string",
"description": "Unique identifier for the VP request."
},
"tenant": {
"description": "The tenant that owns this object.",
"allOf": [
{
"$ref": "#/components/schemas/TenantEntity"
}
]
},
"description": {
"type": "string",
"nullable": true,
"description": "Description of the presentation configuration."
},
"lifeTime": {
"type": "number",
"description": "Lifetime how long the presentation request is valid after creation, in seconds."
},
"dcql_query": {
"description": "The DCQL query to be used for the VP request.",
"allOf": [
{
"$ref": "#/components/schemas/DCQL"
}
]
},
"transaction_data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"registration_cert": {
"nullable": true,
"description": "The registration certificate request containing the necessary details.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateRequest"
}
]
},
"webhookEndpointId": {
"type": "string",
"nullable": true,
"description": "Reference to the webhook endpoint used for notifications.\nOptional: if set, notifications will be sent to this endpoint."
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "The timestamp when the VP request was last updated."
},
"attached": {
"nullable": true,
"description": "Attestation that should be attached",
"type": "array",
"items": {
"$ref": "#/components/schemas/PresentationAttachment"
}
},
"redirectUri": {
"type": "string",
"nullable": true,
"description": "Redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"accessKeyChainId": {
"type": "string",
"nullable": true,
"description": "Optional ID of the access certificate to use for signing the presentation request.\nIf not provided, the default access certificate for the tenant will be used.\n\nNote: This is intentionally NOT a TypeORM relationship because CertEntity uses\na composite primary key (id + tenantId), and SQLite cannot create foreign keys\nthat reference only part of a composite primary key. The relationship is handled\nat the application level in the service layer."
}
},
"required": [
"id",
"tenant",
"dcql_query",
"createdAt",
"updatedAt"
]
}
DELETE /api/verifier/config/{id}¶
Deletes a presentation request configuration by its ID.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
POST /api/verifier/config/{id}/registration-cert/reissue¶
Reissue the registration certificate cache
Description
Bypasses the embedded registration-certificate cache and re-resolves it from the configured registrar.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
POST /api/verifier/offer¶
Create an presentation request that can be sent to the user
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
Schema of the request body
{
"type": "object",
"properties": {
"response_type": {
"type": "string",
"description": "The type of response expected from the presentation request.",
"enum": [
"uri",
"dc-api",
"iso-18013-7"
]
},
"requestId": {
"type": "string",
"description": "Identifier of the presentation configuration"
},
"webhook": {
"description": "Webhook configuration to receive the response.\nIf not provided, the configured webhook from the configuration will be used.",
"allOf": [
{
"$ref": "#/components/schemas/WebhookConfig"
}
]
},
"redirectUri": {
"type": "string",
"description": "Optional redirect URI to which the user-agent should be redirected after the presentation is completed.\nYou can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.",
"example": "https://example.com/callback?session={sessionId}"
},
"expected_origin": {
"type": "string",
"description": "Optional expected browser origin for DC API key-binding audience.\nExample: \"http://localhost:8080\""
},
"transaction_data": {
"description": "Optional transaction data to include in the OID4VP request.\nIf provided, this will override the transaction_data from the presentation configuration.",
"type": "array",
"items": {
"$ref": "#/components/schemas/TransactionData"
}
},
"skewSeconds": {
"type": "number",
"description": "Optional clock skew tolerance for this presentation offer, in seconds.\nIf provided, this overrides the presentation configuration for the created session.",
"minimum": 0
}
},
"required": [
"response_type",
"requestId"
]
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Registrar¶
GET /api/registrar/config¶
Get registrar configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
{
"registrarUrl": "https://sandbox.eudi-wallet.org/api",
"oidcUrl": "https://auth.example.com/realms/my-realm",
"clientId": "registrar-client",
"clientSecret": "string",
"username": "admin@example.com",
"registrationCertificateDefaults": {},
"hasPassword": true
}
Schema of the response body
{
"type": "object",
"properties": {
"registrarUrl": {
"type": "string",
"description": "The base URL of the registrar API",
"example": "https://sandbox.eudi-wallet.org/api"
},
"oidcUrl": {
"type": "string",
"description": "The OIDC issuer URL for authentication (e.g., Keycloak realm URL)",
"example": "https://auth.example.com/realms/my-realm"
},
"clientId": {
"type": "string",
"description": "The OIDC client ID for the registrar",
"example": "registrar-client"
},
"clientSecret": {
"type": "string",
"description": "The OIDC client secret (optional, for confidential clients)"
},
"username": {
"type": "string",
"description": "The username for OIDC login",
"example": "admin@example.com"
},
"registrationCertificateDefaults": {
"nullable": true,
"description": "Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri)",
"additionalProperties": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateDefaults"
}
]
},
"hasPassword": {
"type": "boolean",
"description": "Indicates whether a password is configured (actual password is never returned)",
"example": true
}
},
"required": [
"registrarUrl",
"oidcUrl",
"clientId",
"username",
"hasPassword"
]
}
POST /api/registrar/config¶
Create or replace registrar configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"registrarUrl": "https://sandbox.eudi-wallet.org/api",
"oidcUrl": "https://auth.example.com/realms/my-realm",
"clientId": "registrar-client",
"clientSecret": "string",
"username": "admin@example.com",
"password": "string",
"registrationCertificateDefaults": {}
}
Schema of the request body
{
"type": "object",
"properties": {
"registrarUrl": {
"type": "string",
"description": "The base URL of the registrar API",
"example": "https://sandbox.eudi-wallet.org/api"
},
"oidcUrl": {
"type": "string",
"description": "The OIDC issuer URL for authentication (e.g., Keycloak realm URL)",
"example": "https://auth.example.com/realms/my-realm"
},
"clientId": {
"type": "string",
"description": "The OIDC client ID for the registrar",
"example": "registrar-client"
},
"clientSecret": {
"type": "string",
"description": "The OIDC client secret (optional, for confidential clients)"
},
"username": {
"type": "string",
"description": "The username for OIDC login",
"example": "admin@example.com"
},
"password": {
"type": "string",
"description": "The password for OIDC login (stored in plaintext)"
},
"registrationCertificateDefaults": {
"nullable": true,
"description": "Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri)",
"additionalProperties": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateDefaults"
}
]
}
},
"required": [
"registrarUrl",
"oidcUrl",
"clientId",
"username",
"password"
]
}
Responses
{
"registrarUrl": "https://sandbox.eudi-wallet.org/api",
"oidcUrl": "https://auth.example.com/realms/my-realm",
"clientId": "registrar-client",
"clientSecret": "string",
"username": "admin@example.com",
"registrationCertificateDefaults": {},
"hasPassword": true
}
Schema of the response body
{
"type": "object",
"properties": {
"registrarUrl": {
"type": "string",
"description": "The base URL of the registrar API",
"example": "https://sandbox.eudi-wallet.org/api"
},
"oidcUrl": {
"type": "string",
"description": "The OIDC issuer URL for authentication (e.g., Keycloak realm URL)",
"example": "https://auth.example.com/realms/my-realm"
},
"clientId": {
"type": "string",
"description": "The OIDC client ID for the registrar",
"example": "registrar-client"
},
"clientSecret": {
"type": "string",
"description": "The OIDC client secret (optional, for confidential clients)"
},
"username": {
"type": "string",
"description": "The username for OIDC login",
"example": "admin@example.com"
},
"registrationCertificateDefaults": {
"nullable": true,
"description": "Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri)",
"additionalProperties": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateDefaults"
}
]
},
"hasPassword": {
"type": "boolean",
"description": "Indicates whether a password is configured (actual password is never returned)",
"example": true
}
},
"required": [
"registrarUrl",
"oidcUrl",
"clientId",
"username",
"hasPassword"
]
}
PATCH /api/registrar/config¶
Update registrar configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"registrarUrl": "https://sandbox.eudi-wallet.org/api",
"oidcUrl": "https://auth.example.com/realms/my-realm",
"clientId": "registrar-client",
"clientSecret": "string",
"username": "admin@example.com",
"password": "string",
"registrationCertificateDefaults": {}
}
Schema of the request body
{
"type": "object",
"properties": {
"registrarUrl": {
"type": "string",
"description": "The base URL of the registrar API",
"example": "https://sandbox.eudi-wallet.org/api"
},
"oidcUrl": {
"type": "string",
"description": "The OIDC issuer URL for authentication (e.g., Keycloak realm URL)",
"example": "https://auth.example.com/realms/my-realm"
},
"clientId": {
"type": "string",
"description": "The OIDC client ID for the registrar",
"example": "registrar-client"
},
"clientSecret": {
"type": "string",
"description": "The OIDC client secret (optional, for confidential clients)"
},
"username": {
"type": "string",
"description": "The username for OIDC login",
"example": "admin@example.com"
},
"password": {
"type": "string",
"description": "The password for OIDC login (stored in plaintext)"
},
"registrationCertificateDefaults": {
"nullable": true,
"description": "Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri)",
"additionalProperties": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateDefaults"
}
]
}
}
}
Responses
{
"registrarUrl": "https://sandbox.eudi-wallet.org/api",
"oidcUrl": "https://auth.example.com/realms/my-realm",
"clientId": "registrar-client",
"clientSecret": "string",
"username": "admin@example.com",
"registrationCertificateDefaults": {},
"hasPassword": true
}
Schema of the response body
{
"type": "object",
"properties": {
"registrarUrl": {
"type": "string",
"description": "The base URL of the registrar API",
"example": "https://sandbox.eudi-wallet.org/api"
},
"oidcUrl": {
"type": "string",
"description": "The OIDC issuer URL for authentication (e.g., Keycloak realm URL)",
"example": "https://auth.example.com/realms/my-realm"
},
"clientId": {
"type": "string",
"description": "The OIDC client ID for the registrar",
"example": "registrar-client"
},
"clientSecret": {
"type": "string",
"description": "The OIDC client secret (optional, for confidential clients)"
},
"username": {
"type": "string",
"description": "The username for OIDC login",
"example": "admin@example.com"
},
"registrationCertificateDefaults": {
"nullable": true,
"description": "Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri)",
"additionalProperties": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/RegistrationCertificateDefaults"
}
]
},
"hasPassword": {
"type": "boolean",
"description": "Indicates whether a password is configured (actual password is never returned)",
"example": true
}
},
"required": [
"registrarUrl",
"oidcUrl",
"clientId",
"username",
"hasPassword"
]
}
DELETE /api/registrar/config¶
Delete registrar configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
POST /api/registrar/access-certificate¶
Create an access certificate for a key
Description
Creates an access certificate at the registrar for the specified key. Requires a relying party to be already registered at the registrar. The certificate is automatically stored in EUDIPLO.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Chained AS VP¶
POST /api/issuers/{tenantId}/chained-as-vp/par¶
Pushed Authorization Request
Description
Submit wallet authorization request parameters for the VP-backed AS.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
oauth-client-attestation |
header | string | No | ||
OAuth-Client-Attestation |
header | string | No | Wallet attestation JWT | |
oauth-client-attestation-pop |
header | string | No | ||
OAuth-Client-Attestation-PoP |
header | string | No | Wallet attestation proof-of-possession JWT | |
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"request_uri": {
"type": "string",
"description": "The request URI to use at the authorization endpoint",
"example": "urn:ietf:params:oauth:request_uri:abc123"
},
"expires_in": {
"type": "number",
"description": "The lifetime of the request URI in seconds",
"example": 600
}
},
"required": [
"request_uri",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /api/issuers/{tenantId}/chained-as-vp/authorize¶
Authorization endpoint
Description
Validates the request_uri and redirects the browser into an OID4VP wallet request.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
client_id |
query | string | No | Client identifier | |
request_uri |
query | string | No | Request URI from PAR response | |
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /api/issuers/{tenantId}/chained-as-vp/vp-callback¶
Verifier callback
Description
Receives the OID4VP verifier redirect and finishes the OAuth authorization flow.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
cas |
query | string | No | ||
error |
query | string | No | ||
error_description |
query | string | No | ||
response_code |
query | string | No | ||
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
POST /api/issuers/{tenantId}/chained-as-vp/token¶
Token endpoint
Description
Exchanges the authorization code for an access token containing issuer_state.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
tenantId |
path | string | No | Tenant identifier |
Request body
{
"grant_type": "authorization_code",
"code": "string",
"refresh_token": "string",
"client_id": "string",
"redirect_uri": "string",
"code_verifier": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"grant_type": {
"type": "string",
"description": "Grant type ('authorization_code' or 'refresh_token')",
"example": "authorization_code"
},
"code": {
"type": "string",
"description": "Authorization code received in the callback (authorization_code grant)"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (refresh_token grant)"
},
"client_id": {
"type": "string",
"description": "Client identifier"
},
"redirect_uri": {
"type": "string",
"description": "Redirect URI (must match the one used in PAR)"
},
"code_verifier": {
"type": "string",
"description": "PKCE code verifier"
}
},
"required": [
"grant_type"
]
}
Responses
{
"access_token": "string",
"token_type": "DPoP",
"expires_in": 3600,
"scope": "string",
"authorization_details": [
{}
],
"c_nonce": "string",
"c_nonce_expires_in": 10.12,
"refresh_token": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"access_token": {
"type": "string",
"description": "The access token"
},
"token_type": {
"type": "string",
"description": "Token type (Bearer or DPoP)",
"example": "DPoP"
},
"expires_in": {
"type": "number",
"description": "Token lifetime in seconds",
"example": 3600
},
"scope": {
"type": "string",
"description": "Scope granted"
},
"authorization_details": {
"description": "Authorized credential configurations",
"type": "array",
"items": {
"type": "object"
}
},
"c_nonce": {
"type": "string",
"description": "C_NONCE for credential request"
},
"c_nonce_expires_in": {
"type": "number",
"description": "C_NONCE lifetime in seconds"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (issued when refresh tokens are enabled)"
}
},
"required": [
"access_token",
"token_type",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Key Chain¶
GET /api/key-chain/providers¶
Get available KMS providers
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
{
"providers": [
{
"name": "main-vault",
"type": "vault",
"description": "Production HashiCorp Vault",
"capabilities": null
}
],
"default": "db"
}
Schema of the response body
{
"type": "object",
"properties": {
"providers": {
"description": "Detailed info for each registered KMS provider.",
"type": "array",
"items": {
"$ref": "#/components/schemas/KmsProviderInfoDto"
}
},
"default": {
"type": "string",
"description": "The default KMS provider name.",
"example": "db"
}
},
"required": [
"providers",
"default"
]
}
GET /api/key-chain/providers/health¶
Health probe for every KMS provider
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
GET /api/key-chain/providers/config¶
Get tenant KMS provider configuration
Description
Returns tenant-specific KMS config (if present) and the effective merged runtime config.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"tenantConfig": {
"nullable": true,
"description": "Tenant-specific KMS configuration from <CONFIG_FOLDER>/<tenantId>/kms.json. Null when no tenant file exists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/KmsConfigDto"
}
]
},
"effectiveConfig": {
"description": "Effective configuration used at runtime for the tenant (global + tenant merge).",
"allOf": [
{
"$ref": "#/components/schemas/KmsConfigDto"
}
]
}
},
"required": [
"effectiveConfig"
]
}
PUT /api/key-chain/providers/config¶
Create or replace tenant KMS provider configuration
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"defaultProvider": "main-vault",
"providers": [
{
"id": "db",
"type": "db",
"description": "Default database provider"
},
{
"id": "main-vault",
"type": "vault",
"description": "Production Vault",
"vaultUrl": "${VAULT_URL}",
"vaultToken": "${VAULT_TOKEN}"
},
{
"id": "aws",
"type": "aws-kms",
"description": "AWS KMS",
"region": "${AWS_REGION}"
}
]
}
Schema of the request body
{
"type": "object",
"properties": {
"defaultProvider": {
"type": "string",
"description": "ID of the default KMS provider. Defaults to \"db\" if not set.",
"example": "main-vault"
},
"providers": {
"type": "array",
"description": "List of KMS provider configurations. Each provider must have a unique id and a type.",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/DbKmsConfigDto"
},
{
"$ref": "#/components/schemas/VaultKmsConfigDto"
},
{
"$ref": "#/components/schemas/AwsKmsConfigDto"
},
{
"$ref": "#/components/schemas/Pkcs11KmsConfigDto"
},
{
"$ref": "#/components/schemas/HttpKmsConfigDto"
},
{
"$ref": "#/components/schemas/CscKmsConfigDto"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"db": "#/components/schemas/DbKmsConfigDto",
"vault": "#/components/schemas/VaultKmsConfigDto",
"aws-kms": "#/components/schemas/AwsKmsConfigDto",
"pkcs11": "#/components/schemas/Pkcs11KmsConfigDto",
"http": "#/components/schemas/HttpKmsConfigDto",
"csc": "#/components/schemas/CscKmsConfigDto"
}
}
},
"example": [
{
"id": "db",
"type": "db",
"description": "Default database provider"
},
{
"id": "main-vault",
"type": "vault",
"description": "Production Vault",
"vaultUrl": "${VAULT_URL}",
"vaultToken": "${VAULT_TOKEN}"
},
{
"id": "aws",
"type": "aws-kms",
"description": "AWS KMS",
"region": "${AWS_REGION}"
}
]
}
},
"required": [
"providers"
]
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"tenantConfig": {
"nullable": true,
"description": "Tenant-specific KMS configuration from <CONFIG_FOLDER>/<tenantId>/kms.json. Null when no tenant file exists.",
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/KmsConfigDto"
}
]
},
"effectiveConfig": {
"description": "Effective configuration used at runtime for the tenant (global + tenant merge).",
"allOf": [
{
"$ref": "#/components/schemas/KmsConfigDto"
}
]
}
},
"required": [
"effectiveConfig"
]
}
DELETE /api/key-chain/providers/config¶
Delete tenant KMS provider configuration
Description
Removes
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Responses
GET /api/key-chain¶
List all key chains for the tenant
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
usageType |
query | string | No | Optional usage type filter |
Responses
[
{
"id": "string",
"usageType": "access",
"type": "standalone",
"description": "string",
"kmsProvider": "string",
"rootCertificate": null,
"activePublicKey": null,
"activeCertificate": null,
"previousPublicKey": null,
"previousCertificate": null,
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"rotationPolicy": null,
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
]
POST /api/key-chain¶
Create a new key chain
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"usageType": "attestation",
"type": "internalChain",
"description": "Production credential signing key",
"kmsProvider": "vault",
"rotationPolicy": null
}
Schema of the request body
{
"type": "object",
"properties": {
"usageType": {
"enum": [
"access",
"attestation",
"trustList",
"statusList",
"encrypt"
],
"type": "string",
"description": "Usage type determines the purpose of this key chain (access, attestation, etc.).",
"example": "attestation"
},
"type": {
"enum": [
"standalone",
"internalChain"
],
"type": "string",
"description": "Type of key chain to create.",
"example": "internalChain"
},
"description": {
"type": "string",
"description": "Human-readable description for the key chain.",
"example": "Production credential signing key"
},
"kmsProvider": {
"type": "string",
"description": "KMS provider to use (defaults to the configured default provider).",
"example": "vault"
},
"rotationPolicy": {
"description": "Rotation policy configuration. Only applicable for the signing key (root CA never rotates).",
"allOf": [
{
"$ref": "#/components/schemas/RotationPolicyCreateDto"
}
]
}
},
"required": [
"usageType",
"type"
]
}
Responses
GET /api/key-chain/{id}¶
Get a key chain by ID
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "string",
"usageType": "access",
"type": "standalone",
"description": "string",
"kmsProvider": "string",
"rootCertificate": null,
"activePublicKey": null,
"activeCertificate": null,
"previousPublicKey": null,
"previousCertificate": null,
"previousKeyExpiry": "2022-04-13T15:42:05.901Z",
"rotationPolicy": null,
"createdAt": "2022-04-13T15:42:05.901Z",
"updatedAt": "2022-04-13T15:42:05.901Z"
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for the key chain."
},
"usageType": {
"enum": [
"access",
"attestation",
"trustList",
"statusList",
"encrypt"
],
"type": "string",
"description": "Usage type of the key chain."
},
"type": {
"enum": [
"standalone",
"internalChain"
],
"type": "string",
"description": "Type of key chain (standalone or internalChain)."
},
"description": {
"type": "string",
"description": "Human-readable description."
},
"kmsProvider": {
"type": "string",
"description": "KMS provider used for this key chain."
},
"rootCertificate": {
"description": "Root CA certificate (only for internalChain type).",
"allOf": [
{
"$ref": "#/components/schemas/CertificateInfoDto"
}
]
},
"activePublicKey": {
"description": "Active signing key's public key info.",
"allOf": [
{
"$ref": "#/components/schemas/PublicKeyInfoDto"
}
]
},
"activeCertificate": {
"description": "Active signing key's certificate. Not present for encryption keys.",
"allOf": [
{
"$ref": "#/components/schemas/CertificateInfoDto"
}
]
},
"previousPublicKey": {
"description": "Previous signing key's public key info (if in grace period).",
"allOf": [
{
"$ref": "#/components/schemas/PublicKeyInfoDto"
}
]
},
"previousCertificate": {
"description": "Previous signing key's certificate (if in grace period).",
"allOf": [
{
"$ref": "#/components/schemas/CertificateInfoDto"
}
]
},
"previousKeyExpiry": {
"format": "date-time",
"type": "string",
"description": "Previous key expiry date."
},
"rotationPolicy": {
"description": "Rotation policy configuration.",
"allOf": [
{
"$ref": "#/components/schemas/RotationPolicyResponseDto"
}
]
},
"createdAt": {
"format": "date-time",
"type": "string",
"description": "Timestamp when the key chain was created."
},
"updatedAt": {
"format": "date-time",
"type": "string",
"description": "Timestamp when the key chain was last updated."
}
},
"required": [
"id",
"usageType",
"type",
"kmsProvider",
"activePublicKey",
"rotationPolicy",
"createdAt",
"updatedAt"
]
}
PUT /api/key-chain/{id}¶
Update key chain metadata and rotation policy
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the request body
{
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Human-readable description for the key chain."
},
"rotationPolicy": {
"description": "Rotation policy configuration.",
"allOf": [
{
"$ref": "#/components/schemas/RotationPolicyUpdateDto"
}
]
},
"activeCertificate": {
"type": "string",
"description": "Active certificate chain in PEM format. Used for external certificate updates."
}
}
}
Responses
DELETE /api/key-chain/{id}¶
Delete a key chain
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
GET /api/key-chain/{id}/export¶
Export a key chain in config-import format
Description
Returns the key chain including private key material in the same format used by config import JSON files.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
{
"id": "string",
"description": "string",
"usageType": "access",
"key": null,
"crt": [
"string"
],
"kmsProvider": "string",
"rotationPolicy": null
}
Schema of the response body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Key chain ID."
},
"description": {
"type": "string",
"description": "Human-readable description."
},
"usageType": {
"enum": [
"access",
"attestation",
"trustList",
"statusList",
"encrypt"
],
"type": "string",
"description": "Usage type for this key chain."
},
"key": {
"description": "The private key in JWK format (EC).",
"allOf": [
{
"$ref": "#/components/schemas/ExportEcJwk"
}
]
},
"crt": {
"description": "Certificate chain in PEM format (leaf first, then intermediates/CA).",
"type": "array",
"items": {
"type": "string"
}
},
"kmsProvider": {
"type": "string",
"description": "KMS provider name."
},
"rotationPolicy": {
"description": "Rotation policy.",
"allOf": [
{
"$ref": "#/components/schemas/ExportRotationPolicyDto"
}
]
}
},
"required": [
"id",
"usageType",
"key"
]
}
POST /api/key-chain/import¶
Import an existing key chain
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
{
"id": "string",
"key": null,
"description": "string",
"usageType": "access",
"crt": [
"string"
],
"kmsProvider": "string",
"rotationPolicy": null
}
Schema of the request body
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "ID for the key chain. If not provided, a new UUID will be generated."
},
"key": {
"description": "The private key in JWK format.",
"allOf": [
{
"$ref": "#/components/schemas/EcJwk"
}
]
},
"description": {
"type": "string",
"description": "Human-readable description."
},
"usageType": {
"enum": [
"access",
"attestation",
"trustList",
"statusList",
"encrypt"
],
"type": "string",
"description": "Usage type for this key chain."
},
"crt": {
"description": "Certificate chain (leaf first). Each entry may be PEM or base64-encoded DER; values are normalized to PEM during import. When rotationPolicy.enabled=true, the last certificate in the chain is treated as the root CA certificate.",
"type": "array",
"items": {
"type": "string"
}
},
"kmsProvider": {
"type": "string",
"description": "KMS provider to use. Defaults to 'db'."
},
"rotationPolicy": {
"description": "Rotation policy. When enabled, the imported key becomes a root CA signer and a new leaf key is generated. If crt is provided, the selected root CA certificate must have CA=true and its public key must match the imported private key.",
"allOf": [
{
"$ref": "#/components/schemas/RotationPolicyImportDto"
}
]
}
},
"required": [
"key",
"usageType"
]
}
Responses
POST /api/key-chain/{id}/rotate¶
Rotate the signing key in a key chain
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No | |
id |
path | string | No |
Responses
Storage¶
POST /api/storage¶
Upload files that belong to a tenant like images
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth2 |
header | string | N/A | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Responses
Schemas¶
AccessCertificateRefDto¶
| Name | Type | Description |
|---|---|---|
certificate |
string | |
createdAt |
string | |
id |
string | |
relyingPartyId |
string | |
revoked |
string |
AllowListPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
Array<string> |
ApiKeyConfig¶
| Name | Type | Description |
|---|---|---|
headerName |
string | The name of the header where the API key will be sent. |
value |
string | The value of the API key to be sent in the header. |
AttestationBasedPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
Array<PolicyCredential> |
AttributeProviderEntity¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
tenant |
TenantEntity | |
tenantId |
string | |
url |
string |
AuditLogResponseDto¶
| Name | Type | Description |
|---|---|---|
actionType |
string | |
actorDisplay |
string | |
actorId |
string | |
actorType |
string | |
after |
||
before |
||
changedFields |
Array<string> | |
id |
string | |
requestId |
string | |
tenantId |
string | |
timestamp |
string(date-time) |
AuthenticationMethodAuth¶
| Name | Type | Description |
|---|---|---|
config |
AuthenticationUrlConfig | |
method |
string |
AuthenticationMethodNone¶
| Name | Type | Description |
|---|---|---|
method |
string |
AuthenticationMethodPresentation¶
| Name | Type | Description |
|---|---|---|
config |
PresentationDuringIssuanceConfig | |
method |
string |
AuthenticationUrlConfig¶
| Name | Type | Description |
|---|---|---|
url |
string | The URL used in the OID4VCI authorized code flow. This URL is where users will be redirected for authentication. |
webhook |
Optional webhook configuration for authentication callbacks |
AuthorizationResponse¶
| Name | Type | Description |
|---|---|---|
error |
string | |
error_description |
string | Human-readable description of the error. |
error_uri |
string | URI with additional information about the error. |
response |
string | The response string containing the authorization details (JWE-encrypted VP token). Required for success responses, absent for error responses. |
sendResponse |
boolean | When set to true, the authorization response will be sent to the client. |
state |
string | State value from the authorization request (for correlation). |
AuthorizeQueries¶
| Name | Type | Description |
|---|---|---|
auth_session |
string | |
authorization_details |
RFC 9396 authorization details. When passed via application/x-www-form-urlencoded (PAR) the value is a JSON string; when passed inside a signed request object it can already be an array. | |
client_id |
string | |
code_challenge |
string | |
code_challenge_method |
string | |
dpop_jkt |
string | |
issuer_state |
string | |
redirect_uri |
string | |
request_uri |
string | |
resource |
string | |
response_type |
string | |
scope |
string | |
state |
string |
AwsKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
accessKeyId |
string | AWS access key ID. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders. |
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
region |
string | AWS region for KMS. Supports ${ENV_VAR} placeholders. |
secretAccessKey |
string | AWS secret access key. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
BuiltInAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
CertificateInfoDto¶
| Name | Type | Description |
|---|---|---|
issuer |
string | Certificate issuer (CN). |
notAfter |
string(date-time) | Certificate not after date. |
notBefore |
string(date-time) | Certificate not before date. |
pem |
string | Certificate in PEM format. |
serialNumber |
string | Serial number. |
subject |
string | Certificate subject (CN). |
ChainedAsErrorResponseDto¶
| Name | Type | Description |
|---|---|---|
error |
string | Error code |
error_description |
string | Human-readable error description |
ChainedAsParResponseDto¶
| Name | Type | Description |
|---|---|---|
expires_in |
number | The lifetime of the request URI in seconds |
request_uri |
string | The request URI to use at the authorization endpoint |
ChainedAsTokenConfig¶
| Name | Type | Description |
|---|---|---|
lifetimeSeconds |
number | Access token lifetime in seconds |
refreshTokenEnabled |
boolean | Whether refresh tokens should be issued |
refreshTokenExpiresInSeconds |
number | Refresh token lifetime in seconds |
signingKeyId |
string | Key ID for token signing |
ChainedAsTokenRequestDto¶
| Name | Type | Description |
|---|---|---|
client_id |
string | Client identifier |
code |
string | Authorization code received in the callback (authorization_code grant) |
code_verifier |
string | PKCE code verifier |
grant_type |
string | Grant type ('authorization_code' or 'refresh_token') |
redirect_uri |
string | Redirect URI (must match the one used in PAR) |
refresh_token |
string | Refresh token (refresh_token grant) |
ChainedAsTokenResponseDto¶
| Name | Type | Description |
|---|---|---|
access_token |
string | The access token |
authorization_details |
Array<> | Authorized credential configurations |
c_nonce |
string | C_NONCE for credential request |
c_nonce_expires_in |
number | C_NONCE lifetime in seconds |
expires_in |
number | Token lifetime in seconds |
refresh_token |
string | Refresh token (issued when refresh tokens are enabled) |
scope |
string | Scope granted |
token_type |
string | Token type (Bearer or DPoP) |
ChainedAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
upstream |
Upstream OIDC provider configuration for chained mode |
ClaimFieldDefinitionDto¶
| Name | Type | Description |
|---|---|---|
children |
Array<ClaimFieldDefinitionDto> | Optional nested child fields. Child paths may be specified relative to the parent field path. |
constraints |
Additional JSON schema constraints for this field | |
defaultValue |
Default value | |
disclosable |
boolean | Whether claim is disclosable in SD-JWT |
display |
Array<FieldDisplayDto> | |
mandatory |
boolean | Whether claim is mandatory |
namespace |
string | Namespace for mDOC field. Optional when the namespace is already present as the first path segment. |
path |
Array<> | Path to claim value. For nested child fields this can be relative to the parent path. |
type |
string | Claim value type |
ClaimsQuery¶
| Name | Type | Description |
|---|---|---|
id |
string | |
path |
Array<string> | |
values |
Array<string> |
ClientCredentialsDto¶
| Name | Type | Description |
|---|---|---|
client_id |
string | |
client_secret |
string | |
grant_type |
string |
ClientEntity¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
clientId |
string | The unique identifier for the client. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
secret |
string | The secret key for the client. |
tenant |
The tenant that the client belongs to. | |
tenantId |
string | The unique identifier for the tenant that the client belongs to. Only null for accounts that manage tenants, that do not belong to a client |
ClientSecretResponseDto¶
| Name | Type | Description |
|---|---|---|
secret |
string |
CompleteDeferredDto¶
| Name | Type | Description |
|---|---|---|
claims |
Example: {'given_name': 'John', 'family_name': 'Doe', 'birthdate': '1990-01-15'} |
Claims to include in the credential. The structure should match the credential configuration's expected claims. |
CreateAccessCertificateDto¶
| Name | Type | Description |
|---|---|---|
keyId |
string | The ID of the key to create an access certificate for |
CreateAttributeProviderDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
url |
string |
CreateClientDto¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
clientId |
string | The unique identifier for the client. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
secret |
string | The secret key for the client. |
CreateRegistrarConfigDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
password |
string | The password for OIDC login (stored in plaintext) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
CreateStatusListDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status value. More bits allow more status states. Defaults to tenant configuration. |
capacity |
number | Maximum number of credential status entries. Defaults to tenant configuration. |
credentialConfigurationId |
string | Credential configuration ID to bind this list exclusively to. Leave empty for a shared list. |
keyChainId |
string | Key chain ID to use for signing. Leave empty to use the tenant's default StatusList key chain. |
CreateTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
id |
string | The unique identifier for the tenant. |
name |
string | The name of the tenant. |
roles |
Array<string> | |
sessionConfig |
Session storage configuration. Controls TTL and cleanup behavior. | |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
CreateUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
username |
string |
CreateWebhookEndpointDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
url |
string |
CredentialConfig¶
| Name | Type | Description |
|---|---|---|
attributeProvider |
AttributeProviderEntity | |
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChain |
KeyChainEntity | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
tenant |
The tenant that owns this object. | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpoint |
WebhookEndpointEntity | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialConfigCreate¶
| Name | Type | Description |
|---|---|---|
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialConfigUpdate¶
| Name | Type | Description |
|---|---|---|
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialQueryDcSdJwt¶
| Name | Type | Description |
|---|---|---|
claim_sets |
Array<Array<string>> | Ordered alternative claim combinations for this credential query. |
claims |
Array<ClaimsQuery> | |
format |
string | Credential format discriminator. |
id |
string | |
meta |
dc+sd-jwt schema metadata for the requested credential. | |
multiple |
boolean | |
trusted_authorities |
Array<> | Trusted authority constraints (discriminated by type) for this credential query. |
CredentialQueryMsoMdoc¶
| Name | Type | Description |
|---|---|---|
claim_sets |
Array<Array<string>> | Ordered alternative claim combinations for this credential query. |
claims |
Array<MsoMdocClaimsQuery> | |
format |
string | Credential format discriminator. |
id |
string | |
meta |
mso_mdoc document type metadata for the requested credential. | |
multiple |
boolean | |
trusted_authorities |
Array<> | Trusted authority constraints (discriminated by type) for this credential query. |
CredentialSetQuery¶
| Name | Type | Description |
|---|---|---|
options |
Array<Array<string>> | |
required |
boolean |
CscAuthorizeAuthDataDto¶
| Name | Type | Description |
|---|---|---|
id |
string | Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP). |
value |
string | Authentication factor value sent to CSC credentials/authorize. |
CscKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
apiPath |
string | CSC API path prefix appended to baseUrl. Defaults to /csc/v2. |
authorizeAuthData |
Array<CscAuthorizeAuthDataDto> | Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors). |
baseUrl |
string | Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders. |
clientId |
string | OAuth2 client ID. Supports ${ENV_VAR} placeholders. |
clientSecret |
string | OAuth2 client secret. Supports ${ENV_VAR} placeholders. |
credentialId |
string | Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry. |
description |
string | Human-readable description of this provider instance. |
hashAlgorithmOid |
string | Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
sad |
string | Static SAD token. If set, the adapter sends it directly in signatures/signHash requests. |
scope |
string | OAuth2 scope to request during token acquisition. |
signAlgorithmOid |
string | Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID. |
tokenUrl |
string(uri) | OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
useAuthorizeEndpoint |
boolean | When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash. |
userId |
string | Optional CSC user ID used in credentials/list requests. |
DbKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
type |
string | Type of the KMS provider. |
DCQL¶
| Name | Type | Description |
|---|---|---|
credential_sets |
Array<CredentialSetQuery> | |
credentials |
Array<> | Format-discriminated credential queries. |
DcSdJwtCredentialQueryMeta¶
| Name | Type | Description |
|---|---|---|
vct_values |
Array<string> | VCT identifiers accepted for dc+sd-jwt credentials. |
DeferredCredentialRequestDto¶
| Name | Type | Description |
|---|---|---|
transaction_id |
string | The transaction identifier previously returned by the Credential Endpoint |
DeferredOperationResponse¶
| Name | Type | Description |
|---|---|---|
message |
string | Optional message |
status |
string | The new status of the transaction |
transactionId |
string | The transaction ID |
DeprecateSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
deprecated |
boolean | Whether to mark this version as deprecated |
message |
string | Deprecation message shown to consumers |
supersededByVersion |
string | The version that supersedes this one |
Display¶
| Name | Type | Description |
|---|---|---|
background_color |
string | |
background_image |
DisplayImage | |
description |
string | |
locale |
string | |
logo |
DisplayImage | |
name |
string | |
text_color |
string |
DisplayImage¶
| Name | Type | Description |
|---|---|---|
uri |
string |
DisplayInfo¶
| Name | Type | Description |
|---|---|---|
locale |
string | |
logo |
DisplayLogo | |
name |
string |
DisplayLogo¶
| Name | Type | Description |
|---|---|---|
alt_text |
string | |
uri |
string |
EC_Public¶
| Name | Type | Description |
|---|---|---|
crv |
string | The algorithm intended for use with the key, such as 'ES256'. |
kty |
string | The key type, which is always 'EC' for Elliptic Curve keys. |
x |
string | The x coordinate of the EC public key. |
y |
string | The y coordinate of the EC public key. |
EcJwk¶
| Name | Type | Description |
|---|---|---|
alg |
string | |
crv |
string | |
d |
string | |
kid |
string | |
kty |
string | |
x |
string | |
y |
string |
EmbeddedDisclosurePolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string |
ExportEcJwk¶
| Name | Type | Description |
|---|---|---|
alg |
string | Algorithm |
crv |
string | Curve |
d |
string | Private key (base64url) |
kid |
string | Key ID |
kty |
string | Key type |
x |
string | X coordinate (base64url) |
y |
string | Y coordinate (base64url) |
ExportRotationPolicyDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
ExternalAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
issuer |
string(uri) | Issuer URL for external authorization servers |
label |
string | Human-friendly label for the UI |
type |
string | Authorization server implementation type |
ExternalTrustListEntity¶
| Name | Type | Description |
|---|---|---|
info |
TrustListEntityInfo | |
issuerCertPem |
string | |
revocationCertPem |
string | |
type |
string |
FailDeferredDto¶
| Name | Type | Description |
|---|---|---|
error |
string | Optional error message explaining why the issuance failed |
FederationConfig¶
| Name | Type | Description |
|---|---|---|
cacheTtlSeconds |
number | Cache TTL in seconds for federation entity statements and trust chain results. |
enforceSigningPolicy |
boolean | Whether federation checks are enforced for upstream metadata and signer trust decisions. |
entityId |
string | Entity identifier of this issuer/verifier in the federation. |
mode |
string | Trust decision strategy when both LoTE trust lists and OpenID Federation are configured. |
role |
string | Role this tenant plays in the OpenID Federation topology. |
trustAnchors |
Array<FederationTrustAnchorConfig> | Configured federation trust anchors. |
FederationTrustAnchorConfig¶
| Name | Type | Description |
|---|---|---|
entityConfigurationUri |
string | Federation endpoint URL for the trust anchor entity configuration. |
entityId |
string | Entity identifier (sub) of the federation trust anchor. |
FieldDisplayDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Optional display description |
locale |
string | Locale code based on BCP47 (RFC 5646) |
name |
string | Display name |
FileUploadDto¶
| Name | Type | Description |
|---|---|---|
file |
string(binary) |
FrontendConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
grafana |
Grafana observability configuration |
GrafanaConfigDto¶
| Name | Type | Description |
|---|---|---|
lokiUid |
string | UID of the Loki data source in Grafana |
tempoUid |
string | UID of the Tempo data source in Grafana |
url |
string | Base URL of the Grafana instance |
HttpAuthBaseConfigDto¶
| Name | Type | Description |
|---|---|---|
type |
string | Authentication method for the remote KMS service. |
HttpKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
auth |
Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services. | |
baseUrl |
string | Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders. |
canImport |
boolean | Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false. |
description |
string | Human-readable description of this provider instance. |
healthPath |
string | Path for the health check endpoint on the remote service. Defaults to /health. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
keysPath |
string | Path prefix for key endpoints on the remote service. Defaults to /keys. |
type |
string | Type of the KMS provider. |
IaeActionOpenid4vpPresentation¶
| Name | Type | Description |
|---|---|---|
label |
string | Optional label for this step (for display purposes) |
presentationConfigId |
string | ID of the presentation configuration to use for this step |
type |
string | Action type discriminator |
IaeActionRedirectToWeb¶
| Name | Type | Description |
|---|---|---|
callbackUrl |
string(uri) | URL where the external service should redirect back after completion. If not provided, the service must call back to the IAE endpoint. |
description |
string | Description of what the user should do on the web page (for wallet display) |
label |
string | Optional label for this step (for display purposes) |
type |
string | Action type discriminator |
url |
string(uri) | URL to redirect the user to for web-based interaction |
ImportTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
name |
string | The name of the tenant. |
InteractiveAuthorizationCodeResponseDto¶
| Name | Type | Description |
|---|---|---|
code |
string | Authorization code |
status |
string | Response status |
InteractiveAuthorizationErrorResponseDto¶
| Name | Type | Description |
|---|---|---|
error |
string | OAuth error code |
error_description |
string | Human-readable error description |
InteractiveAuthorizationRequestDto¶
| Name | Type | Description |
|---|---|---|
auth_session |
string | Auth session identifier (for follow-up request) |
authorization_details |
Authorization details | |
client_id |
string | Client identifier (for initial request) |
code_challenge |
string | PKCE code challenge |
code_challenge_method |
string | PKCE code challenge method |
code_verifier |
string | PKCE code verifier (for follow-up request) |
interaction_types_supported |
string | Comma-separated list of supported interaction types (for initial request) |
issuer_state |
string | Issuer state from credential offer |
openid4vp_response |
string | OpenID4VP response (for follow-up request) |
redirect_uri |
string | Redirect URI (for initial request) |
request |
string | JAR request JWT (by value) |
request_uri |
string | JAR request URI (by reference) |
response_type |
string | Response type (for initial request) |
scope |
string | OAuth scope |
state |
string | State parameter |
InternalTrustListEntity¶
| Name | Type | Description |
|---|---|---|
info |
TrustListEntityInfo | |
issuerKeyChainId |
string | |
revocationKeyChainId |
string | |
type |
string |
IssuanceConfig¶
| Name | Type | Description |
|---|---|---|
authorizationServers |
Array<> | Dedicated managed authorization servers hosted by this issuer. At least one entry is required. |
batchSize |
number | Value to determine the amount of credentials that are issued in a batch. Default is 1. |
createdAt |
string(date-time) | The timestamp when the VP request was created. |
credentialRequestEncryption |
boolean | Whether `credential_request_encryption` should be advertised in the credential issuer metadata. |
credentialResponseEncryption |
boolean | Whether `credential_response_encryption` should be advertised in the credential issuer metadata. |
display |
Array<DisplayInfo> | |
dPopRequired |
boolean | Indicates whether DPoP is required for the issuance process. Default value is true. |
federation |
Optional OpenID Federation configuration used for trust evaluation. When omitted, trust checks rely on existing LoTE trust-list behavior. | |
registrationCertificate |
Optional registration certificate configuration for issuer metadata (`issuer_info`). Supports importing an existing JWT or generating one via registrar. | |
registrationCertificateCache |
Server-managed cache for generated issuer registration certificates. | |
signingKeyId |
string | Key ID for signing access tokens. If unset, the default signing key is used. |
tenant |
The tenant that owns this object. | |
txCodeMaxAttempts |
number | null | Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5. |
updatedAt |
string(date-time) | The timestamp when the VP request was last updated. |
walletAttestationRequired |
boolean | Indicates whether wallet attestation is required for the token endpoint. When enabled, wallets must provide OAuth-Client-Attestation headers. Default value is false. |
walletProviderTrustLists |
Array<WalletProviderTrustListRefDto> | Trust lists containing trusted wallet providers. Each entry MUST include either `verifierKey` or `verifierX509Der`. |
IssuerMetadataCredentialConfig¶
| Name | Type | Description |
|---|---|---|
display |
Array<Display> | |
docType |
string | Document type for mDOC credentials (e.g., "org.iso.18013.5.1.mDL"). Only applicable when format is "mso_mdoc". |
format |
string | |
keyAttestationsRequired |
Key attestation requirements for JWT proofs for this credential. When set, this is published in proof_types_supported.jwt.key_attestations_required for this specific credential configuration. | |
proofTypesSupported |
Array<string> | Supported proof types for this credential configuration. Defaults to ['attestation', 'jwt']. |
scope |
string |
IssuerOfferEntryDto¶
| Name | Type | Description |
|---|---|---|
credentialOfferUrl |
string | URL where the user can receive a credential offer from this issuer. |
description |
string | Human-readable description explaining when this issuer offer is relevant for the user. |
IssuerRegistrationCertificateCache¶
| Name | Type | Description |
|---|---|---|
expiresAt |
number | JWT exp claim, seconds since epoch. |
fingerprint |
string | Config fingerprint used to detect cache invalidation. |
issuedAt |
number | JWT iat claim, seconds since epoch. |
jwt |
string | Cached registration certificate JWT generated by EUDIPLO. |
IssuerRegistrationCertificateConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Enable inclusion of a registration certificate in credential issuer metadata. |
jwt |
string | Existing registration certificate JWT used when mode is import. |
mode |
string | import: use an existing JWT, generate: create via registrar using attestation data derived from configured credential configurations. |
privacyPolicy |
string | Privacy policy URL used when generating a registration certificate (optional if registrar defaults are configured). |
supportUri |
string | Support URI used when generating a registration certificate (optional if registrar defaults are configured). |
JwksResponseDto¶
| Name | Type | Description |
|---|---|---|
keys |
Array<EC_Public> | An array of EC public keys in JWK format. |
KeyAttestationsRequired¶
| Name | Type | Description |
|---|---|---|
key_storage |
Array<string> | List of required key storage types (e.g., iso_18045_high, iso_18045_moderate) |
user_authentication |
Array<string> | List of required user authentication types (e.g., iso_18045_high, iso_18045_moderate) |
KeyChainCreateDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description for the key chain. |
kmsProvider |
string | KMS provider to use (defaults to the configured default provider). |
rotationPolicy |
Rotation policy configuration. Only applicable for the signing key (root CA never rotates). | |
type |
string | Type of key chain to create. |
usageType |
string | Usage type determines the purpose of this key chain (access, attestation, etc.). |
KeyChainEntity¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
string | Certificate for the active signing key in PEM format. Either CA-signed (if rootKey exists) or self-signed. |
activeJwk |
||
certValidityDays |
number | Certificate validity in days when generating new certificates. |
createdAt |
string(date-time) | |
description |
string | Human-readable description of the key chain. |
externalKeyId |
string | External key identifier for cloud KMS providers. This field stores the provider-specific key reference for the active signing key. |
id |
string | Unique identifier for the key chain. This is the ID referenced by other entities (e.g., issuance config's signingKeyId). |
kmsProvider |
string | The KMS provider used for this key chain. References a configured KMS provider name. |
lastRotatedAt |
string(date-time) | Timestamp of when the key was last rotated. |
previousCertificate |
string | Certificate for the previous signing key in PEM format. |
previousJwk |
||
previousKeyExpiry |
string(date-time) | Expiry date for the previous key. After this date, the previous key should be deleted. |
rootCertificate |
string | Root CA certificate in PEM format. Self-signed certificate for the root CA key. |
rootExternalKeyId |
string | External key identifier for cloud KMS providers for the root CA key. Used when rotating internal-chain key chains backed by external KMS. |
rootJwk |
||
rotationEnabled |
boolean | |
rotationIntervalDays |
number | Rotation interval in days. Key material will be rotated after this many days. |
tenant |
The tenant that owns this key chain. | |
tenantId |
string | Tenant ID for the key chain. |
updatedAt |
string(date-time) | The timestamp when the key chain was last updated. |
usage |
string | The usage type of the keys (sign or encrypt). |
usageType |
string | The purpose/role of this key chain in the system. |
KeyChainExportDto¶
| Name | Type | Description |
|---|---|---|
crt |
Array<string> | Certificate chain in PEM format (leaf first, then intermediates/CA). |
description |
string | Human-readable description. |
id |
string | Key chain ID. |
key |
The private key in JWK format (EC). | |
kmsProvider |
string | KMS provider name. |
rotationPolicy |
Rotation policy. | |
usageType |
string | Usage type for this key chain. |
KeyChainImportDto¶
| Name | Type | Description |
|---|---|---|
crt |
Array<string> | Certificate chain (leaf first). Each entry may be PEM or base64-encoded DER; values are normalized to PEM during import. When rotationPolicy.enabled=true, the last certificate in the chain is treated as the root CA certificate. |
description |
string | Human-readable description. |
id |
string | ID for the key chain. If not provided, a new UUID will be generated. |
key |
The private key in JWK format. | |
kmsProvider |
string | KMS provider to use. Defaults to 'db'. |
rotationPolicy |
Rotation policy. When enabled, the imported key becomes a root CA signer and a new leaf key is generated. If crt is provided, the selected root CA certificate must have CA=true and its public key must match the imported private key. | |
usageType |
string | Usage type for this key chain. |
KeyChainResponseDto¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
Active signing key's certificate. Not present for encryption keys. | |
activePublicKey |
Active signing key's public key info. | |
createdAt |
string(date-time) | Timestamp when the key chain was created. |
description |
string | Human-readable description. |
id |
string | Unique identifier for the key chain. |
kmsProvider |
string | KMS provider used for this key chain. |
previousCertificate |
Previous signing key's certificate (if in grace period). | |
previousKeyExpiry |
string(date-time) | Previous key expiry date. |
previousPublicKey |
Previous signing key's public key info (if in grace period). | |
rootCertificate |
Root CA certificate (only for internalChain type). | |
rotationPolicy |
Rotation policy configuration. | |
type |
string | Type of key chain (standalone or internalChain). |
updatedAt |
string(date-time) | Timestamp when the key chain was last updated. |
usageType |
string | Usage type of the key chain. |
KeyChainUpdateDto¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
string | Active certificate chain in PEM format. Used for external certificate updates. |
description |
string | Human-readable description for the key chain. |
rotationPolicy |
Rotation policy configuration. |
KmsConfigDto¶
| Name | Type | Description |
|---|---|---|
defaultProvider |
string | ID of the default KMS provider. Defaults to "db" if not set. |
providers |
Array<> | List of KMS provider configurations. Each provider must have a unique id and a type. |
KmsProviderCapabilitiesDto¶
| Name | Type | Description |
|---|---|---|
canCreate |
boolean | Whether the provider supports generating new keys. |
canDelete |
boolean | Whether the provider supports deleting keys. |
canImport |
boolean | Whether the provider supports importing existing keys. |
defaultAlg |
string | Default signing algorithm used when caller does not specify one. |
supportedAlgs |
Array<string> | Signing algorithms supported by the provider. |
KmsProviderInfoDto¶
| Name | Type | Description |
|---|---|---|
capabilities |
Capabilities of this provider. | |
description |
string | Human-readable description of this provider instance. |
name |
string | Unique provider ID (matches the id in kms.json). |
type |
string | Type of the KMS provider (db, vault, aws-kms). |
KmsProvidersResponseDto¶
| Name | Type | Description |
|---|---|---|
default |
string | The default KMS provider name. |
providers |
Array<KmsProviderInfoDto> | Detailed info for each registered KMS provider. |
KmsTenantConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
effectiveConfig |
Effective configuration used at runtime for the tenant (global + tenant merge). | |
tenantConfig |
Tenant-specific KMS configuration from |
ManagedAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
type |
string | Authorization server implementation type |
ManagedUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
id |
string | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
tenantId |
string | |
username |
string |
MetadataSchemaDto¶
| Name | Type | Description |
|---|---|---|
formatIdentifier |
string | The credential format identifier |
id |
string | Unique identifier for this schema entry |
integrity |
string | Subresource Integrity hash for the schema |
meta |
Format-specific metadata for the schema entry | |
uri |
string | URI to the schema definition |
MsoMdocClaimsQuery¶
| Name | Type | Description |
|---|---|---|
id |
string | |
intent_to_retain |
boolean | Whether the holder should be allowed to retain the claim in an mso_mdoc response. |
path |
Array<string> | |
values |
Array<string> |
MsoMdocCredentialQueryMeta¶
| Name | Type | Description |
|---|---|---|
doctype_value |
string | Document type identifier accepted for mso_mdoc credentials. |
NoneTrustPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string |
NotificationRequestDto¶
| Name | Type | Description |
|---|---|---|
event |
string | |
notification_id |
string |
Object¶
OfferRequestDto¶
| Name | Type | Description |
|---|---|---|
authorization_server |
string | Authorization server id from issuer configuration. If omitted, the first enabled server is used. |
credentialClaims |
Example: {'citizen': {'type': 'inline', 'claims': {'given_name': 'John', 'family_name': 'Doe'}}} |
Credential claims configuration per credential. Keys must match credentialConfigurationIds. |
credentialConfigurationIds |
Array<string> | List of credential configuration ids to be included in the offer. |
flow |
string | The flow type for the offer request. |
response_type |
string | The type of response expected for the offer request. |
tx_code |
string | Transaction code for pre-authorized code flow. |
tx_code_description |
string | Description for the transaction code (e.g., "Please enter the PIN sent to your email"). |
webhookEndpointId |
string | ID of the webhook endpoint to notify about the status of the issuance process. |
OfferResponse¶
| Name | Type | Description |
|---|---|---|
crossDeviceUri |
string | URI for cross-device flows (no redirect after completion) |
session |
string | |
uri |
string |
Oid4VpAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Stable identifier used in the AS URL path |
immediateWalletRedirect |
boolean | Immediately redirect the browser into the wallet OID4VP request |
label |
string | Human-friendly label for the UI |
presentationConfigId |
string | Presentation configuration ID to use for OID4VP |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
PaginatedSessionResponseDto¶
| Name | Type | Description |
|---|---|---|
items |
Array<Session> | The sessions for the current page. |
page |
number | Current page number (1-based) |
pageSize |
number | Number of items per page |
total |
number | Total number of sessions matching the query |
totalPages |
number | Total number of pages |
ParResponseDto¶
| Name | Type | Description |
|---|---|---|
expires_in |
number | The expiration time for the request URI in seconds. |
request_uri |
string | The request URI for the Pushed Authorization Request. |
Pkcs11KmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
library |
string | Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders. |
pin |
string | User PIN used for C_Login. Supports ${ENV_VAR} placeholders. |
readOnly |
boolean | Open the PKCS#11 session in read-only mode. Defaults to false. |
slot |
Example: ${PKCS11_SLOT} |
Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
PolicyCredential¶
| Name | Type | Description |
|---|---|---|
claims |
Array<ClaimsQuery> | |
credential_sets |
Array<CredentialSetQuery> | |
credentials |
Array<> |
PresentationAttachment¶
| Name | Type | Description |
|---|---|---|
credential_ids |
Array<string> | |
data |
||
format |
string |
PresentationConfig¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
createdAt |
string(date-time) | The timestamp when the VP request was created. |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
registrationCertCache |
Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
tenant |
The tenant that owns this object. | |
transaction_data |
Array<TransactionData> | |
updatedAt |
string(date-time) | The timestamp when the VP request was last updated. |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationConfigCreateDto¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
transaction_data |
Array<TransactionData> | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationConfigUpdateDto¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
transaction_data |
Array<TransactionData> | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationDuringIssuanceConfig¶
| Name | Type | Description |
|---|---|---|
type |
string | Link to the presentation configuration that is relevant for the issuance process |
PresentationRequest¶
| Name | Type | Description |
|---|---|---|
expected_origin |
string | Optional expected browser origin for DC API key-binding audience. Example: "http://localhost:8080" |
redirectUri |
string | Optional redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
requestId |
string | Identifier of the presentation configuration |
response_type |
string | The type of response expected from the presentation request. |
skewSeconds |
number | Optional clock skew tolerance for this presentation offer, in seconds. If provided, this overrides the presentation configuration for the created session. |
transaction_data |
Array<TransactionData> | Optional transaction data to include in the OID4VP request. If provided, this will override the transaction_data from the presentation configuration. |
webhook |
Webhook configuration to receive the response. If not provided, the configured webhook from the configuration will be used. |
PublicKeyInfoDto¶
| Name | Type | Description |
|---|---|---|
alg |
string | Key algorithm (e.g., ES256). |
crv |
string | Curve (for EC keys). |
kid |
string | Key ID. |
kty |
string | Key type (e.g., EC). |
RegistrarConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
hasPassword |
boolean | Indicates whether a password is configured (actual password is never returned) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
RegistrationCertificateBody¶
| Name | Type | Description |
|---|---|---|
credentials |
Array<> | |
intermediary |
string | |
privacy_policy |
string | |
provided_attestations |
Array<> | |
purpose |
Array<RegistrationCertificatePurpose> | |
support_uri |
string |
RegistrationCertificateDefaults¶
| Name | Type | Description |
|---|---|---|
privacy_policy |
string | Default privacy policy URL for registration certificate creation. |
support_uri |
string | Default support contact URI for registration certificate creation. |
RegistrationCertificatePurpose¶
| Name | Type | Description |
|---|---|---|
content |
string | |
lang |
string |
RegistrationCertificateRequest¶
| Name | Type | Description |
|---|---|---|
body |
Registration certificate creation payload. This is merged with tenant-level registrar defaults when a certificate is created. | |
id |
string | Optional registrar-side certificate identifier. If provided and still valid, EUDIPLO reuses it instead of creating a new certificate. |
jwt |
string | Optional pre-existing registration certificate JWT. If provided, EUDIPLO forwards it as-is and does not create a new one. |
ResolveIssuerMetadataDto¶
| Name | Type | Description |
|---|---|---|
issuerUrl |
string(uri) | Issuer URL or full OpenID4VCI metadata URL to resolve server-side. |
ResolveSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
schemaMetadataUrl |
string(uri) | Schema metadata URL to resolve server-side. The response must contain a signedJwt field. |
ResolveSchemaMetadataJwtDto¶
| Name | Type | Description |
|---|---|---|
signedJwt |
string | Signed schema metadata JWT to resolve server-side. The JWT will be verified, resolved, and converted to DCQL. |
RoleDto¶
| Name | Type | Description |
|---|---|---|
role |
string | OAuth2 roles |
RootOfTrustPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
string |
RotationPolicyCreateDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. Defaults to rotation interval + 30 days grace period. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. Required when enabled is true. |
RotationPolicyImportDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether rotation is enabled. When true, the imported key becomes a root CA signer. |
intervalDays |
number | Rotation interval in days. |
RotationPolicyResponseDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
nextRotationAt |
string(date-time) | Next scheduled rotation date. |
RotationPolicyUpdateDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
SchemaMetaConfig¶
| Name | Type | Description |
|---|---|---|
attestationLoS |
string | Attestation Level of Security |
bindingType |
string | Cryptographic binding type |
id |
string | Optional override for the schema ID (attestation identifier URI). When not set, derived from vct (dc+sd-jwt) or docType (mso_mdoc). |
name |
string | Human-readable name of the schema metadata entry. Required when publishing new schema metadata; optional when linking an existing schema metadata id to a credential config. |
rulebookURI |
string | URI of the Attestation Rulebook. Required when publishing new schema metadata; optional when linking an existing schema metadata id to a credential config. |
schemaURIs |
Array<SchemaUriEntry> | Schema URIs per attestation format. When omitted, the format is derived from the credential config format field. |
trustedAuthorities |
Array<TrustAuthorityEntry> | Trust authorities for this attestation schema |
version |
string | Schema version in SemVer format |
SchemaMetadataResponseDto¶
| Name | Type | Description |
|---|---|---|
attestationLoS |
string | Level of security (LoS) of this attestation |
bindingType |
string | Required binding type between attestation and holder |
category |
string | Domain category for filtering |
createdAt |
string | Server creation timestamp |
deprecated |
boolean | Whether this version is deprecated |
deprecatedAt |
string | Timestamp when this version was marked as deprecated |
deprecationMessage |
string | Deprecation message shown to consumers |
displayName |
string | Optional human-readable schema name for UI display and filtering. |
id |
string | The unique, server-assigned identifier (UUID) for the schema metadata |
issuedAt |
string | Timestamp when the JWT was issued (from the `iat` claim) |
issuer |
string | Issuer from the JWT (`iss` claim) |
issuerOffers |
Array<IssuerOfferEntryDto> | Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description. |
rulebookIntegrity |
string | Subresource Integrity hash for the rulebook URI |
rulebookURI |
string | URI of the human-readable Rulebook document |
schemaURIs |
Array<MetadataSchemaDto> | Format-specific schema URIs for this schema metadata |
signedJwt |
string | The original signed JWT |
signerCertificate |
The access certificate used to sign this schema metadata | |
supersededByVersion |
string | The version that supersedes this one |
supportedFormats |
Array<string> | Credential formats in which this attestation is available |
tags |
Array<string> | Free-form tags for filtering and search |
trustedAuthorities |
Array<TrustAuthorityDto> | Trust frameworks / trust anchors applicable to this schema metadata |
updatedAt |
string | Last update timestamp |
version |
string | Version of this schema metadata (SemVer) |
SchemaMetadataVocabulariesDto¶
| Name | Type | Description |
|---|---|---|
categories |
Array<VocabularyEntryDto> | Allowed category values that can be used when updating schema metadata category. |
tags |
Array<VocabularyEntryDto> | Allowed tag values that can be used when updating schema metadata tags. |
version |
string | Vocabulary publication version for cache invalidation. |
SchemaUriEntry¶
| Name | Type | Description |
|---|---|---|
credentialConfigId |
string | Credential config ID to resolve and upload its schema content. When set, uri can be omitted and is resolved server-side. |
format |
string | Attestation format this schema URI applies to (e.g. dc+sd-jwt, mso_mdoc) |
meta |
Schema-format specific metadata (for example { vct: 'urn:example:vct' } for dc+sd-jwt). | |
uri |
string | URI pointing to the schema document for this format |
Session¶
| Name | Type | Description |
|---|---|---|
auth_queries |
Authorization queries associated with the session. Encrypted at rest. | |
authorization_code |
string | |
browserOrigin |
string | Browser page origin recorded at offer time for BrowserHandover session transcript. Used exclusively by the ISO 18013-7 Annex C flow. |
clientId |
string | Client ID used in the OID4VP authorization request. |
consumed |
boolean | Flag indicating whether the session offer has been consumed. Prevents replay attacks by ensuring each offer can only be used once. For OID4VCI: set after successful token exchange. For OID4VP: set after successful response validation. |
consumedAt |
string(date-time) | Timestamp of the first consumption event for the session offer. For OID4VCI this can be URI resolution or later flow completion. Null if no consumption event has happened yet. |
createdAt |
string(date-time) | The timestamp when the request was created. |
credentialPayload |
Credential payload containing the offer request details. Encrypted at rest - may contain sensitive claim data. | |
credentials |
Array<> | Verified credentials from the presentation process. Encrypted at rest - contains personal information. |
dcApiProtocol |
string | DC API sub-protocol: "oid4vp" (OpenID4VP via DC API) or "iso-18013-7" (org.iso.mdoc). Null/undefined means the standard OID4VP flow (useDcApi=false). |
errorReason |
string | Error reason if the session failed. Stores the error message when status is 'failed'. |
expiresAt |
string(date-time) | The timestamp when the request is set to expire. |
externalIssuer |
string | |
externalSubject |
string | The subject (sub) from the external authorization server token. Used to identify the user at the external AS. |
id |
string | Unique identifier for the session. |
notifications |
Array<> | Notifications associated with the session. |
offer |
Credential offer object containing details about the credential offer or presentation request. Encrypted at rest. | |
offerUrl |
string | Offer URL for the credential offer. |
parsedWebhook |
Where to send the claims webhook response. | |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. |
refresh_token |
string | Refresh token for the session - used to obtain a new access token. |
refresh_token_expires_at |
string(date-time) | Expiration timestamp for the refresh token. Used to validate refresh_token grant requests. |
request_uri |
string | Request URI from the authorization request. |
requestId |
string | |
requestObject |
string | Signed presentation auth request. |
requestUrl |
string | The URL of the presentation auth request. |
responseCode |
string | Cryptographic random code generated after successful VP Token processing. Per OID4VP spec Section 13.3, included in redirect_uri so only the legitimate frontend (which receives the redirect) can confirm the session completed. |
responseEncryptionPrivateJwk |
Per-authorization-request private encryption key used to decrypt wallet responses. Encrypted at rest. | |
responseUri |
string | Response URI used in the OID4VP authorization request. |
skewSeconds |
number | Per-session clock skew tolerance for presentation credential JWT time validation. |
status |
string | Status of the session. |
tenant |
The tenant that owns this object. | |
tenantId |
string | Tenant ID for multi-tenancy support. |
transaction_data |
Array<TransactionData> | Transaction data to include in the OID4VP authorization request. Can be overridden per-request from the presentation configuration. |
txCodeFailedAttempts |
number | Number of failed tx_code (transaction code) validation attempts. Used to enforce brute-force protection in the pre-authorized code flow. Reset implicitly when the session is consumed successfully. |
updatedAt |
string(date-time) | The timestamp when the request was last updated. |
useDcApi |
boolean | Flag indicating whether to use the DC API for the presentation request. |
vp_nonce |
string | Nonce from the Verifiable Presentation request. |
walletNonce |
string | Cryptographic random nonce used in wallet-facing URLs (response_uri, request_uri, state). Per OID4VP spec Section 13.3, this separates the wallet-facing identifier (request-id) from the frontend-facing session ID (transaction-id) to prevent session fixation. |
webhookEndpointId |
string | ID of the webhook endpoint to notify about issuance status. |
SessionLogEntryResponseDto¶
| Name | Type | Description |
|---|---|---|
detail |
Additional structured detail | |
id |
string | Log entry ID |
level |
string | Log level |
message |
string | Log message |
sessionId |
string | Session ID |
stage |
string | Flow stage |
timestamp |
string(date-time) | Timestamp of the log entry |
SessionStorageConfig¶
| Name | Type | Description |
|---|---|---|
cleanupMode |
string | Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII. |
ttlSeconds |
number | Time-to-live for sessions in seconds. If not set, uses global SESSION_TTL. |
SignSchemaMetaConfigDto¶
| Name | Type | Description |
|---|---|---|
config |
The schema metadata configuration to submit. Registrar builds and signs the final schema metadata. | |
credentialConfigId |
string | ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID. |
pinMode |
string | How to update credential config pinning after publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to a different schema id. |
SignVersionSchemaMetaConfigDto¶
| Name | Type | Description |
|---|---|---|
config |
The schema metadata configuration to submit as a new version. Must include the existing id. | |
credentialConfigId |
string | Optional credential config to update pinning for after successful version publish. |
pinMode |
string | How to update credential config pinning after version publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to config.id. |
StatusListAggregationDto¶
| Name | Type | Description |
|---|---|---|
status_lists |
Array<string> | Array of status list token URIs |
StatusListConfig¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status entry: 1 (valid/revoked), 2 (with suspended), 4/8 (extended). If not set, uses global STATUS_BITS. |
capacity |
number | The capacity of the status list. If not set, uses global STATUS_CAPACITY. |
enableAggregation |
boolean | If true, include aggregation_uri in status list JWTs for pre-fetching support (default: true). |
immediateUpdate |
boolean | If true, regenerate JWT immediately on status changes. If false (default), use lazy regeneration on TTL expiry. |
ttl |
number | TTL in seconds for the status list JWT. If not set, uses global STATUS_TTL. |
StatusListImportDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status value. If not provided, uses tenant or global defaults. |
capacity |
number | Capacity of the status list. If not provided, uses tenant or global defaults. |
credentialConfigurationId |
string | null | Credential configuration ID to bind this list exclusively to. Leave empty for a shared list. |
id |
string | Unique identifier for the status list |
keyChainId |
string | Key chain ID to use for signing. Leave empty to use the tenant's default StatusList key chain. |
StatusListResponseDto¶
| Name | Type | Description |
|---|---|---|
availableEntries |
number | Number of available entries |
bits |
number | Bits per status value |
capacity |
number | Total capacity of the status list |
createdAt |
string(date-time) | Creation timestamp |
credentialConfigurationId |
string | null | Credential configuration ID this list is bound to. Null means shared. |
expiresAt |
string(date-time) | null | JWT expiration timestamp. Null if JWT has not been generated yet. |
id |
string | Unique identifier for the status list |
keyChainId |
string | null | Key chain ID used for signing. Null means using the tenant's default. |
tenantId |
string | The tenant ID |
uri |
string | The public URI for this status list |
usedEntries |
number | Number of entries in use |
StatusUpdateDto¶
| Name | Type | Description |
|---|---|---|
credentialConfigurationId |
string | The ID of the credential configuration This is optional, if not provided, all credentials will be revoked of the session. |
sessionId |
string | The session ID of the user |
status |
number | The status of the credential 0 = valid, 1 = revoked, 2 = suspended |
TenantEntity¶
| Name | Type | Description |
|---|---|---|
clients |
Array<ClientEntity> | The clients associated with the tenant. |
description |
string | The description of the tenant. |
id |
string | The unique identifier for the tenant. |
name |
string | The name of the tenant. |
sessionConfig |
Session storage configuration for this tenant. Controls TTL and cleanup behavior. | |
status |
string | The current status of the tenant. |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
TokenResponse¶
| Name | Type | Description |
|---|---|---|
access_token |
string | |
expires_in |
number | |
refresh_token |
string | |
state |
string | |
token_type |
string |
TransactionData¶
| Name | Type | Description |
|---|---|---|
credential_ids |
Array<string> | |
type |
string |
TrustAuthorityDto¶
| Name | Type | Description |
|---|---|---|
frameworkType |
string | Type of trust framework |
id |
string | Unique identifier for this trust authority entry |
value |
string | URI or identifier for the trust list / authority |
verificationMethod |
Verification method for the trust list signature (e.g., JWK) |
TrustAuthorityEntry¶
| Name | Type | Description |
|---|---|---|
frameworkType |
string | Trust framework type (ignored when trustListId is set) |
trustListId |
string | Trust list ID to resolve from the database. When set, frameworkType, value, and verificationMethod are derived automatically. |
value |
string | URI of the trust list or trust anchor (ignored when trustListId is set) |
verificationMethod |
Optional verification material for external trusted authorities (for example a JWK). For internal trust-list URLs, EUDIPLO resolves verification material from the database. |
TrustedAuthorityQueryEtsiTl¶
| Name | Type | Description |
|---|---|---|
type |
string | |
values |
Array<TrustListRef> |
TrustedAuthorityQueryOpenIdFederation¶
| Name | Type | Description |
|---|---|---|
type |
string | |
values |
Array<string> |
TrustList¶
| Name | Type | Description |
|---|---|---|
createdAt |
string(date-time) | |
data |
The full trust list JSON (generated LoTE structure) | |
description |
string | |
entityConfig |
Array<> | The original entity configuration used to create this trust list. Stored for round-tripping when editing. |
id |
string | Unique identifier for the trust list |
jwt |
string | The signed JWT representation of this trust list |
keyChain |
KeyChainEntity | |
keyChainId |
string | |
sequenceNumber |
number | The sequence number for versioning (incremented on updates) |
tenant |
The tenant that owns this object. | |
tenantId |
string | The tenant ID for which the VP request is made. |
updatedAt |
string(date-time) |
TrustListCreateDto¶
| Name | Type | Description |
|---|---|---|
data |
The full trust list JSON (generated LoTE structure) | |
description |
string | |
entities |
Array<> | |
id |
string | |
keyChainId |
string |
TrustListEntityInfo¶
| Name | Type | Description |
|---|---|---|
contactUri |
string | |
country |
string | |
lang |
string | |
locality |
string | |
name |
string | |
postalCode |
string | |
streetAddress |
string | |
uri |
string |
TrustListRef¶
| Name | Type | Description |
|---|---|---|
trustListId |
string | Managed local trust-list identifier. When provided, verifier material is resolved server-side from the trust list key chain. |
url |
string | Trust-list JWT URL. Required for external trust lists when trustListId is not set. |
verifierKey |
JWK used to verify trust-list JWT signatures for external trusted authority values. | |
verifierX509Der |
string | Base64 DER-encoded X.509 certificate used to verify trust-list JWT signatures for external trusted authority values. |
TrustListVersion¶
| Name | Type | Description |
|---|---|---|
createdAt |
string(date-time) | |
data |
The full trust list JSON at this version | |
entityConfig |
The entity configuration at this version | |
id |
string | |
jwt |
string | The signed JWT at this version |
sequenceNumber |
number | The sequence number at the time this version was created |
tenantId |
string | |
trustList |
TrustList | |
trustListId |
string |
UpdateAttributeProviderDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
url |
string |
UpdateClientDto¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
UpdateIssuanceDto¶
| Name | Type | Description |
|---|---|---|
authorizationServers |
Array<> | Dedicated managed authorization servers hosted by this issuer. At least one entry is required. |
batchSize |
number | Value to determine the amount of credentials that are issued in a batch. Default is 1. |
credentialRequestEncryption |
boolean | Whether `credential_request_encryption` should be advertised in the credential issuer metadata. |
credentialResponseEncryption |
boolean | Whether `credential_response_encryption` should be advertised in the credential issuer metadata. |
display |
Array<DisplayInfo> | |
dPopRequired |
boolean | Indicates whether DPoP is required for the issuance process. Default value is true. |
federation |
Optional OpenID Federation configuration used for trust evaluation. When omitted, trust checks rely on existing LoTE trust-list behavior. | |
registrationCertificate |
Optional registration certificate configuration for issuer metadata (`issuer_info`). Supports importing an existing JWT or generating one via registrar. | |
registrationCertificateCache |
Server-managed cache for generated issuer registration certificates. | |
signingKeyId |
string | Key ID for signing access tokens. If unset, the default signing key is used. |
txCodeMaxAttempts |
number | null | Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5. |
walletAttestationRequired |
boolean | Indicates whether wallet attestation is required for the token endpoint. When enabled, wallets must provide OAuth-Client-Attestation headers. Default value is false. |
walletProviderTrustLists |
Array<WalletProviderTrustListRefDto> | Trust lists containing trusted wallet providers. Each entry MUST include either `verifierKey` or `verifierX509Der`. |
UpdateIssuerOfferDto¶
| Name | Type | Description |
|---|---|---|
credentialOfferUrl |
string | URL where the user can receive a credential offer from this issuer. |
description |
string | Human-readable description to help users choose the right issuer. |
UpdateRegistrarConfigDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
password |
string | The password for OIDC login (stored in plaintext) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
UpdateSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
category |
string | Domain category for filtering |
displayName |
string | Optional human-readable schema name for UI display and search |
issuerOffers |
Array<UpdateIssuerOfferDto> | Issuer offer entries shown to users, each with credential-offer URL and description |
tags |
Array<string> | Predefined tags for filtering and search |
UpdateSessionConfigDto¶
| Name | Type | Description |
|---|---|---|
cleanupMode |
string | Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII. |
ttlSeconds |
number | null | Time-to-live for sessions in seconds. Set to null to use global default. |
UpdateStatusListConfigDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | null | Bits per status entry. Set to null to reset to global default. |
capacity |
number | null | The capacity of the status list. Set to null to reset to global default. |
enableAggregation |
boolean | null | If true, include aggregation_uri in status list JWTs for pre-fetching support. Set to null to reset to default (true). |
immediateUpdate |
boolean | null | If true, regenerate JWT on every status change. Set to null to reset to default (false). |
ttl |
number | null | TTL in seconds for the status list JWT. Set to null to reset to global default. |
UpdateStatusListDto¶
| Name | Type | Description |
|---|---|---|
credentialConfigurationId |
string | null | Credential configuration ID to bind this list exclusively to. Set to null to make this a shared list. |
keyChainId |
string | null | Key chain ID to use for signing. Set to null to use the tenant's default StatusList key chain. |
UpdateTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
name |
string | The name of the tenant. |
roles |
Array<string> | |
sessionConfig |
Session storage configuration. Controls TTL and cleanup behavior. | |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
UpdateUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
password |
string | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
username |
string |
UpdateWebhookEndpointDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
url |
string |
UpstreamOidcConfig¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The client ID registered with the upstream provider |
clientSecret |
string | The client secret for confidential clients |
issuer |
string(uri) | The OIDC issuer URL of the upstream provider |
scopes |
Array<string> | Scopes to request from the upstream provider |
VaultKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
type |
string | Type of the KMS provider. |
vaultToken |
string | Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders. |
vaultUrl |
string | URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders. |
VCT¶
| Name | Type | Description |
|---|---|---|
description |
string | |
extends |
string | |
extends#integrity |
string | |
name |
string | |
schema_uri |
string | |
schema_uri#integrity |
string | |
vct |
string |
VocabularyEntryDto¶
| Name | Type | Description |
|---|---|---|
code |
string | Stable machine-readable value to submit in schema metadata category/tags fields. |
label |
string | Display label for UI rendering. |
replacedBy |
string | Replacement code when status is deprecated. |
status |
string | Vocabulary lifecycle status. |
WalletProviderTrustListRefDto¶
| Name | Type | Description |
|---|---|---|
url |
string(uri) | |
verifierKey |
JWK used to verify the trust-list JWT signature. | |
verifierX509Der |
string | Base64 DER-encoded X.509 certificate used to verify the trust-list JWT signature. |
WebHookAuthConfigHeader¶
| Name | Type | Description |
|---|---|---|
config |
Configuration for API key authentication. This is required if the type is 'apiKey'. | |
type |
string | The type of authentication used for the webhook. |
WebHookAuthConfigNone¶
| Name | Type | Description |
|---|---|---|
type |
string | The type of authentication used for the webhook. |
WebhookConfig¶
| Name | Type | Description |
|---|---|---|
auth |
Optional authentication configuration for the webhook. If not provided, no authentication will be used. | |
includeRawTokensFor |
Array<string> | List of credential IDs to include raw tokens for (e.g., ['sca_credential']) |
url |
string | The URL to which the webhook will send notifications. |
WebhookEndpointEntity¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
tenant |
TenantEntity | |
tenantId |
string | |
url |
string |
Security schemes¶
| Name | Type | Scheme | Description |
|---|---|---|---|
| oauth2 | oauth2 |
More documentation¶
Documentation
For more information: https://openwallet-foundation.github.io/eudiplo/docs/latest/
Protocol API¶
EUDIPLO Protocol API main¶
Wallet-facing protocol endpoints for OID4VCI, OID4VP, and related standards. These endpoints are public and secured at the protocol level (DPoP, Wallet Attestation, etc.).
App¶
GET /¶
Main endpoint providing service info
Responses
GET /health¶
Endpoint to check the health of the service.
Responses
{
"status": "ok",
"info": {
"database": {
"status": "up"
}
},
"error": {},
"details": {
"database": {
"status": "up"
}
}
}
Schema of the response body
{
"type": "object",
"properties": {
"status": {
"type": "string",
"example": "ok"
},
"info": {
"type": "object",
"example": {
"database": {
"status": "up"
}
},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
},
"nullable": true
},
"error": {
"type": "object",
"example": {},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
},
"nullable": true
},
"details": {
"type": "object",
"example": {
"database": {
"status": "up"
}
},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
}
}
}
}
{
"status": "error",
"info": {
"database": {
"status": "up"
}
},
"error": {
"redis": {
"status": "down",
"message": "Could not connect"
}
},
"details": {
"database": {
"status": "up"
},
"redis": {
"status": "down",
"message": "Could not connect"
}
}
}
Schema of the response body
{
"type": "object",
"properties": {
"status": {
"type": "string",
"example": "error"
},
"info": {
"type": "object",
"example": {
"database": {
"status": "up"
}
},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
},
"nullable": true
},
"error": {
"type": "object",
"example": {
"redis": {
"status": "down",
"message": "Could not connect"
}
},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
},
"nullable": true
},
"details": {
"type": "object",
"example": {
"database": {
"status": "up"
},
"redis": {
"status": "down",
"message": "Could not connect"
}
},
"additionalProperties": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"type": "string"
}
},
"additionalProperties": true
}
}
}
}
Authentication¶
GET /.well-known/oauth-authorization-server¶
OIDC Discovery Configuration
Description
Returns the OpenID Connect discovery configuration for client credentials authentication.
Responses
GET /.well-known/jwks.json¶
JSON Web Key Set
Description
Returns the JSON Web Key Set for token verification.
Responses
Issuer¶
GET /issuers/{tenantId}/status-management/status-list/{listId}¶
Get the JWT for a specific status list.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
accept |
header | string | No | ||
content-type |
header | string | No | ||
listId |
path | string | No | ||
tenantId |
path | string | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /issuers/{tenantId}/status-management/status-list-aggregation¶
Get all status list URIs
Description
Returns a list of all status list token URIs for the tenant. This allows relying parties to pre-fetch all status lists for offline validation. See RFC draft-ietf-oauth-status-list Section 9.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
{
"status_lists": [
"https://example.com/tenant-123/status-management/status-list/list-1",
"https://example.com/tenant-123/status-management/status-list/list-2"
]
}
Schema of the response body
{
"type": "object",
"properties": {
"status_lists": {
"description": "Array of status list token URIs",
"example": [
"https://example.com/tenant-123/status-management/status-list/list-1",
"https://example.com/tenant-123/status-management/status-list/list-2"
],
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"status_lists"
]
}
GET /issuers/{tenantId}/trust-list/{id}¶
Returns the JWT of the trust list
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
id |
path | string | No | ||
tenantId |
path | string | No |
Responses
OID4VCI¶
GET /issuers/{tenantId}/vci/credential-offers/{sessionId}¶
Credential offer endpoint for credential_offer_uri references.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No | ||
tenantId |
path | string | No |
Responses
POST /issuers/{tenantId}/vci/credential¶
Endpoint to issue credentials
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
POST /issuers/{tenantId}/vci/deferred_credential¶
Deferred Credential Endpoint
According to OID4VCI Section 9, this endpoint is used by the wallet to poll for credentials that were not immediately available.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Responses
POST /issuers/{tenantId}/vci/notification¶
Notification endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Request body
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Responses
POST /issuers/{tenantId}/vci/nonce¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /issuers/{tenantId}/credentials-metadata/vct/{id}¶
Retrieves the VCT (Verifiable Credential Type) from the credentials service.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
id |
path | string | No | ||
tenantId |
path | string | No |
Responses
{
"vct": "string",
"name": "string",
"description": "string",
"extends": "string",
"extends#integrity": "string",
"schema_uri": "string",
"schema_uri#integrity": "string"
}
Schema of the response body
GET /.well-known/openid-credential-issuer/issuers/{tenantId}¶
Get OpenID4VCI issuer metadata
Description
Returns the OpenID4VCI issuer metadata.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/oauth-authorization-server/issuers/{tenantId}¶
Authorization Server Metadata
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/oauth-authorization-server/issuers/{tenantId}/chained-as¶
Chained Authorization Server Metadata (RFC 8414 alternative path format).
Supports discovery via /.well-known/oauth-authorization-server/:tenantId/chained-as
for wallets that construct the discovery URL per RFC 8414.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/oauth-authorization-server/issuers/{tenantId}/chained-as-vp¶
VP-backed Chained Authorization Server Metadata.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/jwks.json/issuers/{tenantId}¶
Returns the JSON Web Key Set (JWKS) for the authorization server.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /.well-known/jwks.json/issuers/{tenantId}/chained-as¶
Returns the JSON Web Key Set (JWKS) for the Chained Authorization Server.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/jwks.json/issuers/{tenantId}/chained-as-vp¶
Returns the JSON Web Key Set (JWKS) for the VP-backed Chained Authorization Server.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
GET /.well-known/oauth-authorization-server/issuers/{tenantId}/authorization-servers/{authorizationServerId}¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | ||
tenantId |
path | string | No |
Responses
GET /.well-known/jwks.json/issuers/{tenantId}/authorization-servers/{authorizationServerId}¶
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | ||
tenantId |
path | string | No |
Responses
GET /issuers/{tenantId}/authorize¶
Endpoint to handle the Authorization Request.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
auth_session |
query | string | No | ||
authorization_details |
query | No | RFC 9396 authorization details. When passed via application/x-www-form-urlencoded (PAR) the value is a JSON string; when passed inside a signed request object it can already be an array. | ||
client_id |
query | string | No | ||
code_challenge |
query | string | No | ||
code_challenge_method |
query | string | No | ||
dpop_jkt |
query | string | No | ||
issuer_state |
query | string | No | ||
redirect_uri |
query | string | No | ||
request_uri |
query | string | No | ||
resource |
query | string | No | ||
response_type |
query | string | No | ||
scope |
query | string | No | ||
state |
query | string | No | ||
tenantId |
path | string | No |
Responses
POST /issuers/{tenantId}/authorize/par¶
Endpoint to handle the Pushed Authorization Request (PAR).
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
oauth-client-attestation |
header | string | No | ||
oauth-client-attestation-pop |
header | string | No | ||
tenantId |
path | string | No |
Request body
{
"issuer_state": "string",
"response_type": "string",
"client_id": "string",
"redirect_uri": "string",
"resource": "string",
"scope": "string",
"code_challenge": "string",
"code_challenge_method": "string",
"dpop_jkt": "string",
"request_uri": "string",
"auth_session": "string",
"state": "string",
"authorization_details": {}
}
Schema of the request body
{
"type": "object",
"properties": {
"issuer_state": {
"type": "string"
},
"response_type": {
"type": "string"
},
"client_id": {
"type": "string"
},
"redirect_uri": {
"type": "string"
},
"resource": {
"type": "string"
},
"scope": {
"type": "string"
},
"code_challenge": {
"type": "string"
},
"code_challenge_method": {
"type": "string"
},
"dpop_jkt": {
"type": "string"
},
"request_uri": {
"type": "string"
},
"auth_session": {
"type": "string"
},
"state": {
"type": "string"
},
"authorization_details": {
"type": "object",
"description": "RFC 9396 authorization details. When passed via\napplication/x-www-form-urlencoded (PAR) the value is a JSON string; when\npassed inside a signed request object it can already be an array."
}
}
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
POST /issuers/{tenantId}/authorize/token¶
Endpoint to validate the token request. This endpoint is used to exchange the authorization code for an access token.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
POST /issuers/{tenantId}/authorize/challenge¶
Client Attestation Challenge Endpoint. Returns a nonce for inclusion in the Client Attestation PoP JWT.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
tenantId |
path | string | No |
Responses
POST /issuers/{tenantId}/authorize/interactive¶
Interactive Authorization Endpoint
Description
Handles interactive authorization requests during credential issuance.
Initial Request:
- Contains interaction_types_supported (e.g., "openid4vp_presentation,redirect_to_web")
- Response will indicate required interaction (OpenID4VP presentation or web redirect)
Follow-up Request:
- Contains auth_session from previous response
- Contains openid4vp_response (for presentation flow) or code_verifier (for web flow)
- Response will contain authorization code on success
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
origin |
header | string | No | ||
tenantId |
path | string | No |
Request body
{
"response_type": "string",
"client_id": "string",
"interaction_types_supported": "string",
"redirect_uri": "string",
"scope": "string",
"code_challenge": "string",
"code_challenge_method": "string",
"authorization_details": {},
"state": "string",
"issuer_state": "string",
"auth_session": "string",
"openid4vp_response": "string",
"code_verifier": "string",
"request": "string",
"request_uri": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"response_type": {
"type": "string",
"description": "Response type (for initial request)"
},
"client_id": {
"type": "string",
"description": "Client identifier (for initial request)"
},
"interaction_types_supported": {
"type": "string",
"description": "Comma-separated list of supported interaction types (for initial request)"
},
"redirect_uri": {
"type": "string",
"description": "Redirect URI (for initial request)"
},
"scope": {
"type": "string",
"description": "OAuth scope"
},
"code_challenge": {
"type": "string",
"description": "PKCE code challenge"
},
"code_challenge_method": {
"type": "string",
"description": "PKCE code challenge method"
},
"authorization_details": {
"type": "object",
"description": "Authorization details"
},
"state": {
"type": "string",
"description": "State parameter"
},
"issuer_state": {
"type": "string",
"description": "Issuer state from credential offer"
},
"auth_session": {
"type": "string",
"description": "Auth session identifier (for follow-up request)"
},
"openid4vp_response": {
"type": "string",
"description": "OpenID4VP response (for follow-up request)"
},
"code_verifier": {
"type": "string",
"description": "PKCE code verifier (for follow-up request)"
},
"request": {
"type": "string",
"description": "JAR request JWT (by value)"
},
"request_uri": {
"type": "string",
"description": "JAR request URI (by reference)"
}
}
}
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
{
"error": "invalid_request",
"error_description": "Missing required parameter: interaction_types_supported"
}
Schema of the response body
{
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "OAuth error code",
"example": "invalid_request"
},
"error_description": {
"type": "string",
"description": "Human-readable error description",
"example": "Missing required parameter: interaction_types_supported"
}
},
"required": [
"error"
]
}
POST /issuers/{tenantId}/authorize/interactive/complete-web-auth/{authSession}¶
Complete web authorization
Description
Mark a web authorization session as completed after user interaction
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authSession |
path | string | No | ||
tenantId |
path | string | No |
Responses
OID4VP¶
GET /presentations/{sessionId}/oid4vp/request¶
Returns the authorization request for a given requestId and session. Returns the cached request JWT if available, otherwise generates a new one. Per OID4VP spec section 5.10.1: Response MUST use Content-Type: application/oauth-authz-req+jwt
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No |
Responses
POST /presentations/{sessionId}/oid4vp/request¶
Returns the authorization request for a given requestId and session. Returns the cached request JWT if available, otherwise generates a new one. Per OID4VP spec section 5.10.1: Response MUST use Content-Type: application/oauth-authz-req+jwt
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No |
Responses
GET /presentations/{sessionId}/oid4vp/request/no-redirect¶
Returns the authorization request for a given requestId and session, but does not redirect in the end. Returns the cached request JWT if available, otherwise generates a new one. Per OID4VP spec section 5.10.1: Response MUST use Content-Type: application/oauth-authz-req+jwt
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No |
Responses
POST /presentations/{sessionId}/oid4vp¶
Endpoint to receive the response from the wallet.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No |
Request body
{
"response": "string",
"sendResponse": true,
"error": "string",
"error_description": "string",
"error_uri": "string",
"state": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"response": {
"type": "string",
"description": "The response string containing the authorization details (JWE-encrypted VP token).\nRequired for success responses, absent for error responses."
},
"sendResponse": {
"type": "boolean",
"description": "When set to true, the authorization response will be sent to the client."
},
"error": {
"type": "string"
},
"error_description": {
"type": "string",
"description": "Human-readable description of the error."
},
"error_uri": {
"type": "string",
"description": "URI with additional information about the error."
},
"state": {
"type": "string",
"description": "State value from the authorization request (for correlation)."
}
}
}
Responses
Chained AS¶
POST /issuers/{tenantId}/chained-as/par¶
Pushed Authorization Request
Description
Submit authorization request parameters. Returns a request_uri for use at the authorization endpoint.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
oauth-client-attestation |
header | string | No | ||
OAuth-Client-Attestation |
header | string | No | Wallet attestation JWT | |
oauth-client-attestation-pop |
header | string | No | ||
OAuth-Client-Attestation-PoP |
header | string | No | Wallet attestation proof-of-possession JWT | |
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"request_uri": {
"type": "string",
"description": "The request URI to use at the authorization endpoint",
"example": "urn:ietf:params:oauth:request_uri:abc123"
},
"expires_in": {
"type": "number",
"description": "The lifetime of the request URI in seconds",
"example": 600
}
},
"required": [
"request_uri",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /issuers/{tenantId}/chained-as/authorize¶
Authorization endpoint
Description
Validates the request_uri from PAR and redirects to the upstream OIDC provider for authentication.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
client_id |
query | string | No | Client identifier | |
request_uri |
query | string | No | Request URI from PAR response | |
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /issuers/{tenantId}/chained-as/callback¶
Upstream OIDC callback
Description
Receives the authorization response from the upstream OIDC provider, exchanges the code, and redirects back to the wallet.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
code |
query | string | No | ||
error |
query | string | No | ||
error_description |
query | string | No | ||
state |
query | string | No | ||
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
POST /issuers/{tenantId}/chained-as/token¶
Token endpoint
Description
Exchanges the authorization code for an access token containing issuer_state.
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
tenantId |
path | string | No | Tenant identifier |
Request body
{
"grant_type": "authorization_code",
"code": "string",
"refresh_token": "string",
"client_id": "string",
"redirect_uri": "string",
"code_verifier": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"grant_type": {
"type": "string",
"description": "Grant type ('authorization_code' or 'refresh_token')",
"example": "authorization_code"
},
"code": {
"type": "string",
"description": "Authorization code received in the callback (authorization_code grant)"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (refresh_token grant)"
},
"client_id": {
"type": "string",
"description": "Client identifier"
},
"redirect_uri": {
"type": "string",
"description": "Redirect URI (must match the one used in PAR)"
},
"code_verifier": {
"type": "string",
"description": "PKCE code verifier"
}
},
"required": [
"grant_type"
]
}
Responses
{
"access_token": "string",
"token_type": "DPoP",
"expires_in": 3600,
"scope": "string",
"authorization_details": [
{}
],
"c_nonce": "string",
"c_nonce_expires_in": 10.12,
"refresh_token": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"access_token": {
"type": "string",
"description": "The access token"
},
"token_type": {
"type": "string",
"description": "Token type (Bearer or DPoP)",
"example": "DPoP"
},
"expires_in": {
"type": "number",
"description": "Token lifetime in seconds",
"example": 3600
},
"scope": {
"type": "string",
"description": "Scope granted"
},
"authorization_details": {
"description": "Authorized credential configurations",
"type": "array",
"items": {
"type": "object"
}
},
"c_nonce": {
"type": "string",
"description": "C_NONCE for credential request"
},
"c_nonce_expires_in": {
"type": "number",
"description": "C_NONCE lifetime in seconds"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (issued when refresh tokens are enabled)"
}
},
"required": [
"access_token",
"token_type",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Authorization Servers¶
POST /issuers/{tenantId}/authorization-servers/{authorizationServerId}/par¶
Pushed Authorization Request
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | Authorization server identifier | |
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
oauth-client-attestation |
header | string | No | ||
OAuth-Client-Attestation |
header | string | No | Wallet attestation JWT | |
oauth-client-attestation-pop |
header | string | No | ||
OAuth-Client-Attestation-PoP |
header | string | No | Wallet attestation proof-of-possession JWT | |
tenantId |
path | string | No | Tenant identifier |
Responses
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
Schema of the response body
{
"type": "object",
"properties": {
"request_uri": {
"type": "string",
"description": "The request URI to use at the authorization endpoint",
"example": "urn:ietf:params:oauth:request_uri:abc123"
},
"expires_in": {
"type": "number",
"description": "The lifetime of the request URI in seconds",
"example": 600
}
},
"required": [
"request_uri",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
GET /issuers/{tenantId}/authorization-servers/{authorizationServerId}/authorize¶
Authorization endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | Authorization server identifier | |
client_id |
query | string | No | Client identifier | |
request_uri |
query | string | No | Request URI from PAR response | |
tenantId |
path | string | No | Tenant identifier |
Responses
GET /issuers/{tenantId}/authorization-servers/{authorizationServerId}/vp-callback¶
OID4VP callback
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | Authorization server identifier | |
cas |
query | string | No | ||
error |
query | string | No | ||
error_description |
query | string | No | ||
response_code |
query | string | No | ||
tenantId |
path | string | No | Tenant identifier |
Responses
POST /issuers/{tenantId}/authorization-servers/{authorizationServerId}/token¶
Token endpoint
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
authorizationServerId |
path | string | No | Authorization server identifier | |
dpop |
header | string | No | ||
DPoP |
header | string | No | DPoP proof JWT | |
tenantId |
path | string | No | Tenant identifier |
Request body
{
"grant_type": "authorization_code",
"code": "string",
"refresh_token": "string",
"client_id": "string",
"redirect_uri": "string",
"code_verifier": "string"
}
Schema of the request body
{
"type": "object",
"properties": {
"grant_type": {
"type": "string",
"description": "Grant type ('authorization_code' or 'refresh_token')",
"example": "authorization_code"
},
"code": {
"type": "string",
"description": "Authorization code received in the callback (authorization_code grant)"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (refresh_token grant)"
},
"client_id": {
"type": "string",
"description": "Client identifier"
},
"redirect_uri": {
"type": "string",
"description": "Redirect URI (must match the one used in PAR)"
},
"code_verifier": {
"type": "string",
"description": "PKCE code verifier"
}
},
"required": [
"grant_type"
]
}
Responses
{
"access_token": "string",
"token_type": "DPoP",
"expires_in": 3600,
"scope": "string",
"authorization_details": [
{}
],
"c_nonce": "string",
"c_nonce_expires_in": 10.12,
"refresh_token": "string"
}
Schema of the response body
{
"type": "object",
"properties": {
"access_token": {
"type": "string",
"description": "The access token"
},
"token_type": {
"type": "string",
"description": "Token type (Bearer or DPoP)",
"example": "DPoP"
},
"expires_in": {
"type": "number",
"description": "Token lifetime in seconds",
"example": 3600
},
"scope": {
"type": "string",
"description": "Scope granted"
},
"authorization_details": {
"description": "Authorized credential configurations",
"type": "array",
"items": {
"type": "object"
}
},
"c_nonce": {
"type": "string",
"description": "C_NONCE for credential request"
},
"c_nonce_expires_in": {
"type": "number",
"description": "C_NONCE lifetime in seconds"
},
"refresh_token": {
"type": "string",
"description": "Refresh token (issued when refresh tokens are enabled)"
}
},
"required": [
"access_token",
"token_type",
"expires_in"
]
}
⚠️ This example has been generated automatically from the schema and it is not accurate. Refer to the schema for more information.
ISO 18013-7¶
POST /presentations/{sessionId}/iso-18013-7¶
Accept the HPKE-encrypted DeviceResponse from the wallet (via DC API + browser JS). Body: { data: string } — base64url-encoded HPKE output (enc || ciphertext)
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
sessionId |
path | string | No |
Responses
Storage¶
GET /storage/{key}¶
Get a file and stream it
Input parameters
| Parameter | In | Type | Default | Nullable | Description |
|---|---|---|---|---|---|
key |
path | string | No |
Responses
Schemas¶
AccessCertificateRefDto¶
| Name | Type | Description |
|---|---|---|
certificate |
string | |
createdAt |
string | |
id |
string | |
relyingPartyId |
string | |
revoked |
string |
AllowListPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
Array<string> |
ApiKeyConfig¶
| Name | Type | Description |
|---|---|---|
headerName |
string | The name of the header where the API key will be sent. |
value |
string | The value of the API key to be sent in the header. |
AttestationBasedPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
Array<PolicyCredential> |
AttributeProviderEntity¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
tenant |
TenantEntity | |
tenantId |
string | |
url |
string |
AuditLogResponseDto¶
| Name | Type | Description |
|---|---|---|
actionType |
string | |
actorDisplay |
string | |
actorId |
string | |
actorType |
string | |
after |
||
before |
||
changedFields |
Array<string> | |
id |
string | |
requestId |
string | |
tenantId |
string | |
timestamp |
string(date-time) |
AuthenticationMethodAuth¶
| Name | Type | Description |
|---|---|---|
config |
AuthenticationUrlConfig | |
method |
string |
AuthenticationMethodNone¶
| Name | Type | Description |
|---|---|---|
method |
string |
AuthenticationMethodPresentation¶
| Name | Type | Description |
|---|---|---|
config |
PresentationDuringIssuanceConfig | |
method |
string |
AuthenticationUrlConfig¶
| Name | Type | Description |
|---|---|---|
url |
string | The URL used in the OID4VCI authorized code flow. This URL is where users will be redirected for authentication. |
webhook |
Optional webhook configuration for authentication callbacks |
AuthorizationResponse¶
| Name | Type | Description |
|---|---|---|
error |
string | |
error_description |
string | Human-readable description of the error. |
error_uri |
string | URI with additional information about the error. |
response |
string | The response string containing the authorization details (JWE-encrypted VP token). Required for success responses, absent for error responses. |
sendResponse |
boolean | When set to true, the authorization response will be sent to the client. |
state |
string | State value from the authorization request (for correlation). |
AuthorizeQueries¶
| Name | Type | Description |
|---|---|---|
auth_session |
string | |
authorization_details |
RFC 9396 authorization details. When passed via application/x-www-form-urlencoded (PAR) the value is a JSON string; when passed inside a signed request object it can already be an array. | |
client_id |
string | |
code_challenge |
string | |
code_challenge_method |
string | |
dpop_jkt |
string | |
issuer_state |
string | |
redirect_uri |
string | |
request_uri |
string | |
resource |
string | |
response_type |
string | |
scope |
string | |
state |
string |
AwsKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
accessKeyId |
string | AWS access key ID. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders. |
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
region |
string | AWS region for KMS. Supports ${ENV_VAR} placeholders. |
secretAccessKey |
string | AWS secret access key. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
BuiltInAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
CertificateInfoDto¶
| Name | Type | Description |
|---|---|---|
issuer |
string | Certificate issuer (CN). |
notAfter |
string(date-time) | Certificate not after date. |
notBefore |
string(date-time) | Certificate not before date. |
pem |
string | Certificate in PEM format. |
serialNumber |
string | Serial number. |
subject |
string | Certificate subject (CN). |
ChainedAsErrorResponseDto¶
| Name | Type | Description |
|---|---|---|
error |
string | Error code |
error_description |
string | Human-readable error description |
ChainedAsParResponseDto¶
| Name | Type | Description |
|---|---|---|
expires_in |
number | The lifetime of the request URI in seconds |
request_uri |
string | The request URI to use at the authorization endpoint |
ChainedAsTokenConfig¶
| Name | Type | Description |
|---|---|---|
lifetimeSeconds |
number | Access token lifetime in seconds |
refreshTokenEnabled |
boolean | Whether refresh tokens should be issued |
refreshTokenExpiresInSeconds |
number | Refresh token lifetime in seconds |
signingKeyId |
string | Key ID for token signing |
ChainedAsTokenRequestDto¶
| Name | Type | Description |
|---|---|---|
client_id |
string | Client identifier |
code |
string | Authorization code received in the callback (authorization_code grant) |
code_verifier |
string | PKCE code verifier |
grant_type |
string | Grant type ('authorization_code' or 'refresh_token') |
redirect_uri |
string | Redirect URI (must match the one used in PAR) |
refresh_token |
string | Refresh token (refresh_token grant) |
ChainedAsTokenResponseDto¶
| Name | Type | Description |
|---|---|---|
access_token |
string | The access token |
authorization_details |
Array<> | Authorized credential configurations |
c_nonce |
string | C_NONCE for credential request |
c_nonce_expires_in |
number | C_NONCE lifetime in seconds |
expires_in |
number | Token lifetime in seconds |
refresh_token |
string | Refresh token (issued when refresh tokens are enabled) |
scope |
string | Scope granted |
token_type |
string | Token type (Bearer or DPoP) |
ChainedAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
upstream |
Upstream OIDC provider configuration for chained mode |
ClaimFieldDefinitionDto¶
| Name | Type | Description |
|---|---|---|
children |
Array<ClaimFieldDefinitionDto> | Optional nested child fields. Child paths may be specified relative to the parent field path. |
constraints |
Additional JSON schema constraints for this field | |
defaultValue |
Default value | |
disclosable |
boolean | Whether claim is disclosable in SD-JWT |
display |
Array<FieldDisplayDto> | |
mandatory |
boolean | Whether claim is mandatory |
namespace |
string | Namespace for mDOC field. Optional when the namespace is already present as the first path segment. |
path |
Array<> | Path to claim value. For nested child fields this can be relative to the parent path. |
type |
string | Claim value type |
ClaimsQuery¶
| Name | Type | Description |
|---|---|---|
id |
string | |
path |
Array<string> | |
values |
Array<string> |
ClientCredentialsDto¶
| Name | Type | Description |
|---|---|---|
client_id |
string | |
client_secret |
string | |
grant_type |
string |
ClientEntity¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
clientId |
string | The unique identifier for the client. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
secret |
string | The secret key for the client. |
tenant |
The tenant that the client belongs to. | |
tenantId |
string | The unique identifier for the tenant that the client belongs to. Only null for accounts that manage tenants, that do not belong to a client |
ClientSecretResponseDto¶
| Name | Type | Description |
|---|---|---|
secret |
string |
CompleteDeferredDto¶
| Name | Type | Description |
|---|---|---|
claims |
Example: {'given_name': 'John', 'family_name': 'Doe', 'birthdate': '1990-01-15'} |
Claims to include in the credential. The structure should match the credential configuration's expected claims. |
CreateAccessCertificateDto¶
| Name | Type | Description |
|---|---|---|
keyId |
string | The ID of the key to create an access certificate for |
CreateAttributeProviderDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
url |
string |
CreateClientDto¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
clientId |
string | The unique identifier for the client. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
secret |
string | The secret key for the client. |
CreateRegistrarConfigDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
password |
string | The password for OIDC login (stored in plaintext) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
CreateStatusListDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status value. More bits allow more status states. Defaults to tenant configuration. |
capacity |
number | Maximum number of credential status entries. Defaults to tenant configuration. |
credentialConfigurationId |
string | Credential configuration ID to bind this list exclusively to. Leave empty for a shared list. |
keyChainId |
string | Key chain ID to use for signing. Leave empty to use the tenant's default StatusList key chain. |
CreateTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
id |
string | The unique identifier for the tenant. |
name |
string | The name of the tenant. |
roles |
Array<string> | |
sessionConfig |
Session storage configuration. Controls TTL and cleanup behavior. | |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
CreateUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
username |
string |
CreateWebhookEndpointDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
url |
string |
CredentialConfig¶
| Name | Type | Description |
|---|---|---|
attributeProvider |
AttributeProviderEntity | |
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChain |
KeyChainEntity | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
tenant |
The tenant that owns this object. | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpoint |
WebhookEndpointEntity | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialConfigCreate¶
| Name | Type | Description |
|---|---|---|
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialConfigUpdate¶
| Name | Type | Description |
|---|---|---|
attributeProviderId |
string | null | Reference to the attribute provider used for fetching claims. Optional: if set, claims will be fetched from this provider during issuance. |
config |
IssuerMetadataCredentialConfig | |
description |
string | null | |
embeddedDisclosurePolicy |
Embedded disclosure policy (discriminated union by `policy`). The discriminator makes class-transformer instantiate the right subclass, and then class-validator runs that subclass’s rules. | |
fields |
Array<ClaimFieldDefinitionDto> | |
iaeActions |
Array<> | List of IAE actions to execute before credential issuance |
id |
string | |
keyBinding |
boolean | |
keyChainId |
string | Reference to the key chain used for signing. Optional: if not specified, the default attestation key chain will be used. |
lifeTime |
number | |
schemaMeta |
TS11 schema metadata configuration for EUDI Catalogue of Attestations. When present, EUDIPLO can generate a SchemaMeta object per the TS11 spec using the GET /issuer/credentials/:id/schema-metadata endpoint. The underlying TS11 specification is not yet finalized. | |
sdJwtTrustFormat |
string | null | For SD-JWT credentials: determines whether to include certificate chain (x5c) or use federation-based trust (iss claim). Default: "x5c" (federation must be explicitly selected) |
statusManagement |
boolean | |
vct |
VCT as a URI string (e.g., urn:eudi:pid:de:1) or as an object for EUDIPLO-hosted VCT | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
CredentialQueryDcSdJwt¶
| Name | Type | Description |
|---|---|---|
claim_sets |
Array<Array<string>> | Ordered alternative claim combinations for this credential query. |
claims |
Array<ClaimsQuery> | |
format |
string | Credential format discriminator. |
id |
string | |
meta |
dc+sd-jwt schema metadata for the requested credential. | |
multiple |
boolean | |
trusted_authorities |
Array<> | Trusted authority constraints (discriminated by type) for this credential query. |
CredentialQueryMsoMdoc¶
| Name | Type | Description |
|---|---|---|
claim_sets |
Array<Array<string>> | Ordered alternative claim combinations for this credential query. |
claims |
Array<MsoMdocClaimsQuery> | |
format |
string | Credential format discriminator. |
id |
string | |
meta |
mso_mdoc document type metadata for the requested credential. | |
multiple |
boolean | |
trusted_authorities |
Array<> | Trusted authority constraints (discriminated by type) for this credential query. |
CredentialSetQuery¶
| Name | Type | Description |
|---|---|---|
options |
Array<Array<string>> | |
required |
boolean |
CscAuthorizeAuthDataDto¶
| Name | Type | Description |
|---|---|---|
id |
string | Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP). |
value |
string | Authentication factor value sent to CSC credentials/authorize. |
CscKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
apiPath |
string | CSC API path prefix appended to baseUrl. Defaults to /csc/v2. |
authorizeAuthData |
Array<CscAuthorizeAuthDataDto> | Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors). |
baseUrl |
string | Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders. |
clientId |
string | OAuth2 client ID. Supports ${ENV_VAR} placeholders. |
clientSecret |
string | OAuth2 client secret. Supports ${ENV_VAR} placeholders. |
credentialId |
string | Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry. |
description |
string | Human-readable description of this provider instance. |
hashAlgorithmOid |
string | Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
sad |
string | Static SAD token. If set, the adapter sends it directly in signatures/signHash requests. |
scope |
string | OAuth2 scope to request during token acquisition. |
signAlgorithmOid |
string | Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID. |
tokenUrl |
string(uri) | OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
useAuthorizeEndpoint |
boolean | When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash. |
userId |
string | Optional CSC user ID used in credentials/list requests. |
DbKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
type |
string | Type of the KMS provider. |
DCQL¶
| Name | Type | Description |
|---|---|---|
credential_sets |
Array<CredentialSetQuery> | |
credentials |
Array<> | Format-discriminated credential queries. |
DcSdJwtCredentialQueryMeta¶
| Name | Type | Description |
|---|---|---|
vct_values |
Array<string> | VCT identifiers accepted for dc+sd-jwt credentials. |
DeferredCredentialRequestDto¶
| Name | Type | Description |
|---|---|---|
transaction_id |
string | The transaction identifier previously returned by the Credential Endpoint |
DeferredOperationResponse¶
| Name | Type | Description |
|---|---|---|
message |
string | Optional message |
status |
string | The new status of the transaction |
transactionId |
string | The transaction ID |
DeprecateSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
deprecated |
boolean | Whether to mark this version as deprecated |
message |
string | Deprecation message shown to consumers |
supersededByVersion |
string | The version that supersedes this one |
Display¶
| Name | Type | Description |
|---|---|---|
background_color |
string | |
background_image |
DisplayImage | |
description |
string | |
locale |
string | |
logo |
DisplayImage | |
name |
string | |
text_color |
string |
DisplayImage¶
| Name | Type | Description |
|---|---|---|
uri |
string |
DisplayInfo¶
| Name | Type | Description |
|---|---|---|
locale |
string | |
logo |
DisplayLogo | |
name |
string |
DisplayLogo¶
| Name | Type | Description |
|---|---|---|
alt_text |
string | |
uri |
string |
EC_Public¶
| Name | Type | Description |
|---|---|---|
crv |
string | The algorithm intended for use with the key, such as 'ES256'. |
kty |
string | The key type, which is always 'EC' for Elliptic Curve keys. |
x |
string | The x coordinate of the EC public key. |
y |
string | The y coordinate of the EC public key. |
EcJwk¶
| Name | Type | Description |
|---|---|---|
alg |
string | |
crv |
string | |
d |
string | |
kid |
string | |
kty |
string | |
x |
string | |
y |
string |
EmbeddedDisclosurePolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string |
ExportEcJwk¶
| Name | Type | Description |
|---|---|---|
alg |
string | Algorithm |
crv |
string | Curve |
d |
string | Private key (base64url) |
kid |
string | Key ID |
kty |
string | Key type |
x |
string | X coordinate (base64url) |
y |
string | Y coordinate (base64url) |
ExportRotationPolicyDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
ExternalAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
issuer |
string(uri) | Issuer URL for external authorization servers |
label |
string | Human-friendly label for the UI |
type |
string | Authorization server implementation type |
ExternalTrustListEntity¶
| Name | Type | Description |
|---|---|---|
info |
TrustListEntityInfo | |
issuerCertPem |
string | |
revocationCertPem |
string | |
type |
string |
FailDeferredDto¶
| Name | Type | Description |
|---|---|---|
error |
string | Optional error message explaining why the issuance failed |
FederationConfig¶
| Name | Type | Description |
|---|---|---|
cacheTtlSeconds |
number | Cache TTL in seconds for federation entity statements and trust chain results. |
enforceSigningPolicy |
boolean | Whether federation checks are enforced for upstream metadata and signer trust decisions. |
entityId |
string | Entity identifier of this issuer/verifier in the federation. |
mode |
string | Trust decision strategy when both LoTE trust lists and OpenID Federation are configured. |
role |
string | Role this tenant plays in the OpenID Federation topology. |
trustAnchors |
Array<FederationTrustAnchorConfig> | Configured federation trust anchors. |
FederationTrustAnchorConfig¶
| Name | Type | Description |
|---|---|---|
entityConfigurationUri |
string | Federation endpoint URL for the trust anchor entity configuration. |
entityId |
string | Entity identifier (sub) of the federation trust anchor. |
FieldDisplayDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Optional display description |
locale |
string | Locale code based on BCP47 (RFC 5646) |
name |
string | Display name |
FileUploadDto¶
| Name | Type | Description |
|---|---|---|
file |
string(binary) |
FrontendConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
grafana |
Grafana observability configuration |
GrafanaConfigDto¶
| Name | Type | Description |
|---|---|---|
lokiUid |
string | UID of the Loki data source in Grafana |
tempoUid |
string | UID of the Tempo data source in Grafana |
url |
string | Base URL of the Grafana instance |
HttpAuthBaseConfigDto¶
| Name | Type | Description |
|---|---|---|
type |
string | Authentication method for the remote KMS service. |
HttpKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
auth |
Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services. | |
baseUrl |
string | Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders. |
canImport |
boolean | Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false. |
description |
string | Human-readable description of this provider instance. |
healthPath |
string | Path for the health check endpoint on the remote service. Defaults to /health. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
keysPath |
string | Path prefix for key endpoints on the remote service. Defaults to /keys. |
type |
string | Type of the KMS provider. |
IaeActionOpenid4vpPresentation¶
| Name | Type | Description |
|---|---|---|
label |
string | Optional label for this step (for display purposes) |
presentationConfigId |
string | ID of the presentation configuration to use for this step |
type |
string | Action type discriminator |
IaeActionRedirectToWeb¶
| Name | Type | Description |
|---|---|---|
callbackUrl |
string(uri) | URL where the external service should redirect back after completion. If not provided, the service must call back to the IAE endpoint. |
description |
string | Description of what the user should do on the web page (for wallet display) |
label |
string | Optional label for this step (for display purposes) |
type |
string | Action type discriminator |
url |
string(uri) | URL to redirect the user to for web-based interaction |
ImportTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
name |
string | The name of the tenant. |
InteractiveAuthorizationCodeResponseDto¶
| Name | Type | Description |
|---|---|---|
code |
string | Authorization code |
status |
string | Response status |
InteractiveAuthorizationErrorResponseDto¶
| Name | Type | Description |
|---|---|---|
error |
string | OAuth error code |
error_description |
string | Human-readable error description |
InteractiveAuthorizationRequestDto¶
| Name | Type | Description |
|---|---|---|
auth_session |
string | Auth session identifier (for follow-up request) |
authorization_details |
Authorization details | |
client_id |
string | Client identifier (for initial request) |
code_challenge |
string | PKCE code challenge |
code_challenge_method |
string | PKCE code challenge method |
code_verifier |
string | PKCE code verifier (for follow-up request) |
interaction_types_supported |
string | Comma-separated list of supported interaction types (for initial request) |
issuer_state |
string | Issuer state from credential offer |
openid4vp_response |
string | OpenID4VP response (for follow-up request) |
redirect_uri |
string | Redirect URI (for initial request) |
request |
string | JAR request JWT (by value) |
request_uri |
string | JAR request URI (by reference) |
response_type |
string | Response type (for initial request) |
scope |
string | OAuth scope |
state |
string | State parameter |
InternalTrustListEntity¶
| Name | Type | Description |
|---|---|---|
info |
TrustListEntityInfo | |
issuerKeyChainId |
string | |
revocationKeyChainId |
string | |
type |
string |
IssuanceConfig¶
| Name | Type | Description |
|---|---|---|
authorizationServers |
Array<> | Dedicated managed authorization servers hosted by this issuer. At least one entry is required. |
batchSize |
number | Value to determine the amount of credentials that are issued in a batch. Default is 1. |
createdAt |
string(date-time) | The timestamp when the VP request was created. |
credentialRequestEncryption |
boolean | Whether `credential_request_encryption` should be advertised in the credential issuer metadata. |
credentialResponseEncryption |
boolean | Whether `credential_response_encryption` should be advertised in the credential issuer metadata. |
display |
Array<DisplayInfo> | |
dPopRequired |
boolean | Indicates whether DPoP is required for the issuance process. Default value is true. |
federation |
Optional OpenID Federation configuration used for trust evaluation. When omitted, trust checks rely on existing LoTE trust-list behavior. | |
registrationCertificate |
Optional registration certificate configuration for issuer metadata (`issuer_info`). Supports importing an existing JWT or generating one via registrar. | |
registrationCertificateCache |
Server-managed cache for generated issuer registration certificates. | |
signingKeyId |
string | Key ID for signing access tokens. If unset, the default signing key is used. |
tenant |
The tenant that owns this object. | |
txCodeMaxAttempts |
number | null | Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5. |
updatedAt |
string(date-time) | The timestamp when the VP request was last updated. |
walletAttestationRequired |
boolean | Indicates whether wallet attestation is required for the token endpoint. When enabled, wallets must provide OAuth-Client-Attestation headers. Default value is false. |
walletProviderTrustLists |
Array<WalletProviderTrustListRefDto> | Trust lists containing trusted wallet providers. Each entry MUST include either `verifierKey` or `verifierX509Der`. |
IssuerMetadataCredentialConfig¶
| Name | Type | Description |
|---|---|---|
display |
Array<Display> | |
docType |
string | Document type for mDOC credentials (e.g., "org.iso.18013.5.1.mDL"). Only applicable when format is "mso_mdoc". |
format |
string | |
keyAttestationsRequired |
Key attestation requirements for JWT proofs for this credential. When set, this is published in proof_types_supported.jwt.key_attestations_required for this specific credential configuration. | |
proofTypesSupported |
Array<string> | Supported proof types for this credential configuration. Defaults to ['attestation', 'jwt']. |
scope |
string |
IssuerOfferEntryDto¶
| Name | Type | Description |
|---|---|---|
credentialOfferUrl |
string | URL where the user can receive a credential offer from this issuer. |
description |
string | Human-readable description explaining when this issuer offer is relevant for the user. |
IssuerRegistrationCertificateCache¶
| Name | Type | Description |
|---|---|---|
expiresAt |
number | JWT exp claim, seconds since epoch. |
fingerprint |
string | Config fingerprint used to detect cache invalidation. |
issuedAt |
number | JWT iat claim, seconds since epoch. |
jwt |
string | Cached registration certificate JWT generated by EUDIPLO. |
IssuerRegistrationCertificateConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Enable inclusion of a registration certificate in credential issuer metadata. |
jwt |
string | Existing registration certificate JWT used when mode is import. |
mode |
string | import: use an existing JWT, generate: create via registrar using attestation data derived from configured credential configurations. |
privacyPolicy |
string | Privacy policy URL used when generating a registration certificate (optional if registrar defaults are configured). |
supportUri |
string | Support URI used when generating a registration certificate (optional if registrar defaults are configured). |
JwksResponseDto¶
| Name | Type | Description |
|---|---|---|
keys |
Array<EC_Public> | An array of EC public keys in JWK format. |
KeyAttestationsRequired¶
| Name | Type | Description |
|---|---|---|
key_storage |
Array<string> | List of required key storage types (e.g., iso_18045_high, iso_18045_moderate) |
user_authentication |
Array<string> | List of required user authentication types (e.g., iso_18045_high, iso_18045_moderate) |
KeyChainCreateDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description for the key chain. |
kmsProvider |
string | KMS provider to use (defaults to the configured default provider). |
rotationPolicy |
Rotation policy configuration. Only applicable for the signing key (root CA never rotates). | |
type |
string | Type of key chain to create. |
usageType |
string | Usage type determines the purpose of this key chain (access, attestation, etc.). |
KeyChainEntity¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
string | Certificate for the active signing key in PEM format. Either CA-signed (if rootKey exists) or self-signed. |
activeJwk |
||
certValidityDays |
number | Certificate validity in days when generating new certificates. |
createdAt |
string(date-time) | |
description |
string | Human-readable description of the key chain. |
externalKeyId |
string | External key identifier for cloud KMS providers. This field stores the provider-specific key reference for the active signing key. |
id |
string | Unique identifier for the key chain. This is the ID referenced by other entities (e.g., issuance config's signingKeyId). |
kmsProvider |
string | The KMS provider used for this key chain. References a configured KMS provider name. |
lastRotatedAt |
string(date-time) | Timestamp of when the key was last rotated. |
previousCertificate |
string | Certificate for the previous signing key in PEM format. |
previousJwk |
||
previousKeyExpiry |
string(date-time) | Expiry date for the previous key. After this date, the previous key should be deleted. |
rootCertificate |
string | Root CA certificate in PEM format. Self-signed certificate for the root CA key. |
rootExternalKeyId |
string | External key identifier for cloud KMS providers for the root CA key. Used when rotating internal-chain key chains backed by external KMS. |
rootJwk |
||
rotationEnabled |
boolean | |
rotationIntervalDays |
number | Rotation interval in days. Key material will be rotated after this many days. |
tenant |
The tenant that owns this key chain. | |
tenantId |
string | Tenant ID for the key chain. |
updatedAt |
string(date-time) | The timestamp when the key chain was last updated. |
usage |
string | The usage type of the keys (sign or encrypt). |
usageType |
string | The purpose/role of this key chain in the system. |
KeyChainExportDto¶
| Name | Type | Description |
|---|---|---|
crt |
Array<string> | Certificate chain in PEM format (leaf first, then intermediates/CA). |
description |
string | Human-readable description. |
id |
string | Key chain ID. |
key |
The private key in JWK format (EC). | |
kmsProvider |
string | KMS provider name. |
rotationPolicy |
Rotation policy. | |
usageType |
string | Usage type for this key chain. |
KeyChainImportDto¶
| Name | Type | Description |
|---|---|---|
crt |
Array<string> | Certificate chain (leaf first). Each entry may be PEM or base64-encoded DER; values are normalized to PEM during import. When rotationPolicy.enabled=true, the last certificate in the chain is treated as the root CA certificate. |
description |
string | Human-readable description. |
id |
string | ID for the key chain. If not provided, a new UUID will be generated. |
key |
The private key in JWK format. | |
kmsProvider |
string | KMS provider to use. Defaults to 'db'. |
rotationPolicy |
Rotation policy. When enabled, the imported key becomes a root CA signer and a new leaf key is generated. If crt is provided, the selected root CA certificate must have CA=true and its public key must match the imported private key. | |
usageType |
string | Usage type for this key chain. |
KeyChainResponseDto¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
Active signing key's certificate. Not present for encryption keys. | |
activePublicKey |
Active signing key's public key info. | |
createdAt |
string(date-time) | Timestamp when the key chain was created. |
description |
string | Human-readable description. |
id |
string | Unique identifier for the key chain. |
kmsProvider |
string | KMS provider used for this key chain. |
previousCertificate |
Previous signing key's certificate (if in grace period). | |
previousKeyExpiry |
string(date-time) | Previous key expiry date. |
previousPublicKey |
Previous signing key's public key info (if in grace period). | |
rootCertificate |
Root CA certificate (only for internalChain type). | |
rotationPolicy |
Rotation policy configuration. | |
type |
string | Type of key chain (standalone or internalChain). |
updatedAt |
string(date-time) | Timestamp when the key chain was last updated. |
usageType |
string | Usage type of the key chain. |
KeyChainUpdateDto¶
| Name | Type | Description |
|---|---|---|
activeCertificate |
string | Active certificate chain in PEM format. Used for external certificate updates. |
description |
string | Human-readable description for the key chain. |
rotationPolicy |
Rotation policy configuration. |
KmsConfigDto¶
| Name | Type | Description |
|---|---|---|
defaultProvider |
string | ID of the default KMS provider. Defaults to "db" if not set. |
providers |
Array<> | List of KMS provider configurations. Each provider must have a unique id and a type. |
KmsProviderCapabilitiesDto¶
| Name | Type | Description |
|---|---|---|
canCreate |
boolean | Whether the provider supports generating new keys. |
canDelete |
boolean | Whether the provider supports deleting keys. |
canImport |
boolean | Whether the provider supports importing existing keys. |
defaultAlg |
string | Default signing algorithm used when caller does not specify one. |
supportedAlgs |
Array<string> | Signing algorithms supported by the provider. |
KmsProviderInfoDto¶
| Name | Type | Description |
|---|---|---|
capabilities |
Capabilities of this provider. | |
description |
string | Human-readable description of this provider instance. |
name |
string | Unique provider ID (matches the id in kms.json). |
type |
string | Type of the KMS provider (db, vault, aws-kms). |
KmsProvidersResponseDto¶
| Name | Type | Description |
|---|---|---|
default |
string | The default KMS provider name. |
providers |
Array<KmsProviderInfoDto> | Detailed info for each registered KMS provider. |
KmsTenantConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
effectiveConfig |
Effective configuration used at runtime for the tenant (global + tenant merge). | |
tenantConfig |
Tenant-specific KMS configuration from |
ManagedAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Unique identifier for this authorization server |
label |
string | Human-friendly label for the UI |
type |
string | Authorization server implementation type |
ManagedUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
id |
string | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
tenantId |
string | |
username |
string |
MetadataSchemaDto¶
| Name | Type | Description |
|---|---|---|
formatIdentifier |
string | The credential format identifier |
id |
string | Unique identifier for this schema entry |
integrity |
string | Subresource Integrity hash for the schema |
meta |
Format-specific metadata for the schema entry | |
uri |
string | URI to the schema definition |
MsoMdocClaimsQuery¶
| Name | Type | Description |
|---|---|---|
id |
string | |
intent_to_retain |
boolean | Whether the holder should be allowed to retain the claim in an mso_mdoc response. |
path |
Array<string> | |
values |
Array<string> |
MsoMdocCredentialQueryMeta¶
| Name | Type | Description |
|---|---|---|
doctype_value |
string | Document type identifier accepted for mso_mdoc credentials. |
NoneTrustPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string |
NotificationRequestDto¶
| Name | Type | Description |
|---|---|---|
event |
string | |
notification_id |
string |
Object¶
OfferRequestDto¶
| Name | Type | Description |
|---|---|---|
authorization_server |
string | Authorization server id from issuer configuration. If omitted, the first enabled server is used. |
credentialClaims |
Example: {'citizen': {'type': 'inline', 'claims': {'given_name': 'John', 'family_name': 'Doe'}}} |
Credential claims configuration per credential. Keys must match credentialConfigurationIds. |
credentialConfigurationIds |
Array<string> | List of credential configuration ids to be included in the offer. |
flow |
string | The flow type for the offer request. |
response_type |
string | The type of response expected for the offer request. |
tx_code |
string | Transaction code for pre-authorized code flow. |
tx_code_description |
string | Description for the transaction code (e.g., "Please enter the PIN sent to your email"). |
webhookEndpointId |
string | ID of the webhook endpoint to notify about the status of the issuance process. |
OfferResponse¶
| Name | Type | Description |
|---|---|---|
crossDeviceUri |
string | URI for cross-device flows (no redirect after completion) |
session |
string | |
uri |
string |
Oid4VpAuthorizationServerConfig¶
| Name | Type | Description |
|---|---|---|
enabled |
boolean | Whether this managed authorization server is enabled |
id |
string | Stable identifier used in the AS URL path |
immediateWalletRedirect |
boolean | Immediately redirect the browser into the wallet OID4VP request |
label |
string | Human-friendly label for the UI |
presentationConfigId |
string | Presentation configuration ID to use for OID4VP |
requireDPoP |
boolean | Require DPoP for token requests issued by this authorization server |
token |
Token configuration for this authorization server | |
type |
string | Authorization server implementation type |
PaginatedSessionResponseDto¶
| Name | Type | Description |
|---|---|---|
items |
Array<Session> | The sessions for the current page. |
page |
number | Current page number (1-based) |
pageSize |
number | Number of items per page |
total |
number | Total number of sessions matching the query |
totalPages |
number | Total number of pages |
ParResponseDto¶
| Name | Type | Description |
|---|---|---|
expires_in |
number | The expiration time for the request URI in seconds. |
request_uri |
string | The request URI for the Pushed Authorization Request. |
Pkcs11KmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
library |
string | Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders. |
pin |
string | User PIN used for C_Login. Supports ${ENV_VAR} placeholders. |
readOnly |
boolean | Open the PKCS#11 session in read-only mode. Defaults to false. |
slot |
Example: ${PKCS11_SLOT} |
Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders. |
type |
string | Type of the KMS provider. |
PolicyCredential¶
| Name | Type | Description |
|---|---|---|
claims |
Array<ClaimsQuery> | |
credential_sets |
Array<CredentialSetQuery> | |
credentials |
Array<> |
PresentationAttachment¶
| Name | Type | Description |
|---|---|---|
credential_ids |
Array<string> | |
data |
||
format |
string |
PresentationConfig¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
createdAt |
string(date-time) | The timestamp when the VP request was created. |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
registrationCertCache |
Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
tenant |
The tenant that owns this object. | |
transaction_data |
Array<TransactionData> | |
updatedAt |
string(date-time) | The timestamp when the VP request was last updated. |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationConfigCreateDto¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
transaction_data |
Array<TransactionData> | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationConfigUpdateDto¶
| Name | Type | Description |
|---|---|---|
accessKeyChainId |
string | null | Optional ID of the access certificate to use for signing the presentation request. If not provided, the default access certificate for the tenant will be used. Note: This is intentionally NOT a TypeORM relationship because CertEntity uses a composite primary key (id + tenantId), and SQLite cannot create foreign keys that reference only part of a composite primary key. The relationship is handled at the application level in the service layer. |
attached |
Array<PresentationAttachment> | Attestation that should be attached |
dcql_query |
The DCQL query to be used for the VP request. | |
description |
string | null | Description of the presentation configuration. |
id |
string | Unique identifier for the VP request. |
lifeTime |
number | Lifetime how long the presentation request is valid after creation, in seconds. |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
registration_cert |
The registration certificate request containing the necessary details. | |
skewSeconds |
number | Clock skew tolerance for credential JWT time validation, in seconds. |
statusCheckMode |
string | Status list verification mode for presentations: strict (default), best_effort, or disabled. |
transaction_data |
Array<TransactionData> | |
webhookEndpointId |
string | null | Reference to the webhook endpoint used for notifications. Optional: if set, notifications will be sent to this endpoint. |
PresentationDuringIssuanceConfig¶
| Name | Type | Description |
|---|---|---|
type |
string | Link to the presentation configuration that is relevant for the issuance process |
PresentationRequest¶
| Name | Type | Description |
|---|---|---|
expected_origin |
string | Optional expected browser origin for DC API key-binding audience. Example: "http://localhost:8080" |
redirectUri |
string | Optional redirect URI to which the user-agent should be redirected after the presentation is completed. You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID. |
requestId |
string | Identifier of the presentation configuration |
response_type |
string | The type of response expected from the presentation request. |
skewSeconds |
number | Optional clock skew tolerance for this presentation offer, in seconds. If provided, this overrides the presentation configuration for the created session. |
transaction_data |
Array<TransactionData> | Optional transaction data to include in the OID4VP request. If provided, this will override the transaction_data from the presentation configuration. |
webhook |
Webhook configuration to receive the response. If not provided, the configured webhook from the configuration will be used. |
PublicKeyInfoDto¶
| Name | Type | Description |
|---|---|---|
alg |
string | Key algorithm (e.g., ES256). |
crv |
string | Curve (for EC keys). |
kid |
string | Key ID. |
kty |
string | Key type (e.g., EC). |
RegistrarConfigResponseDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
hasPassword |
boolean | Indicates whether a password is configured (actual password is never returned) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
RegistrationCertificateBody¶
| Name | Type | Description |
|---|---|---|
credentials |
Array<> | |
intermediary |
string | |
privacy_policy |
string | |
provided_attestations |
Array<> | |
purpose |
Array<RegistrationCertificatePurpose> | |
support_uri |
string |
RegistrationCertificateDefaults¶
| Name | Type | Description |
|---|---|---|
privacy_policy |
string | Default privacy policy URL for registration certificate creation. |
support_uri |
string | Default support contact URI for registration certificate creation. |
RegistrationCertificatePurpose¶
| Name | Type | Description |
|---|---|---|
content |
string | |
lang |
string |
RegistrationCertificateRequest¶
| Name | Type | Description |
|---|---|---|
body |
Registration certificate creation payload. This is merged with tenant-level registrar defaults when a certificate is created. | |
id |
string | Optional registrar-side certificate identifier. If provided and still valid, EUDIPLO reuses it instead of creating a new certificate. |
jwt |
string | Optional pre-existing registration certificate JWT. If provided, EUDIPLO forwards it as-is and does not create a new one. |
ResolveIssuerMetadataDto¶
| Name | Type | Description |
|---|---|---|
issuerUrl |
string(uri) | Issuer URL or full OpenID4VCI metadata URL to resolve server-side. |
ResolveSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
schemaMetadataUrl |
string(uri) | Schema metadata URL to resolve server-side. The response must contain a signedJwt field. |
ResolveSchemaMetadataJwtDto¶
| Name | Type | Description |
|---|---|---|
signedJwt |
string | Signed schema metadata JWT to resolve server-side. The JWT will be verified, resolved, and converted to DCQL. |
RoleDto¶
| Name | Type | Description |
|---|---|---|
role |
string | OAuth2 roles |
RootOfTrustPolicy¶
| Name | Type | Description |
|---|---|---|
policy |
string | |
values |
string |
RotationPolicyCreateDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. Defaults to rotation interval + 30 days grace period. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. Required when enabled is true. |
RotationPolicyImportDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether rotation is enabled. When true, the imported key becomes a root CA signer. |
intervalDays |
number | Rotation interval in days. |
RotationPolicyResponseDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
nextRotationAt |
string(date-time) | Next scheduled rotation date. |
RotationPolicyUpdateDto¶
| Name | Type | Description |
|---|---|---|
certValidityDays |
number | Certificate validity in days. |
enabled |
boolean | Whether automatic key rotation is enabled. |
intervalDays |
number | Rotation interval in days. |
SchemaMetaConfig¶
| Name | Type | Description |
|---|---|---|
attestationLoS |
string | Attestation Level of Security |
bindingType |
string | Cryptographic binding type |
id |
string | Optional override for the schema ID (attestation identifier URI). When not set, derived from vct (dc+sd-jwt) or docType (mso_mdoc). |
name |
string | Human-readable name of the schema metadata entry. Required when publishing new schema metadata; optional when linking an existing schema metadata id to a credential config. |
rulebookURI |
string | URI of the Attestation Rulebook. Required when publishing new schema metadata; optional when linking an existing schema metadata id to a credential config. |
schemaURIs |
Array<SchemaUriEntry> | Schema URIs per attestation format. When omitted, the format is derived from the credential config format field. |
trustedAuthorities |
Array<TrustAuthorityEntry> | Trust authorities for this attestation schema |
version |
string | Schema version in SemVer format |
SchemaMetadataResponseDto¶
| Name | Type | Description |
|---|---|---|
attestationLoS |
string | Level of security (LoS) of this attestation |
bindingType |
string | Required binding type between attestation and holder |
category |
string | Domain category for filtering |
createdAt |
string | Server creation timestamp |
deprecated |
boolean | Whether this version is deprecated |
deprecatedAt |
string | Timestamp when this version was marked as deprecated |
deprecationMessage |
string | Deprecation message shown to consumers |
displayName |
string | Optional human-readable schema name for UI display and filtering. |
id |
string | The unique, server-assigned identifier (UUID) for the schema metadata |
issuedAt |
string | Timestamp when the JWT was issued (from the `iat` claim) |
issuer |
string | Issuer from the JWT (`iss` claim) |
issuerOffers |
Array<IssuerOfferEntryDto> | Issuer offer entries for this schema metadata. Each entry provides a credential offer URL and user-facing description. |
rulebookIntegrity |
string | Subresource Integrity hash for the rulebook URI |
rulebookURI |
string | URI of the human-readable Rulebook document |
schemaURIs |
Array<MetadataSchemaDto> | Format-specific schema URIs for this schema metadata |
signedJwt |
string | The original signed JWT |
signerCertificate |
The access certificate used to sign this schema metadata | |
supersededByVersion |
string | The version that supersedes this one |
supportedFormats |
Array<string> | Credential formats in which this attestation is available |
tags |
Array<string> | Free-form tags for filtering and search |
trustedAuthorities |
Array<TrustAuthorityDto> | Trust frameworks / trust anchors applicable to this schema metadata |
updatedAt |
string | Last update timestamp |
version |
string | Version of this schema metadata (SemVer) |
SchemaMetadataVocabulariesDto¶
| Name | Type | Description |
|---|---|---|
categories |
Array<VocabularyEntryDto> | Allowed category values that can be used when updating schema metadata category. |
tags |
Array<VocabularyEntryDto> | Allowed tag values that can be used when updating schema metadata tags. |
version |
string | Vocabulary publication version for cache invalidation. |
SchemaUriEntry¶
| Name | Type | Description |
|---|---|---|
credentialConfigId |
string | Credential config ID to resolve and upload its schema content. When set, uri can be omitted and is resolved server-side. |
format |
string | Attestation format this schema URI applies to (e.g. dc+sd-jwt, mso_mdoc) |
meta |
Schema-format specific metadata (for example { vct: 'urn:example:vct' } for dc+sd-jwt). | |
uri |
string | URI pointing to the schema document for this format |
Session¶
| Name | Type | Description |
|---|---|---|
auth_queries |
Authorization queries associated with the session. Encrypted at rest. | |
authorization_code |
string | |
browserOrigin |
string | Browser page origin recorded at offer time for BrowserHandover session transcript. Used exclusively by the ISO 18013-7 Annex C flow. |
clientId |
string | Client ID used in the OID4VP authorization request. |
consumed |
boolean | Flag indicating whether the session offer has been consumed. Prevents replay attacks by ensuring each offer can only be used once. For OID4VCI: set after successful token exchange. For OID4VP: set after successful response validation. |
consumedAt |
string(date-time) | Timestamp of the first consumption event for the session offer. For OID4VCI this can be URI resolution or later flow completion. Null if no consumption event has happened yet. |
createdAt |
string(date-time) | The timestamp when the request was created. |
credentialPayload |
Credential payload containing the offer request details. Encrypted at rest - may contain sensitive claim data. | |
credentials |
Array<> | Verified credentials from the presentation process. Encrypted at rest - contains personal information. |
dcApiProtocol |
string | DC API sub-protocol: "oid4vp" (OpenID4VP via DC API) or "iso-18013-7" (org.iso.mdoc). Null/undefined means the standard OID4VP flow (useDcApi=false). |
errorReason |
string | Error reason if the session failed. Stores the error message when status is 'failed'. |
expiresAt |
string(date-time) | The timestamp when the request is set to expire. |
externalIssuer |
string | |
externalSubject |
string | The subject (sub) from the external authorization server token. Used to identify the user at the external AS. |
id |
string | Unique identifier for the session. |
notifications |
Array<> | Notifications associated with the session. |
offer |
Credential offer object containing details about the credential offer or presentation request. Encrypted at rest. | |
offerUrl |
string | Offer URL for the credential offer. |
parsedWebhook |
Where to send the claims webhook response. | |
redirectUri |
string | null | Redirect URI to which the user-agent should be redirected after the presentation is completed. |
refresh_token |
string | Refresh token for the session - used to obtain a new access token. |
refresh_token_expires_at |
string(date-time) | Expiration timestamp for the refresh token. Used to validate refresh_token grant requests. |
request_uri |
string | Request URI from the authorization request. |
requestId |
string | |
requestObject |
string | Signed presentation auth request. |
requestUrl |
string | The URL of the presentation auth request. |
responseCode |
string | Cryptographic random code generated after successful VP Token processing. Per OID4VP spec Section 13.3, included in redirect_uri so only the legitimate frontend (which receives the redirect) can confirm the session completed. |
responseEncryptionPrivateJwk |
Per-authorization-request private encryption key used to decrypt wallet responses. Encrypted at rest. | |
responseUri |
string | Response URI used in the OID4VP authorization request. |
skewSeconds |
number | Per-session clock skew tolerance for presentation credential JWT time validation. |
status |
string | Status of the session. |
tenant |
The tenant that owns this object. | |
tenantId |
string | Tenant ID for multi-tenancy support. |
transaction_data |
Array<TransactionData> | Transaction data to include in the OID4VP authorization request. Can be overridden per-request from the presentation configuration. |
txCodeFailedAttempts |
number | Number of failed tx_code (transaction code) validation attempts. Used to enforce brute-force protection in the pre-authorized code flow. Reset implicitly when the session is consumed successfully. |
updatedAt |
string(date-time) | The timestamp when the request was last updated. |
useDcApi |
boolean | Flag indicating whether to use the DC API for the presentation request. |
vp_nonce |
string | Nonce from the Verifiable Presentation request. |
walletNonce |
string | Cryptographic random nonce used in wallet-facing URLs (response_uri, request_uri, state). Per OID4VP spec Section 13.3, this separates the wallet-facing identifier (request-id) from the frontend-facing session ID (transaction-id) to prevent session fixation. |
webhookEndpointId |
string | ID of the webhook endpoint to notify about issuance status. |
SessionLogEntryResponseDto¶
| Name | Type | Description |
|---|---|---|
detail |
Additional structured detail | |
id |
string | Log entry ID |
level |
string | Log level |
message |
string | Log message |
sessionId |
string | Session ID |
stage |
string | Flow stage |
timestamp |
string(date-time) | Timestamp of the log entry |
SessionStorageConfig¶
| Name | Type | Description |
|---|---|---|
cleanupMode |
string | Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII. |
ttlSeconds |
number | Time-to-live for sessions in seconds. If not set, uses global SESSION_TTL. |
SignSchemaMetaConfigDto¶
| Name | Type | Description |
|---|---|---|
config |
The schema metadata configuration to submit. Registrar builds and signs the final schema metadata. | |
credentialConfigId |
string | ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID. |
pinMode |
string | How to update credential config pinning after publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to a different schema id. |
SignVersionSchemaMetaConfigDto¶
| Name | Type | Description |
|---|---|---|
config |
The schema metadata configuration to submit as a new version. Must include the existing id. | |
credentialConfigId |
string | Optional credential config to update pinning for after successful version publish. |
pinMode |
string | How to update credential config pinning after version publish. keep_current: do not change existing pin (unless empty). update_to_new_version: update pinned version under current id. replace_id: repoint pin to config.id. |
StatusListAggregationDto¶
| Name | Type | Description |
|---|---|---|
status_lists |
Array<string> | Array of status list token URIs |
StatusListConfig¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status entry: 1 (valid/revoked), 2 (with suspended), 4/8 (extended). If not set, uses global STATUS_BITS. |
capacity |
number | The capacity of the status list. If not set, uses global STATUS_CAPACITY. |
enableAggregation |
boolean | If true, include aggregation_uri in status list JWTs for pre-fetching support (default: true). |
immediateUpdate |
boolean | If true, regenerate JWT immediately on status changes. If false (default), use lazy regeneration on TTL expiry. |
ttl |
number | TTL in seconds for the status list JWT. If not set, uses global STATUS_TTL. |
StatusListImportDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | Bits per status value. If not provided, uses tenant or global defaults. |
capacity |
number | Capacity of the status list. If not provided, uses tenant or global defaults. |
credentialConfigurationId |
string | null | Credential configuration ID to bind this list exclusively to. Leave empty for a shared list. |
id |
string | Unique identifier for the status list |
keyChainId |
string | Key chain ID to use for signing. Leave empty to use the tenant's default StatusList key chain. |
StatusListResponseDto¶
| Name | Type | Description |
|---|---|---|
availableEntries |
number | Number of available entries |
bits |
number | Bits per status value |
capacity |
number | Total capacity of the status list |
createdAt |
string(date-time) | Creation timestamp |
credentialConfigurationId |
string | null | Credential configuration ID this list is bound to. Null means shared. |
expiresAt |
string(date-time) | null | JWT expiration timestamp. Null if JWT has not been generated yet. |
id |
string | Unique identifier for the status list |
keyChainId |
string | null | Key chain ID used for signing. Null means using the tenant's default. |
tenantId |
string | The tenant ID |
uri |
string | The public URI for this status list |
usedEntries |
number | Number of entries in use |
StatusUpdateDto¶
| Name | Type | Description |
|---|---|---|
credentialConfigurationId |
string | The ID of the credential configuration This is optional, if not provided, all credentials will be revoked of the session. |
sessionId |
string | The session ID of the user |
status |
number | The status of the credential 0 = valid, 1 = revoked, 2 = suspended |
TenantEntity¶
| Name | Type | Description |
|---|---|---|
clients |
Array<ClientEntity> | The clients associated with the tenant. |
description |
string | The description of the tenant. |
id |
string | The unique identifier for the tenant. |
name |
string | The name of the tenant. |
sessionConfig |
Session storage configuration for this tenant. Controls TTL and cleanup behavior. | |
status |
string | The current status of the tenant. |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
TokenResponse¶
| Name | Type | Description |
|---|---|---|
access_token |
string | |
expires_in |
number | |
refresh_token |
string | |
state |
string | |
token_type |
string |
TransactionData¶
| Name | Type | Description |
|---|---|---|
credential_ids |
Array<string> | |
type |
string |
TrustAuthorityDto¶
| Name | Type | Description |
|---|---|---|
frameworkType |
string | Type of trust framework |
id |
string | Unique identifier for this trust authority entry |
value |
string | URI or identifier for the trust list / authority |
verificationMethod |
Verification method for the trust list signature (e.g., JWK) |
TrustAuthorityEntry¶
| Name | Type | Description |
|---|---|---|
frameworkType |
string | Trust framework type (ignored when trustListId is set) |
trustListId |
string | Trust list ID to resolve from the database. When set, frameworkType, value, and verificationMethod are derived automatically. |
value |
string | URI of the trust list or trust anchor (ignored when trustListId is set) |
verificationMethod |
Optional verification material for external trusted authorities (for example a JWK). For internal trust-list URLs, EUDIPLO resolves verification material from the database. |
TrustedAuthorityQueryEtsiTl¶
| Name | Type | Description |
|---|---|---|
type |
string | |
values |
Array<TrustListRef> |
TrustedAuthorityQueryOpenIdFederation¶
| Name | Type | Description |
|---|---|---|
type |
string | |
values |
Array<string> |
TrustList¶
| Name | Type | Description |
|---|---|---|
createdAt |
string(date-time) | |
data |
The full trust list JSON (generated LoTE structure) | |
description |
string | |
entityConfig |
Array<> | The original entity configuration used to create this trust list. Stored for round-tripping when editing. |
id |
string | Unique identifier for the trust list |
jwt |
string | The signed JWT representation of this trust list |
keyChain |
KeyChainEntity | |
keyChainId |
string | |
sequenceNumber |
number | The sequence number for versioning (incremented on updates) |
tenant |
The tenant that owns this object. | |
tenantId |
string | The tenant ID for which the VP request is made. |
updatedAt |
string(date-time) |
TrustListCreateDto¶
| Name | Type | Description |
|---|---|---|
data |
The full trust list JSON (generated LoTE structure) | |
description |
string | |
entities |
Array<> | |
id |
string | |
keyChainId |
string |
TrustListEntityInfo¶
| Name | Type | Description |
|---|---|---|
contactUri |
string | |
country |
string | |
lang |
string | |
locality |
string | |
name |
string | |
postalCode |
string | |
streetAddress |
string | |
uri |
string |
TrustListRef¶
| Name | Type | Description |
|---|---|---|
trustListId |
string | Managed local trust-list identifier. When provided, verifier material is resolved server-side from the trust list key chain. |
url |
string | Trust-list JWT URL. Required for external trust lists when trustListId is not set. |
verifierKey |
JWK used to verify trust-list JWT signatures for external trusted authority values. | |
verifierX509Der |
string | Base64 DER-encoded X.509 certificate used to verify trust-list JWT signatures for external trusted authority values. |
TrustListVersion¶
| Name | Type | Description |
|---|---|---|
createdAt |
string(date-time) | |
data |
The full trust list JSON at this version | |
entityConfig |
The entity configuration at this version | |
id |
string | |
jwt |
string | The signed JWT at this version |
sequenceNumber |
number | The sequence number at the time this version was created |
tenantId |
string | |
trustList |
TrustList | |
trustListId |
string |
UpdateAttributeProviderDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | |
name |
string | |
url |
string |
UpdateClientDto¶
| Name | Type | Description |
|---|---|---|
allowedIssuanceConfigs |
Array<string> | List of issuance config IDs this client can use. If empty/null, all configs are allowed. |
allowedPresentationConfigs |
Array<string> | List of presentation config IDs this client can use. If empty/null, all configs are allowed. |
description |
string | The description of the client. |
roles |
Array<string> | The roles assigned to the client. |
UpdateIssuanceDto¶
| Name | Type | Description |
|---|---|---|
authorizationServers |
Array<> | Dedicated managed authorization servers hosted by this issuer. At least one entry is required. |
batchSize |
number | Value to determine the amount of credentials that are issued in a batch. Default is 1. |
credentialRequestEncryption |
boolean | Whether `credential_request_encryption` should be advertised in the credential issuer metadata. |
credentialResponseEncryption |
boolean | Whether `credential_response_encryption` should be advertised in the credential issuer metadata. |
display |
Array<DisplayInfo> | |
dPopRequired |
boolean | Indicates whether DPoP is required for the issuance process. Default value is true. |
federation |
Optional OpenID Federation configuration used for trust evaluation. When omitted, trust checks rely on existing LoTE trust-list behavior. | |
registrationCertificate |
Optional registration certificate configuration for issuer metadata (`issuer_info`). Supports importing an existing JWT or generating one via registrar. | |
registrationCertificateCache |
Server-managed cache for generated issuer registration certificates. | |
signingKeyId |
string | Key ID for signing access tokens. If unset, the default signing key is used. |
txCodeMaxAttempts |
number | null | Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5. |
walletAttestationRequired |
boolean | Indicates whether wallet attestation is required for the token endpoint. When enabled, wallets must provide OAuth-Client-Attestation headers. Default value is false. |
walletProviderTrustLists |
Array<WalletProviderTrustListRefDto> | Trust lists containing trusted wallet providers. Each entry MUST include either `verifierKey` or `verifierX509Der`. |
UpdateIssuerOfferDto¶
| Name | Type | Description |
|---|---|---|
credentialOfferUrl |
string | URL where the user can receive a credential offer from this issuer. |
description |
string | Human-readable description to help users choose the right issuer. |
UpdateRegistrarConfigDto¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The OIDC client ID for the registrar |
clientSecret |
string | The OIDC client secret (optional, for confidential clients) |
oidcUrl |
string | The OIDC issuer URL for authentication (e.g., Keycloak realm URL) |
password |
string | The password for OIDC login (stored in plaintext) |
registrarUrl |
string | The base URL of the registrar API |
registrationCertificateDefaults |
Optional default values merged into registration certificate creation requests (for example privacy_policy, support_uri) | |
username |
string | The username for OIDC login |
UpdateSchemaMetadataDto¶
| Name | Type | Description |
|---|---|---|
category |
string | Domain category for filtering |
displayName |
string | Optional human-readable schema name for UI display and search |
issuerOffers |
Array<UpdateIssuerOfferDto> | Issuer offer entries shown to users, each with credential-offer URL and description |
tags |
Array<string> | Predefined tags for filtering and search |
UpdateSessionConfigDto¶
| Name | Type | Description |
|---|---|---|
cleanupMode |
string | Cleanup mode: 'full' deletes everything, 'anonymize' keeps metadata but removes PII. |
ttlSeconds |
number | null | Time-to-live for sessions in seconds. Set to null to use global default. |
UpdateStatusListConfigDto¶
| Name | Type | Description |
|---|---|---|
bits |
number | null | Bits per status entry. Set to null to reset to global default. |
capacity |
number | null | The capacity of the status list. Set to null to reset to global default. |
enableAggregation |
boolean | null | If true, include aggregation_uri in status list JWTs for pre-fetching support. Set to null to reset to default (true). |
immediateUpdate |
boolean | null | If true, regenerate JWT on every status change. Set to null to reset to default (false). |
ttl |
number | null | TTL in seconds for the status list JWT. Set to null to reset to global default. |
UpdateStatusListDto¶
| Name | Type | Description |
|---|---|---|
credentialConfigurationId |
string | null | Credential configuration ID to bind this list exclusively to. Set to null to make this a shared list. |
keyChainId |
string | null | Key chain ID to use for signing. Set to null to use the tenant's default StatusList key chain. |
UpdateTenantDto¶
| Name | Type | Description |
|---|---|---|
description |
string | The description of the tenant. |
name |
string | The name of the tenant. |
roles |
Array<string> | |
sessionConfig |
Session storage configuration. Controls TTL and cleanup behavior. | |
statusListConfig |
Status list configuration for this tenant. Only affects newly created status lists. |
UpdateUserDto¶
| Name | Type | Description |
|---|---|---|
email |
string | |
enabled |
boolean | |
password |
string | |
roles |
Array<string> | |
temporaryPassword |
string | One-time temporary password returned only on user creation. |
username |
string |
UpdateWebhookEndpointDto¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
url |
string |
UpstreamOidcConfig¶
| Name | Type | Description |
|---|---|---|
clientId |
string | The client ID registered with the upstream provider |
clientSecret |
string | The client secret for confidential clients |
issuer |
string(uri) | The OIDC issuer URL of the upstream provider |
scopes |
Array<string> | Scopes to request from the upstream provider |
VaultKmsConfigDto¶
| Name | Type | Description |
|---|---|---|
description |
string | Human-readable description of this provider instance. |
id |
string | Unique identifier for this provider instance. Used when generating keys to specify which provider to use. |
type |
string | Type of the KMS provider. |
vaultToken |
string | Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders. |
vaultUrl |
string | URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders. |
VCT¶
| Name | Type | Description |
|---|---|---|
description |
string | |
extends |
string | |
extends#integrity |
string | |
name |
string | |
schema_uri |
string | |
schema_uri#integrity |
string | |
vct |
string |
VocabularyEntryDto¶
| Name | Type | Description |
|---|---|---|
code |
string | Stable machine-readable value to submit in schema metadata category/tags fields. |
label |
string | Display label for UI rendering. |
replacedBy |
string | Replacement code when status is deprecated. |
status |
string | Vocabulary lifecycle status. |
WalletProviderTrustListRefDto¶
| Name | Type | Description |
|---|---|---|
url |
string(uri) | |
verifierKey |
JWK used to verify the trust-list JWT signature. | |
verifierX509Der |
string | Base64 DER-encoded X.509 certificate used to verify the trust-list JWT signature. |
WebHookAuthConfigHeader¶
| Name | Type | Description |
|---|---|---|
config |
Configuration for API key authentication. This is required if the type is 'apiKey'. | |
type |
string | The type of authentication used for the webhook. |
WebHookAuthConfigNone¶
| Name | Type | Description |
|---|---|---|
type |
string | The type of authentication used for the webhook. |
WebhookConfig¶
| Name | Type | Description |
|---|---|---|
auth |
Optional authentication configuration for the webhook. If not provided, no authentication will be used. | |
includeRawTokensFor |
Array<string> | List of credential IDs to include raw tokens for (e.g., ['sca_credential']) |
url |
string | The URL to which the webhook will send notifications. |
WebhookEndpointEntity¶
| Name | Type | Description |
|---|---|---|
auth |
||
description |
string | null | |
id |
string | Unique identifier for the webhook endpoint |
name |
string | |
tenant |
TenantEntity | |
tenantId |
string | |
url |
string |
More documentation¶
Documentation
For more information: https://openwallet-foundation.github.io/eudiplo/docs/latest/