{
"openapi" : "3.1.0",
"info" : {
"title" : "walt.id Enterprise",
"description" : "Interact with the walt.id Enterprise. Version is reported to be 1.1.1 and this service instance was started 2026-10-01T15:18:57Z.
Questions about anything here? Visit support.
Any HTTP status code of 200 - 299 indicates request success, 400 - 499 client error / invalid request, 500+ internal server processing exception.",
"contact" : {
"name" : "walt.id",
"url" : "https://walt.id",
"email" : "office@walt.id"
},
"license" : {
"name" : "Commercial License",
"url" : "https://walt.id/enterprise-stack"
},
"version" : "1.1.1"
},
"externalDocs" : {
"description" : "docs.walt.id",
"url" : "https://docs.walt.id"
},
"servers" : [ {
"url" : "/",
"description" : "Development Server"
} ],
"tags" : [ ],
"paths" : {
"/features/registered" : {
"get" : {
"tags" : [ "Feature management" ],
"summary" : "List registered features",
"description" : "Lists every feature flag registered by this service instance, regardless of its current state.\nThe response is an object whose keys are stable feature identifiers and whose values are\nhuman-readable descriptions. Use it to discover valid identifiers before changing\n`enabledFeatures` or `disabledFeatures` in feature configuration.\n\nThis endpoint is intentionally public and requires no authentication. It exposes feature names\nand descriptions, but never feature configuration values or secrets. Feature descriptions must\ntherefore not contain sensitive information.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "All feature identifiers registered by this service and their descriptions",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
},
"examples" : {
"Registered feature catalog" : {
"value" : {
"web" : "Web service",
"openapi" : "Enables openapi endpoints",
"persistence" : "Storage"
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/features/state" : {
"get" : {
"tags" : [ "Feature management" ],
"summary" : "Show feature states",
"description" : "Shows how every registered feature is resolved at runtime. The three buckets are mutually\nexclusive:\n\n- `enabled`: features successfully enabled during startup. This includes base features,\n explicitly enabled features, and features whose declared default is enabled.\n- `disabled`: features explicitly listed in `disabledFeatures` configuration.\n- `defaultedDisabled`: features that were not explicitly configured and whose declared default\n is disabled.\n\nEach bucket contains `features`, a map from stable feature identifiers to human-readable\ndescriptions, and `total`, the number of entries in that map. There is intentionally no\n`defaultedEnabled` bucket: default-enabled features are activated during startup and reported\nunder `enabled`.\n\nThis endpoint is intentionally public and requires no authentication. It is intended for\ndiagnostics and exposes the service's feature posture, so deployments should account for that\noperational metadata exposure. It does not expose configuration values or secrets and must not\nbe used as an authorization decision point.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Runtime state of every registered feature",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformations"
},
"examples" : {
"Feature state buckets" : {
"value" : {
"enabled" : {
"features" : {
"web" : "Web service",
"openapi" : "Enables openapi endpoints"
},
"total" : 2
},
"disabled" : {
"features" : {
"debug-endpoints" : "Enables various debug endpoints"
},
"total" : 1
},
"defaultedDisabled" : {
"features" : {
"persistence" : "Storage"
},
"total" : 1
}
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/livez" : {
"get" : {
"tags" : [ ],
"parameters" : [ ],
"responses" : { },
"deprecated" : false
}
},
"/auth/account/emailpass" : {
"post" : {
"tags" : [ "Authentication" ],
"summary" : "Account authentication",
"description" : "Login with account. Applied Auth flow configuration(s) on this route are:\n```json\n|Method: email\n|-> Flow end (success)\n```\nEmail login is enabled. Use EmailPass.EmailPassCredentials request, e.g.:\n```json\n{\"email\":\"email@address\",\"password\":\"pass\"}\n```\nAfterwards, follow AuthSession response for more information.",
"parameters" : [ ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.EmailPass.EmailPassCredentials"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Successful authentication",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.sessions.AuthSessionInformation"
}
}
}
}
},
"deprecated" : false
}
},
"/auth/account/logout" : {
"post" : {
"tags" : [ "Authentication" ],
"summary" : "Logout",
"description" : "Invalidate a session or token. Provide Authorization Bearer token or auth cookie; optionally, a `sessionId` via route/query parameter or `X-Session-Id` header.",
"parameters" : [ ],
"responses" : { },
"deprecated" : false
}
},
"/v1/admin/account/register" : {
"post" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Register new account",
"description" : "Creates a new user account in the system through the administration API. This endpoint allows administrators to register accounts on behalf of users or for system setup purposes.\n\n**Use Cases:**\n- Administrative account creation for new users\n- Bulk account provisioning during system setup\n- Creating accounts with specific initial configurations\n- Setting up service accounts or API accounts\n\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Account registration request with profile, preferences, and initial authentication",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.AccountService.UnwrappedAccountRegistrationRequest"
},
"examples" : {
"Account registration with email/password" : {
"value" : {
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna"
},
"preferences" : {
"timeZone" : "UTC",
"languagePreference" : "EN"
},
"initialAuth" : {
"type" : "email",
"identifier" : {
"type" : "email",
"email" : "max.mustermann@example.org"
},
"data" : {
"type" : "email",
"password" : "password123456"
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Account successfully registered",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Registered account" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - validation errors in profile data, invalid email format, or invalid country code",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
},
"409" : {
"description" : "Account already exists with the provided email address",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/by-email/{email}" : {
"get" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Get account by email",
"description" : "Retrieves account information by email address. This administrative endpoint allows looking up accounts using their email identifier. Returns complete account information including roles and preferences\n\n**Use Cases:**\n- Look up account details by email address\n- Verify account existence before operations\n- Retrieve account information for administrative purposes\n- Support account recovery and management workflows\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "email",
"in" : "path",
"description" : "The email address of the account to retrieve",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "max.mustermann@example.org"
} ],
"responses" : {
"200" : {
"description" : "Account information for the specified email",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Account with email" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
}
}
}
}
}
},
"404" : {
"description" : "No account found with the specified email address",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/{id}/roles/add/{organization}/{role}" : {
"post" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Add role to account",
"description" : "Adds a role to an account within a specific organization. This allows administrators to grant permissions to accounts by assigning them roles that define access levels and capabilities.\n\n**Use Cases:**\n- Grant permissions to accounts by assigning roles\n- Add accounts to organizational roles\n- Update account access levels within organizations\n- Manage role-based access control (RBAC) for accounts\n\n**Important Notes:**\n- Requires superadmin privileges\n- The role must exist in the specified organization\n- Account permission cache is invalidated after role addition\n- Roles are scoped to specific organizations\n\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID) to add the role to",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
}, {
"name" : "organization",
"in" : "path",
"description" : "The organization ID where the role should be added",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid"
}, {
"name" : "role",
"in" : "path",
"description" : "The role ID to add to the account",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "admin"
} ],
"responses" : {
"200" : {
"description" : "Updated organization roles for the account",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
},
"examples" : {
"Updated roles" : {
"value" : {
"waltid" : [ "admin", "user", "editor" ],
"waltid.tenant1" : [ "viewer" ]
}
}
}
}
}
},
"404" : {
"description" : "Account, organization, or role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/{id}/roles/remove/{organization}/{role}" : {
"post" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Remove role from account",
"description" : "Removes a role from an account within a specific organization. This allows administrators to revoke permissions by removing roles that define access levels and capabilities.\n\n**Use Cases:**\n- Revoke permissions from accounts by removing roles\n- Remove accounts from organizational roles\n- Downgrade account access levels within organizations\n- Manage role-based access control (RBAC) for accounts\n\n**Important Notes:**\n- Requires superadmin privileges\n- The role must be currently assigned to the account\n- Account permission cache is invalidated after role removal\n- Roles are scoped to specific organizations\n\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID) to remove the role from",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
}, {
"name" : "organization",
"in" : "path",
"description" : "The organization ID where the role should be removed",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid"
}, {
"name" : "role",
"in" : "path",
"description" : "The role ID to remove from the account",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "admin"
} ],
"responses" : {
"200" : {
"description" : "Updated organization roles for the account",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
},
"examples" : {
"Updated roles" : {
"value" : {
"waltid" : [ "user" ]
}
}
}
}
}
},
"404" : {
"description" : "Account, organization, or role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/accounts" : {
"get" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "List all accounts",
"description" : "Retrieves a paginated list of all accounts in the system. This endpoint allows administrators to view and manage all user and API accounts.\n\n**Use Cases:**\n- View all accounts in the system\n- Audit account access and management\n- Export account information for reporting\n- Support account administration workflows\n\n**Important Notes:**\n- Results are paginated for performance\n- Returns both user accounts and API accounts\n- Requires superadmin authentication\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "maxPageSize",
"in" : "query",
"description" : "How many entries to return per page",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "page",
"in" : "query",
"description" : "How many pages to skip",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "Paginated list of accounts",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"title" : "ArrayList"
},
"examples" : {
"List of accounts" : {
"value" : [ {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
} ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Create a new account",
"description" : "Creates a new account in the system through the CRUD API. This endpoint allows administrators to create accounts with full control over account properties.\n\n**Use Cases:**\n- Administrative account creation\n- Bulk account provisioning\n- Creating accounts with specific configurations\n- Setting up service or API accounts\n\n**Important Notes:**\n- Requires superadmin authentication\n- Account ID can be specified or will be generated\n- Full account object including profile, preferences, and roles can be set\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Account creation request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Account creation" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Account created successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid account data or validation errors",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
},
"409" : {
"description" : "Account with provided ID already exists",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/{id}" : {
"get" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Get account by ID",
"description" : "Retrieves a specific account by its ID. This endpoint allows administrators to view detailed information about a particular account.\n\n**Use Cases:**\n- View account details for administration\n- Retrieve account information for auditing\n- Access account profile and preferences\n- Review account roles and permissions\n\n**Important Notes:**\n- Requires superadmin authentication\n- Returns complete account object including all profile and preference data\n- Account ID must be a valid UUID\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID)",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
} ],
"responses" : {
"200" : {
"description" : "Account information",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Account details" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
}
}
}
}
}
},
"404" : {
"description" : "Account not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Update an account",
"description" : "Updates an existing account in the system. This endpoint allows administrators to modify account properties including profile, preferences, and roles.\n\n**Use Cases:**\n- Update account profile information\n- Modify account preferences\n- Change account roles and permissions\n- Update account flags or settings\n\n**Important Notes:**\n- Requires superadmin authentication\n- Account ID in the path must match the ID in the request body\n- All account properties can be updated\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID)",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
} ],
"requestBody" : {
"description" : "Updated account data",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Updated account" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid" : [ "admin", "user" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"202" : {
"description" : "Account updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid account data or ID mismatch",
"headers" : { }
},
"404" : {
"description" : "Account not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Administration (Global) / Accounts" ],
"summary" : "Delete an account",
"description" : "Deletes an account from the system. This endpoint permanently removes an account and all associated data.\n\n**Use Cases:**\n- Remove accounts that are no longer needed\n- Clean up test or temporary accounts\n- Support account lifecycle management\n- Comply with data deletion requests\n\n**Important Notes:**\n- Requires superadmin authentication\n- This operation is permanent and cannot be undone\n- All account data including roles and preferences will be deleted\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID) to delete",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
} ],
"responses" : {
"202" : {
"description" : "Account deleted successfully",
"headers" : { }
},
"404" : {
"description" : "Account not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/organizations" : {
"get" : {
"tags" : [ "Administration (Global) / Organizations" ],
"summary" : "List all organizations",
"description" : "Retrieves a paginated list of all organizations in the system. This endpoint allows administrators to view and manage all organizations.\n\n**Use Cases:**\n- View all organizations in the system\n- Audit organization configurations\n- Export organization information for reporting\n- Support organization administration workflows\n\n**Important Notes:**\n- Results are paginated for performance\n- Returns complete organization objects including profile, billing, and configuration\n- Requires superadmin authentication\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "maxPageSize",
"in" : "query",
"description" : "How many entries to return per page",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "page",
"in" : "query",
"description" : "How many pages to skip",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "Paginated list of organizations",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization"
},
"title" : "ArrayList"
},
"examples" : {
"List of organizations" : {
"value" : [ {
"_id" : "waltid",
"profile" : {
"name" : "Example Organization"
},
"billing" : {
"billingCountry" : "AT",
"billingAddress" : "Liechtensteinstraße 111/115, 1090 Vienna",
"vatNr" : "ATU12345678",
"iban" : "AT611904300234573201",
"swift" : "BAWAATWW"
},
"configuration" : { }
} ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Administration (Global) / Organizations" ],
"summary" : "Create a new organization",
"description" : "Creates a new organization in the system through the CRUD API. This endpoint allows administrators to create organizations with full control over organization properties.\n\n**Use Cases:**\n- Administrative organization creation\n- Setting up new organizations for customers\n- Creating organizations with specific configurations\n- Bulk organization provisioning\n\n**Important Notes:**\n- Requires superadmin authentication\n- Organization ID must be valid (lowercase letters, digits, and hyphens)\n- Full organization object including profile, billing, and configuration can be set\n- Organization validation is performed before creation\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Organization creation request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization"
},
"examples" : {
"Organization creation" : {
"value" : {
"_id" : "waltid",
"profile" : {
"name" : "Example Organization"
},
"billing" : {
"billingCountry" : "AT",
"billingAddress" : "Liechtensteinstraße 111/115, 1090 Vienna",
"vatNr" : "ATU12345678",
"iban" : "AT611904300234573201",
"swift" : "BAWAATWW"
},
"configuration" : { }
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Organization created successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid organization data, validation errors, or invalid organization ID format",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
},
"409" : {
"description" : "Organization with provided ID already exists",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/organizations/{id}" : {
"get" : {
"tags" : [ "Administration (Global) / Organizations" ],
"summary" : "Get organization by ID",
"description" : "Retrieves a specific organization by its ID. This endpoint allows administrators to view detailed information about a particular organization.\n\n**Use Cases:**\n- View organization details for administration\n- Retrieve organization information for auditing\n- Access organization profile, billing, and configuration\n- Review organization settings\n\n**Important Notes:**\n- Requires superadmin authentication\n- Returns complete organization object including all profile, billing, and configuration data\n- Organization ID must be a valid organization identifier\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The organization ID",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid"
} ],
"responses" : {
"200" : {
"description" : "Organization information",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization"
},
"examples" : {
"Organization details" : {
"value" : {
"_id" : "waltid",
"profile" : {
"name" : "Example Organization"
},
"billing" : {
"billingCountry" : "AT",
"billingAddress" : "Liechtensteinstraße 111/115, 1090 Vienna",
"vatNr" : "ATU12345678",
"iban" : "AT611904300234573201",
"swift" : "BAWAATWW"
},
"configuration" : { }
}
}
}
}
}
},
"404" : {
"description" : "Organization not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Administration (Global) / Organizations" ],
"summary" : "Update an organization",
"description" : "Updates an existing organization in the system. This endpoint allows administrators to modify organization properties including profile, billing, and configuration.\n\n**Use Cases:**\n- Update organization profile information\n- Modify billing information\n- Update organization settings\n\n**Important Notes:**\n- Requires superadmin authentication\n- Organization ID in the path must match the ID in the request body\n- All organization properties can be updated\n- Organization validation is performed before update\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The organization ID",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid"
} ],
"requestBody" : {
"description" : "Updated organization data",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization"
},
"examples" : {
"Updated organization" : {
"value" : {
"_id" : "waltid",
"profile" : {
"name" : "Example Organization"
},
"billing" : {
"billingCountry" : "AT",
"billingAddress" : "Liechtensteinstraße 111/115, 1090 Vienna",
"vatNr" : "ATU12345678",
"iban" : "AT611904300234573201",
"swift" : "BAWAATWW"
},
"configuration" : { }
}
}
}
}
},
"required" : true
},
"responses" : {
"202" : {
"description" : "Organization updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid organization data, validation errors, or ID mismatch",
"headers" : { }
},
"404" : {
"description" : "Organization not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Administration (Global) / Organizations" ],
"summary" : "Delete an organization",
"description" : "Deletes an organization from the system. This endpoint permanently removes an organization and all associated data.\n\n**Use Cases:**\n- Remove organizations that are no longer needed\n- Clean up test or temporary organizations\n- Support organization lifecycle management\n- Comply with data deletion requests\n\n**Important Notes:**\n- Requires superadmin authentication\n- This operation is permanent and cannot be undone\n- All organization data including configuration and associated resources will be deleted\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The organization ID to delete",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid"
} ],
"responses" : {
"202" : {
"description" : "Organization deleted successfully",
"headers" : { }
},
"404" : {
"description" : "Organization not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/auth/{id}/add-initial" : {
"post" : {
"tags" : [ "Administration (Global) / Authentication" ],
"summary" : "Add initial authentication to account",
"description" : "Adds an initial authentication method to an existing account. This allows administrators to configure how accounts authenticate to the system, such as email/password or other authentication methods.\n\n**Use Cases:**\n- Configure authentication methods for existing accounts\n- Add additional authentication methods to accounts\n- Set up initial authentication for accounts created through other means\n- Enable password reset or authentication method changes\n\n**Important Notes:**\n- Requires superadmin privileges\n- The account must already exist\n- Authentication data (e.g., passwords) are securely stored and hashed\n- Multiple authentication methods can be associated with a single account\n\n**Behavior:**\n- Creates a mapping between the account identifier and account ID\n- Stores authentication data securely if provided\n- Authentication methods can be added incrementally\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID) to add authentication to",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
} ],
"requestBody" : {
"description" : "The authentication method registration including type, identifier, and optional stored data",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.initalauth.AuthMethodRegistration"
},
"examples" : {
"Email/password authentication" : {
"value" : {
"type" : "email",
"identifier" : {
"type" : "email",
"email" : "user@example.org"
},
"data" : {
"type" : "email",
"password" : "securePassword123"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Initial authentication method added successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid authentication method, invalid identifier, or account not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/auth/{id}/map-identifier" : {
"post" : {
"tags" : [ "Administration (Global) / Authentication" ],
"summary" : "Add account identifier",
"description" : "Maps an account identifier (such as an email address) to an existing account ID. This creates a link between an authentication identifier and an account, allowing the identifier to be used for authentication.\n\n**Use Cases:**\n- Link additional identifiers to existing accounts\n- Support multiple authentication identifiers per account\n- Enable account recovery through alternative identifiers\n- Map external authentication identifiers to accounts\n\n**Important Notes:**\n- Requires superadmin privileges\n- The account must already exist\n- Identifiers must be unique across the system\n- Multiple identifiers can map to the same account\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "The account ID (UUID) to map the identifier to",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "123e4567-e89b-12d3-a456-426614174000"
} ],
"requestBody" : {
"description" : "The account identifier to map to the account",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier"
},
"examples" : {
"Email identifier" : {
"value" : {
"type" : "email",
"email" : "user@example.org"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Account identifier mapped successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid identifier format or account not found",
"headers" : { }
},
"409" : {
"description" : "Identifier already mapped to another account",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/auth/unmap-identifier" : {
"post" : {
"tags" : [ "Administration (Global) / Authentication" ],
"summary" : "Remove account identifier",
"description" : "Removes the mapping between an account identifier and an account ID. This unlinks the identifier from the account, preventing it from being used for authentication.\n\n**Use Cases:**\n- Remove obsolete or compromised identifiers from accounts\n- Unlink identifiers when accounts are deactivated\n- Clean up identifier mappings during account management\n- Support identifier rotation and replacement workflows\n\n**Important Notes:**\n- Requires superadmin privileges\n- Removing an identifier may prevent authentication if it's the only identifier\n- Stored authentication data associated with the identifier may remain\n- Operation is idempotent if identifier is already unmapped\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "The account identifier to unmap",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier"
},
"examples" : {
"Email identifier" : {
"value" : {
"type" : "email",
"email" : "user@example.org"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Account identifier unmapped successfully",
"headers" : { }
},
"404" : {
"description" : "Identifier mapping not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/auth/stored-data/add" : {
"post" : {
"tags" : [ "Administration (Global) / Authentication" ],
"summary" : "Add stored data to account identifier",
"description" : "Adds or updates stored authentication data for an account identifier. This allows administrators to set or update authentication credentials such as passwords, tokens, or other authentication secrets.\n\n**Use Cases:**\n- Set initial passwords for accounts\n- Update authentication credentials for account identifiers\n- Configure authentication data for various authentication methods\n- Support password reset and credential management\n\n**Important Notes:**\n- Requires superadmin privileges\n- Authentication data is securely stored and hashed\n- Data format depends on the authentication method type\n- Stored data is associated with both identifier and method\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "The stored authentication data including identifier and data",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.storeddata.IdentifiedStoredData"
},
"examples" : {
"Email/password stored data" : {
"value" : {
"identifier" : {
"type" : "email",
"email" : "user@example.org"
},
"data" : {
"type" : "email",
"password" : "newPassword123"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Stored authentication data added successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid identifier, invalid data format, or validation errors",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/account/auth/stored-data/remove" : {
"post" : {
"tags" : [ "Administration (Global) / Authentication" ],
"summary" : "Remove stored data from account identifier",
"description" : "Removes stored authentication data for a specific account identifier and authentication method combination. This allows administrators to delete authentication credentials such as passwords or tokens.\n\n**Use Cases:**\n- Remove compromised authentication credentials\n- Delete obsolete authentication data\n- Clean up stored data during account deactivation\n- Support credential rotation and replacement\n\n**Important Notes:**\n- Requires superadmin privileges\n- Removes data for a specific identifier and method combination\n- Does not remove the identifier mapping itself\n- Operation is idempotent if data doesn't exist\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "The identifier and method combination to remove stored data from",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.authnz.AuthenticationService.IdentifiedMethod"
},
"examples" : {
"Email method" : {
"value" : {
"identifier" : {
"type" : "email",
"email" : "user@example.org"
},
"method" : "email"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Stored authentication data removed successfully",
"headers" : { }
},
"404" : {
"description" : "Stored data not found for the specified identifier and method",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/admin/migrations" : {
"get" : {
"tags" : [ "Administration (Global) / DB Migrations" ],
"summary" : "Get migration status",
"description" : "Returns current migration status including pending migrations and history",
"parameters" : [ ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.persistence.interfaces.DataStoreMigrationService.MigrationRunInformation"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/admin/migrations/{dbVersion}" : {
"post" : {
"tags" : [ "Administration (Global) / DB Migrations" ],
"summary" : "Perform migration action",
"description" : "Schedules a migration action (run, dry-run, validate, rollback) for the specified database version. The action will be executed after the node acquires a DB migration lock",
"parameters" : [ {
"name" : "dbVersion",
"in" : "path",
"description" : "DB version of the migration which should be executed.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.persistence.migration.DataStoreMigrationController.MigrationActionRequest"
},
"examples" : {
"Dry-Run" : {
"value" : {
"action" : "DRY_RUN",
"remark" : "Example Dry Run"
}
}
}
}
},
"required" : true
},
"responses" : {
"202" : {
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/admin/admin/cluster-status" : {
"get" : {
"tags" : [ "Administration (Global) / Cluster" ],
"summary" : "Get cluster status",
"description" : "Returns the status of all running cluster nodes",
"parameters" : [ ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.clusterstatus.EnterpriseClusterNodeStatus"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/superadmin/create-by-token" : {
"post" : {
"tags" : [ "Administration / Superadmin" ],
"summary" : "Create superadmin with configured token",
"description" : "Creates a new superadmin account using a pre-configured registration token. This endpoint allows initial superadmin setup during system deployment or when adding new superadmin accounts using tokens configured in the system configuration.\n\n**Use Cases:**\n- Initial superadmin account creation during system setup\n- Create superadmin accounts using pre-configured tokens\n- Bootstrap superadmin access for new deployments\n- Add additional superadmin accounts using configured tokens\n\n**Important Notes:**\n- This endpoint is feature-flagged and may not be available in all deployments\n- Tokens must be pre-configured in the system configuration\n- Each token can only be used once - tokens are single-use\n- Tokens may have expiration dates that must be checked\n- The superadmin account ID is deterministically generated from the token\n- Authentication credentials are configured as part of the token configuration\n\n**Production:** production runs with dev-mode disabled, where a token is only usable if it\nexplicitly sets `devModeOnly = false`. Tokens that omit the flag work only in dev-mode.\n\n**Recovery:** tokens are single-use. To recover a lost superadmin, configure a second token,\nactivate it, then delete the old account.\n\n**Rate limiting:** unauthenticated and throttled per source IP (5 requests/minute by default).\nExceeding it returns `429` with a `Retry-After` header.\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "The superadmin registration token configured in the system",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.admin.superadmin.SuperAdminRegistrationRequest"
},
"examples" : {
"Superadmin registration token" : {
"value" : {
"token" : "superadmin-token"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Superadmin account created successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - token not found, already used, expired, superadmin registration feature not enabled, or the token requires dev-mode (devModeOnly is not explicitly false)",
"headers" : { }
},
"401" : {
"description" : "Authentication may be required depending on configuration",
"headers" : { }
},
"403" : {
"description" : "Superadmin registration is disabled or not permitted",
"headers" : { }
},
"429" : {
"description" : "Rate limited - retry after the interval in the Retry-After header",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v1/superadmin/list" : {
"get" : {
"tags" : [ "Administration / Superadmin" ],
"summary" : "List superadmin IDs",
"description" : "Retrieves a list of all account IDs that have superadmin privileges. Superadmin accounts are identified by having the \"superadmin\" flag set on their account.\n\n**Use Cases:**\n- Audit superadmin accounts in the system\n- List all accounts with superadmin privileges\n- Verify superadmin account existence\n- Support superadmin account management workflows\n\n**Important Notes:**\n- Requires superadmin authentication\n- Returns only account IDs, not full account information\n- Superadmin status is determined by the presence of the \"superadmin\" flag\n- Account IDs are returned as UUID strings\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "List of superadmin account IDs",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"List of superadmin IDs" : {
"value" : [ "123e4567-e89b-12d3-a456-426614174000", "223e4567-e89b-12d3-a456-426614174001", "323e4567-e89b-12d3-a456-426614174002" ]
},
"Empty list" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required - superadmin access required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions - superadmin access required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/readyz" : {
"get" : {
"tags" : [ ],
"parameters" : [ ],
"responses" : { },
"deprecated" : false
}
},
"/v1/account/info" : {
"get" : {
"tags" : [ "Account" ],
"summary" : "View account information",
"description" : "Retrieves detailed information about the currently authenticated account. This includes profile data, preferences, roles, and flags associated with the account.\n\n**Use Cases:**\n- Display account information in user interfaces\n- Retrieve account details for profile management\n- Access account roles and permissions information\n- View account preferences and settings\n\n**Important Notes:**\n- Requires authentication - returns information for the currently logged-in account\n- Returns complete account data including roles across all organizations\n- Account roles are organized by organization/tenant paths\n- Flags can indicate special account states or features\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Account information for the currently authenticated user",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account"
},
"examples" : {
"Account with full profile and roles" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org",
"addressCountry" : "AT",
"address" : "Liechtensteinstraße 111/115, 1090 Vienna",
"phone" : "+43 1 2345678",
"profileImage" : "https://example.com/avatars/max-mustermann.jpg"
},
"accountPreferences" : {
"timeZone" : "Europe/Vienna",
"languagePreference" : "DE"
},
"flags" : [ ],
"roles" : {
"waltid.organization1" : [ "admin", "user" ],
"waltid.organization1.tenant1" : [ "editor" ]
}
}
},
"Account with minimal information" : {
"value" : {
"_id" : "123e4567-e89b-12d3-a456-426614174001",
"type" : "USER",
"createdAt" : null,
"updatedAt" : null,
"profile" : {
"name" : "Jane Doe",
"email" : "jane.doe@example.org",
"addressCountry" : "US",
"address" : "123 Main Street, New York, NY 10001"
},
"accountPreferences" : {
"timeZone" : "UTC",
"languagePreference" : "EN"
},
"flags" : [ ],
"roles" : { }
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"404" : {
"description" : "Account not found",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/account/preferences" : {
"put" : {
"tags" : [ "Account" ],
"summary" : "Update account preferences",
"description" : "Updates the preferences for the currently authenticated account. Preferences include timezone, language, and other user-specific settings that affect how the account interacts with the system.\n\n**Use Cases:**\n- Update timezone settings for accurate time display\n- Change language preferences for localized content\n- Modify user-specific application settings\n- Configure account notification preferences\n\n**Important Notes:**\n- Requires authentication - updates preferences for the currently logged-in account\n- Only preference fields are updated, not profile information\n- Preference validation ensures valid timezone and language codes\n- Changes take effect immediately after update\n\n**Behavior:**\n- Invalid preference values result in validation errors\n- Timezone must be a valid IANA timezone identifier\n- Language preference should follow ISO 639-1 language codes\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Updated account preferences",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account.AccountPreferences"
},
"examples" : {
"Preferences with custom timezone and language" : {
"value" : {
"timeZone" : "America/New_York",
"languagePreference" : "EN"
}
},
"Preferences with default values" : {
"value" : {
"timeZone" : "UTC",
"languagePreference" : "EN"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Account preferences updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid timezone, invalid language code, or validation errors",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"404" : {
"description" : "Account not found",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/organization/info" : {
"get" : {
"tags" : [ "Organization" ],
"summary" : "View selected organization information",
"description" : "Permissions: ANY OF: [ADMIN_ORGANIZATION_GET] \nOperation: 'view-info' \nRequires authentication. \n\n---\nRetrieves detailed information about the currently selected organization. This includes the organization profile, billing information, and configuration settings.\n\n**Use Cases:**\n- Display organization information in user interfaces\n- Retrieve organization details for management purposes\n- Access organization configuration and settings\n- Review billing information and organization profile\n\n**Important Notes:**\n- Returns information for the organization in the current request context\n- Organization is determined from the authenticated account's context\n- Includes complete organization data including configuration\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Organization information for the selected organization",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization"
},
"examples" : {
"Organization with full configuration" : {
"value" : {
"_id" : "waltid",
"profile" : {
"name" : "walt.id GmbH"
},
"billing" : {
"billingCountry" : "AT",
"billingAddress" : "Liechtensteinstraße 111/115, 1090 Vienna",
"vatNr" : "ATU75569617",
"iban" : "AT611904300234573201",
"swift" : "BAWAATWW"
},
"configuration" : {
"rootDidRegistry" : "waltid.didregistry"
}
}
},
"Organization with minimal configuration" : {
"value" : {
"_id" : "example-org",
"profile" : {
"name" : "Example Organization"
},
"billing" : {
"billingCountry" : "US",
"billingAddress" : "123 Main Street, New York, NY 10001"
},
"configuration" : { }
}
}
}
}
}
},
"404" : {
"description" : "Organization not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view organization information",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/organization/update-config" : {
"post" : {
"tags" : [ "Organization" ],
"summary" : "Update organization configuration",
"description" : "Permissions: ANY OF: [ADMIN_ORGANIZATION_UPDATE_CONFIGURATION] \nOperation: 'update-organization-config' \nRequires authentication. \n\n---\nUpdates the configuration settings for the currently selected organization. Organization configuration includes settings such as root DID registry references that affect how the organization operates.\n\n**Use Cases:**\n- Update organization-level service configurations\n- Modify root DID registry settings\n- Change organization configuration after initial setup\n- Adjust organization settings for operational changes\n\n**Important Notes:**\n- Only configuration settings are updated, not profile or billing information\n- Root DID registry must be within the organization's scope if specified\n- Configuration validation ensures settings are valid for the organization\n- Changes take effect immediately after update\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Updated organization configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.OrganizationConfiguration"
},
"examples" : {
"Configuration with root DID registry" : {
"value" : {
"rootDidRegistry" : "waltid.tenant1.didregistry.main"
}
},
"Configuration without root DID registry" : {
"value" : { }
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Organization configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid configuration, root DID registry out of scope, or validation errors",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update organization configuration",
"headers" : { }
},
"404" : {
"description" : "Organization not found",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/organization/permissions/organization" : {
"get" : {
"tags" : [ "Organization" ],
"summary" : "List accounts that have some permission on organization",
"description" : "Permissions: ANY OF: [ADMIN_ORGANIZATION_GET_ACCOUNTS] \nOperation: 'list-organization-accounts' \nRequires authentication. \n\n---\nRetrieves a list of all accounts (both user and API accounts) that have any permission assigned within the organization. This provides an overview of all accounts with access to the organization.\n\n**Use Cases:**\n- Audit accounts with access to an organization\n- Review all accounts that have permissions in the organization\n- List organization members and API keys\n- Support access control and permission management workflows\n\n**Important Notes:**\n- Returns minimal account information (ID, type, name, email)\n- Includes both user accounts and API accounts\n- Only accounts with at least one permission in the organization are returned\n- Account information is minimal and does not include full profile or preferences\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "List of accounts with permissions in the organization",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.MinimalAccount"
},
"title" : "ArrayList"
},
"examples" : {
"List of accounts with permissions" : {
"value" : [ {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org"
}
}, {
"_id" : "223e4567-e89b-12d3-a456-426614174001",
"type" : "API",
"profile" : {
"name" : "API Key",
"email" : "api-key@example.org"
}
} ]
},
"Empty list" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list organization accounts",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/organization/permissions/tenant/{tenant}" : {
"get" : {
"tags" : [ "Organization" ],
"summary" : "List accounts that have some permission on tenant",
"description" : "Permissions: ANY OF: [ADMIN_ORGANIZATION_GET_TENANTS_OF_ACCOUNT] \nOperation: 'list-tenant-accounts' \nRequires authentication. \n\n---\nRetrieves a list of all accounts that have any permission assigned within a specific tenant. This provides an overview of accounts with access to a particular tenant within the organization.\n\n**Use Cases:**\n- Audit accounts with access to a specific tenant\n- Review all accounts that have permissions in a tenant\n- List tenant members and their access\n- Support tenant-level access control management\n\n**Important Notes:**\n- Returns minimal account information (ID, type, name, email)\n- Includes both user accounts and API accounts\n- Only accounts with at least one permission on the tenant are returned\n- Tenant must exist and be within the organization's scope\n- Accounts are filtered to only those with actual permissions on the tenant\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "tenant",
"in" : "path",
"description" : "The tenant identifier or path",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid.tenant1"
} ],
"responses" : {
"200" : {
"description" : "List of accounts with permissions on the tenant",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.MinimalAccount"
},
"title" : "ArrayList"
},
"examples" : {
"List of accounts with tenant permissions" : {
"value" : [ {
"_id" : "123e4567-e89b-12d3-a456-426614174000",
"type" : "USER",
"profile" : {
"name" : "Max Mustermann",
"email" : "max.mustermann@example.org"
}
} ]
},
"Empty list" : {
"value" : [ ]
}
}
}
}
},
"400" : {
"description" : "Invalid request - tenant not found or tenant is not within the organization scope",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list tenant accounts",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/events/query" : {
"post" : {
"tags" : [ "Events" ],
"summary" : "Query events",
"description" : "Permissions: ANY OF: [VIEW_EVENTS] \nOperation: 'view-events' \nRequires authentication. \n\n---\nQueries events from the event store based on specified filters. This endpoint allows you to retrieve and aggregate events for monitoring, auditing, and analytics purposes. Events can be filtered by type, status, action, target, timestamp range, and event-specific properties.\n\n**Use Cases:**\n- Monitor issuance and verification sessions\n- Audit system activity and user actions\n- Generate analytics and reports on event data\n\n**Important Notes:**\n- Requires authentication and read permission on the organization\n- Supports simple queries (returns event list)\n- Filter supports both minimal and comprehensive filtering options\n- Can filter by event type (IssuanceEvent, VerificationEvent), status, action, target, timestamp range, and event-specific properties\n\nFor more information, see: the docs",
"parameters" : [ ],
"requestBody" : {
"description" : "Event filter specifying criteria for querying events",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.events.filter.EventFilter"
},
"examples" : {
"Verification event, minimal filter" : {
"value" : {
"eventType" : [ "VerificationEvent" ],
"status" : [ "Open", "Success", "Failure" ],
"action" : [ "init_session", "process_request" ],
"verificationEventFilter" : {
"format" : [ "vc+sd-jwt", "dc+sd-jwt", "jwt_vc_json", "mso_mdoc" ]
}
}
},
"Verification event, full filter" : {
"value" : {
"eventType" : [ "VerificationEvent" ],
"status" : [ "Open", "Success", "Failure" ],
"action" : [ "init_session", "process_request" ],
"fromTimestamp" : 0,
"toTimestamp" : 1790867954760,
"callId" : "",
"target" : [ "waltid.tenant1.verifier1", "waltid.tenant1.verifier2" ],
"verificationEventFilter" : {
"format" : [ "vc+sd-jwt", "dc+sd-jwt", "jwt_vc_json", "mso_mdoc" ],
"signatureAlgorithm" : [ "" ],
"sessionId" : "",
"holder" : [ "" ],
"credentialType" : [ "" ]
}
}
},
"Issuance event, minimal filter" : {
"value" : {
"eventType" : [ "IssuanceEvent" ],
"status" : [ "Open", "Success", "Failure" ],
"action" : [ "init_session", "process_request" ],
"issuanceEventFilter" : {
"format" : [ "vc+sd-jwt", "dc+sd-jwt", "jwt_vc_json", "mso_mdoc" ]
}
}
},
"Issuance event, full filter" : {
"value" : {
"eventType" : [ "IssuanceEvent" ],
"status" : [ "Open", "Success", "Failure" ],
"action" : [ "init_session", "process_request" ],
"fromTimestamp" : 0,
"toTimestamp" : 1790867954762,
"callId" : "",
"target" : [ "waltid.tenant1.issuer1", "waltid.tenant1.issuer2" ],
"issuanceEventFilter" : {
"credentialConfigurationId" : [ "" ],
"format" : [ "vc+sd-jwt", "dc+sd-jwt", "jwt_vc_json", "mso_mdoc" ],
"sessionId" : ""
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Query results. Returns a list of events when groupBy is not provided, or a list of EventCount objects when groupBy is specified.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"title" : "*"
}
}
}
},
"400" : {
"description" : "Invalid request - invalid filter, invalid organization ID, or malformed groupBy parameter",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query events for the specified organization",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/audit/query" : {
"post" : {
"tags" : [ "eIDAS Audit Log" ],
"summary" : "Query eIDAS audit log",
"description" : "Permissions: ANY OF: [VIEW_AUDIT_LOG] \nOperation: 'eidas-audit-query' \nRequires authentication. \n\n---\nReturns eIDAS compliance audit entries for one service target.\n\n**Permissions:** `VIEW_AUDIT_LOG` is checked against the body `target` (not the\norganization root), so least-privilege roles scoped to a single issuer or verifier\ncan query without a URL `?target=` override.\n\n**Required fields:** `organizationId` (must match the organization resolved from the\nrequest host) and `target` (service path, e.g. `waltid.tenant1.issuer1`).\n\n**Entry types:**\n- `CREDENTIAL_ISSUED` — signed credential payload delivered via OpenID4VCI\n (includes `loaAchieved`, default `NOT_APPLICABLE`, and optional `identityProofingRefId`\n supplied by the issuance request / offer runtime overrides)\n- `CREDENTIAL_LIFECYCLE` — provisioned / issued / suspended / unsuspended / revoked\n- `PRESENTATION_VERIFICATION_COMPLETED` — finished OpenID4VP presentation session\n (includes revocation / WRPAC evidence arrays and optional `pairwiseSubjectId`)\n\nCredential payloads are never stored; only hashes and public evidence appear in\nresponses.",
"parameters" : [ ],
"requestBody" : {
"description" : "Audit log query filter. `organizationId` and `target` are required.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.EidasAuditLogFilter"
},
"examples" : {
"By service target" : {
"description" : "List recent entries for one issuer or verifier service.",
"value" : {
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1"
}
},
"By issuance session" : {
"description" : "Correlate lifecycle and issuance entries for a single OID4VCI session.",
"value" : {
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"sessionId" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"limit" : 50
}
},
"Lifecycle events only" : {
"description" : "Restrict to CREDENTIAL_LIFECYCLE (e.g. revocations).",
"value" : {
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"entryTypes" : [ "CREDENTIAL_LIFECYCLE" ]
}
},
"Time and sequence window" : {
"description" : "Page a bounded sequence/time range within a service target.",
"value" : {
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"fromTimestamp" : 1719913600000,
"toTimestamp" : 1720000000000,
"fromSequence" : 10,
"toSequence" : 50,
"limit" : 25
}
},
"Presentation by nonce" : {
"description" : "Look up a presentation by the raw OpenID4VP nonce (hashed server-side for lookup).",
"value" : {
"organizationId" : "waltid",
"target" : "waltid.tenant1.verifier1",
"entryTypes" : [ "PRESENTATION_VERIFICATION_COMPLETED" ],
"nonce" : "a3f7c2e1-nonce-value-here",
"limit" : 10
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Matching audit entries (newest/oldest order depends on store; typically ascending sequence)",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.EidasAuditLogEntry"
},
"title" : "ArrayList"
},
"examples" : {
"Mixed issuance and verification entries" : {
"value" : [ {
"entryType" : "CREDENTIAL_ISSUED",
"id" : "550e8400-e29b-41d4-a716-446655440001",
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"timestamp" : 1720000000000,
"sequenceNumber" : 12,
"prevEntryHash" : "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456",
"entryHash" : "f6e5d4c3b2a1098765432109876543210fedcba0987654321fedcba098765432",
"sessionId" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"credentialConfigurationId" : "identity_credential",
"format" : "dc+sd-jwt",
"credentialPayloadHash" : "9f3df3b70633c3d23f5ef04d5d1e7f1d715b9683d8744cd38ec1a8114ec99f00",
"holderBindingPublicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "device-key-1",
"x" : "2Z3gxK7IatHaxPWLYkBYn1XS0wKdL7fMQQuF_nGw2Kw",
"y" : "41CM3oYupV2TNid0xDbESe0bzKWVNu0LU8kKQS47jUI"
},
"proofType" : "jwt",
"callId" : "call-8c2f1a90",
"loaAchieved" : "HIGH",
"identityProofingRefId" : "id-proofing-session-42"
}, {
"entryType" : "CREDENTIAL_LIFECYCLE",
"id" : "550e8400-e29b-41d4-a716-446655440002",
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"timestamp" : 1720003600000,
"sequenceNumber" : 13,
"prevEntryHash" : "f6e5d4c3b2a1098765432109876543210fedcba0987654321fedcba098765432",
"entryHash" : "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"sessionId" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"credentialConfigurationId" : "identity_credential",
"event" : "REVOKED",
"reasonCode" : "key_compromise",
"operatorId" : "waltid.tenant1.api-key-ops"
}, {
"entryType" : "PRESENTATION_VERIFICATION_COMPLETED",
"id" : "550e8400-e29b-41d4-a716-446655440003",
"organizationId" : "waltid",
"target" : "waltid.tenant1.verifier1",
"timestamp" : 1720007200000,
"sequenceNumber" : 14,
"prevEntryHash" : "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"entryHash" : "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
"sessionId" : "v-session-7f3a9c2e",
"nonceHash" : "7c4a8d09ca3762af61e59520943dc26494f8941b715b9683d8744cd38ec1a811",
"dcqlQuery" : "{\"credentials\":[{\"id\":\"pid\",\"format\":\"dc+sd-jwt\",\"meta\":{\"vct_values\":[\"https://example.com/PID\"]},\"claims\":[{\"path\":[\"age_over_18\"]}]}]}",
"requestObjectX5c" : [ "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNVBAMMCXZlcmlmaWVyMQ==" ],
"requestObjectHash" : "c3d4e5f6789012345678901234567890abcdef1234567890abcdef1234567890",
"verifierInfo" : [ {
"format" : "jwt",
"data" : "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6ZXhhbXBsZTp2ZXJpZmllciJ9.sig"
} ],
"issuerSignatureEvidence" : [ {
"policyId" : "signature",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"holderBindingEvidence" : [ {
"policyId" : "dc+sd-jwt/kb-jwt_signature",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"revocationStatusEvidence" : [ {
"policyId" : "credential-status",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"verifierTrustEvidence" : [ {
"policyId" : "wrpac",
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"pairwiseSubjectId" : "7c4a8d09ca3762af61e59520943dc26494f8941b715b9683d8744cd38ec1a811",
"outcome" : "SUCCESS",
"failureCategory" : null,
"callId" : "call-1d4e9b22"
} ]
},
"Lifecycle / revocation entries" : {
"value" : [ {
"entryType" : "CREDENTIAL_LIFECYCLE",
"id" : "550e8400-e29b-41d4-a716-446655440002",
"organizationId" : "waltid",
"target" : "waltid.tenant1.issuer1",
"timestamp" : 1720003600000,
"sequenceNumber" : 13,
"prevEntryHash" : "f6e5d4c3b2a1098765432109876543210fedcba0987654321fedcba098765432",
"entryHash" : "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"sessionId" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"credentialConfigurationId" : "identity_credential",
"event" : "REVOKED",
"reasonCode" : "key_compromise",
"operatorId" : "waltid.tenant1.api-key-ops"
} ]
},
"Presentation verification entries" : {
"value" : [ {
"entryType" : "PRESENTATION_VERIFICATION_COMPLETED",
"id" : "550e8400-e29b-41d4-a716-446655440003",
"organizationId" : "waltid",
"target" : "waltid.tenant1.verifier1",
"timestamp" : 1720007200000,
"sequenceNumber" : 14,
"prevEntryHash" : "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"entryHash" : "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
"sessionId" : "v-session-7f3a9c2e",
"nonceHash" : "7c4a8d09ca3762af61e59520943dc26494f8941b715b9683d8744cd38ec1a811",
"dcqlQuery" : "{\"credentials\":[{\"id\":\"pid\",\"format\":\"dc+sd-jwt\",\"meta\":{\"vct_values\":[\"https://example.com/PID\"]},\"claims\":[{\"path\":[\"age_over_18\"]}]}]}",
"requestObjectX5c" : [ "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNVBAMMCXZlcmlmaWVyMQ==" ],
"requestObjectHash" : "c3d4e5f6789012345678901234567890abcdef1234567890abcdef1234567890",
"verifierInfo" : [ {
"format" : "jwt",
"data" : "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6ZXhhbXBsZTp2ZXJpZmllciJ9.sig"
} ],
"issuerSignatureEvidence" : [ {
"policyId" : "signature",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"holderBindingEvidence" : [ {
"policyId" : "dc+sd-jwt/kb-jwt_signature",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"revocationStatusEvidence" : [ {
"policyId" : "credential-status",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"verifierTrustEvidence" : [ {
"policyId" : "wrpac",
"success" : true,
"evidenceCapturedAt" : 1720007200000
} ],
"pairwiseSubjectId" : "7c4a8d09ca3762af61e59520943dc26494f8941b715b9683d8744cd38ec1a811",
"outcome" : "SUCCESS",
"failureCategory" : null,
"callId" : "call-1d4e9b22"
}, {
"entryType" : "PRESENTATION_VERIFICATION_COMPLETED",
"id" : "550e8400-e29b-41d4-a716-446655440004",
"organizationId" : "waltid",
"target" : "waltid.tenant1.verifier1",
"timestamp" : 1720007800000,
"sequenceNumber" : 15,
"prevEntryHash" : "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
"entryHash" : "11223344556677889900aabbccddeeff11223344556677889900aabbccddeeff",
"sessionId" : "v-session-failed-01",
"nonceHash" : "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"dcqlQuery" : "{\"credentials\":[{\"id\":\"pid\",\"format\":\"dc+sd-jwt\",\"meta\":{\"vct_values\":[\"https://example.com/PID\"]},\"claims\":[{\"path\":[\"age_over_18\"]}]}]}",
"holderBindingEvidence" : [ {
"policyId" : "dc+sd-jwt/kb-jwt_signature",
"queryId" : "pid",
"credentialIndex" : 0,
"success" : false,
"errors" : [ "KB-JWT signature verification failed" ],
"evidenceCapturedAt" : 1720007800000
} ],
"outcome" : "FAILED",
"failureCategory" : "VP_POLICY",
"callId" : "call-9a7c3e11"
} ]
}
}
}
}
},
"400" : {
"description" : "Invalid filter (missing target, mismatched organizationId, or invalid range/limit)",
"headers" : { }
},
"403" : {
"description" : "Missing VIEW_AUDIT_LOG permission on the requested target",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/audit/verify-chain" : {
"get" : {
"tags" : [ "eIDAS Audit Log" ],
"summary" : "Verify eIDAS audit chain integrity",
"description" : "Permissions: ANY OF: [VIEW_AUDIT_LOG] \nOperation: 'eidas-audit-verify-chain' \nRequires authentication. \n\n---\nRe-computes entry hashes, sequence continuity, and predecessor links for the\norganization-wide hash chain.\n\n**Scope:** organization root only (`VIEW_AUDIT_LOG` on the organization). Service-scoped\nroles cannot call this endpoint.\n\n**Limits:** optional `fromSequence` / `toSequence` bound the check. External signed\ncheckpoints are still required to detect deletion of a complete chain suffix.",
"parameters" : [ {
"name" : "fromSequence",
"in" : "query",
"description" : "Inclusive lower bound on sequenceNumber (default: 0)",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
}
}, {
"name" : "toSequence",
"in" : "query",
"description" : "Inclusive upper bound on sequenceNumber (default: no upper bound)",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
}
} ],
"responses" : {
"200" : {
"description" : "Chain verification result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.ChainVerificationResult"
},
"examples" : {
"Intact chain" : {
"value" : {
"intact" : true,
"checkedEntries" : 42,
"firstBrokenAt" : null,
"message" : "Chain intact"
}
},
"Broken chain" : {
"description" : "`firstBrokenAt` is the sequence number of the first broken entry.",
"value" : {
"intact" : false,
"checkedEntries" : 42,
"firstBrokenAt" : 17,
"message" : "Broken hash chain at sequence 17"
}
}
}
}
}
},
"400" : {
"description" : "Invalid sequence query parameter",
"headers" : { }
},
"403" : {
"description" : "Missing VIEW_AUDIT_LOG on the organization, or called with a non-organization-root target",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/resources-api/tree" : {
"get" : {
"tags" : [ "Organization Resources" ],
"description" : "Permissions: ANY OF: [VIEW_RESOURCE_TREE] \nOperation: 'view-resource-tree' \nRequires authentication. \n",
"parameters" : [ {
"name" : "root",
"in" : "query",
"description" : "A child node of the organization can selected as root of the resource tree, by default the root node is the organization.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Returns the resource tree for the organization",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/permissions/list-roles" : {
"get" : {
"tags" : [ "Permissions" ],
"summary" : "List roles of the current account",
"description" : "Permissions: None required \nOperation: 'list-own-roles' \nRequires authentication. \n\n---\nReturns all role identifiers assigned to the currently authenticated account within the selected organization.\n\n**Use Cases:**\n- Show current user's roles in an account settings UI\n- Determine access level for client-side feature toggles\n- Debug authorization issues by inspecting assigned roles\n\n**Important Notes:**\n- Requires authentication and appropriate permissions for the organization\n- Only roles for the current account and organization are returned\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "List of roles retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Example roles" : {
"value" : [ "org.myfirstrole", "org.editor", "org.viewer" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/permissions/list-permissions" : {
"get" : {
"tags" : [ "Permissions" ],
"summary" : "List permissions supported by the Enterprise API",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_LIST] \nOperation: 'list-permissions' \nRequires authentication. \n\n---\nReturns all permissions supported by the Enterprise API as action strings.\n\n**Use Cases:**\n- Inspect which permissions are available for assignment to roles\n- Populate role-permission pickers in administration UIs\n\n**Important Notes:**\n- Requires authentication and the `list-roles` permission for the organization\n- Returned values are the permission action strings used when creating or updating roles\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "List of permissions retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Example permissions" : {
"value" : [ "all", "view-info", "list-roles", "create-role", "add-role-permission" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list supported permissions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/permissions/list-role-and-permissions" : {
"get" : {
"tags" : [ "Permissions" ],
"summary" : "List roles with permissions of the current account",
"description" : "Permissions: None required \nOperation: 'list-own-roles' \nRequires authentication. \n\n---\nReturns all roles of the current account together with their associated permissions in structured form.\n\n**Use Cases:**\n- Inspect which permissions are granted by each role\n- Build role/permission overview pages for administrators or users\n- Debug complex authorization setups by examining effective permissions\n\n**Important Notes:**\n- Requires authentication and appropriate permissions for the organization\n- Permissions are returned as structured permission objects\n- Only roles and permissions for the current account and organization are returned\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Roles with permissions retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.permissions.Permission"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
},
"examples" : {
"Example roles with permissions" : {
"value" : {
"org.myfirstrole" : [ {
"target" : "example.kms",
"action" : "generate-key"
}, {
"target" : "example.kms",
"action" : "store-key"
}, {
"target" : "example.kms",
"action" : "import-key-jwk"
} ]
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles and permissions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/permissions/list-role-and-permissions-serialized" : {
"get" : {
"tags" : [ "Permissions" ],
"summary" : "List roles with permissions of the current account (serialized)",
"description" : "Permissions: None required \nOperation: 'list-own-roles' \nRequires authentication. \n\n---\nReturns all roles of the current account together with their associated permissions as serialized string values.\n\n**Use Cases:**\n- Integrate with systems that expect permissions as simple string identifiers\n- Log or audit effective permissions in a human-readable format\n- Export role/permission information for external analysis tools\n\n**Important Notes:**\n- Requires authentication and appropriate permissions for the organization\n- Permissions are returned as string representations (e.g. enum names or IDs)\n- Only roles and permissions for the current account and organization are returned\n\nFor more information, see: the docs",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Serialized roles with permissions retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
},
"examples" : {
"Example serialized roles with permissions" : {
"value" : {
"org.myfirstrole" : [ "example.kms:+generate-key", "example.kms:+store-key", "example.kms:+import-key-jwk" ]
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles and permissions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/permissions/auth-debug" : {
"get" : {
"tags" : [ "Permissions" ],
"description" : "Permissions: None required \nOperation: 'auth-debug' \nRequires authentication. \n",
"parameters" : [ ],
"responses" : {
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/resources/list" : {
"get" : {
"tags" : [ "Service | Resource" ],
"summary" : "List sub-entries of a resource (this endpoint will be replaced in the future)",
"description" : "Permissions: ANY OF: [LIST_SUBENTRIES] \nOperation: 'list-subentries' \nAccepts targets: [TraversableEntry] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "The IDs of the sub-entries of this resource.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/resources/delete" : {
"delete" : {
"tags" : [ "Service | Resource" ],
"summary" : "Delete a resource (this endpoint will be replaced in the future)",
"description" : "Permissions: ANY OF: [DELETE_RESOURCE] \nOperation: 'delete-resource' \nAccepts targets: [TreeEntry] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"202" : {
"description" : "The resource was deleted.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/resources/delete-recursive" : {
"delete" : {
"tags" : [ "Service | Resource" ],
"summary" : "Recursively delete a resource (this endpoint will be replaced in the future)",
"description" : "Permissions: ANY OF: [DELETE_RESOURCE_RECURSIVE, ES_DID_STORE_DELETE, ES_KMS_DELETE, ES_DID_SERVICE_DELETE, ES_DID_REGISTRY_DELETE, ES_POLICY_STORE_DELETE, ES_CREDENTIAL_STORE_DELETE, ES_X509_STORE_DELETE, ES_X509_SERVICE_DELETE, ES_TRUST_REGISTRY_DELETE, ES_VICAL_DELETE, ES_CREDENTIAL_STATUS_DELETE, ES_ISSUER_DELETE, ES_VERIFIER_DELETE, ES_WALLET_DELETE, ES_OIDC_BRIDGE_DELETE] \nOperation: 'delete-resource-recursive' \nAccepts targets: [TreeEntry] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"202" : {
"description" : "The resource was deleted.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/tenants/create" : {
"post" : {
"tags" : [ "Service | Resource" ],
"summary" : "Create new tenant entry in the organization",
"description" : "Permissions: ANY OF: [ADMIN_TENANT_CREATE] \nOperation: 'create-tenant' \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.NewTenantRequest"
},
"examples" : {
"Create tenant (no friendly name)" : {
"value" : { }
},
"Create tenant, with name" : {
"value" : {
"name" : "New Tenant"
}
},
"Create tenant, with Tenant Configuration" : {
"value" : {
"configuration" : {
"didRegistry" : "didregistry"
}
}
}
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "Created new tenant.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/tenant"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/services/create" : {
"post" : {
"tags" : [ "Service | Resource" ],
"summary" : "Create new service entry in the organization",
"description" : "Permissions: ANY OF: [RM_CREATE_SERVICE, ES_KMS_CREATE, ES_DID_STORE_CREATE, ES_DID_SERVICE_CREATE, ES_DID_REGISTRY_CREATE, ES_POLICY_STORE_CREATE, ES_CLIENT_ATTESTER_CREATE, ES_CREDENTIAL_STORE_CREATE, ES_X509_STORE_CREATE, ES_X509_SERVICE_CREATE, ES_TRUST_REGISTRY_CREATE, ES_VICAL_CREATE, ES_CREDENTIAL_STATUS_CREATE, ES_ISSUER_CREATE, ES_VERIFIER_CREATE, ES_WALLET_CREATE, ES_OIDC_BRIDGE_CREATE] \nOperation: 'create-service' \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Service configuration object. Select an example for the supported service-specific fields; the `type` property identifies the service type.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Create Client Attester Service" : {
"value" : {
"type" : "client-attester",
"signingKeyId" : "waltid.kms.key"
}
},
"Create Credential Store" : {
"value" : {
"type" : "credential-store"
}
},
"Create DID Registry" : {
"value" : {
"type" : "did-registry"
}
},
"Create DID Service" : {
"value" : {
"type" : "did"
}
},
"Create DID Store" : {
"value" : {
"type" : "did-store"
}
},
"Create Issuer2 - Default" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"org.iso.23220.photoid.1" : {
"format" : "mso_mdoc",
"scope" : "org.iso.23220.photoid.1",
"doctype" : "org.iso.23220.photoid.1",
"credential_signing_alg_values_supported" : [ -7, -9 ],
"cryptographic_binding_methods_supported" : [ "cose_key" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"open_badge_credential" : {
"format" : "jwt_vc_json",
"scope" : "open_badge_credential",
"credential_definition" : {
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ]
},
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "did:key", "did:web", "did:jwk", "did:ebsi" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - Self-Hosted SD-JWT VCT" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - External SD-JWT VCT" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "https://issuer.example.com/vct/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - Credential Metadata Display" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
},
"credential_metadata" : {
"display" : [ {
"name" : "Identity Credential",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/assets/identity-logo.png",
"alt_text" : "Identity credential logo"
},
"description" : "Government-issued identity credential",
"background_color" : "#12107c",
"background_image" : {
"uri" : "https://issuer.example.com/assets/identity-bg.png"
},
"text_color" : "#FFFFFF"
} ],
"claims" : [ {
"path" : [ "given_name" ],
"display" : [ {
"name" : "Given Name",
"locale" : "en-US"
}, {
"name" : "Vorname",
"locale" : "de-DE"
} ]
}, {
"path" : [ "family_name" ],
"display" : [ {
"name" : "Family Name",
"locale" : "en-US"
} ]
} ]
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - Client Attestation and Anonymous Pre-Auth" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"org.iso.23220.photoid.1" : {
"format" : "mso_mdoc",
"scope" : "org.iso.23220.photoid.1",
"doctype" : "org.iso.23220.photoid.1",
"credential_signing_alg_values_supported" : [ -7, -9 ],
"cryptographic_binding_methods_supported" : [ "cose_key" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"open_badge_credential" : {
"format" : "jwt_vc_json",
"scope" : "open_badge_credential",
"credential_definition" : {
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ]
},
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "did:key", "did:web", "did:jwk", "did:ebsi" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
}, {
"type" : "client-attestation",
"config" : {
"verificationMethod" : {
"type" : "static-jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "f83OJ3D2xF4mNqA6x0Y6qf9jR9sM8f2Q1gW0m2yPj9k",
"y" : "x_FEzRu9k5D4Q0h9sVQXK2fAq8rLz4jN0wQ1Xy2aP5M"
}
}
}
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - Credential Encryption" : {
"description" : "Uses a dedicated EC P-256 credentialEncryptionKey matching the KMS ECKey-JWK import example.",
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"credentialEncryptionKey" : "waltid.tenant1.kms1.ecKey1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"org.iso.23220.photoid.1" : {
"format" : "mso_mdoc",
"scope" : "org.iso.23220.photoid.1",
"doctype" : "org.iso.23220.photoid.1",
"credential_signing_alg_values_supported" : [ -7, -9 ],
"cryptographic_binding_methods_supported" : [ "cose_key" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"open_badge_credential" : {
"format" : "jwt_vc_json",
"scope" : "open_badge_credential",
"credential_definition" : {
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ]
},
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "did:key", "did:web", "did:jwk", "did:ebsi" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - EUDI Client Attestation X509 Chain" : {
"description" : "Pins PID Issuer CA 02 so Wallet Provider leaf rotations keep verifying.",
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"org.iso.23220.photoid.1" : {
"format" : "mso_mdoc",
"scope" : "org.iso.23220.photoid.1",
"doctype" : "org.iso.23220.photoid.1",
"credential_signing_alg_values_supported" : [ -7, -9 ],
"cryptographic_binding_methods_supported" : [ "cose_key" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"open_badge_credential" : {
"format" : "jwt_vc_json",
"scope" : "open_badge_credential",
"credential_definition" : {
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ]
},
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "did:key", "did:web", "did:jwk", "did:ebsi" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "client-attestation",
"config" : {
"verificationMethod" : {
"type" : "x509-chain",
"trustedRootCertificatesPem" : [ "-----BEGIN CERTIFICATE-----\nMIIC0zCCAnmgAwIBAgIUXRXxkLbUM6+njr/XT0IIw/HA/uowCgYIKoZIzj0EAwMw\nVzEZMBcGA1UEAwwQUElEIElzc3VlciBDQSAwMjEtMCsGA1UECgwkRVVESSBXYWxs\nZXQgUmVmZXJlbmNlIEltcGxlbWVudGF0aW9uMQswCQYDVQQGEwJFVTAeFw0yNTA0\nMDkwMDAzMzBaFw0zNDA3MDYwMDAzMjlaMFcxGTAXBgNVBAMMEFBJRCBJc3N1ZXIg\nQ0EgMDIxLTArBgNVBAoMJEVVREkgV2FsbGV0IFJlZmVyZW5jZSBJbXBsZW1lbnRh\ndGlvbjELMAkGA1UEBhMCRVUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARkqdLm\nwIlv+SSWr00tAIrt7EAMztgd3w9qA6qEm16yVfsLcyx2f4oIWuH45wa37J9GoNWp\ndeo27VoSoNMCzxOYo4IBITCCAR0wEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSME\nGDAWgBRCUFC+ELgQ8J1EXI2/qxAI7ifcSTATBgNVHSUEDDAKBggrgQICAAABBzBD\nBgNVHR8EPDA6MDigNqA0hjJodHRwczovL3ByZXByb2QucGtpLmV1ZGl3LmRldi9j\ncmwvcGlkX0NBX0VVXzAyLmNybDAdBgNVHQ4EFgQUQlBQvhC4EPCdRFyNv6sQCO4n\n3EkwDgYDVR0PAQH/BAQDAgEGMF0GA1UdEgRWMFSGUmh0dHBzOi8vZ2l0aHViLmNv\nbS9ldS1kaWdpdGFsLWlkZW50aXR5LXdhbGxldC9hcmNoaXRlY3R1cmUtYW5kLXJl\nZmVyZW5jZS1mcmFtZXdvcmswCgYIKoZIzj0EAwMDSAAwRQIhAIavYfC5o0VVLKfg\nTKkzzWgc09hzDMsCl3O2le2sQfG7AiA2soqAN5gtUOLQKWK00DUz22EW79rvaV+V\nJPvfdQeokA==\n-----END CERTIFICATE-----" ]
}
}
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create Issuer2 - EUDI Client Attestation X509 Chain + Credential Encryption" : {
"description" : "Uses EUDI X509 chain client attestation plus a dedicated EC P-256 credentialEncryptionKey matching the KMS ECKey-JWK import example.",
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"credentialEncryptionKey" : "waltid.tenant1.kms1.ecKey1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"org.iso.23220.photoid.1" : {
"format" : "mso_mdoc",
"scope" : "org.iso.23220.photoid.1",
"doctype" : "org.iso.23220.photoid.1",
"credential_signing_alg_values_supported" : [ -7, -9 ],
"cryptographic_binding_methods_supported" : [ "cose_key" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
},
"open_badge_credential" : {
"format" : "jwt_vc_json",
"scope" : "open_badge_credential",
"credential_definition" : {
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ]
},
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "did:key", "did:web", "did:jwk", "did:ebsi" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "client-attestation",
"config" : {
"verificationMethod" : {
"type" : "x509-chain",
"trustedRootCertificatesPem" : [ "-----BEGIN CERTIFICATE-----\nMIIC0zCCAnmgAwIBAgIUXRXxkLbUM6+njr/XT0IIw/HA/uowCgYIKoZIzj0EAwMw\nVzEZMBcGA1UEAwwQUElEIElzc3VlciBDQSAwMjEtMCsGA1UECgwkRVVESSBXYWxs\nZXQgUmVmZXJlbmNlIEltcGxlbWVudGF0aW9uMQswCQYDVQQGEwJFVTAeFw0yNTA0\nMDkwMDAzMzBaFw0zNDA3MDYwMDAzMjlaMFcxGTAXBgNVBAMMEFBJRCBJc3N1ZXIg\nQ0EgMDIxLTArBgNVBAoMJEVVREkgV2FsbGV0IFJlZmVyZW5jZSBJbXBsZW1lbnRh\ndGlvbjELMAkGA1UEBhMCRVUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARkqdLm\nwIlv+SSWr00tAIrt7EAMztgd3w9qA6qEm16yVfsLcyx2f4oIWuH45wa37J9GoNWp\ndeo27VoSoNMCzxOYo4IBITCCAR0wEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSME\nGDAWgBRCUFC+ELgQ8J1EXI2/qxAI7ifcSTATBgNVHSUEDDAKBggrgQICAAABBzBD\nBgNVHR8EPDA6MDigNqA0hjJodHRwczovL3ByZXByb2QucGtpLmV1ZGl3LmRldi9j\ncmwvcGlkX0NBX0VVXzAyLmNybDAdBgNVHQ4EFgQUQlBQvhC4EPCdRFyNv6sQCO4n\n3EkwDgYDVR0PAQH/BAQDAgEGMF0GA1UdEgRWMFSGUmh0dHBzOi8vZ2l0aHViLmNv\nbS9ldS1kaWdpdGFsLWlkZW50aXR5LXdhbGxldC9hcmNoaXRlY3R1cmUtYW5kLXJl\nZmVyZW5jZS1mcmFtZXdvcmswCgYIKoZIzj0EAwMDSAAwRQIhAIavYfC5o0VVLKfg\nTKkzzWgc09hzDMsCl3O2le2sQfG7AiA2soqAN5gtUOLQKWK00DUz22EW79rvaV+V\nJPvfdQeokA==\n-----END CERTIFICATE-----" ]
}
}
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
},
"Create KMS Service" : {
"value" : {
"type" : "kms"
}
},
"Create KMS Service - AWS" : {
"value" : {
"type" : "kms",
"defaultKeyGenerationRequests" : {
"aws" : {
"auth" : {
"region" : "eu-central-1"
}
}
}
}
},
"Create KMS Service - AWS (AccessKeys)" : {
"value" : {
"type" : "kms",
"defaultKeyGenerationRequests" : {
"aws-rest-api" : {
"auth" : {
"accessKeyId" : "accessKey",
"secretAccessKey" : "secretKey",
"region" : "eu-central-1"
}
}
}
}
},
"Create KMS Service - AWS (RoleName)" : {
"value" : {
"type" : "kms",
"defaultKeyGenerationRequests" : {
"aws-rest-api" : {
"auth" : {
"roleName" : "roleName",
"region" : "eu-central-1"
}
}
}
}
},
"Create KMS Service - AWS (config-ref)" : {
"value" : {
"type" : "kms",
"configRef" : "aws-kms"
}
},
"Create KMS Service - Azure" : {
"value" : {
"type" : "kms",
"defaultKeyGenerationRequests" : {
"azure" : {
"auth" : {
"keyVaultUrl" : "https://your-key-vault-name.vault.azure.net/"
}
}
}
}
},
"Create OIDC Bridge - Keycloak (mDL)" : {
"value" : {
"type" : "oidc-bridge",
"issuerUrl" : "http://waltid.enterprise.localhost:3000",
"clients" : {
"keycloak" : {
"clientId" : "keycloak",
"clientSecret" : "keycloak-client-secret",
"redirectUris" : [ "http://keycloak.localhost:8080/realms/waltid-vc/broker/waltid-vc/endpoint" ]
}
},
"defaultClaimMappings" : [ {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"document_number\"]",
"oidcClaim" : "sub"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"given_name\"]",
"oidcClaim" : "given_name"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"family_name\"]",
"oidcClaim" : "family_name"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"birth_date\"]",
"oidcClaim" : "birthdate"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"document_number\"]",
"oidcClaim" : "document_number"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issue_date\"]",
"oidcClaim" : "issue_date"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"expiry_date\"]",
"oidcClaim" : "expiry_date"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issuing_country\"]",
"oidcClaim" : "issuing_country"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issuing_authority\"]",
"oidcClaim" : "issuing_authority"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"un_distinguishing_sign\"]",
"oidcClaim" : "un_distinguishing_sign"
} ],
"flows" : {
"qr" : {
"enabled" : true,
"buttonLabel" : "Scan QR Code"
},
"dc_api" : {
"enabled" : true,
"buttonLabel" : "Browser Wallet (DC API)"
},
"deep_link" : {
"enabled" : true,
"buttonLabel" : "Open Mobile Wallet"
},
"web_wallet" : {
"enabled" : true,
"buttonLabel" : "Open Web Wallet",
"targetUrl" : "https://waltid.enterprise.localhost"
}
},
"uiConfig" : {
"logoUrl" : "https://example.com/logo.png",
"brandName" : "walt.id Enterprise",
"primaryColor" : "#3B82F6",
"webWalletBaseUrl" : "https://waltid.enterprise.localhost"
}
}
},
"Create OIDC Bridge - Minimal" : {
"value" : {
"type" : "oidc-bridge",
"issuerUrl" : "https://enterprise.example.com",
"clients" : {
"demo-client" : {
"clientId" : "demo-client",
"clientSecret" : "demo-secret",
"redirectUris" : [ "https://app.example.com/callback" ]
}
}
}
},
"Create PolicyStore" : {
"value" : {
"type" : "policy-store"
}
},
"Create Credential Status - AWS registry (regular setup)" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "aws",
"bucketName" : "bucket-name",
"region" : "region",
"accessKeyId" : "s3-access-key-id",
"secretKey" : "s3-secret-key"
}
}
}
},
"Create Credential Status - AWS registry (CDN setup)" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "aws",
"bucketName" : "bucket-name",
"region" : "region",
"accessKeyId" : "s3-access-key-id",
"secretKey" : "s3-secret-key"
},
"bucketUrl" : "https://example.com"
}
}
},
"Create Credential Status - AWS registry (S3 compatible)" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "aws",
"bucketName" : "bucket-name",
"region" : "region",
"accessKeyId" : "s3-access-key-id",
"secretKey" : "s3-secret-key",
"endpointUrl" : "https://s3-compatible.com"
}
}
}
},
"Create Credential Status - Azure registry" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "azure",
"bucketName" : "bucket-name",
"connectionString" : "connection-string"
},
"bucketUrl" : "https://storage-name.blob.core.windows.net/bucket-name"
}
}
},
"Create Credential Status - Azure registry (Managed Identity)" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "azure",
"bucketName" : "bucket-name",
"accountUrl" : "https://storage-name.blob.core.windows.net"
},
"bucketUrl" : "https://storage-name.blob.core.windows.net/bucket-name"
}
}
},
"Create Credential Status - GCP registry" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "gcp",
"bucketName" : "bucket-name",
"projectId" : "project-id",
"serviceAccountKeyJson" : {
"note" : "Provide your GCP service account JSON ",
"project_id" : "YOUR_PROJECT_ID"
}
},
"bucketUrl" : "https://storage.cloud.google.com/bucket-name"
}
}
},
"Create Credential Status - in-memory registry" : {
"value" : {
"type" : "credential-status",
"config" : {
"registry" : {
"type" : "in-memory"
}
}
}
},
"Create Credential Status - via config-ref-aws" : {
"value" : {
"type" : "credential-status",
"config" : {
"configRef" : "aws-s3-eu-north-2"
}
}
},
"Create Credential Status - via config-ref-azure" : {
"value" : {
"type" : "credential-status",
"config" : {
"configRef" : "azure-storage-example"
}
}
},
"Create Trust Registry Service" : {
"value" : {
"type" : "trust-registry"
}
},
"Create Verifier2 with minimal configuration" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123"
}
},
"Create Verifier2 with client metadata" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123"
}
},
"Create Verifier2 with internationalized metadata" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123",
"clientMetadata" : {
"client_name" : "Age Verification Service",
"logo_uri" : "https://verifier.example.com/logo.png",
"tos_uri" : "https://verifier.example.com/terms",
"policy_uri" : "https://verifier.example.com/privacy",
"client_uri" : "https://verifier.example.com",
"client_name#fr-FR" : "Service de Vérification d'Âge",
"client_name#de" : "Altersverifizierungsdienst",
"client_name#es-ES" : "Servicio de Verificación de Edad",
"logo_uri#fr-FR" : "https://verifier.example.com/logo-fr.png",
"logo_uri#de" : "https://verifier.example.com/logo-de.png",
"tos_uri#fr-FR" : "https://verifier.example.com/terms-fr",
"tos_uri#de" : "https://verifier.example.com/terms-de",
"policy_uri#fr-FR" : "https://verifier.example.com/privacy-fr",
"client_uri#fr-FR" : "https://verifier.example.com/fr",
"client_uri#de" : "https://verifier.example.com/de"
}
}
},
"Create Verifier2 with inline x5c" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "x509_san_dns:verifier.example.com",
"x5c" : [ "MIIBljCCAT2gAwIBAgIUP/xM+biohoGvcYdfgGxd0CQBT28wCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjYxMDAxMTFaFw0yNzAxMjYxMDAxMTFaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOQMWbqm+DvDO1RRPsVYzbNc2vgdVOw9zZhu+n+8NZqqMbW+qJuXQZ2rxiUzIvzqtQHITjSozNGHmyNbN9b1JxOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRHt/+svL7jM/XYPvNMjwWM3JlYSjAfBgNVHSMEGDAWgBRHCT92dpAI1vlPm7tTUfYYjgkfwDAKBggqhkjOPQQDAgNHADBEAiALQcUEt5xjuTdYRZ+flY2dXXr7lW961XTJbxQsSDSJxQIgHK8ZyQrwkMjfze81axgISEmb+AZBUY8LCPtJ8MpNcWI=" ]
}
},
"Create Verifier2 with x5cReferences" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "x509_san_dns:verifier.example.com",
"x5cReferences" : [ "waltid.tenant1.x509-store.cert1" ]
}
},
"Create VICAL Service" : {
"value" : {
"type" : "vical-service",
"signingKeyId" : "waltid.kms.key",
"signerCertificateId" : "waltid.x509-store.signer-cert",
"signerCertificateChainIds" : [ "waltid.x509-store.signer-chain-root" ]
}
},
"Wallet2 with minimal configuration" : {
"value" : {
"type" : "wallet2"
}
},
"Wallet2 with Client Attester" : {
"value" : {
"type" : "wallet2",
"dependencies" : [ "waltid.client-attester" ]
}
},
"Wallet2 with static did and key" : {
"value" : {
"type" : "wallet2",
"configuration" : {
"staticDid" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
"staticKey" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
}
},
"Create X.509 Certificate Service" : {
"value" : {
"type" : "x509-service"
}
},
"Create X.509 Certificate Store" : {
"value" : {
"type" : "x509-store"
}
}
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "Created new service. The new service reference will in the response",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"title" : "*"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/resource-api/services/init" : {
"post" : {
"tags" : [ "Service | Resource" ],
"summary" : "Composable resource & service initialization",
"description" : "Permissions: None required \nOperation: 'batch-create' \nRequires authentication. \n\n---\nInitialize a full service hierarchy (wallet, issuer) with fine-grained, composable control.\n\nEach resource block declares `createIfNotFound`, `target`, `config`, and optional children.\nResources are created in dependency order; children are always created after their parent.\n\n**Wallet creation order:** wallet → kms → key → didStore → didService → did → credentialStore\n**Issuer creation order:** kms → key → issuer → didStore → didService → did → profile → x509Store → x509Service → iacaKey → iacaCert → dscKey → dsc\n\nBoth `wallet` and `issuer` blocks can be submitted in a single request for atomic tenant\nbootstrap. All blocks are **idempotent** when `createIfNotFound = true`; safe to re-post.\n\n**Permissions:** Required roles are derived from the request body. For each block with\n`createIfNotFound = true`, the caller must hold the corresponding create permission on that\nblock's `target` (e.g. `ES_KMS_CREATE` for a KMS block). Blocks with `createIfNotFound = false`\nonly resolve an existing resource and fail if it is absent, so they do not require create\npermissions. `RM_CREATE_SERVICE` satisfies any service-create check.\n\n> **Scope:** This endpoint targets the Issuer2 / Wallet2 ecosystem only.\n> External Authorization Server (Keycloak) configuration is set on the `IssuerServiceReference2`\n> via `POST /services` and is not repeated here.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ComposableInitRequest"
},
"examples" : {
"Wallet – minimal (KMS + ES256 key only)" : {
"description" : "Creates a wallet service with a single JWK-backed ES256 key.\nSuitable when DID management and credential storage are handled externally.",
"value" : {
"wallet" : {
"target" : "waltid.tenant.wallet",
"kms" : {
"target" : "waltid.tenant.wallet.kms",
"key" : {
"target" : "waltid.tenant.wallet.kms.wallet_key",
"config" : {
"keyType" : "secp256r1"
}
}
}
}
}
},
"Wallet – full stack (ES256 key + did:key + credential store)" : {
"description" : "Creates a complete wallet stack: KMS with ES256 key, DID store, DID service\nwith a `did:key` identity, and a credential store. Typical starting point for\na Wallet2 tenant that will receive credentials via OID4VCI.",
"value" : {
"wallet" : {
"target" : "waltid.tenant.wallet",
"kms" : {
"target" : "waltid.tenant.wallet.kms",
"key" : {
"target" : "waltid.tenant.wallet.kms.wallet_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.wallet.didstore"
},
"didService" : {
"target" : "waltid.tenant.wallet.didservice",
"dependencies" : [ "waltid.tenant.wallet.kms", "waltid.tenant.wallet.didstore" ],
"did" : {
"target" : "waltid.tenant.wallet.didstore.wallet_did"
}
},
"credentialStore" : {
"target" : "waltid.tenant.wallet.credentialstore"
}
}
}
},
"Wallet – ES256 key + did:jwk + credential store" : {
"description" : "Same as the full wallet stack but uses a `did:jwk` identifier instead of\n`did:key`. Prefer this when the verifier requires JWK-based binding methods.",
"value" : {
"wallet" : {
"target" : "waltid.tenant.wallet",
"kms" : {
"target" : "waltid.tenant.wallet.kms",
"key" : {
"target" : "waltid.tenant.wallet.kms.wallet_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.wallet.didstore"
},
"didService" : {
"target" : "waltid.tenant.wallet.didservice",
"dependencies" : [ "waltid.tenant.wallet.kms", "waltid.tenant.wallet.didstore" ],
"did" : {
"target" : "waltid.tenant.wallet.didstore.did",
"type" : "jwk"
}
},
"credentialStore" : {
"target" : "waltid.tenant.wallet.credentialstore"
}
}
}
},
"Wallet – AWS KMS + did:key + credential store" : {
"description" : "Full wallet stack backed by AWS KMS (IAM role-based auth, eu-central-1).\nReplace `region` with your target AWS region. Credentials are resolved from\nthe instance profile / environment automatically.",
"value" : {
"wallet" : {
"target" : "waltid.tenant.wallet",
"kms" : {
"target" : "waltid.tenant.wallet.kms",
"config" : {
"backend" : "aws",
"auth" : {
"region" : "us-east-1"
}
},
"key" : {
"target" : "waltid.tenant.wallet.kms.wallet_key",
"config" : {
"backend" : "aws",
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.wallet.didstore"
},
"didService" : {
"target" : "waltid.tenant.wallet.didservice",
"dependencies" : [ "waltid.tenant.wallet.kms", "waltid.tenant.wallet.didstore" ],
"did" : {
"target" : "waltid.tenant.wallet.didstore.did"
}
},
"credentialStore" : {
"target" : "waltid.tenant.wallet.credentialstore"
}
}
}
},
"Issuer – minimal (KMS + ES256 key only)" : {
"description" : "Creates an Issuer2 service with a JWK-backed ES256 signing key.\nNo DID or profile is created. Useful when you need to configure the issuer\nmanually or add a DID and profile in subsequent calls.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
}
}
}
},
"Issuer – full stack (ES256 key + did:key + OpenBadge profile)" : {
"description" : "Creates a complete Issuer2 stack: KMS, ES256 signing key, DID store,\nDID service with a `did:key` identity, and a default OpenBadgeCredential\nprofile. Ready to issue credentials immediately after this call.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.issuer_did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – full stack with did:jwk" : {
"description" : "Identical to the full issuer stack but registers a `did:jwk` identifier.\nUseful for issuers targeting wallets that prefer JWK-encoded DIDs.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did",
"type" : "jwk"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – full stack with did:web" : {
"description" : "Full issuer stack with a `did:web` identifier. The domain is resolved from\n`DidWebOpenApiDocs.DEFAULT_WEB_DOMAIN`; override it at the DID service level\nif needed. Suitable for production issuers that need a publicly resolvable DID.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did",
"type" : "web"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – AWS KMS backend + did:key + profile" : {
"description" : "Full issuer stack with keys stored in AWS KMS (IAM role auth, eu-central-1).\nSwap `region` as needed. The `did:key` identifier is derived from the\nAWS-managed key material.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"config" : {
"backend" : "aws",
"auth" : {
"region" : "eu-central-1"
}
},
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"backend" : "aws",
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – Azure Key Vault backend + did:key + profile" : {
"description" : "Full issuer stack with keys stored in Azure Key Vault.\nReplace `keyVaultUrl` with your vault endpoint. Uses Managed Identity\nby default; supply `clientId`/`clientSecret` in the auth object for\nService Principal auth.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"config" : {
"backend" : "azure",
"auth" : {
"keyVaultUrl" : "https://your-key-vault-name.vault.azure.net/"
}
},
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"backend" : "azure",
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – pre-authorized flow only (no DID)" : {
"description" : "Creates an Issuer2 service configured for anonymous pre-authorized code flow.\nNo DID is registered because holder binding uses `jwk` method directly.\nAdd `didStore` + `didService` blocks later if DID-based binding is needed.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Pre-Authorized Issuance Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – authorized code flow with Keycloak (profile only, AS pre-configured)" : {
"description" : "Assumes the Issuer2 service was already created via `POST /services` with\n`authProviderConfiguration` pointing to Keycloak. This call layers the DID\nand the issuance profile on top of that existing service.\n`createIfNotFound = true` on the issuer block means the service itself is\nskipped if already present; only the DID and profile are created.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Keycloak-Backed Authorized Issuance Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
},
"Issuer – custom credential data + mapping in profile" : {
"description" : "Full issuer stack where the profile carries explicit `credentialData` (an\nOpenBadgeCredential template) and a `mapping` expression that resolves\n`credentialSubject.id` from the wallet's DID at issuance time.\nPlaceholders such as `\"did:key:placeholder\"` are overwritten by the mapping.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Identity Credential Profile",
"credentialConfigurationId" : "open_badge_credential",
"credentialData" : {
"@context" : [ "https://www.w3.org/ns/credentials/v2", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "Academic Excellence Award",
"validFrom" : "2025-01-01T00:00:00Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Acme University",
"url" : "https://acme.edu/",
"id" : "did:key:placeholder",
"image" : {
"id" : "https://acme.edu/logo.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:placeholder",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:7b408e3a-bc01-49e3-b8e9-4a4a99c5d123",
"type" : [ "Achievement" ],
"name" : "Academic Excellence Award",
"description" : "Awarded for outstanding academic performance",
"criteria" : {
"narrative" : "Recipients must maintain a GPA above 3.8"
}
}
}
},
"mapping" : {
"credentialSubject" : {
"id" : ""
}
}
}
}
}
}
},
"Issuer – X.509 full chain (IACA + DSC creation)" : {
"description" : "Provisions the X.509 certificate infrastructure required for ISO 18013-5\nmDL/mDoc credential issuance — IACA root and Document Signer Certificate —\nusing freshly generated keys.\n\n**What gets created:**\n- KMS with a token-signing key (`token_key`)\n- X.509 store (persistent certificate storage)\n- X.509 service (linked to KMS + store, used for certificate management)\n- IACA root key (`iaca_key`) generated inside the KMS\n- IACA root certificate signed by `iaca_key`, stored as `iaca-root`\n- DSC key (`dsc_key`) generated inside the KMS\n- Document Signer Certificate signed by the IACA, stored as `document-signer`\n- The **X.509 store** is attached to the issuer as a dependency\n\n**Required follow-up to enable mDoc issuance:**\nThis call bootstraps the certificate infrastructure only. The issuer is still\ncreated with a default JWT credential configuration. Two additional API calls\nare needed before the issuer can sign mDoc credentials:\n1. `PUT /v2/{target}/issuer-service-api/configuration/update` — add an `mso_mdoc` credential\n configuration entry with the target document type (e.g. `org.iso.18013.5.1.mDL`)\n2. `POST /v2/{target}/issuer-service-api/credentials/profiles` — create an mDoc credential profile\n setting `issuerKeyId` to the DSC key path\n (`waltid.tenant.issuer.kms.dsc_key`) and `x5Chain` to the stored DSC\n certificate reference (`waltid.tenant.issuer.x509store.document-signer`)",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.token_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"x509" : {
"x509Service" : {
"target" : "waltid.tenant.issuer.x509service"
},
"x509Store" : {
"target" : "waltid.tenant.issuer.x509store"
},
"iaca" : {
"storedCertificateId" : "iaca-root",
"certificateData" : {
"country" : "DE",
"commonName" : "IACA Root CA",
"issuerAlternativeNameConf" : {
"uri" : "https://issuer.example.com"
},
"organizationName" : "Example GmbH",
"crlDistributionPointUri" : "https://crl.example.com/iaca.crl"
},
"keyIdSuffix" : "iaca_key",
"keyGenerationRequest" : {
"keyType" : "secp256r1"
}
},
"dsc" : {
"storedCertificateId" : "document-signer",
"certificateData" : {
"country" : "DE",
"commonName" : "Document Signer Certificate",
"crlDistributionPointUri" : "https://crl.example.com/dsc.crl",
"organizationName" : "Example GmbH"
},
"keyIdSuffix" : "dsc_key",
"keyGenerationRequest" : {
"keyType" : "secp256r1"
}
}
}
}
}
},
"Issuer – X.509 with existing IACA (DSC only)" : {
"description" : "Provisions the X.509 Document Signer Certificate (DSC) infrastructure for\nmDL/mDoc issuance under an **existing** IACA — skipping IACA creation.\n\n**What gets created:**\n- KMS with a token-signing key (`token_key`)\n- X.509 store and X.509 service\n- DSC key (`dsc_key`) generated inside the KMS\n- DSC signed by the provided IACA certificate + `iaca_key` already in KMS\n- The **X.509 store** is attached to the issuer as a dependency\n\n**Prerequisites:** Replace `existingIacaPem` with your real PEM-encoded IACA\ncertificate. The IACA private key referenced by `existingIacaKeyTarget` must\nalready exist in the issuer's KMS before this call is made.\n\n**Required follow-up to enable mDoc issuance:**\nSame as the full-chain example: add an `mso_mdoc` credential configuration to\nthe issuer service, then create an mDoc credential profile with `issuerKeyId`\npointing to `waltid.tenant.issuer.kms.dsc_key` and `x5Chain` referencing the\nstored DSC at `waltid.tenant.issuer.x509store.document-signer`.\n\nUse this when the IACA root is maintained by a separate authority (e.g. a\nnational PKI operator) and you only need to issue a new DSC under it.",
"value" : {
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.token_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"x509" : {
"x509Service" : {
"target" : "waltid.tenant.issuer.x509service"
},
"x509Store" : {
"target" : "waltid.tenant.issuer.x509store"
},
"existingIacaPem" : "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----",
"existingIacaKeyTarget" : "waltid.tenant.issuer.kms.iaca_key",
"dsc" : {
"storedCertificateId" : "document-signer",
"certificateData" : {
"country" : "DE",
"commonName" : "Document Signer Certificate",
"crlDistributionPointUri" : "https://crl.example.com/dsc.crl",
"organizationName" : "Example GmbH"
},
"keyIdSuffix" : "dsc_key",
"keyGenerationRequest" : {
"keyType" : "secp256r1"
}
}
}
}
}
},
"Full tenant bootstrap – wallet2 + issuer2 in one call" : {
"description" : "Bootstraps an entire tenant in a single atomic request:\n- **Wallet2**: Ed25519/JWK KMS, did:key, credential store\n- **Issuer2**: ES256/JWK KMS, did:key, default OpenBadge profile\n\nBoth stacks are independent (separate KMS paths). Use this as your\ngo-to example for spinning up a new tenant from scratch.",
"value" : {
"wallet" : {
"target" : "waltid.tenant.wallet",
"kms" : {
"target" : "waltid.tenant.wallet.kms",
"key" : {
"target" : "waltid.tenant.wallet.kms.wallet_key",
"config" : { }
}
},
"didStore" : {
"target" : "waltid.tenant.wallet.didstore"
},
"didService" : {
"target" : "waltid.tenant.wallet.didservice",
"dependencies" : [ "waltid.tenant.wallet.kms", "waltid.tenant.wallet.didstore" ],
"did" : {
"target" : "waltid.tenant.wallet.didstore.wallet_did"
}
},
"credentialStore" : {
"target" : "waltid.tenant.wallet.credentialstore"
}
},
"issuer" : {
"target" : "waltid.tenant.issuer",
"kms" : {
"target" : "waltid.tenant.issuer.kms",
"key" : {
"target" : "waltid.tenant.issuer.kms.issuer_key",
"config" : {
"keyType" : "secp256r1"
}
}
},
"didStore" : {
"target" : "waltid.tenant.issuer.didstore"
},
"didService" : {
"target" : "waltid.tenant.issuer.didservice",
"dependencies" : [ "waltid.tenant.issuer.kms", "waltid.tenant.issuer.didstore" ],
"did" : {
"target" : "waltid.tenant.issuer.didstore.issuer_did"
}
},
"profile" : {
"target" : "waltid.tenant.issuer.profile",
"config" : {
"name" : "Default Issuer Profile",
"credentialConfigurationId" : "open_badge_credential"
}
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "All requested resources were processed. Check each result's `created` flag.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ComposableInitResponse"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/host-alias-api/host-aliases/create" : {
"post" : {
"tags" : [ "Service | Host Alias" ],
"summary" : "Create host alias at location",
"description" : "Permissions: ANY OF: [ADMIN_HOST_ALIAS_CREATE] \nOperation: 'create-host-alias' \nRequires authentication. \n\n---\nCreates a host alias entry bound to the given target path within the organization tree.\n\nHost aliases map an external domain (e.g., tenant1.example.com) to an internal organization/tenant path,\nenabling inbound routing and service discovery for multi-tenant setups.\n\nNotes:\n- The target path must not already exist; otherwise the request fails\n- Only organizational roots and tenant nodes may be used as parents\n- Deleting the alias removes both the alias mapping and its resource entry\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Host alias creation payload",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.hostalias.HostAliasService.HostAliasCreationRequest"
},
"examples" : {
"Create alias" : {
"value" : {
"domain" : "tenant1.example.com"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Created host alias",
"headers" : { }
},
"400" : {
"description" : "Invalid target path or alias already exists at the location",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create host aliases",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/host-alias-api/host-aliases/view" : {
"get" : {
"tags" : [ "Service | Host Alias" ],
"summary" : "View host alias information",
"description" : "Permissions: ANY OF: [ADMIN_HOST_ALIAS_GET] \nOperation: 'view-host-alias' \nAccepts targets: [HostAliasResource] \nRequires authentication. \n\n---\nReturns the host-alias resource stored at the specified target path.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Host alias resource",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/host-alias"
},
"examples" : {
"Alias example" : {
"value" : {
"_id" : "waltid.tenant1.host-aliases.tenant1-example-com",
"domain" : "tenant1.example.com",
"parent" : "waltid.tenant1.host-aliases"
}
}
}
}
}
},
"404" : {
"description" : "No host alias resource found at the target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view host aliases",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/host-alias-api/host-aliases/delete" : {
"delete" : {
"tags" : [ "Service | Host Alias" ],
"summary" : "Delete existing host alias",
"description" : "Permissions: ANY OF: [ADMIN_HOST_ALIAS_DELETE] \nOperation: 'delete-host-alias' \nNo target restriction. \nRequires authentication. \n\n---\nDeletes the host alias mapping and removes its resource entry from the organization tree.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Host alias deleted",
"headers" : { }
},
"404" : {
"description" : "No host alias resource found at the target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete host aliases",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/apikeys-api/api-keys/create" : {
"post" : {
"tags" : [ "Service | API Keys" ],
"summary" : "Create a new API key",
"description" : "Permissions: ANY OF: [CREATE_API_KEY] \nOperation: 'create-apikey' \nRequires authentication. \n\n---\nCreates a new API key for programmatic access to the Enterprise API. \nAPI keys are used for authentication when making API requests using Bearer token authentication.\n\n**Important Notes:**\n- The API key token is only returned once during creation. Store it securely.\n- API keys can be permanent (no expiration) or temporary (with expiration).\n- Expiration format follows ISO 8601 duration format (e.g., \"30d\", \"1h\", \"90d\").\n- API keys are scoped to the target organization/tenant where they are created.\n- Each API key creates a dedicated API account with its own permissions.\n- This endpoint will fail if an API key already exists at the target path.\n- Name and expiration are fixed at creation and cannot be changed afterward - delete and recreate the key if you need different values.\n\n**Security:**\n- Treat API keys as sensitive credentials.\n- Rotate API keys regularly for security best practices.\n- Delete unused or compromised API keys immediately.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "API key creation request with name and optional expiration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.apikeys.ApiKeyService.ApiKeyCreationRequest"
},
"examples" : {
"Permanent API Key (no expiration)" : {
"value" : {
"name" : "Production API Key"
}
},
"Temporary API Key (30 days)" : {
"value" : {
"name" : "Temporary Integration Key",
"expiration" : "30d"
}
},
"Short-lived API Key (1 hour)" : {
"value" : {
"name" : "Test API Key",
"expiration" : "1h"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "API key created successfully. The token is returned only once - store it securely.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.apikeys.ApiKeyService.ApiKeyInformation"
},
"examples" : {
"Permanent API Key Response" : {
"value" : {
"_id" : "waltid.tenant1.api-key.production-key",
"name" : "Production API Key",
"token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhcGktMTIzNDU2NzgtYWJjZC1kZWYxLTIzNDUtNTY3ODkwYWJjZGVmIiwic3RhdHVzIjoiU1VDQ0VTUyIsImV4cCI6MTcwMDAwMDAwMCwiaWF0IjoxNjk5OTk5OTk5fQ.example-signature"
}
},
"Temporary API Key Response" : {
"value" : {
"_id" : "waltid.tenant1.api-key.temp-key",
"name" : "Temporary Integration Key",
"token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhcGktOTg3NjU0MzItemVkYy14eXotOTg3Ni01NDMyMTB6ZWRjeHl6Iiwic3RhdHVzIjoiU1VDQ0VTUyIsImV4cCI6MTcwMDAwMDAwMCwiaWF0IjoxNjk5OTk5OTk5fQ.example-signature"
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - entry already exists at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create API keys at this target",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/apikeys-api/api-keys/view" : {
"get" : {
"tags" : [ "Service | API Keys" ],
"summary" : "View API key details",
"description" : "Permissions: ANY OF: [VIEW_API_KEY] \nOperation: 'view-apikey' \nAccepts targets: [ApiKeyResource] \nRequires authentication. \n\n---\nRetrieves detailed information about an existing API key, including its metadata, creation timestamp, \naccount ID, and token expiration (if set).\n\n**Note:** The full token is included in this response. Handle it securely as it provides full API access.\nThe token is also available during creation, but this endpoint allows you to retrieve it later.\n\n**Response Fields:**\n- `_id`: The target path of the API key\n- `name`: Human-readable name for the API key\n- `createdAt`: ISO 8601 timestamp when the API key was created\n- `accountId`: The associated API account identifier\n- `token`: The JWT token used for authentication (Bearer token)\n- `tokenExpiration`: Optional expiration timestamp if the key has an expiration date\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "The target path of the API key resource (e.g., 'waltid.tenant1.api-key.my-key')",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid.tenant1.api-key.production-key"
} ],
"responses" : {
"200" : {
"description" : "API key information retrieved successfully. The response includes the full API key resource with token, metadata, account ID, and expiration information.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/api-key"
}
}
}
},
"404" : {
"description" : "API key not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this API key",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/apikeys-api/api-keys/delete" : {
"delete" : {
"tags" : [ "Service | API Keys" ],
"summary" : "Delete an API key",
"description" : "Permissions: ANY OF: [DELETE_API_KEY] \nOperation: 'delete-apikey' \nAccepts targets: [ApiKeyResource] \nRequires authentication. \n\n---\nPermanently deletes an API key and its associated API account. This action cannot be undone.\n\n**Important:**\n- The API key will immediately stop working for authentication.\n- The associated API account will be deleted.\n- Any applications using this API key will lose access.\n- Ensure you have an alternative authentication method before deletion.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "The target path of the API key resource to delete (e.g., 'waltid.tenant1.api-key.my-key')",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid.tenant1.api-key.production-key"
} ],
"responses" : {
"200" : {
"description" : "API key deleted successfully",
"headers" : { }
},
"404" : {
"description" : "API key not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete this API key",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/apikeys-api/api-keys/list" : {
"get" : {
"tags" : [ "Service | API Keys" ],
"summary" : "List API keys",
"description" : "Permissions: ANY OF: [LIST_API_KEY] \nOperation: 'list-apikey' \nAccepts targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nRecursively lists all API keys within the specified target path (organization or tenant).\nReturns a stream of API key metadata including their paths and creation timestamps.\n\n**Note:** This endpoint returns a Flow (stream) of API keys, not a single array.\nThe response will contain multiple API key entries as they are discovered.\n\n**Use Cases:**\n- Audit existing API keys\n- Identify unused or expired keys\n- Manage API key inventory\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "The target path to search for API keys (organization or tenant path, e.g., 'waltid.tenant1')",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid.tenant1"
} ],
"responses" : {
"200" : {
"description" : "Stream of API keys found within the target path",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.apikeys.ApiKeyDataTransferObject"
},
"examples" : {
"First API Key" : {
"value" : {
"path" : "waltid.tenant1.api-key.production-key",
"created" : "2024-01-15T10:30:00.000Z"
}
},
"Second API Key" : {
"value" : {
"path" : "waltid.tenant1.api-key.temp-key",
"created" : "2024-01-20T14:45:00.000Z"
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list API keys at this target",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/create" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Create a new role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_CREATE] \nOperation: 'create-role' \nAccepts parent targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nCreates a new role within an organization or tenant. Roles are used to group permissions and can be assigned to users or API keys to control access to resources. You can find the required permissions for the various API endpoints within this documentation. In the description of each endpoint, look for a field labeled \"Operation.\" This field indicates the specific permission needed to access that endpoint.\n\n**Use Cases:**\n- Define custom access control roles for your organization\n- Create role templates with predefined permissions\n- Set up hierarchical permission structures\n- Organize permissions by function or department\n\n**Important Notes:**\n- Roles can be created at the organization level or tenant level\n- The role ID is automatically generated from the target path\n- Permissions can be included during creation or added later\n- Permissions must reference resources within the role's parent path\n- Role names are optional but recommended for clarity\n- This endpoint will fail if the role already exists (use PUT for idempotent upsert)\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.RoleCreationRequest"
},
"examples" : {
"Simple role" : {
"value" : {
"name" : "My simple role"
}
},
"Role with permissions" : {
"value" : {
"name" : "KMS Key Creator",
"permissions" : [ {
"target" : "example.kms",
"action" : "generate-key"
}, {
"target" : "example.kms",
"action" : "store-key"
}, {
"target" : "example.kms",
"action" : "import-key-jwk"
} ]
}
},
"Admin role" : {
"value" : {
"name" : "My Admin",
"permissions" : [ {
"target" : "root_of_my_organization",
"action" : "all"
} ]
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Role created successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid role creation request - invalid permissions, target path, or role already exists",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles" : {
"put" : {
"tags" : [ "Service | Roles" ],
"summary" : "Create or get existing role (idempotent)",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_CREATE] \nOperation: 'upsert-role' \nAccepts parent targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nCreates a new role or returns the existing role if it already exists. This is an idempotent operation - calling it multiple times with the same target will always succeed.\n\n**Use Cases:**\n- Ensure a role exists without failing if it already exists\n- Idempotent role setup in automation scripts\n- Safe role creation in integration tests\n- Declarative infrastructure-as-code patterns\n\n**Important Notes:**\n- If the role already exists, it is returned without modification\n- If the role doesn't exist, it is created with the provided configuration\n- Returns HTTP 200 if role already existed, HTTP 201 if newly created\n- The response body contains the role (existing or newly created)\n- Permissions in the request are only applied when creating a new role\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.RoleCreationRequest"
},
"examples" : {
"Simple role" : {
"value" : {
"name" : "My simple role"
}
},
"Role with permissions" : {
"value" : {
"name" : "KMS Key Creator",
"permissions" : [ {
"target" : "example.kms",
"action" : "generate-key"
}, {
"target" : "example.kms",
"action" : "store-key"
}, {
"target" : "example.kms",
"action" : "import-key-jwk"
} ]
}
},
"Admin role" : {
"value" : {
"name" : "My Admin",
"permissions" : [ {
"target" : "root_of_my_organization",
"action" : "all"
} ]
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Role created successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Newly created role" : {
"value" : {
"_id" : "example.role1",
"name" : "Example role 1",
"permissions" : [ ],
"parent" : "example"
}
}
}
}
}
},
"200" : {
"description" : "Role already exists - returning existing role",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Existing role" : {
"value" : {
"_id" : "example.role2",
"name" : "Admin Role",
"permissions" : [ {
"target" : "example.test",
"action" : "all"
} ],
"parent" : "example"
}
}
}
}
}
},
"400" : {
"description" : "Invalid role creation request - invalid permissions or target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/list" : {
"get" : {
"tags" : [ "Service | Roles" ],
"summary" : "Recursively list roles",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_LIST] \nOperation: 'list-roles' \nAccepts targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nRetrieves all roles within an organization or tenant, including roles in nested structures. The search is recursive, meaning it will find roles at all levels within the specified path.\n\n**Use Cases:**\n- Audit all roles in an organization or tenant\n- Discover available roles for assignment\n- Review role structure and hierarchy\n- Export role configurations for documentation\n\n**Important Notes:**\n- The search is recursive and includes all child paths\n- Results include roles at the specified level and all nested levels\n- Roles are identified by their type prefix in the path\n- The response format is a list of JSON objects representing each role\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of roles found recursively within the specified path",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"title" : "ArrayList"
},
"examples" : {
"Role response" : {
"value" : [ {
"_id" : "example.role1",
"name" : "Example role 1",
"permissions" : [ {
"target" : "example.test",
"action" : "all"
} ],
"parent" : "example"
}, {
"_id" : "example.tenant1.roleAbc",
"name" : "Example role 2",
"permissions" : [ ],
"parent" : "example.tenant1"
} ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/view" : {
"get" : {
"tags" : [ "Service | Roles" ],
"summary" : "View existing role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_GET] \nOperation: 'view-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRetrieves detailed information about a specific role, including its name, identifier, and all associated permissions.\n\n**Use Cases:**\n- Review role permissions before assignment\n- Audit role configuration\n- Understand what access a role provides\n- Verify role settings\n\n**Important Notes:**\n- Returns the complete role definition including all permissions\n- The role must exist at the specified target path\n- Permissions are returned as a list with full details\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Role details including name, identifier, and permissions",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Example role 1" : {
"value" : {
"_id" : "example.role1",
"name" : "Example role 1",
"permissions" : [ {
"target" : "example.test",
"action" : "all"
} ],
"parent" : "example"
}
},
"Example role 2" : {
"value" : {
"_id" : "example.tenant1.roleAbc",
"name" : "Example role 2",
"permissions" : [ ],
"parent" : "example.tenant1"
}
}
}
}
}
},
"404" : {
"description" : "Role not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/delete" : {
"delete" : {
"tags" : [ "Service | Roles" ],
"summary" : "Delete role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_DELETE] \nOperation: 'delete-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nPermanently deletes a role from the organization or tenant. This operation removes the role definition and all its permissions.\n\n**Use Cases:**\n- Remove obsolete or unused roles\n- Clean up test roles\n- Reorganize role structure\n- Remove deprecated access patterns\n\n**Important Notes:**\n- This operation is irreversible\n- Deleting a role does not automatically unassign it from users or API keys\n- Users and API keys with this role assigned will lose access once the role is deleted\n- Consider unassigning the role from all accounts before deletion\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Role deleted successfully",
"headers" : { }
},
"404" : {
"description" : "Role not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/account/assign" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Assign role to a user",
"description" : "Permissions: ANY OF: [ADMIN_USER_ROLES_ASSIGN] \nOperation: 'user-assign-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nAssigns a role to a user account identified by email address. The user will immediately gain all permissions associated with the role.\n\n**Use Cases:**\n- Grant access to new team members\n- Promote users to higher privilege levels\n- Assign role-based access to specific resources\n- Implement role-based access control (RBAC) workflows\n\n**Important Notes:**\n- The user must exist in the system and be identified by their email\n- The role is assigned within the context of the organization\n- Users can have multiple roles assigned simultaneously\n- Permission changes take effect immediately\n- The assigner must have appropriate permissions to assign roles\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.UserRoleAssigningRequest"
},
"examples" : {
"Assign role to user" : {
"value" : {
"assigneeEmail" : "user@example.com"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Role assigned to user successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - user not found or invalid email address",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to assign roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/account/unassign" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Unassign a role from a user",
"description" : "Permissions: ANY OF: [ADMIN_USER_ROLES_UNASSIGN] \nOperation: 'user-unassign-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRemoves a role assignment from a user account. The user will immediately lose all permissions associated with the role.\n\n**Use Cases:**\n- Revoke access when users change roles\n- Remove temporary access grants\n- Downgrade user privileges\n- Clean up role assignments for departed team members\n\n**Important Notes:**\n- The user is identified by their email address\n- Removing a role assignment takes effect immediately\n- Users may still have access through other assigned roles\n- The unassigner must have appropriate permissions\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.UserRoleAssigningRequest"
},
"examples" : {
"Unassign role from user" : {
"value" : {
"assigneeEmail" : "user@example.com"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Role unassigned from user successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - user not found, role not assigned, or invalid email address",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to unassign roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/apikey/assign" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Assign role to an API Key",
"description" : "Permissions: ANY OF: [ASSIGN_APIKEY_ROLE] \nOperation: 'apikey-assign-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nAssigns a role to an API key, granting the API key all permissions associated with the role. This enables programmatic access with role-based permissions.\n\n**Use Cases:**\n- Grant API keys access to specific resources\n- Implement service-to-service authentication with fine-grained permissions\n- Create API keys with predefined role-based access\n- Enable automated systems to access resources based on roles\n\n**Important Notes:**\n- The API key is identified by its target path\n- The API key must exist in the system\n- API keys can have multiple roles assigned simultaneously\n- Permission changes take effect immediately\n- The assigner must have appropriate permissions to assign roles\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ApiKeyRoleAssigningRequest"
},
"examples" : {
"Assign role to API key" : {
"value" : {
"apikey" : "waltid.tenant1.api-key.production-key"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Role assigned to API key successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - API key not found or invalid target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to assign roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/apikey/unassign" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Unassign a role from an API Key",
"description" : "Permissions: ANY OF: [UNASSIGN_APIKEY_ROLE] \nOperation: 'apikey-unassign-role' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRemoves a role assignment from an API key. The API key will immediately lose all permissions associated with the role.\n\n**Use Cases:**\n- Revoke API key access when changing service permissions\n- Remove temporary access grants for API keys\n- Downgrade API key privileges\n- Clean up role assignments for deprecated API keys\n\n**Important Notes:**\n- The API key is identified by its target path\n- Removing a role assignment takes effect immediately\n- API keys may still have access through other assigned roles\n- The unassigner must have appropriate permissions\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ApiKeyRoleAssigningRequest"
},
"examples" : {
"Unassign role from API key" : {
"value" : {
"apikey" : "waltid.tenant1.api-key.production-key"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Role unassigned from API key successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - API key not found, role not assigned, or invalid target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to unassign roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/external-mappings" : {
"get" : {
"tags" : [ "Service | Roles" ],
"summary" : "Get all external mappings for a role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_GET] \nOperation: 'get-role-external-mappings' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRetrieves all external role mappings configured for a specific Enterprise role.\n\n**Use Cases:**\n- View which IdP roles map to this Enterprise role\n- Review mapping configuration before updates\n- Debug authentication issues\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of external mappings for this role",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
},
"title" : "ArrayList"
},
"examples" : {
"Mappings list" : {
"value" : [ {
"externalRole" : "tenant-admin"
}, {
"externalRole" : "department-lead",
"providerId" : "keycloak-prod",
"conditions" : {
"emailDomains" : [ "company.com", "subsidiary.com" ],
"requiredClaims" : {
"department" : "engineering"
}
}
} ]
}
}
}
}
},
"404" : {
"description" : "Role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Roles" ],
"summary" : "Update external role mappings",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_UPDATE] \nOperation: 'update-external-mappings' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nReplaces all external role mappings for a role. External mappings define which IdP roles (from OIDC providers like Keycloak or Azure AD) map to this Enterprise role.\n\n**Use Cases:**\n- Configure SSO role mapping from external identity providers\n- Update mappings when IdP role names change\n- Bulk update all mappings for a role\n\n**Important Notes:**\n- This operation replaces ALL existing mappings\n- To add/remove individual mappings, use the add/remove endpoints\n- Mappings take effect immediately for new authentications\n- Existing sessions are not affected until re-authentication\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.UpdateExternalMappingsRequest"
},
"examples" : {
"Update mappings" : {
"value" : {
"externalMappings" : [ {
"externalRole" : "tenant-admin"
}, {
"externalRole" : "department-lead",
"providerId" : "keycloak-prod",
"conditions" : {
"emailDomains" : [ "company.com", "subsidiary.com" ],
"requiredClaims" : {
"department" : "engineering"
}
}
} ]
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Mappings updated successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Updated role" : {
"value" : {
"_id" : "waltid.tenant1.BW_ADMIN",
"name" : "Business Wallet Admin",
"permissions" : [ {
"target" : "waltid.tenant1",
"action" : "all"
} ],
"externalMappings" : [ {
"externalRole" : "tenant-admin"
}, {
"externalRole" : "super-admin",
"providerId" : "keycloak-prod"
} ],
"parent" : "waltid.tenant1"
}
}
}
}
}
},
"404" : {
"description" : "Role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Roles" ],
"summary" : "Clear all external mappings from a role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_UPDATE] \nOperation: 'clear-external-mappings' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRemoves all external role mappings from an Enterprise role. This is an idempotent operation - calling it on a role with no mappings succeeds without error.\n\n**Use Cases:**\n- Reset role to have no external mappings\n- Prepare role for fresh mapping configuration\n- Remove all SSO access to a role\n\n**Important Notes:**\n- This operation is irreversible\n- Users with mapped external roles will lose access on next authentication\n- Existing sessions are not affected until re-authentication\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "All mappings cleared successfully",
"headers" : { }
},
"404" : {
"description" : "Role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/roles/external-mappings/{externalRole}" : {
"get" : {
"tags" : [ "Service | Roles" ],
"summary" : "Get a single external mapping",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_GET] \nOperation: 'get-single-external-mapping' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRetrieves a specific external role mapping by its external role name.\n\n**Path Parameters:**\n- `externalRole`: The name of the external IdP role (URL-encoded if it contains special characters)\n\n**Query Parameters:**\n- `providerId` (optional): If the mapping was created with a specific provider ID, include it to get that specific mapping\n\n**Use Cases:**\n- Check if a specific mapping exists\n- Review mapping conditions before update\n- Debug specific authentication scenarios\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The external mapping",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
},
"examples" : {
"Simple mapping" : {
"value" : {
"externalRole" : "tenant-admin"
}
},
"Mapping with conditions" : {
"value" : {
"externalRole" : "department-lead",
"providerId" : "keycloak-prod",
"conditions" : {
"emailDomains" : [ "company.com", "subsidiary.com" ],
"requiredClaims" : {
"department" : "engineering"
}
}
}
}
}
}
}
},
"404" : {
"description" : "Role or mapping not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Roles" ],
"summary" : "Create or update a single external mapping (idempotent)",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_UPDATE] \nOperation: 'upsert-single-external-mapping' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nCreates a new external role mapping or updates an existing one. This is an **idempotent** operation - calling it multiple times with the same parameters produces the same result.\n\n**Path Parameters:**\n- `externalRole`: The name of the external IdP role to map (URL-encoded if it contains special characters)\n\n**Request Body:**\n- `providerId` (optional): Scope mapping to a specific OIDC provider\n- `conditions` (optional): Conditions that must be met for the mapping to apply\n- `enabled`: Whether the mapping is active (default: true)\n\n**Idempotency:**\n- If the mapping doesn't exist, it is created (returns HTTP 201)\n- If the mapping already exists, it is updated with the new values (returns HTTP 200)\n- The external role name comes from the URL path, not the request body\n\n**Use Cases:**\n- Add a new IdP role mapping to an Enterprise role\n- Update conditions or enabled status on an existing mapping\n- Declarative configuration in automation scripts\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.UpsertSingleMappingRequest"
},
"examples" : {
"Simple mapping" : {
"value" : { }
},
"Mapping with provider" : {
"value" : {
"providerId" : "keycloak-prod"
}
},
"Mapping with conditions" : {
"value" : {
"providerId" : "keycloak-prod",
"conditions" : {
"emailDomains" : [ "company.com" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Mapping created successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Role with new mapping" : {
"value" : {
"_id" : "waltid.tenant1.BW_ADMIN",
"name" : "Business Wallet Admin",
"permissions" : [ {
"target" : "waltid.tenant1",
"action" : "all"
} ],
"externalMappings" : [ {
"externalRole" : "tenant-admin"
}, {
"externalRole" : "super-admin",
"providerId" : "keycloak-prod"
} ],
"parent" : "waltid.tenant1"
}
}
}
}
}
},
"200" : {
"description" : "Mapping updated successfully (already existed)",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/role"
},
"examples" : {
"Role with updated mapping" : {
"value" : {
"_id" : "waltid.tenant1.BW_ADMIN",
"name" : "Business Wallet Admin",
"permissions" : [ {
"target" : "waltid.tenant1",
"action" : "all"
} ],
"externalMappings" : [ {
"externalRole" : "tenant-admin"
}, {
"externalRole" : "super-admin",
"providerId" : "keycloak-prod"
} ],
"parent" : "waltid.tenant1"
}
}
}
}
}
},
"404" : {
"description" : "Role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Roles" ],
"summary" : "Delete a single external mapping (idempotent)",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_UPDATE] \nOperation: 'delete-single-external-mapping' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRemoves a specific external role mapping from an Enterprise role. This is an **idempotent** operation - calling it on a non-existent mapping succeeds without error.\n\n**Path Parameters:**\n- `externalRole`: The name of the external IdP role to unmap (URL-encoded if it contains special characters)\n\n**Query Parameters:**\n- `providerId` (optional): If the mapping was created with a specific provider ID, include it to delete that specific mapping\n\n**Idempotency:**\n- Always returns HTTP 204 (No Content) whether the mapping existed or not\n- Safe to call multiple times without side effects\n\n**Use Cases:**\n- Remove a specific IdP role mapping\n- Clean up obsolete mappings\n- Revoke SSO access for a specific external role\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "Mapping deleted (or didn't exist)",
"headers" : { }
},
"404" : {
"description" : "Role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update role",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/permissions/permissions/add-to-role" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Add permission to existing role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_ADD_PERMISSION] \nOperation: 'add-role-permission' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nAdds a new permission to an existing role. The permission is immediately available to all users and API keys assigned to the role.\n\n**Use Cases:**\n- Extend role capabilities incrementally\n- Grant additional resource access to existing roles\n- Update role permissions without recreating the role\n- Implement fine-grained access control adjustments\n\n**Important Notes:**\n- Permissions must reference resources within the role's parent path\n- Permission changes invalidate the organization's permission cache\n- All users and API keys with this role will immediately gain the new permission\n- Duplicate permissions are handled gracefully\n- The permission target must be within the role's organizational scope\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.permissions.Permission"
},
"examples" : {
"Add permission" : {
"value" : {
"target" : "example.test",
"action" : "all"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Permission added to role successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - permission target outside role scope, invalid permission format, or role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to modify role permissions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/permissions/permissions/remove-from-role" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Remove permission from existing role",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_REMOVE_PERMISSION] \nOperation: 'remove-role-permission' \nAccepts targets: [Role] \nRequires authentication. \n\n---\nRemoves a permission from an existing role. All users and API keys assigned to the role will immediately lose access granted by this permission.\n\n**Use Cases:**\n- Restrict role capabilities\n- Remove access to specific resources\n- Implement least-privilege access control\n- Revoke permissions without removing the entire role\n\n**Important Notes:**\n- Permission removal takes effect immediately\n- Permission changes invalidate the organization's permission cache\n- All users and API keys with this role will immediately lose the permission\n- Users may still have access through other roles or permissions\n- The permission must exactly match to be removed\n\n**Available permissions**\nALL_PERMISSIONS;ADMIN_ORGANIZATION_GET;ADMIN_ORGANIZATION_UPDATE_CONFIGURATION;ADMIN_ORGANIZATION_GET_ACCOUNTS;ADMIN_ORGANIZATION_GET_TENANTS_OF_ACCOUNT;ADMIN_TENANT_GET;ADMIN_TENANT_UPDATE;ADMIN_TENANT_CREATE;ADMIN_TENANT_INIT_WALLET;ADMIN_USER_ROLES_GET;ADMIN_USER_ROLES_ASSIGN;ADMIN_USER_ROLES_UNASSIGN;ADMIN_ROLE_CREATE;ADMIN_ROLE_LIST;ADMIN_ROLE_GET;ADMIN_ROLE_DELETE;ADMIN_ROLE_UPDATE;ADMIN_ROLE_ADD_PERMISSION;ADMIN_ROLE_REMOVE_PERMISSION;ADMIN_HOST_ALIAS_CREATE;ADMIN_HOST_ALIAS_GET;ADMIN_HOST_ALIAS_DELETE;LIST_SERVICE_DEPENDENCIES;ADD_SERVICE_DEPENDENCY;REMOVE_SERVICE_DEPENDENCY;DELEGATE_SERVICE;VIEW_METADATA;SET_METADATA;PURGE_METADATA;UPDATE_METADATA;QUERY_BY_METADATA;VIEW_RESOURCE_TREE;VIEW_EVENTS;VIEW_AUDIT_LOG;RM_CREATE_SERVICE;LIST_SUBENTRIES;DELETE_RESOURCE;DELETE_RESOURCE_RECURSIVE;UPDATE_SERVICE_CONFIGURATION;VIEW_SERVICE_CONFIGURATION;VIEW_SERVICE_DEFAULT_REQUESTS;UPDATE_SERVICE_DEFAULT_REQUESTS;CREATE_API_KEY;VIEW_API_KEY;DELETE_API_KEY;LIST_API_KEY;ASSIGN_APIKEY_ROLE;UNASSIGN_APIKEY_ROLE;ES_X509_SERVICE_CREATE;ES_X509_SERVICE_DELETE;ES_X509_SERVICE_CREATE_CSR;ES_X509_SERVICE_CREATE_CERTIFICATE;ES_X509_SERVICE_UPSERT_CERTIFICATE;ES_X509_SERVICE_CREATE_IACA_CERTIFICATE;ES_X509_SERVICE_CREATE_DS_CERTIFICATE;ES_X509_STORE_CREATE;ES_X509_STORE_DELETE;ES_X509_STORE_GET_CERTIFICATES;ES_X509_STORE_GET_CERTIFICATES_IDS;ES_X509_STORE_ADD_CERTIFICATE;ES_X509_STORE_UPDATE_CERTIFICATE;ES_X509_STORE_DELETE_CERTIFICATE;ES_CREDENTIAL_STORE_CREATE;ES_CREDENTIAL_STORE_DELETE;ES_CREDENTIAL_STORE_LIST_CREDENTIALS;ES_CREDENTIAL_STORE_LIST_CREDENTIAL_IDS;ES_CREDENTIAL_STORE_QUERY_CREDENTIAL_DOCUMENT;ES_CREDENTIAL_STORE_QUERY_CREDENTIAL_METADATA;ES_CREDENTIAL_STORE_ADD_CREDENTIAL;ES_CREDENTIAL_STORE_UPDATE_CREDENTIAL;ES_CREDENTIAL_STORE_GET_CREDENTIAL;ES_CREDENTIAL_STORE_DELETE_CREDENTIAL;ES_CREDENTIAL_STORE_DELETE_ALL_CREDENTIALS;ES_DID_STORE_CREATE;ES_DID_STORE_DELETE;ES_DID_STORE_LIST_DIDS;ES_DID_STORE_ADD_DID;ES_DID_STORE_GET_DID;ES_DID_STORE_UPDATE_DID;ES_DID_STORE_DELETE_DID;ES_DID_SERVICE_CREATE;ES_DID_SERVICE_DELETE;ES_DID_SERVICE_LIST_DIDS;ES_DID_SERVICE_CREATE_DID_KEY;ES_DID_SERVICE_CREATE_DID_JWK;ES_DID_SERVICE_CREATE_DID_WEB;ES_DID_SERVICE_RESOLVE_DID;ES_DID_REGISTRY_CREATE;ES_DID_REGISTRY_DELETE;ES_DID_REGISTRY_LIST_DIDS;ES_KMS_CREATE;ES_KMS_DELETE;ES_KMS_LIST_KEYS;ES_KMS_GET_KEY;ES_KMS_REMOVE_KEY;ES_KMS_DELETE_KEY;ES_KMS_GENERATE_KEY;ES_KMS_STORE_KEY;ES_KMS_IMPORT_KEY_JWK;ES_KMS_IMPORT_KEY_PEM;ES_KMS_SIGN;ES_POLICY_STORE_CREATE;ES_POLICY_STORE_DELETE;ES_POLICY_STORE_LIST_POLICIES;ES_POLICY_STORE_LIST_POLICY_IDS;ES_POLICY_STORE_GET_POLICY;ES_POLICY_STORE_ADD_POLICY;ES_POLICY_STORE_UPDATE_POLICY;ES_POLICY_STORE_DELETE_POLICY;ES_ISSUER_CREATE;ES_ISSUER_DELETE;ES_ISSUER_GET_CONFIGURATION;ES_ISSUER_GET_SESSION;ES_ISSUER_UPDATE_SESSION;ES_ISSUER_ISSUE_CREDENTIAL;ES_ISSUER_UPDATE_CREDENTIAL_STATUS;ES_ISSUER_GET_DISPLAY_CONFIGURATION;ES_ISSUER_UPDATE_DISPLAY_CONFIGURATION;ES_ISSUER_DELETE_DISPLAY_CONFIGURATION;ES_ISSUER_GET_CREDENTIAL_PROFILE;ES_ISSUER_ADD_CREDENTIAL_PROFILE;ES_ISSUER_UPDATE_CREDENTIAL_PROFILE;ES_ISSUER_DELETE_CREDENTIAL_PROFILE;ES_WALLET_CREATE;ES_WALLET_DELETE;ES_WALLET_RECEIVE_CREDENTIALS_FULL;ES_WALLET_PRESENT_CREDENTIALS_FULL;ES_WALLET_OBTAIN_CLIENT_ATTESTATION;ES_WALLET_GET_CURRENT_CLIENT_ATTESTATION;ES_WALLET_ISOLATED_PRESENT_CREDENTIALS;ES_WALLET_ISOLATED_RESOLVE_OFFER;ES_WALLET_ISOLATED_PROVIDER_METADATA;ES_WALLET_ISOLATED_OFFER_CREDENTIALS;ES_WALLET_ISOLATED_TOKEN_SEND_REQUEST;ES_WALLET_ISOLATED_REQUEST_NONCE;ES_WALLET_ISOLATED_PROOF_OF_POSSESSION;ES_WALLET_ISOLATED_RECEIVE_CREDENTIAL;ES_VERIFIER_CREATE;ES_VERIFIER_DELETE;ES_VERIFIER_GET_OPENID_METADATA;ES_VERIFIER_UPDATE_OPENID_METADATA;ES_VERIFIER_DELETE_OPENID_METADATA;ES_VERIFIER_VERIFY_CREDENTIAL;ES_VERIFIER_GET_VERIFIER_SESSION;ES_VERIFIER_UPDATE_VERIFIER_SESSION;ES_VERIFIER_DELETE_VERIFIER_SESSION;ES_VERIFIER_GET_VERIFIER_PRESENTATION_REQUEST_URL;ES_VERIFIER_GET_VERIFIER_PRESENTED_CREDENTIALS;ES_VERIFIER_GET_VERIFIER_POLICIES_LIST;ES_OIDC_BRIDGE_CREATE;ES_OIDC_BRIDGE_DELETE;ES_OIDC_BRIDGE_READ;ES_OIDC_BRIDGE_OIDC_PUBLIC;ES_VERIFIER_CREATE_VERIFIER_SESSION;ES_VERIFIER_SEND_VERIFICATION_SSE_EVENTS;ES_VICAL_CREATE;ES_VICAL_DELETE;ES_VICAL_PUBLISH;ES_VICAL_LIST;ES_CLIENT_ATTESTER_CREATE;ES_CLIENT_ATTESTER_ATTEST;ES_TRUST_REGISTRY_CREATE;ES_TRUST_REGISTRY_DELETE;ES_TRUST_REGISTRY_RESOLVE;ES_TRUST_REGISTRY_MANAGE;ES_TRUST_REGISTRY_READ;ES_CREDENTIAL_STATUS_CREATE;ES_CREDENTIAL_STATUS_DELETE;ES_CREDENTIAL_STATUS_CREATE_LIST;ES_CREDENTIAL_STATUS_DELETE_LIST;ES_CREDENTIAL_STATUS_GET_LIST;ES_CREDENTIAL_STATUS_GET_LIST_URL;ES_CREDENTIAL_STATUS_GET_CAPACITY;ES_CREDENTIAL_STATUS_GET_ENTRIES;ES_CREDENTIAL_STATUS_GET_STATUS_ENTRY;ES_CREDENTIAL_STATUS_GET_STATUS;ES_CREDENTIAL_STATUS_CREATE_STATUS_ENTRY;ES_CREDENTIAL_STATUS_UPDATE_STATUS_ENTRY;ES_CREDENTIAL_STATUS_UPDATE_STATUS_ENTRY_BY_INDEX;ID_CACHE_LIST;ID_CACHE_UPLOAD;ID_CACHE_MAPPING;ID_CACHE_DOCUMENT_LIST;ID_CACHE_DOCUMENT;ID_CACHE_DOCUMENT_COLLECT_ID;ID_CACHE_DOCUMENT_STATUS\n \nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.permissions.Permission"
},
"examples" : {
"Remove permission" : {
"value" : {
"target" : "example.test",
"action" : "all"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Permission removed from role successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - permission not found in role, invalid permission format, or role not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to modify role permissions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/external-mappings" : {
"get" : {
"tags" : [ "Service | Roles" ],
"summary" : "List all external role mappings",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_LIST] \nOperation: 'list-all-external-mappings' \nAccepts targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nLists all external role mappings across all roles within an organization or tenant scope. This provides a complete view of how external IdP roles map to Enterprise roles.\n\n**Use Cases:**\n- Audit all SSO role mappings\n- Review external access configuration\n- Debug authentication issues\n- Generate documentation of role mappings\n\n**Response Format:**\nEach item contains the Enterprise role ID, role name, and the external mapping details.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of all external mappings",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ExternalMappingListItem"
},
"title" : "ArrayList"
},
"examples" : {
"Mapping list" : {
"value" : [ {
"roleId" : "waltid.tenant1.BW_ADMIN",
"roleName" : "Business Wallet Admin",
"mapping" : {
"externalRole" : "tenant-admin"
}
}, {
"roleId" : "waltid.tenant1.BW_OPERATOR",
"roleName" : "Business Wallet Operator",
"mapping" : {
"externalRole" : "wallet-operator"
}
} ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/roles-api/external-mappings/resolve" : {
"post" : {
"tags" : [ "Service | Roles" ],
"summary" : "Resolve external roles to Enterprise roles",
"description" : "Permissions: ANY OF: [ADMIN_ROLE_LIST] \nOperation: 'resolve-external-roles' \nAccepts targets: [OrganizationTree, Tenant] \nRequires authentication. \n\n---\nTests external role resolution without performing actual authentication. Given a set of external roles (as would appear in an IdP token), returns which Enterprise roles would be assigned.\n\n**Use Cases:**\n- Debug role mapping configuration\n- Test new mappings before deployment\n- Verify expected role assignments\n- Troubleshoot authentication issues\n\n**Request Parameters:**\n- `externalRoles`: Set of role names as they would appear in the IdP token\n- `providerId`: Optional - filter to mappings for a specific provider\n- `userEmail`: Optional - for testing email domain conditions\n- `userClaims`: Optional - for testing required claims conditions\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ResolveExternalRolesRequest"
},
"examples" : {
"Simple resolution" : {
"value" : {
"externalRoles" : [ "tenant-admin", "user" ]
}
},
"Resolution with conditions" : {
"value" : {
"externalRoles" : [ "department-lead" ],
"providerId" : "keycloak-prod",
"userEmail" : "user@company.com",
"userClaims" : {
"department" : "engineering"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Resolution result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ResolveExternalRolesResponse"
},
"examples" : {
"Resolution result" : {
"value" : {
"resolvedRoles" : [ {
"roleId" : "waltid.tenant1.BW_ADMIN",
"name" : "Business Wallet Admin",
"matchedExternalRole" : "tenant-admin"
} ]
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list roles",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/tenant-api/tenants/config/view" : {
"get" : {
"tags" : [ "Tenant Management" ],
"summary" : "View tenant configuration",
"description" : "Permissions: ANY OF: [ADMIN_TENANT_GET] \nOperation: 'view-tenant-config' \nAccepts targets: [Tenant] \nRequires authentication. \n\n---\nRetrieves the current configuration for a tenant. Tenant configuration includes service references and settings that define how the tenant operates within the system.\n\n**Use Cases:**\n- Review tenant service configurations\n- Audit tenant setup and dependencies\n- Verify service references are correctly configured\n- Export tenant configuration for backup or migration\n\n**Important Notes:**\n- Configuration is tenant-specific and scoped to the tenant context\n- Service references in the configuration are relative to the tenant\n- Empty or null values indicate that a service is not configured\n- Configuration changes may affect tenant functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The tenant configuration including all service references and settings",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.tenants.TenantConfiguration"
},
"examples" : {
"Tenant with DID registry" : {
"value" : {
"didRegistry" : "waltid.tenant1.did-registry.main"
}
},
"Tenant without DID registry" : {
"value" : { }
}
}
}
}
},
"404" : {
"description" : "Tenant not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view tenant configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/tenant-api/tenants/config/update" : {
"post" : {
"tags" : [ "Tenant Management" ],
"summary" : "Update tenant configuration",
"description" : "Permissions: ANY OF: [ADMIN_TENANT_UPDATE] \nOperation: 'update-tenant-config' \nAccepts targets: [Tenant] \nRequires authentication. \n\n---\nUpdates the configuration for a tenant. This allows you to modify service references and settings that control how the tenant operates.\n\n**Use Cases:**\n- Configure tenant service dependencies\n- Update service references when services are moved or renamed\n- Enable or disable tenant features through configuration\n- Migrate tenant configurations between environments\n\n**Important Notes:**\n- Configuration updates take effect immediately\n- Service references must be valid and accessible within the tenant context\n- Setting a service reference to null removes that service dependency\n- Invalid service references may cause tenant operations to fail\n- Configuration changes may require tenant restart or service reinitialization\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.tenants.TenantConfiguration"
},
"examples" : {
"Update with DID registry" : {
"value" : {
"didRegistry" : "waltid.tenant1.did-registry.main"
}
},
"Update without DID registry" : {
"value" : { }
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Tenant configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - invalid service references, malformed configuration, or tenant not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update tenant configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [CredentialStatusServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.x509-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [CredentialStatusServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, x509-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [CredentialStatusServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/create" : {
"post" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Create new credential status configuration",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_CREATE_LIST] \nOperation: 'credential-status.config.create' \nRequires authentication. \n\n---\nCreates a new credential status configuration that defines how credential status information is managed and stored. \nThe configuration specifies the status list type, purpose, signing material, and other parameters required for status management.\n\n**Use Cases:**\n- Set up revocation status lists for verifiable credentials\n- Configure suspension status lists for temporary credential suspension\n- Create custom status lists with multiple status values\n- Initialize status credential infrastructure for credential lifecycle management\n\n**Custom Configuration ID:**\nYou can specify a custom configuration ID by including it in the URL path: {org}.{tenant}.{status-service}.{my-custom-id}\n\n**Important Notes:**\n- If no custom ID is provided, the ID is generated from a SHA-256 hash of the configuration\n- This means identical configurations (same type, purpose, format) will return the same ID\n- To create multiple status lists with the same configuration, provide unique custom IDs\n- Different status list types (BitstringStatusList, StatusList2021, RevocationList2020, TokenStatusList) have different capabilities\n- The signing material (`key` or `keyReference`, and DID or X.509 certificate) must be valid and accessible\n- Custom status lists can define multiple status values beyond simple revocation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The status list credential configuration. Provide `key` (inline JWK) or `keyReference` (KMS path), and `did`, `x5c`, or `x5cReferences`.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.revocation.models.StatusCredentialConfigPublic"
},
"examples" : {
"BitstringStatusList with revocation purpose" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "BitstringStatusList"
}
}
},
"BitstringStatusList with custom purpose having 4 statuses" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "BitstringStatusList",
"statusSize" : 2,
"statuses" : [ {
"status" : "0x0",
"message" : "unset"
}, {
"status" : "0x1",
"message" : "temporary"
}, {
"status" : "0x2",
"message" : "conditional"
}, {
"status" : "0x3",
"message" : "indefinite"
} ],
"purpose" : "suspension"
}
}
},
"StatusList2021 with revocation purpose" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "StatusList2021"
}
}
},
"RevocationList2020 with revocation purpose" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "RevocationList2020"
}
}
},
"TokenStatusList JWT formatted" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "TokenStatusList"
}
}
},
"TokenStatusList CWT formatted" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"did" : "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiMW1rQnBEYWZqVk9ONm9XVmlIZGREZXNEYXpKaXk1R0NTYko3VDU4QkJ3cyIsIngiOiJzZ1BiZWRPQjl1WEMtVG54LUVhV1IxRmg1Y25JLUxRLU43NUV1UE8wV2VFIn0",
"config" : {
"type" : "TokenStatusList",
"format" : "CWT"
}
}
},
"TokenStatusList with X.509 certificate" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"x5c" : [ "MIIBljCCAT2gAwIBAgIUP/xM+biohoGvcYdfgGxd0CQBT28wCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjYxMDAxMTFaFw0yNzAxMjYxMDAxMTFaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOQMWbqm+DvDO1RRPsVYzbNc2vgdVOw9zZhu+n+8NZqqMbW+qJuXQZ2rxiUzIvzqtQHITjSozNGHmyNbN9b1JxOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRHt/+svL7jM/XYPvNMjwWM3JlYSjAfBgNVHSMEGDAWgBRHCT92dpAI1vlPm7tTUfYYjgkfwDAKBggqhkjOPQQDAgNHADBEAiALQcUEt5xjuTdYRZ+flY2dXXr7lW961XTJbxQsSDSJxQIgHK8ZyQrwkMjfze81axgISEmb+AZBUY8LCPtJ8MpNcWI=" ],
"config" : {
"type" : "TokenStatusList"
}
}
},
"TokenStatusList with X.509 store references" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"x5cReferences" : [ "waltid.tenant1.x509-store.cert1" ],
"config" : {
"type" : "TokenStatusList"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "The status list credential configuration resource identifier",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Configuration ID" : {
"value" : "revocation"
}
}
}
}
},
"400" : {
"description" : "Invalid request - invalid configuration, missing required fields, or invalid signing material",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create status configurations",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/delete" : {
"delete" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Delete a status credential configuration",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_DELETE_LIST] \nOperation: 'credential-status.config.delete' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nDeletes a status credential configuration and removes it from the system. This is mainly used for development and testing purposes.\n\n**Use Cases:**\n- Remove unused or obsolete status list configurations\n- Clean up test configurations\n- Delete configurations that are no longer needed\n\n**Important Notes:**\n- This operation is irreversible\n- Credentials that reference this status list will no longer be able to have their status verified\n- The status list data in external storage (S3, Azure, GCP) is NOT automatically deleted\n- Consider the impact on existing credentials before deleting\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The status credential configuration was successfully deleted",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
},
"examples" : {
"Deletion confirmation" : {
"value" : {
"deleted" : "organization.tenant.status-service.config-id"
}
}
}
}
}
},
"404" : {
"description" : "Status credential configuration not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete status credential configurations",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/list" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "List status credential configurations",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_GET_LIST] \nOperation: 'credential-status.credential.list' \nAccepts targets: [CredentialStatusServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all status credential configuration identifiers within the service.\nThis provides an overview of all configured status lists and their purposes.\n\n**Use Cases:**\n- Audit all status credential configurations\n- Discover available status lists for credential issuance\n- Review status list purposes and types\n- Export configuration identifiers for documentation\n\n**Important Notes:**\n- Returns only the configuration identifiers, not the full configurations\n- Configuration IDs are unique within the service scope\n- Empty list indicates no status configurations have been created\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "The list of status credential configuration identifiers",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"List of configuration IDs" : {
"value" : [ "waltid.tenant1.credential-status.revocation", "waltid.tenant1.credential-status.suspension", "waltid.tenant1.credential-status.custom" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list status credential configurations",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/url" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Get the status credential URL",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_GET_LIST_URL] \nOperation: 'credential-status.credential.url' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nRetrieves the URL where the status credential is hosted. This URL can be used by verifiers to fetch and validate credential status information.\n\n**Use Cases:**\n- Obtain status credential URLs for credential embedding\n- Provide status credential locations to verifiers\n- Configure credential status endpoints in credential definitions\n- Access status credentials via HTTP/HTTPS\n\n**Important Notes:**\n- The URL format depends on the configured registry and storage backend\n- URLs are generated based on the service configuration (AWS S3, Azure Blob, GCP, or local)\n- The URL points to the location where the status credential can be fetched\n- URLs are stable and can be embedded in credentials\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The URL where the status credential is hosted and can be fetched",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Status credential URL" : {
"value" : "https://example.com/credentials/1234567890"
}
}
}
}
},
"404" : {
"description" : "Status credential configuration not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to access status credential URLs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/capacity" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Get status list capacity information",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_GET_CAPACITY] \nOperation: 'credential-status.credential.capacity' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nRetrieves capacity information for a status list, including current usage, maximum capacity, and status indicators.\nThis endpoint is essential for monitoring status list utilization and planning for rollover.\n\n**Use Cases:**\n- Monitor status list utilization to prevent capacity exhaustion\n- Set up alerts when status lists approach capacity thresholds\n- Plan proactive rollover to new status lists before reaching capacity\n- Audit status list usage across the organization\n\n**Response Fields:**\n- `statusListId`: The identifier of the status list\n- `usedEntries`: Number of entries currently allocated\n- `maxEntries`: Maximum capacity of the status list\n- `availableEntries`: Remaining capacity\n- `usagePercent`: Current utilization as a percentage\n- `status`: Capacity status indicator (HEALTHY, WARNING, CRITICAL, FULL)\n\n**Status Thresholds (configurable via service configuration):**\n- `HEALTHY`: Usage below warning threshold (default: < 80%)\n- `WARNING`: Usage at or above warning threshold (default: >= 80%)\n- `CRITICAL`: Usage at or above critical threshold (default: >= 95%)\n- `FULL`: Status list has reached maximum capacity\n\n**Important Notes:**\n- When status is WARNING or CRITICAL, consider creating a new status list\n- When status is FULL, no new status entries can be created\n- Thresholds can be configured per service via the capacity configuration\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The capacity information for the status list",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"title" : "*"
},
"examples" : {
"Healthy status list" : {
"value" : {
"statusListId" : "organization.tenant.status-service.config-id",
"usedEntries" : 1500,
"maxEntries" : 32000,
"availableEntries" : 30500,
"usagePercent" : 4.69,
"status" : "HEALTHY"
}
},
"Warning status list" : {
"value" : {
"statusListId" : "organization.tenant.status-service.config-id",
"usedEntries" : 26000,
"maxEntries" : 32000,
"availableEntries" : 6000,
"usagePercent" : 81.25,
"status" : "WARNING"
}
},
"Critical status list" : {
"value" : {
"statusListId" : "organization.tenant.status-service.config-id",
"usedEntries" : 31000,
"maxEntries" : 32000,
"availableEntries" : 1000,
"usagePercent" : 96.88,
"status" : "CRITICAL"
}
},
"Full status list" : {
"value" : {
"statusListId" : "organization.tenant.status-service.config-id",
"usedEntries" : 32000,
"maxEntries" : 32000,
"availableEntries" : 0,
"usagePercent" : 100.0,
"status" : "FULL"
}
}
}
}
}
},
"404" : {
"description" : "Status credential configuration not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to access status list capacity",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/entries" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "List all status entries",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_GET_ENTRIES] \nOperation: 'credential-status.entries.list' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nRetrieves status entries (indices and their current status values) for a status list configuration.\nThis endpoint provides visibility into all credentials that have been assigned status indices within the list.\n\n**Use Cases:**\n- Audit all credentials with status tracking in a status list\n- Query which indices have been allocated and their current status\n- Identify revoked or suspended credentials within a status list\n- Export status data for compliance or reporting purposes\n\n**Query Parameters:**\n- `limit`: Maximum number of entries to return (default: 100, max: 1000)\n- `offset`: Number of entries to skip for pagination (default: 0)\n- `status`: Filter by status value (e.g., \"0x0\" for valid, \"0x1\" for revoked/invalid)\n- `sort`: Sort order - `index`/`index:asc` for ascending (default), `index:desc` for descending\n\n**Response Fields:**\n- `entries`: List of status entries, each containing:\n - `index`: The status list index assigned to the credential\n - `status`: Object with `status` (the value) and `message` (human-readable description)\n- `total`: Total number of entries matching the filter (before pagination)\n- `limit`: The limit used for this request\n- `offset`: The offset used for this request\n- `hasMore`: Whether there are more entries beyond this page\n\n**Important Notes:**\n- Returns allocated indices, not the full capacity of the status list\n- Status values depend on the status list configuration\n- For TokenStatusList: \"0x0\" = VALID, \"0x1\" = INVALID, \"0x2\" = SUSPENDED\n- For BitstringStatusList: \"0x0\" = unset, \"0x1\" = set (revoked)\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'index', 'index:asc', 'index:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "index:desc"
}, {
"name" : "status",
"in" : "query",
"description" : "Filter by status value (e.g., '0x0' for valid, '0x1' for revoked)",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "0x1"
} ],
"responses" : {
"200" : {
"description" : "Paginated list of status entries with their indices and current status values",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"title" : "*"
},
"examples" : {
"Status entries (first page)" : {
"value" : {
"entries" : [ {
"index" : "0",
"status" : {
"status" : "0x0",
"message" : "VALID"
}
}, {
"index" : "1",
"status" : {
"status" : "0x0",
"message" : "VALID"
}
}, {
"index" : "2",
"status" : {
"status" : "0x1",
"message" : "INVALID"
}
} ],
"total" : 150,
"limit" : 100,
"offset" : 0,
"hasMore" : true
}
},
"Filtered by revoked status" : {
"value" : {
"entries" : [ {
"index" : "2",
"status" : {
"status" : "0x1",
"message" : "INVALID"
}
}, {
"index" : "47",
"status" : {
"status" : "0x1",
"message" : "INVALID"
}
} ],
"total" : 2,
"limit" : 100,
"offset" : 0,
"hasMore" : false
}
}
}
}
}
},
"404" : {
"description" : "Status credential configuration not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to access status entries",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/status/create" : {
"post" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Create new credential status",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_CREATE_STATUS_ENTRY] \nOperation: 'credential-status.create' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nAllocates a new index within the status credential and returns the corresponding status entry that can be embedded in a verifiable credential. \nThis operation reserves a position in the status list for tracking the credential's status.\n\n**Use Cases:**\n- Initialize status tracking for newly issued credentials\n- Reserve status list indices during credential issuance\n- Generate status entries for embedding in verifiable credentials\n- Set up credential status infrastructure before credential distribution\n\n**Important Notes:**\n- Each status entry corresponds to a unique index in the status list\n- The initial status value determines the starting state of the credential\n- Status entries are format-specific (W3C vs IETF) based on the configuration\n- The returned status entry must be added to the credential's credentialStatus property\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The initial status value for the credential",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.revocation.models.CredentialStatusCreateRequest"
},
"examples" : {
"Initialize with unrevoked status" : {
"value" : {
"initialStatus" : "0x0"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "The status entry object that can be added to the credentialStatus property of the holder credential",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.status.domain.entry.StatusEntry"
},
"examples" : {
"BitstringStatusListEntry revocation status" : {
"value" : {
"id" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b#11597",
"type" : "BitstringStatusListEntry",
"statusPurpose" : "revocation",
"statusListIndex" : "11597",
"statusSize" : 1,
"statusListCredential" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b",
"statusMessage" : [ {
"status" : "0x0",
"message" : "unset"
}, {
"status" : "0x1",
"message" : "set"
} ]
}
},
"BitstringStatusListEntry custom status" : {
"value" : {
"id" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b#11597",
"type" : "BitstringStatusListEntry",
"statusPurpose" : "suspension",
"statusListIndex" : "11597",
"statusSize" : 2,
"statusListCredential" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b",
"statusMessage" : [ {
"status" : "0x0",
"message" : "unset"
}, {
"status" : "0x1",
"message" : "temporary"
}, {
"status" : "0x2",
"message" : "conditional"
}, {
"status" : "0x3",
"message" : "indefinite"
} ]
}
},
"StatusList2021 entry" : {
"value" : {
"id" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b#11597",
"type" : "StatusList2021Entry",
"statusPurpose" : "revocation",
"statusListIndex" : "11597",
"statusSize" : 1,
"statusListCredential" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b",
"statusMessage" : [ {
"status" : "0x0",
"message" : "unset"
}, {
"status" : "0x1",
"message" : "set"
} ]
}
},
"RevocationList2020 entry" : {
"value" : {
"id" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b#11597",
"type" : "RevocationList2020Status",
"statusPurpose" : "revocation",
"statusListIndex" : "11597",
"statusSize" : 1,
"statusListCredential" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b",
"statusMessage" : [ {
"status" : "0x0",
"message" : "unset"
}, {
"status" : "0x1",
"message" : "set"
} ]
}
},
"TokenStatusList entry" : {
"value" : {
"status_list" : {
"idx" : 11597,
"uri" : "http://localhost:3000/credentials/99914b932bd37a50b983c5e7c90ae93b"
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - invalid status value, configuration not found, or status list exhausted",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create status entries",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/status/update" : {
"put" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Update credential status",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_UPDATE_STATUS_ENTRY, ES_CREDENTIAL_STATUS_UPDATE_STATUS_ENTRY_BY_INDEX] \nOperation: 'credential-status.update' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nUpdates the status of a credential.\nThis operation is used to revoke, suspend, or change the status of a credential after issuance.\n\n**Use Cases:**\n- Revoke credentials that are no longer valid\n- Suspend credentials temporarily\n- Update credential status based on lifecycle events\n- Change custom status values for specialized use cases\n\n**Update modes:**\n- `session`: normal lifecycle update path. The issuer session is resolved and checked against the target status list, so callers must have `credential-status.update` on the status configuration.\n- `index`: direct status-list index update path for administrative or system repair use cases. This bypasses the issuer session-to-status-list association check and therefore requires the dedicated `credential-status.update-by-index` permission.\n\n**Important Notes:**\n- Exactly one of `session` or `index` must be provided\n- Status updates are asynchronous and may take time to propagate\n- The update operation requires the credential to have been created with a status entry\n- Status changes are permanent and reflected in the status credential\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Either the issuer session identifier or direct status-list index, the new status value, and an optional free-form reasonCode recorded on the eIDAS CREDENTIAL_LIFECYCLE audit entry",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.revocation.models.CredentialStatusUpdateRequest"
},
"examples" : {
"Revoke credential" : {
"value" : {
"session" : "{organization}.{tenant}.{issuer-service}.{session-id}",
"status" : "0x1",
"reasonCode" : "key_compromise"
}
},
"Admin/system revoke credential by index" : {
"value" : {
"index" : 11597,
"status" : "0x1",
"reasonCode" : "affiliation_changed"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "An object indicating the result of the status update operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.revocation.models.CredentialStatusUpdateResponse"
},
"examples" : {
"Success result" : {
"value" : {
"successful" : true
}
},
"Failure result" : {
"value" : {
"successful" : false
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - session not found, invalid status value, or index not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update credential status. Direct index updates require credential-status.update-by-index.",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-status-service-api/status-credential/status" : {
"get" : {
"tags" : [ "Service | Credential Status Service" ],
"summary" : "Get credential status",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STATUS_GET_STATUS] \nOperation: 'credential-status.get' \nAccepts targets: [CredentialStatusConfigStore] \nRequires authentication. \n\n---\nRetrieves the current status value of a credential.\n\n**Lookup modes:**\n- `session`: normal lifecycle read path. The issuer session is resolved and checked against the target status list.\n- `index`: direct status-list index read path for administrative or system repair use cases. This bypasses the issuer session-to-status-list association check.\n\nBoth lookup modes require `credential-status.get` on the status configuration. Session lookups also require access to the issuer session.\n\n**Important Notes:**\n- Exactly one of `session` or `index` must be provided\n- The credential must already have a status entry allocated on the target status list\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "session",
"in" : "query",
"description" : "Issuer session identifier used to resolve the status-list index",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "{organization}.{tenant}.{issuer-service}.{session-id}"
}, {
"name" : "index",
"in" : "query",
"description" : "Direct status-list index.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 11597
} ],
"responses" : {
"200" : {
"description" : "The current status value for the resolved index",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.IndexStatus"
},
"examples" : {
"Unrevoked status" : {
"value" : {
"index" : "11597",
"status" : {
"status" : "0x0",
"message" : "unset"
}
}
},
"Revoked status" : {
"value" : {
"index" : "11597",
"status" : {
"status" : "0x1",
"message" : "set"
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - session not found, index not found, or both/neither session and index provided",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to get credential status.",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/list" : {
"get" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "List all stored credentials",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_LIST_CREDENTIALS] \nOperation: 'list-credentials' \nAccepts targets: [CredentialStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all credentials stored in the Credential Store. \nEach credential includes its full document, metadata, and associated information.\n\n**Use Cases:**\n- Audit stored credentials\n- Retrieve all credentials for a specific store\n- Export credentials for backup or migration\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
} ],
"responses" : {
"200" : {
"description" : "List of all stored credentials in the Credential Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/credential"
},
"title" : "ArrayList<>"
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/list-ids" : {
"get" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "List credential IDs",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_LIST_CREDENTIAL_IDS] \nOperation: 'list-credential-ids' \nAccepts targets: [CredentialStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all credential IDs (paths) stored in the Credential Store.\nThis endpoint returns only the identifiers, not the full credential data, making it more efficient for large stores.\n\n**Use Cases:**\n- Check if a credential exists\n- Get a quick overview of stored credentials\n- Iterate through credentials without loading full data\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "List of credential IDs (paths) stored in the Credential Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Credential IDs" : {
"value" : [ "waltid.tenant1.credential-store.credential1", "waltid.tenant1.credential-store.credential2" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list credential IDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/query/document/schema" : {
"post" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Query credentials by document schema",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_QUERY_CREDENTIAL_DOCUMENT] \nOperation: 'query-credential-documents-schema' \nAccepts targets: [CredentialStoreServiceReference] \nRequires authentication. \n\n---\nQueries credentials by applying filters to the credential document data using PresentationDefinition InputDescriptor Constraint Fields.\n\n**How it works:**\n- Provide a list of constraint fields that define the query criteria\n- The filters are applied to the credential document (the actual credential data)\n- Returns all credentials that match the specified constraints\n\n**Use Cases:**\n- Find credentials by specific attributes (e.g., issuer, type, subject)\n- Filter credentials based on credential data values\n- Search for credentials matching specific criteria\n\n**Filter Format:**\nEach field in the request should follow the PresentationDefinition InputDescriptor Constraints format with:\n- `path`: JSONPath expression to the field in the credential document\n- `filter`: JSON Schema filter to match against the field value\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "List of PresentationDefinition InputDescriptor Constraint Fields to use as filters",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.definitionparser.PresentationDefinition.InputDescriptor.Constraints.Field"
},
"title" : "ArrayList"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "List of credential documents matching the filter criteria",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/credential"
},
"title" : "ArrayList<>"
}
}
}
},
"400" : {
"description" : "Invalid filter format or query syntax",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/query/metadata/schema" : {
"post" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Query credentials by metadata schema",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_QUERY_CREDENTIAL_METADATA] \nOperation: 'query-credential-metadata-schema' \nAccepts targets: [CredentialStoreServiceReference] \nRequires authentication. \n\n---\nQueries credentials by applying filters to the credential metadata using PresentationDefinition InputDescriptor Constraint Fields.\n\n**How it works:**\n- Provide a list of constraint fields that define the query criteria\n- The filters are applied to the credential metadata (not the credential document)\n- Returns all credentials whose metadata matches the specified constraints\n\n**Use Cases:**\n- Find credentials by metadata tags or labels\n- Filter credentials based on custom metadata fields\n- Search for credentials with specific metadata attributes\n\n**Filter Format:**\nEach field in the request should follow the PresentationDefinition InputDescriptor Constraints format with:\n- `path`: JSONPath expression to the field in the credential metadata\n- `filter`: JSON Schema filter to match against the field value\n\n**Note:** This queries metadata, not the credential document itself. Use the document schema query endpoint to filter by credential data.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "List of PresentationDefinition InputDescriptor Constraint Fields to use as filters on metadata",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.definitionparser.PresentationDefinition.InputDescriptor.Constraints.Field"
},
"title" : "ArrayList"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "List of credential metadata matching the filter criteria",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/credential"
},
"title" : "ArrayList<>"
}
}
}
},
"400" : {
"description" : "Invalid filter format or query syntax",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/store" : {
"put" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Store a credential",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_ADD_CREDENTIAL] \nOperation: 'store-credential' \nAccepts parent targets: [CredentialStoreServiceReference, CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nStores a new credential in the Credential Store. The credential will be persisted with its document and optional metadata.\n\n**Important:**\n- The credential path is determined by the target path in the request\n- If a credential already exists at the target path, the request will fail\n- Use the update endpoint to modify existing credentials\n- Credentials can include optional metadata for additional organization\n\n**Credential Format:**\nThe credential must be a valid DigitalCredential (W3C Verifiable Credential format).\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The credential to store, including its document and optional metadata",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/credential"
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Credential stored successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/credential"
}
}
}
},
"400" : {
"description" : "Invalid credential format or credential already exists at target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to store credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/update" : {
"put" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Update a stored credential",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_UPDATE_CREDENTIAL] \nOperation: 'update-credential' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nUpdates an existing credential in the Credential Store. This replaces the entire credential at the target path.\n\n**Important:**\n- The credential must already exist at the target path\n- This operation replaces the entire credential (document and metadata)\n- To update only metadata, use the metadata update endpoint with JSON Patch\n\n**Use Cases:**\n- Replace a credential with a new version\n- Update credential data while maintaining the same path\n- Refresh expired or revoked credentials\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The updated credential to replace the existing one",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/credential"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Credential updated successfully",
"headers" : { }
},
"404" : {
"description" : "Credential not found at the specified target path",
"headers" : { }
},
"400" : {
"description" : "Invalid credential format",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/view" : {
"get" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "View a stored credential",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_GET_CREDENTIAL] \nOperation: 'view-credential' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nRetrieves a specific credential from the Credential Store by its target path.\nReturns the full credential including its document and metadata.\n\n**Response includes:**\n- Full credential document (W3C Verifiable Credential)\n- Associated metadata (if any)\n- Credential path/ID\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The requested credential with its full document and metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/credential"
}
}
}
},
"404" : {
"description" : "Credential not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this credential",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/delete" : {
"delete" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Delete a stored credential",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_DELETE_CREDENTIAL] \nOperation: 'delete-credential' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nPermanently deletes a credential from the Credential Store. This action cannot be undone.\n\n**Important:**\n- The credential will be immediately removed from the store\n- This operation is irreversible\n- Ensure you have backups if the credential data is important\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "Credential deleted successfully",
"headers" : { }
},
"404" : {
"description" : "Credential not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/delete-all" : {
"delete" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Delete all credentials from store",
"description" : "Permissions: ANY OF: [ES_CREDENTIAL_STORE_DELETE_ALL_CREDENTIALS] \nOperation: 'delete-all-credentials' \nAccepts targets: [CredentialStoreServiceReference] \nRequires authentication. \n\n---\nPermanently deletes all credentials stored in the Credential Store. This is a destructive operation that cannot be undone.\n\n**Warning:**\n- All credentials in the store will be deleted\n- This operation is irreversible\n- Use with extreme caution\n- Consider backing up credentials before executing this operation\n\n**Response:**\nReturns the count of deleted credentials.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "All credentials deleted successfully. Response includes count of deleted items.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Delete result" : {
"value" : {
"deleted" : 42
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete all credentials",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/metadata/view" : {
"get" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "View metadata",
"description" : "Permissions: ANY OF: [VIEW_METADATA] \nOperation: 'view-metadata' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nRetrieves the metadata associated with this resource. Metadata provides additional information, tags, descriptions, or custom attributes that can be used for organization, search, and filtering.\n\n**Use Cases:**\n- Retrieve custom attributes and tags\n- Access resource descriptions and annotations\n- Review metadata for organization and categorization\n- Export metadata for documentation or reporting\n\n**Important Notes:**\n- Metadata is optional and may not exist for all resources\n- Returns 404 if no metadata has been set\n- Metadata is stored as a JSON object allowing flexible structure\n- Metadata does not affect core resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with data" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
}
},
"404" : {
"description" : "No metadata stored for this resource",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/metadata/set" : {
"put" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Set metadata",
"description" : "Permissions: ANY OF: [SET_METADATA] \nOperation: 'set-metadata' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nSets or replaces the complete metadata for this resource. This operation replaces any existing metadata with the provided metadata object.\n\n**Use Cases:**\n- Initialize metadata for a new resource\n- Replace existing metadata completely\n- Set custom attributes and tags\n- Add resource descriptions and annotations\n\n**Important Notes:**\n- This operation completely replaces existing metadata\n- To update specific fields, use the update endpoint with JSON Patch\n- Metadata is stored as a JSON object\n- Setting metadata to an empty object is valid\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Metadata to set for this resource",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with description and tags" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata was set for this resource",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON object",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to set metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/metadata/purge" : {
"delete" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Purge metadata",
"description" : "Permissions: ANY OF: [PURGE_METADATA] \nOperation: 'purge-metadata' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nPermanently removes all metadata associated with this resource. After this operation, the resource will have no metadata until new metadata is set.\n\n**Use Cases:**\n- Remove metadata that is no longer needed\n- Clean up test or temporary metadata\n- Reset metadata to a clean state\n- Remove sensitive information from metadata\n\n**Important Notes:**\n- This operation is irreversible\n- The resource itself is not affected, only its metadata\n- After purging, the view endpoint will return 404 until new metadata is set\n- Purging metadata does not affect resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource was deleted",
"headers" : { }
},
"404" : {
"description" : "Resource not found or no metadata exists to purge",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to purge metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/metadata/update" : {
"post" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "Update metadata (with JSON Patch)",
"description" : "Permissions: ANY OF: [UPDATE_METADATA] \nOperation: 'update-metadata' \nAccepts targets: [CredentialStoreStoredCredential] \nRequires authentication. \n\n---\nUpdates the metadata for this resource using JSON Patch format (RFC 6902). This allows partial updates to specific fields without replacing the entire metadata object.\n\n**Use Cases:**\n- Update specific metadata fields without replacing the entire object\n- Add new fields to existing metadata\n- Remove specific fields from metadata\n- Modify nested metadata structures\n\n**Important Notes:**\n- Uses RFC 6902 JSON Patch format for updates\n- If no metadata exists, an empty object is used as the base\n- Supports add, remove, replace, move, copy, and test operations\n- Partial updates preserve other metadata fields\n- Invalid patch operations will result in an error\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "JSON Patch document following RFC 6902 format - array of patch operations. Each operation must have 'op', 'path', and optionally 'value' fields.",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"title" : "JsonArray"
},
"examples" : {
"Single replace operation" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
} ]
},
"Multiple operations (replace, add, remove)" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
}, {
"op" : "add",
"path" : "/tags/-",
"value" : "new-tag"
}, {
"op" : "remove",
"path" : "/oldField"
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON Patch, invalid patch operation, or patch cannot be applied",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/credential-store-service-api/credentials/metadata/query" : {
"post" : {
"tags" : [ "Service | Credential Store Service" ],
"summary" : "List by metadata matching query",
"description" : "Permissions: ANY OF: [QUERY_BY_METADATA] \nOperation: 'query-by-metadata' \nAccepts targets: [TraversableServiceReference] \nRequires authentication. \n\n---\nQueries and returns resources that match the specified metadata constraints. This allows you to find resources based on their metadata attributes using field-based filtering.\n\n**Use Cases:**\n- Find resources by tags or custom attributes\n- Filter resources based on metadata values\n- Search for resources with specific metadata fields\n- Implement metadata-based resource discovery\n\n**Important Notes:**\n- Query uses field constraints to match metadata\n- Returns a map of matching resource targets to their metadata\n- Resources without metadata are not included in results\n- Query constraints follow the Presentation Definition Input Descriptor format\n- Empty query returns all resources with metadata\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "List of field constraints to match against metadata",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.definitionparser.PresentationDefinition.InputDescriptor.Constraints.Field"
},
"title" : "ArrayList"
},
"examples" : {
"Query by tags field" : {
"value" : [ {
"path" : [ "tags" ]
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Map of matching resource targets to their metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"title" : "LinkedHashMap"
}
}
}
},
"400" : {
"description" : "Invalid request - malformed query constraints",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-registry-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | DID Registry Service" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [DidRegistryServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.did-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-registry-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | DID Registry Service" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [DidRegistryServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: did-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-registry-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | DID Registry Service" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [DidRegistryServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-registry-service-api/registry/list" : {
"get" : {
"tags" : [ "Service | DID Registry Service" ],
"summary" : "List registered DIDs",
"description" : "Permissions: ANY OF: [ES_DID_STORE_LIST_DIDS, ES_DID_REGISTRY_LIST_DIDS] \nOperation: 'list' \nAccepts targets: [DidRegistryServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all DIDs registered in the DID Registry. \nThese are DIDs that have been linked to the registry and are available for resolution.\n\n**Response Format:**\nReturns a list of DID identifiers (strings) that are registered in the registry.\n\n**Use Cases:**\n- Discover all DIDs available in the registry\n- Audit registered DIDs\n- Check if a specific DID is registered\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of registered DID identifiers in the registry",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Registered DIDs" : {
"value" : [ "did:web:did-registry-api:registry:alice", "did:web:did-registry-api:registry:bob" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list registered DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-registry-service-api/registry/{id}/did.json" : {
"get" : {
"tags" : [ "Service | DID Registry Service" ],
"summary" : "Resolve a DID and retrieve its document",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nResolves a decentralized identifier (DID) and retrieves its associated DID document.\nThis endpoint is publicly accessible (no authentication required) and follows the W3C DID resolution specification.\n\n**DID Resolution:**\n- Takes a DID identifier as input\n- Returns the corresponding DID document (JSON-LD format)\n- Follows the W3C DID Core specification for resolution\n\n**Public Access:**\nThis endpoint is unauthenticated, allowing public DID resolution as required by the DID specification.\nThis enables wallets, verifiers, and other systems to resolve DIDs without authentication.\n\n**Use Cases:**\n- Resolve DIDs for verification\n- Retrieve public keys for encryption/signing\n- Access service endpoints associated with DIDs\n- Enable DID-based authentication flows\n\n**Path Parameters:**\n- `id`: The unique identifier of the DID to resolve\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "id",
"in" : "path",
"description" : "Unique identifier of the DID to resolve",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "alice"
} ],
"responses" : {
"200" : {
"description" : "DID document resolved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
},
"examples" : {
"Resolved did:web" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"verificationMethod" : [ {
"id" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"type" : "JsonWebKey2020",
"controller" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"x" : "sTgvlFxftGMKOpengFu-N9AwgiSKwzdzmH75rxJh1ZE"
}
} ],
"assertionMethod" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"authentication" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"capabilityInvocation" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"capabilityDelegation" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"keyAgreement" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ]
}
}
}
}
}
}
},
"404" : {
"description" : "DID not found with the specified identifier",
"headers" : { }
}
},
"deprecated" : false
}
},
"/{target}/{id}/did.json" : {
"get" : {
"tags" : [ ],
"summary" : "Resolve a DID from tenant's configured DID Registry",
"description" : "Permissions: None required \n\n---\nResolves a DID from a tenant's configured DID Registry. \nThis endpoint allows resolving DIDs that are registered in a specific tenant's registry.\n\n**How it works:**\n- The target parameter specifies the tenant path\n- The DID is resolved from that tenant's configured DID Registry\n- If the tenant doesn't have a DID Registry configured, a 404 error is returned\n\n**Public Access:**\nThis endpoint is unauthenticated, allowing public DID resolution as required by the DID specification.\n\n**Path Structure:**\nThe path follows the pattern: `{target}/{id}/did.json`\n- `target`: The tenant path (e.g., `waltid.tenant1`)\n- `id`: The DID identifier within that tenant's registry\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Tenant path where the DID is registered",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "waltid.tenant1"
}, {
"name" : "id",
"in" : "path",
"description" : "Unique identifier of the DID to resolve",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "alice"
} ],
"responses" : {
"200" : {
"description" : "DID document resolved successfully from tenant's registry",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
}
}
}
},
"404" : {
"description" : "DID not found, tenant has no DID Registry configured, or DID Registry not found",
"headers" : { }
}
},
"deprecated" : false
}
},
"/{id}/did.json" : {
"get" : {
"tags" : [ ],
"summary" : "Resolve a DID from organization's root DID Registry",
"description" : "Permissions: None required \n\n---\nResolves a DID from the organization's root DID Registry.\nThis endpoint allows resolving DIDs that are registered at the organization level.\n\n**How it works:**\n- The DID is resolved from the organization's root DID Registry\n- No target parameter is needed as it uses the organization's root registry\n- If the organization doesn't have a root DID Registry configured, a 404 error is returned\n\n**Public Access:**\nThis endpoint is unauthenticated, allowing public DID resolution as required by the DID specification.\n\n**Path Structure:**\nThe path follows the pattern: `{id}/did.json`\n- `id`: The DID identifier in the organization's root registry\n\n**Use Cases:**\n- Resolve organization-level DIDs\n- Access DIDs registered at the root level\n- Enable DID resolution for organization-wide identifiers\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "id",
"in" : "path",
"description" : "Unique identifier of the DID to resolve from the organization's root registry",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "org-root-did"
} ],
"responses" : {
"200" : {
"description" : "DID document resolved successfully from organization's root registry",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
}
}
}
},
"404" : {
"description" : "DID not found, organization has no root DID Registry configured, or DID Registry not found",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v1/{target}/did-store-service-api/dids" : {
"get" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "List all stored DIDs",
"description" : "Permissions: ANY OF: [ES_DID_STORE_LIST_DIDS] \nOperation: 'list-dids' \nAccepts targets: [DidStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all DIDs (Decentralized Identifiers) stored in the DID Store, including their corresponding DID documents.\n\n**Response includes:**\n- DID identifier (e.g., `did:key:...`, `did:web:...`)\n- Full DID document (JSON-LD format)\n- Associated metadata (if any)\n\n**Use Cases:**\n- Audit all DIDs in a store\n- Export DIDs for backup or migration\n- Retrieve DID documents for verification\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
} ],
"responses" : {
"200" : {
"description" : "List of all DIDs with their corresponding DID documents stored in the DID Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/did-entry"
},
"title" : "ArrayList<>"
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/list-did-ids" : {
"get" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "List all DID IDs",
"description" : "Permissions: ANY OF: [ES_DID_STORE_LIST_DIDS] \nOperation: 'list-did-ids' \nAccepts targets: [DidStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all DID identifiers stored in the DID Store.\nThis endpoint returns only the DID strings (identifiers), not the full DID documents, making it more efficient for large stores.\n\n**Use Cases:**\n- Check if a specific DID exists in the store\n- Get a quick overview of stored DIDs\n- Iterate through DIDs without loading full documents\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "List of DID identifiers stored in the DID Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"DID IDs" : {
"value" : [ "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK", "did:web:example.com:user:alice" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list DID IDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/view" : {
"get" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "View a stored DID",
"description" : "Permissions: ANY OF: [ES_DID_STORE_GET_DID] \nOperation: 'view-did' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nRetrieves a specific DID from the DID Store by its target path.\nReturns the full DID entry including the DID identifier, DID document, and metadata.\n\n**Response includes:**\n- DID identifier\n- Full DID document (JSON-LD format following W3C DID specification)\n- Associated metadata (if any)\n\n**Use Cases:**\n- Retrieve a specific DID document for verification\n- Access DID metadata\n- Verify DID existence and content\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The requested DID with its full document and metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/did-entry"
}
}
}
},
"404" : {
"description" : "DID not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this DID",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/add" : {
"post" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Add a new DID to the store",
"description" : "Permissions: ANY OF: [ES_DID_STORE_ADD_DID] \nOperation: 'add-did' \nAccepts parent targets: [DidStoreServiceReference] \nRequires authentication. \n\n---\nAdds a new DID to the DID Store. The DID will be persisted with its identifier and DID document.\n\n**Important:**\n- The DID path is determined by the target path in the request\n- If a DID already exists at the target path, the request will fail\n- Use the update endpoint to modify existing DIDs\n- The DID document must be valid JSON-LD following W3C DID specification\n\n**Request Format:**\n- `did`: The DID identifier (e.g., `did:key:...`, `did:web:...`)\n- `document`: The DID document as a JSON object\n\n**Use Cases:**\n- Store DIDs created externally\n- Import DIDs from other systems\n- Add DIDs to the store for later use\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The DID to store, including its identifier and document",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.DidToStore"
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "DID added successfully to the store",
"headers" : { }
},
"400" : {
"description" : "Invalid DID format, invalid DID document, or DID already exists at target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/update" : {
"put" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Update a stored DID",
"description" : "Permissions: ANY OF: [ES_DID_STORE_UPDATE_DID] \nOperation: 'update-did' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nUpdates an existing DID in the DID Store. This replaces the entire DID entry at the target path.\n\n**Important:**\n- The DID must already exist at the target path\n- This operation replaces the entire DID entry (identifier, document, and metadata)\n- Renaming is supported: if the DID identifier changes, the old entry is removed and a new one is created\n- When renaming, the parent DID Store must remain the same\n\n**Use Cases:**\n- Update a DID document with new keys or services\n- Rename a DID entry\n- Refresh DID information\n\n**Renaming Behavior:**\nIf the DID identifier in the update request differs from the current one, the system will:\n1. Remove the old DID entry\n2. Create a new entry with the updated identifier\nThe parent DID Store must remain the same for this operation to succeed.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The updated DID entry to replace the existing one",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/did-entry"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "DID updated successfully",
"headers" : { }
},
"404" : {
"description" : "DID not found at the specified target path",
"headers" : { }
},
"400" : {
"description" : "Invalid DID format or invalid rename operation (parent changed)",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/delete" : {
"delete" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Delete a stored DID",
"description" : "Permissions: ANY OF: [ES_DID_STORE_DELETE_DID] \nOperation: 'delete-did' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nPermanently deletes a DID from the DID Store. This action cannot be undone.\n\n**Important:**\n- The DID will be immediately removed from the store\n- This operation is irreversible\n- Ensure you have backups if the DID data is important\n- Deleting a DID does not invalidate it on the blockchain or other networks\n\n**Use Cases:**\n- Remove obsolete or unused DIDs\n- Clean up test DIDs\n- Comply with data retention policies\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "DID deleted successfully",
"headers" : { }
},
"404" : {
"description" : "DID not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/metadata/view" : {
"get" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "View metadata",
"description" : "Permissions: ANY OF: [VIEW_METADATA] \nOperation: 'view-metadata' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nRetrieves the metadata associated with this resource. Metadata provides additional information, tags, descriptions, or custom attributes that can be used for organization, search, and filtering.\n\n**Use Cases:**\n- Retrieve custom attributes and tags\n- Access resource descriptions and annotations\n- Review metadata for organization and categorization\n- Export metadata for documentation or reporting\n\n**Important Notes:**\n- Metadata is optional and may not exist for all resources\n- Returns 404 if no metadata has been set\n- Metadata is stored as a JSON object allowing flexible structure\n- Metadata does not affect core resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with data" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
}
},
"404" : {
"description" : "No metadata stored for this resource",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/metadata/set" : {
"put" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Set metadata",
"description" : "Permissions: ANY OF: [SET_METADATA] \nOperation: 'set-metadata' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nSets or replaces the complete metadata for this resource. This operation replaces any existing metadata with the provided metadata object.\n\n**Use Cases:**\n- Initialize metadata for a new resource\n- Replace existing metadata completely\n- Set custom attributes and tags\n- Add resource descriptions and annotations\n\n**Important Notes:**\n- This operation completely replaces existing metadata\n- To update specific fields, use the update endpoint with JSON Patch\n- Metadata is stored as a JSON object\n- Setting metadata to an empty object is valid\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Metadata to set for this resource",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with description and tags" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata was set for this resource",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON object",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to set metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/metadata/purge" : {
"delete" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Purge metadata",
"description" : "Permissions: ANY OF: [PURGE_METADATA] \nOperation: 'purge-metadata' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nPermanently removes all metadata associated with this resource. After this operation, the resource will have no metadata until new metadata is set.\n\n**Use Cases:**\n- Remove metadata that is no longer needed\n- Clean up test or temporary metadata\n- Reset metadata to a clean state\n- Remove sensitive information from metadata\n\n**Important Notes:**\n- This operation is irreversible\n- The resource itself is not affected, only its metadata\n- After purging, the view endpoint will return 404 until new metadata is set\n- Purging metadata does not affect resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource was deleted",
"headers" : { }
},
"404" : {
"description" : "Resource not found or no metadata exists to purge",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to purge metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/metadata/update" : {
"post" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "Update metadata (with JSON Patch)",
"description" : "Permissions: ANY OF: [UPDATE_METADATA] \nOperation: 'update-metadata' \nAccepts targets: [DidStoreStoredDid] \nRequires authentication. \n\n---\nUpdates the metadata for this resource using JSON Patch format (RFC 6902). This allows partial updates to specific fields without replacing the entire metadata object.\n\n**Use Cases:**\n- Update specific metadata fields without replacing the entire object\n- Add new fields to existing metadata\n- Remove specific fields from metadata\n- Modify nested metadata structures\n\n**Important Notes:**\n- Uses RFC 6902 JSON Patch format for updates\n- If no metadata exists, an empty object is used as the base\n- Supports add, remove, replace, move, copy, and test operations\n- Partial updates preserve other metadata fields\n- Invalid patch operations will result in an error\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "JSON Patch document following RFC 6902 format - array of patch operations. Each operation must have 'op', 'path', and optionally 'value' fields.",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"title" : "JsonArray"
},
"examples" : {
"Single replace operation" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
} ]
},
"Multiple operations (replace, add, remove)" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
}, {
"op" : "add",
"path" : "/tags/-",
"value" : "new-tag"
}, {
"op" : "remove",
"path" : "/oldField"
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON Patch, invalid patch operation, or patch cannot be applied",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-store-service-api/dids/metadata/query" : {
"post" : {
"tags" : [ "Service | DID Store Service" ],
"summary" : "List by metadata matching query",
"description" : "Permissions: ANY OF: [QUERY_BY_METADATA] \nOperation: 'query-by-metadata' \nAccepts targets: [TraversableServiceReference] \nRequires authentication. \n\n---\nQueries and returns resources that match the specified metadata constraints. This allows you to find resources based on their metadata attributes using field-based filtering.\n\n**Use Cases:**\n- Find resources by tags or custom attributes\n- Filter resources based on metadata values\n- Search for resources with specific metadata fields\n- Implement metadata-based resource discovery\n\n**Important Notes:**\n- Query uses field constraints to match metadata\n- Returns a map of matching resource targets to their metadata\n- Resources without metadata are not included in results\n- Query constraints follow the Presentation Definition Input Descriptor format\n- Empty query returns all resources with metadata\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "List of field constraints to match against metadata",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.definitionparser.PresentationDefinition.InputDescriptor.Constraints.Field"
},
"title" : "ArrayList"
},
"examples" : {
"Query by tags field" : {
"value" : [ {
"path" : [ "tags" ]
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Map of matching resource targets to their metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"title" : "LinkedHashMap"
}
}
}
},
"400" : {
"description" : "Invalid request - malformed query constraints",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/dependencies/list" : {
"get" : {
"tags" : [ "DID Service" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.did-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/dependencies/add" : {
"post" : {
"tags" : [ "DID Service" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, did-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/dependencies/remove" : {
"post" : {
"tags" : [ "DID Service" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/default-requests" : {
"get" : {
"tags" : [ "DID Service" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Did Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"create-did-key" : {
"keyReference" : "waltid.tenant1.kms1.did-key",
"useJwkJcsPub" : true
},
"create-did-web" : {
"type" : "single_key_reference",
"domain" : "did.example.com",
"path" : "tenant1",
"keyReference" : "waltid.tenant1.kms1.did-web-key"
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/default-requests/{operation}" : {
"get" : {
"tags" : [ "DID Service" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Did Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-did-key — method option and KMS key" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.did-key",
"useJwkJcsPub" : true
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "DID Service" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Did Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-did-key — method option and KMS key" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.did-key",
"useJwkJcsPub" : true
}
},
"create-did-web — domain, path, and KMS key" : {
"value" : {
"type" : "single_key_reference",
"domain" : "did.example.com",
"path" : "tenant1",
"keyReference" : "waltid.tenant1.kms1.did-web-key"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-did-key — method option and KMS key" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.did-key",
"useJwkJcsPub" : true
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "DID Service" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Did Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/create/key" : {
"post" : {
"tags" : [ "DID Service" ],
"summary" : "Create a did:key",
"description" : "Permissions: ANY OF: [ES_DID_SERVICE_CREATE_DID_KEY] \nOperation: 'create-did-key' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nCreate a decentralized identifier (DID) according to the did:key method specification.\n\nThe did:key method is a simple, self-contained DID method that encodes a public key directly in the DID identifier.\n\nWe also support the creation of EBSI compliant DID:key via the `useJwkJcsPub` flag.\n\nThe DID contains all necessary information, has no external dependencies, and provides immediate DID generation.\n\nThe key can be provided either as a reference to a key stored in the KMS (`keyReference`) or as an inline JWK (`key`). When `key` is provided, `keyReference` is ignored.\n\n\n\nThe created DID will also be stored in all linked DID Stores (`DidStoreServiceReference`). \n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.models.CreateDidKeyRequest"
},
"examples" : {
"Create request with default values" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"didId" : "did"
}
},
"Create request without Jwk Jcs Public Key encoding" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"useJwkJcsPub" : false,
"didId" : "did"
}
},
"Create request with inline JWK key (Secp256r1)" : {
"value" : {
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"d" : "LTYx9pqrj0GN25cQu-uZnTT9XJ3zSmsz4ot6Fx9_OVc",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
},
"didId" : "did"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "DID created successfully. Returns the DID identifier and its document.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
},
"examples" : {
"Result based on Secp256r1 key and with Jwk Jcs Public Key encoding" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ",
"verificationMethod" : [ {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ",
"type" : "JsonWebKey2020",
"controller" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "YRCxjscyFRmd0fW3VDlFxndI6600D5wNC4v66l_WIEk",
"x" : "LaUzyhPtvuUVDU11dv1JAKS4jOcs2dKh41N3g5x8r6Q",
"y" : "QXgfwvK8qCH0rawqb8hpz9u9GplawcX4GnVmyCOzPhk"
}
} ],
"assertionMethod" : [ "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ" ],
"authentication" : [ "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ" ],
"capabilityInvocation" : [ "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ" ],
"capabilityDelegation" : [ "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ" ],
"keyAgreement" : [ "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ#z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbpaY9KKxATriPQDjx7KmJDNbFDCSv1Vx9krY91dqqBB1Yfymif25KK5Lf5G62mXjQuAv714NJ6gKuHxgJ4jgGeCAECZNDjky3HL58sW7r93boKeEdwAAdBNuWoyDyLCTMPJ" ]
}
}
},
"Result based on Secp256r1 key and without Jwk Jcs Public Key encoding" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr",
"verificationMethod" : [ {
"id" : "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr",
"type" : "JsonWebKey2020",
"controller" : "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "0rFu6z2J-aGhb0tzxorb6jVjnvjJPEn2Ef0_akW7_OY",
"x" : "TlXwxHy_WjzRG0ae5o2HNYo8hL9JR3fcexNJeBao7is",
"y" : "0owZIPuH_daBLsQARfb6lXZXS7e6rS-aMAoINllwqD8"
}
} ],
"assertionMethod" : [ "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr" ],
"authentication" : [ "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr" ],
"capabilityInvocation" : [ "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr" ],
"capabilityDelegation" : [ "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr" ],
"keyAgreement" : [ "did:key:zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr#zDnaenw5Duvko46us1sd6UCenQeEMn77tesdAUqMRhrBK8QYr" ]
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - key not found or invalid key identifier",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/create/jwk" : {
"post" : {
"tags" : [ "DID Service" ],
"summary" : "Create a did:jwk",
"description" : "Permissions: ANY OF: [ES_DID_SERVICE_CREATE_DID_JWK] \nOperation: 'create-did-jwk' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nCreate a decentralized identifier (DID) according to the did:jwk method specification.\n\nThe did:jwk method is a simple DID method that encodes a JSON Web Key (JWK) directly in the DID identifier.\n\nIt's designed for scenarios where you want to use standard JWK format for key representation.\n\nThe DID uses standard JSON Web Key format, is self-contained, has no external dependencies, and follows W3C DID and JWK specifications.\n\nThe key can be provided either as a reference to a key stored in the KMS (`keyReference`) or as an inline JWK (`key`). When `key` is provided, `keyReference` is ignored.\n\n\n\nThe created DID will also be stored in all linked DID Stores (`DidStoreServiceReference`). \n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.models.CreateDidJwkRequest"
},
"examples" : {
"Create sample request" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.key1",
"didId" : "did"
}
},
"Create request with inline JWK key (Secp256r1)" : {
"value" : {
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"d" : "LTYx9pqrj0GN25cQu-uZnTT9XJ3zSmsz4ot6Fx9_OVc",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
},
"didId" : "did"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "DID created successfully. Returns the DID identifier and its document.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
},
"examples" : {
"Result based on Secp256r1 key" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ",
"verificationMethod" : [ {
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0",
"type" : "JsonWebKey2020",
"controller" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "zTAuLimJoUKN8p-U4boKSC3PQrp98g1shJvjkemE4uU",
"x" : "BTBcv4JHzwWUV2WBpafChRLNAGUfIfX56odiGzoJqwM",
"y" : "smf7Jy7yKUIYKL3ihhYn3nC40hKQTayhX-RRmWKkP6c"
}
} ],
"assertionMethod" : [ "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0" ],
"authentication" : [ "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0" ],
"capabilityInvocation" : [ "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0" ],
"capabilityDelegation" : [ "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0" ],
"keyAgreement" : [ "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoielRBdUxpbUpvVUtOOHAtVTRib0tTQzNQUXJwOThnMXNoSnZqa2VtRTR1VSIsIngiOiJCVEJjdjRKSHp3V1VWMldCcGFmQ2hSTE5BR1VmSWZYNTZvZGlHem9KcXdNIiwieSI6InNtZjdKeTd5S1VJWUtMM2loaFluM25DNDBoS1FUYXloWC1SUm1XS2tQNmMifQ#0" ]
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - key not found or invalid key identifier",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/create/web" : {
"post" : {
"tags" : [ "DID Service" ],
"summary" : "Create a did:web",
"description" : "Permissions: ANY OF: [ES_DID_SERVICE_CREATE_DID_WEB] \nOperation: 'create-did-web' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nCreate a decentralized identifier (DID) according to the did:web method specification.\n\nThe did:web method allows DIDs to be resolved via HTTPS from a well-known location on a web domain.\n\nThe DID document is hosted at a standard path on the domain, making it discoverable and resolvable.\n\nImportant: This endpoint creates the DID and its document, but does not provide registry functionality.\n\nThe DID will not be automatically resolvable until you host the DID document at the appropriate location on your web server following the did:web specification.\n\nKey features include web-based resolution via HTTPS from your domain, flexible configuration supporting custom paths and domains, service endpoint configurations (DIDComm, credential registries, etc.), and support for custom JSON-LD properties.\n\n\n\nThe created DID will also be stored in all linked DID Stores (`DidStoreServiceReference`). \n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.models.CreateDidWebBaseRequest"
},
"examples" : {
"Create with single key (e.g., secp256r1) for all verification relationships and default values" : {
"value" : {
"type" : "single_key_reference",
"keyReference" : "waltid.tenant1.kms1.secp256r1key",
"domain" : "walt.id"
}
},
"Create with inline JWK key (e.g., secp256r1) for all verification relationships and default values" : {
"value" : {
"type" : "single_key_reference",
"keyReference" : "",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"d" : "LTYx9pqrj0GN25cQu-uZnTT9XJ3zSmsz4ot6Fx9_OVc",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
},
"domain" : "walt.id"
}
},
"Create with single key (e.g., RSA) for all verification relationships and web path" : {
"value" : {
"type" : "single_key_reference",
"keyReference" : "waltid.tenant1.kms1.rsakey",
"domain" : "walt.id",
"path" : "user/alice"
}
},
"Create with single key (e.g., secp256k1) for all verification relationships, web path and service configurations" : {
"value" : {
"type" : "single_key_reference",
"keyReference" : "waltid.tenant1.kms1.secp256k1",
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ]
}
},
"Create with single key (e.g., secp256k1) for all verification relationships, web path, service configurations and custom properties" : {
"value" : {
"type" : "single_key_reference",
"keyReference" : "waltid.tenant1.kms1.rsakey",
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ],
"rootCustomProperties" : {
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
},
"Create with two keys (e.g., secp256r1 and RSA) for all verification relationships and default values" : {
"value" : {
"type" : "key_reference_set",
"keyReferenceSet" : [ "waltid.tenant1.kms1.secp256r1key", "waltid.tenant1.kms1.rsakey" ],
"domain" : "walt.id",
"didId" : "did"
}
},
"Create with two keys (e.g., secp256r1 and RSA) for all verification relationships and web path" : {
"value" : {
"type" : "key_reference_set",
"keyReferenceSet" : [ "waltid.tenant1.kms1.secp256r1key", "waltid.tenant1.kms1.rsakey" ],
"domain" : "walt.id",
"path" : "user/alice"
}
},
"Create with two keys (e.g., secp256r1 and RSA) for all verification relationships, web path and service configurations" : {
"value" : {
"type" : "key_reference_set",
"keyReferenceSet" : [ "waltid.tenant1.kms1.secp256r1key", "waltid.tenant1.kms1.rsakey" ],
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ]
}
},
"Create with two keys (e.g., secp256r1 and RSA) for all verification relationships, web path, service configurations and custom properties" : {
"value" : {
"type" : "key_reference_set",
"keyReferenceSet" : [ "waltid.tenant1.kms1.secp256r1key", "waltid.tenant1.kms1.rsakey" ],
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ],
"rootCustomProperties" : {
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
},
"Create with two unique keys for each verification relationship and default values" : {
"value" : {
"type" : "verification_key_reference_set_config",
"verificationKeyReferenceSetConfiguration" : {
"authentication" : [ "waltid.tenant1.kms1.ed25519-authentication-key", "waltid.tenant1.kms1.rsa-authentication-key" ],
"assertionMethod" : [ "waltid.tenant1.kms1.secp256r1-assertion-key", "waltid.tenant1.kms1.secp256k1-assertion-key" ],
"capabilityInvocation" : [ "waltid.tenant1.kms1.ed25519-capability-invocation-key", "waltid.tenant1.kms1.secp256r1-capability-invocation-key" ],
"capabilityDelegation" : [ "waltid.tenant1.kms1.ed25519-capability-delegation-key", "waltid.tenant1.kms1.secp256k1-capability-delegation-key" ],
"keyAgreement" : [ "waltid.tenant1.kms1.secp256r1-key-agreement-key", "waltid.tenant1.kms1.secp256k1-key-agreement-key" ]
},
"domain" : "walt.id"
}
},
"Create with two unique keys for each verification relationship and web path" : {
"value" : {
"type" : "verification_key_reference_set_config",
"verificationKeyReferenceSetConfiguration" : {
"authentication" : [ "waltid.tenant1.kms1.ed25519-authentication-key", "waltid.tenant1.kms1.rsa-authentication-key" ],
"assertionMethod" : [ "waltid.tenant1.kms1.secp256r1-assertion-key", "waltid.tenant1.kms1.secp256k1-assertion-key" ],
"capabilityInvocation" : [ "waltid.tenant1.kms1.ed25519-capability-invocation-key", "waltid.tenant1.kms1.secp256r1-capability-invocation-key" ],
"capabilityDelegation" : [ "waltid.tenant1.kms1.ed25519-capability-delegation-key", "waltid.tenant1.kms1.secp256k1-capability-delegation-key" ],
"keyAgreement" : [ "waltid.tenant1.kms1.secp256r1-key-agreement-key", "waltid.tenant1.kms1.secp256k1-key-agreement-key" ]
},
"domain" : "walt.id",
"path" : "user/alice"
}
},
"Create with two unique keys for each verification relationship, web path and service configurations" : {
"value" : {
"type" : "verification_key_reference_set_config",
"verificationKeyReferenceSetConfiguration" : {
"authentication" : [ "waltid.tenant1.kms1.ed25519-authentication-key", "waltid.tenant1.kms1.rsa-authentication-key" ],
"assertionMethod" : [ "waltid.tenant1.kms1.secp256r1-assertion-key", "waltid.tenant1.kms1.secp256k1-assertion-key" ],
"capabilityInvocation" : [ "waltid.tenant1.kms1.ed25519-capability-invocation-key", "waltid.tenant1.kms1.secp256r1-capability-invocation-key" ],
"capabilityDelegation" : [ "waltid.tenant1.kms1.ed25519-capability-delegation-key", "waltid.tenant1.kms1.secp256k1-capability-delegation-key" ],
"keyAgreement" : [ "waltid.tenant1.kms1.secp256r1-key-agreement-key", "waltid.tenant1.kms1.secp256k1-key-agreement-key" ]
},
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ]
}
},
"Create with two unique keys for each verification relationship, web path, service configurations and custom properties" : {
"value" : {
"type" : "verification_key_reference_set_config",
"verificationKeyReferenceSetConfiguration" : {
"authentication" : [ "waltid.tenant1.kms1.ed25519-authentication-key", "waltid.tenant1.kms1.rsa-authentication-key" ],
"assertionMethod" : [ "waltid.tenant1.kms1.secp256r1-assertion-key", "waltid.tenant1.kms1.secp256k1-assertion-key" ],
"capabilityInvocation" : [ "waltid.tenant1.kms1.ed25519-capability-invocation-key", "waltid.tenant1.kms1.secp256r1-capability-invocation-key" ],
"capabilityDelegation" : [ "waltid.tenant1.kms1.ed25519-capability-delegation-key", "waltid.tenant1.kms1.secp256k1-capability-delegation-key" ],
"keyAgreement" : [ "waltid.tenant1.kms1.secp256r1-key-agreement-key", "waltid.tenant1.kms1.secp256k1-key-agreement-key" ]
},
"domain" : "walt.id",
"path" : "user/alice",
"serviceConfigurationSet" : [ {
"type" : "DIDCommMessaging",
"serviceEndpoint" : [ {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
} ]
}, {
"type" : "CredentialRegistry",
"serviceEndpoint" : [ "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id" ]
} ],
"rootCustomProperties" : {
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "DID created successfully. Returns the DID identifier and its document.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
},
"examples" : {
"Result with single key (e.g., secp256r1) for all verification relationships and default values" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id",
"verificationMethod" : [ {
"id" : "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY",
"x" : "rVrFm_2iqIDq8Ob6iOIjXxfrYsj1D7p0EGhqa1IAYxM",
"y" : "7uintwxH5jQ-bRASDe_vE57iaQdVqOIYgNj852Tjv78"
}
} ],
"assertionMethod" : [ "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY" ],
"authentication" : [ "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY" ],
"capabilityInvocation" : [ "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY" ],
"capabilityDelegation" : [ "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY" ],
"keyAgreement" : [ "did:web:walt.id#rehbnyTEW3DcmUO484fAqzQNr3gZ0M-s9fcwcKCfkzY" ]
}
}
},
"Result with single key (e.g., RSA) for all verification relationships and web path" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA",
"n" : "iFWQMyRgoW3jeRyLBiVyvNHVghQzKhUyXzAXdKFmW58uR8T2f-lsQYWwub8beB38J2I5viljj-ALpFQqHmh2WvXfcr5-OPRB6IRPktsxHyzS1aB5cLXltyB6hnXZo1kV54y09rOqS_erkOV69wKl0Hg5oZALBABzMcD1id_oJ5eB8GThG4cO9n5fHa8HFKiuwG2gObXQdiwb6tM4on81_pTQCLi2bo1U3prlzwVfbTpaObo6Pq4hGQFjYm9f2ZWpVEfNBqnUS71NV2sM1XaukpRaFuKgP8OqKh66yhor1huroalgDmD0z2Jb6zWU0eGpyr2M5i5VNzjphsPfTRVubw"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA" ],
"authentication" : [ "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#3C7FQWaqxXm8TC_2MqKStyakbKFh9uuS_cMfJ6-psFA" ]
}
}
},
"Result with single key (e.g., secp256k1) for all verification relationships, web path and service configurations" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"authentication" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#aaa51666-a3b1-4765-818c-2b088769d17d",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#5c8ced25-7c6b-4ca7-ba65-675d764adc61",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ]
}
}
},
"Result with single key (e.g., secp256k1) for all verification relationships, web path, service configurations and custom properties" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"authentication" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#5f1a6ccf-4c49-4c94-92f9-2ca0bfee68b6",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#a907a9de-658c-4d3f-b33c-a41648254674",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ],
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
},
"Result with two keys (e.g., secp256r1 and RSA) for all verification relationships and default values" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id",
"verificationMethod" : [ {
"id" : "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
} ],
"assertionMethod" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"authentication" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityDelegation" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityInvocation" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"keyAgreement" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ]
}
}
},
"Result with two keys (e.g., secp256r1 and RSA) for all verification relationships and web path" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"authentication" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ]
}
}
},
"Result with two keys (e.g., secp256r1 and RSA) for all verification relationships, web path and service configurations" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"authentication" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#ef2d72ab-a12c-43c3-aec2-2c41e7893382",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#83c897b3-e7b8-44f4-81e6-00314a9e634a",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ]
}
}
},
"Result with two keys (e.g., secp256r1 and RSA) for all verification relationships, web path, service configurations and custom properties" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
} ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"authentication" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#d3ee4bf5-3991-4947-ae8f-93976588ce92",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#a0321b69-afe4-4477-b0da-bc2a8bf5a0c4",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ],
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
},
"Result with two unique keys for each verification relationship and default values" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id",
"verificationMethod" : [ {
"id" : "did:web:walt.id#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}, {
"id" : "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
}, {
"id" : "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"authentication" : [ "did:web:walt.id#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"assertionMethod" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ" ],
"capabilityDelegation" : [ "did:web:walt.id#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ]
}
}
},
"Result with two unique keys for each verification relationship and web path" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
}, {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"authentication" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ]
}
}
},
"Result with two unique keys for each verification relationship, web path and service configurations" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
}, {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"authentication" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#a455e4a2-7fbd-4499-8bd3-0fac798aaffd",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#e68c3ad9-0bae-4411-b67d-45d83150f18b",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ]
}
}
},
"Result with two unique keys for each verification relationship, web path, service configurations and custom properties" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:web:walt.id:user:alice",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:web:walt.id:user:alice",
"verificationMethod" : [ {
"id" : "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}, {
"id" : "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "RSA",
"e" : "AQAB",
"kid" : "ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4",
"n" : "uCSgFKMp7hSBEavMe8nkHW_IUUvOw3mDlRjh0pwFgHeHVJd72K5XHL3CDWfgSxPs2vKKxAvN6SseBujEA7ExprVkcyRiD-fdJK4ougB7oChbkiyOYZ24tFDunQwDHxY8UOW1pewyLiVS6uzdt1UyJyQuIC8bxq_46ITL9hB3rWiuh6EVO28JHElUrYvdlFMTkl1OL8JgWAhrWaCnedddSvKAJ2o9wph_1VfjemHiL8O3fc2IVFR3r2rAWDkrMomUZDt-as56em9O76rTXtOoKiqjDKgGcYa14rcVFrYB4IP5-2N9MZOVx9rb7vrD3_0W8nY7UuHkx0InsUPNclcVOw"
}
}, {
"id" : "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"kid" : "9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ",
"x" : "yzfoYvMBd8wgdaDgTh40hGrPSTHh0IooU13RM27gQDg",
"y" : "j8cuG9HmrSFnTUKzHPjbPYhMuAWzGz6tuVivczZf95c"
}
}, {
"id" : "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"type" : "JsonWebKey2020",
"controller" : "did:web:walt.id:user:alice",
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "secp256k1",
"kid" : "cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ",
"x" : "lwGTFdA4m3qeEXUu-H1OgowMJHEdCby7wT5Fb56GMOQ",
"y" : "NDsPQvf8WBDJKXYrYKjsdooraVPyJtr_0jZMKuTyhhg"
}
} ],
"authentication" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#ja1HNg4t6ge8KDROIVk2PH2iVRMtidAXJuHGOXzZdg4" ],
"assertionMethod" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"capabilityInvocation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ" ],
"capabilityDelegation" : [ "did:web:walt.id:user:alice#h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"keyAgreement" : [ "did:web:walt.id:user:alice#9pfGPMRgKwqrGP_ClGdZq-ytzHxXdREyQ2kES6hZxQQ", "did:web:walt.id:user:alice#cfZ5uMdxsAlGTehHLV-NG1D6LyVxpMtb-Q4g8CKs8KQ" ],
"service" : [ {
"id" : "did:web:walt.id:user:alice#248267b2-51b2-4445-b20b-69bfc24e5187",
"type" : "DIDCommMessaging",
"serviceEndpoint" : {
"uri" : "http://example.com/path",
"accept" : [ "didcomm/v2", "didcomm/aip2;env=rfc587" ],
"routingKeys" : [ "did:example:somemediator#somekey" ]
}
}, {
"id" : "did:web:walt.id:user:alice#ebb295a5-3971-4759-916f-c3dee592ba32",
"type" : "CredentialRegistry",
"serviceEndpoint" : "https://ssi.eecc.de/api/registry/vcs/some-credential-subject-id"
} ],
"some-key1" : "some-string-value1",
"some-key2" : {
"some-nested-key1" : "some-nested-value1"
},
"some-key3" : [ "some-array-value1" ]
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - key not found, invalid configuration, or malformed request",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/did-service-api/dids/resolve/{did}" : {
"get" : {
"tags" : [ "DID Service" ],
"summary" : "Resolve a DID",
"description" : "Permissions: ANY OF: [ES_DID_SERVICE_RESOLVE_DID] \nOperation: 'resolve-did' \nAccepts targets: [DidServiceReference] \nRequires authentication. \n\n---\nResolve a decentralized identifier (DID) and retrieve its associated DID document.\n\nThis endpoint resolves a DID according to the W3C DID Core specification.\n\nIt retrieves the DID document associated with the given DID identifier, which contains public keys, service endpoints, and other metadata needed to interact with the DID.\n\nTakes a DID identifier as input (e.g., did:key, did:web, did:jwk), resolves the DID using the appropriate method-specific resolver, and returns the complete DID document in JSON-LD format.\n\nUse cases include retrieving public keys for verification or encryption, accessing service endpoints associated with a DID, verifying DID ownership, and enabling DID-based authentication flows.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "did",
"in" : "path",
"description" : "The did to be resolved",
"required" : true,
"deprecated" : false,
"allowEmptyValue" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg"
} ],
"responses" : {
"200" : {
"description" : "DID resolved successfully. Returns the DID identifier and its complete document.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.didservice.DidEnterpriseService.DidResult"
},
"examples" : {
"Resolved did:key" : {
"value" : {
"id" : "org.tenant.did-store.did",
"did" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"document" : {
"@context" : [ "https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1" ],
"id" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"verificationMethod" : [ {
"id" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"type" : "JsonWebKey2020",
"controller" : "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg",
"publicKeyJwk" : {
"kty" : "OKP",
"crv" : "Ed25519",
"x" : "sTgvlFxftGMKOpengFu-N9AwgiSKwzdzmH75rxJh1ZE"
}
} ],
"assertionMethod" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"authentication" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"capabilityInvocation" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"capabilityDelegation" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ],
"keyAgreement" : [ "did:key:z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg#z6MkrP3u6dEz2gpWq89J7DMWtPCYW8dGrpPBzkfkDt9FXrQg" ]
}
}
}
}
}
}
},
"400" : {
"description" : "Invalid DID format or malformed DID identifier",
"headers" : { }
},
"404" : {
"description" : "DID not found or could not be resolved",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to resolve DIDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.credential-status.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.x509-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, credential-status, x509-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"credential-status dependency" : {
"value" : {
"dependency" : "waltid.tenant1.credential-status.main"
}
},
"x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove credential-status dependency" : {
"value" : {
"dependency" : "waltid.tenant1.credential-status.main"
}
},
"Remove x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/configuration/view" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/configuration/update" : {
"put" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nUpdates the configuration for Issuer Service instance2. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/issuer2"
},
"examples" : {
"Update Issuer2 - Self-Hosted SD-JWT VCT" : {
"value" : {
"type" : "issuer2",
"baseUrl" : "https://dentinal-aggradational-dorris.ngrok-free.dev",
"tokenKeyId" : "waltid.tenant1.kms1.key1",
"kms" : "waltid.tenant1.kms1",
"credentialConfigurations" : {
"identity_credential" : {
"format" : "dc+sd-jwt",
"scope" : "identity_credential",
"vct" : "{vctBaseURL}/identity_credential",
"credential_signing_alg_values_supported" : [ "ES256" ],
"cryptographic_binding_methods_supported" : [ "jwk" ],
"proof_types_supported" : {
"jwt" : {
"proof_signing_alg_values_supported" : [ "ES256", "EdDSA" ]
}
}
}
},
"issuerDisplayConfiguration" : [ {
"name" : "walt.id Issuer",
"locale" : "en-US",
"logo" : {
"uri" : "https://issuer.example.com/logo.png",
"alt_text" : "walt.id Issuer logo"
}
}, {
"name" : "walt.id Issuer",
"locale" : "de-DE",
"logo" : {
"uri" : "https://issuer.example.com/logo-de.png",
"alt_text" : "walt.id Issuer DE Logo"
}
} ],
"authProviderConfiguration" : {
"name" : "Keycloak",
"authorizeUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/auth",
"accessTokenUrl" : "https://keycloak.demo.walt.id/realms/mynewrealm/protocol/openid-connect/token",
"clientId" : "issuer_api",
"clientSecret" : "Y0DyNhF4NgpOS6VMRUtl0JtvxrRYQD4s",
"defaultScopes" : [ "openid", "profile" ],
"forwardIssuerStateToAuthorizationServer" : true
},
"sdJwtVcTypeMetadataConfiguration" : {
"identity_credential" : {
"name" : "The Identity Credential",
"description" : "This is our development version of the identity credential. Be safe."
}
},
"clientAuthenticationConfig" : {
"supportedMethods" : [ {
"type" : "preauth-anonymous"
} ]
},
"batchCredentialIssuance" : {
"batch_size" : 10
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/configuration/openid-metadata/display/view" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "View display metadata configuration for this Issuer Service instance",
"description" : "Permissions: ANY OF: [ES_ISSUER_GET_DISPLAY_CONFIGURATION] \nOperation: 'issuer-configuration-display-view' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nRetrieve the display metadata configuration that is associated with this issuer service instance.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Display Metadata Configuration",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.IssuerDisplayConfiguration"
},
"title" : "ArrayList"
},
"examples" : {
"Example response with configured display information" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"locale" : "en-US",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png",
"alt_text" : "logo specific text goes here"
}
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/configuration/openid-metadata/display/update" : {
"put" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "Update display metadata configuration for this Issuer Service instance",
"description" : "Permissions: ANY OF: [ES_ISSUER_UPDATE_DISPLAY_CONFIGURATION] \nOperation: 'issuer-configuration-display-update' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nUpdate the display metadata configuration that is associated with this issuer service instance.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.IssuerDisplayConfiguration"
},
"title" : "ArrayList"
},
"examples" : {
"Single-entry example with human-readable name" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service"
} ]
},
"Single-entry example with human-readable name and logo URI" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png"
}
} ]
},
"Single-entry example with human-readable name, logo URI and alternative text" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png",
"alt_text" : "alternative logo specific text goes here"
}
} ]
},
"Single-entry example with human-readable name, logo URI and en-US specific localization" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"locale" : "en-US",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png"
}
} ]
},
"Multi-entry example for different localizations" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"locale" : "en-US",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png"
}
}, {
"name" : "walt.id Enterprise Issuer Service",
"locale" : "en-GB",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png"
}
} ]
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"description" : "Display metadata configuration updated successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.IssuerDisplayConfiguration"
},
"title" : "ArrayList"
},
"examples" : {
"Example response body" : {
"value" : [ {
"name" : "walt.id Enterprise Issuer Service",
"locale" : "en-US",
"logo" : {
"uri" : "https://cdn.walt.id/issuer/logo.png",
"alt_text" : "logo specific text goes here"
}
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/configuration/openid-metadata/display/delete" : {
"delete" : {
"tags" : [ "Service | Issuer Service API v2 - Service Management" ],
"summary" : "Delete display metadata configuration for this Issuer Service instance",
"description" : "Permissions: ANY OF: [ES_ISSUER_DELETE_DISPLAY_CONFIGURATION] \nOperation: 'issuer-configuration-display-delete' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nDelete the display metadata configuration that is associated with this issuer service instance.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/credentials/profiles" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "View credential profile",
"description" : "Permissions: ANY OF: [ES_ISSUER_GET_CREDENTIAL_PROFILE] \nOperation: 'issuer-credential-profile-view' \nAccepts targets: [StoredCredentialProfile2] \nRequires authentication. \n\n---\nGet one credential profile. The profile ID is taken from the target.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Credential profile",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfile"
},
"examples" : {
"View profile response" : {
"value" : {
"profileId" : "profile-mdoc-photo-id-default",
"name" : "mDoc photo ID profile",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Update credential profile",
"description" : "Permissions: ANY OF: [ES_ISSUER_UPDATE_CREDENTIAL_PROFILE] \nOperation: 'issuer-credential-profile-update' \nAccepts targets: [StoredCredentialProfile2] \nRequires authentication. \n\n---\nUpdate an existing credential profile addressed by target. Version is incremented automatically.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfileUpdateRequest"
},
"examples" : {
"Update SD-JWT profile request with SD-JWT selective disclosure config (birthdate disclosed, family_name hidden)" : {
"value" : {
"name" : "SD-JWT VC profile (updated)",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key2",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name"
},
"credentialStatus" : {
"statusCredentialConfig" : "waltid.tenant1.credential-status.revocation",
"initialStatus" : "0x0"
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"description" : "Updated credential profile",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfile"
},
"examples" : {
"Updated SD-JWT profile response with SD-JWT selective disclosure config (birthdate disclosed, family_name hidden)" : {
"value" : {
"profileId" : "profile-sd-jwt-vc-default",
"name" : "SD-JWT VC profile (updated)",
"version" : 2,
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key2",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name"
},
"credentialStatus" : {
"statusCredentialConfig" : "waltid.tenant1.credential-status.revocation",
"initialStatus" : "0x0"
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Create credential profile",
"description" : "Permissions: ANY OF: [ES_ISSUER_ADD_CREDENTIAL_PROFILE] \nOperation: 'issuer-credential-profile-create' \nRequires authentication. \n\n---\nCreate a credential issuance profile bound 1:1 to a credential_configuration_id. The profile ID is taken from the target. The profile stores the default issuer/key/material and credential data used for profile-derived offers. For SD-JWT based profiles, selective disclosure configuration can be stored on the profile and reused by default. For mDoc profiles, put namespace value functions in mapping and MSO validity functions in msoData. Namespace values are resolved before CBOR conversion; msoData controls validFrom, validUntil, and expectedUpdate in the MSO. Blank or whitespace msoData fields are rejected. Omitted offer override keys inherit the profile; JSON null for expectedUpdate clears it so the MSO omits it. Use , , and for ISO full-date fields such as photo-ID issuance_date / expiry_date (mDL uses issue_date). Date webhooks must also return YYYY-MM-DD for stringToFullDate conversion. Replace the example.com webhook URLs with your own endpoints and keep document expiry consistent with MSO validity. These defaults can later be overridden per offer for supported runtime override fields.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfileCreateRequest"
},
"examples" : {
"[sd-jwt-vc] profile" : {
"value" : {
"name" : "SD-JWT VC profile",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
}
}
},
"[sd-jwt-vc] profile with x509" : {
"value" : {
"name" : "SD-JWT VC profile with x509",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIICujCCAmCgAwIBAgIQe2sGqmM7RsuiZRfQHUziAzAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjBwMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSkwJwYDVQQDDCBFbnRlcnByaXNlIElz\nc3VlcjIgU0QtSldUIFNpZ25lcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBli\nqXS94z6DyecCoEgPo8Uto4KfmVAxOrCEG3gfOrxdF3xAwH96/xVciV7mFQslU/eR\nQgP+5pSZiNf8bjMoGfqjgdcwgdQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC\nB4AwHQYDVR0OBBYEFO0uPS0noP3tKJ30+OBVWy/60ip7MB8GA1UdIwQYMBaAFPCS\n4p9uoj7P5OJ52xfdd7V4yh+0MDQGA1UdEgQtMCuGKWh0dHBzOi8vZW50ZXJwcmlz\nZS1pc3N1ZXIuZXhhbXBsZS9hdC9pYWNhMD4GA1UdHwQ3MDUwM6AxoC+GLWh0dHBz\nOi8vZW50ZXJwcmlzZS1pc3N1ZXIuZXhhbXBsZS9hdC9pYWNhLmNybDAKBggqhkjO\nPQQDAgNIADBFAiEAglNfkcic8iJDhrWwJMS1Z6hBeNnx1qxOZ4p6afoxhD4CIAUj\no4YlNdIgYfr25xUYFie2RmFgnRRxBPUiJDvR8n+p\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
}
}
},
"[sd-jwt-vc] profile with selective disclosures" : {
"value" : {
"name" : "SD-JWT VC profile with selective disclosure",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
}
}
},
"[sd-jwt-vc] profile with credential status" : {
"value" : {
"name" : "SD-JWT VC profile with credential status",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
},
"credentialStatus" : {
"statusCredentialConfig" : "waltid.tenant1.credential-status.revocation",
"initialStatus" : "0x0"
}
}
},
"[w3c-vc-dm-1.1] profile" : {
"value" : {
"name" : "W3C VC DM 1.1 profile",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
}
}
},
"[w3c-vc-dm-1.1] profile with credential status" : {
"value" : {
"name" : "W3C VC DM 1.1 profile with credential status",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
},
"credentialStatus" : {
"statusCredentialConfig" : "waltid.tenant1.credential-status.revocation",
"initialStatus" : "0x0"
}
}
},
"[w3c-vc-dm-1.1] profile with credential schema" : {
"value" : {
"name" : "W3C VC DM 1.1 profile with credential schema",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
},
"credentialSchema" : [ {
"id" : "https://purl.imsglobal.org/spec/ob/v3p0/schema/json/ob_v3p0_anyachievementcredential_schema.json",
"type" : "JsonSchemaValidator2019"
} ]
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
}
}
},
"[w3c-vc-dm-2.0] OpenBadge profile" : {
"value" : {
"name" : "W3C VC DM 2.0 OpenBadge profile",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/ns/credentials/v2", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "Certified Machine Learning Engineer — Graduate Level",
"description" : "Awarded to graduates who have demonstrated advanced competency in machine learning theory, model engineering, and production deployment as part of the MSc Artificial Intelligence programme.",
"validFrom" : "2025-07-22T09:02:24Z",
"validUntil" : "2028-07-22T00:00:00Z",
"issuer" : {
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"type" : [ "Profile" ],
"name" : "Northgate Institute of Technology",
"url" : "https://www.northgate-tech.edu/",
"email" : "credentials@northgate-tech.edu",
"description" : "Northgate Institute of Technology is an accredited research university specialising in engineering, computer science, and applied AI.",
"image" : {
"id" : "https://www.northgate-tech.edu/assets/logo-official.png",
"type" : "Image"
},
"address" : {
"type" : "Address",
"addressCountry" : "GB",
"addressLocality" : "Manchester"
},
"otherIdentifier" : [ {
"type" : "IdentifierEntry",
"identifier" : "0033-UK-NORTHGATE",
"identifierType" : "ext:UKPRN"
} ],
"accreditation" : {
"type" : "Profile",
"name" : "Quality Assurance Agency for Higher Education (QAA)",
"url" : "https://www.qaa.ac.uk/"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"name" : "John Doe",
"email" : "j.doe@student.edu",
"identifier" : [ {
"type" : "IdentifierEntry",
"identifier" : "STU-2024-ML-0471",
"identifierType" : "ext:studentId"
} ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"achievementType" : "Degree",
"name" : "Certified Machine Learning Engineer — Graduate Level",
"description" : "This badge certifies that the holder has completed the MSc Artificial Intelligence programme with a specialisation in machine learning engineering, covering the full model lifecycle from research to production.",
"humanCode" : "NIT-ML-G3",
"fieldOfStudy" : "Artificial Intelligence / Machine Learning",
"specialization" : "Production ML Systems",
"inLanguage" : "en-GB",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/ml-engineer-graduate.png",
"type" : "Image"
},
"criteria" : {
"type" : "Criteria",
"narrative" : "To earn this credential the candidate must: (1) complete 180 credits of postgraduate study across core ML modules with a minimum grade of Merit; (2) deliver a capstone research project demonstrating novel application of ML techniques, assessed by an independent panel; (3) pass a practical deployment examination requiring the candidate to train, evaluate, and serve a model via a REST API under examination conditions; and (4) adhere to the university's Academic Integrity and Responsible AI guidelines throughout the programme.",
"id" : "https://www.northgate-tech.edu/programmes/msc-ai/criteria"
},
"alignment" : [ {
"type" : "Alignment",
"targetType" : "ext:ESCO",
"targetName" : "Machine learning engineer",
"targetCode" : "http://data.europa.eu/esco/occupation/0f39db14-94b4-4b9e-93f6-027b6c1c1e56",
"targetUrl" : "https://esco.ec.europa.eu/en/classification/occupation?uri=http%3A%2F%2Fdata.europa.eu%2Fesco%2Foccupation%2F0f39db14-94b4-4b9e-93f6-027b6c1c1e56",
"targetFramework" : "European Skills, Competences, Qualifications and Occupations (ESCO) v1.2"
}, {
"type" : "Alignment",
"targetType" : "ext:ONET",
"targetName" : "Computer and Information Research Scientists",
"targetCode" : "15-1221.00",
"targetUrl" : "https://www.onetonline.org/link/summary/15-1221.00",
"targetFramework" : "O*NET 28.0"
} ],
"tag" : [ "machine-learning", "deep-learning", "mlops", "python", "pytorch", "model-deployment", "graduate" ],
"relatedAction" : [ {
"id" : "urn:uuid:f1a2b3c4-0001-4d5e-8f6a-7b8c9d0e1f2a",
"type" : [ "Achievement" ],
"achievementType" : "Badge",
"name" : "MLOps Practitioner",
"description" : "Intermediate stackable badge: CI/CD pipelines for ML models, experiment tracking, and model registry management.",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/mlops-practitioner.png",
"type" : "Image"
}
}, {
"id" : "urn:uuid:f1a2b3c4-0002-4d5e-8f6a-7b8c9d0e1f2b",
"type" : [ "Achievement" ],
"achievementType" : "Badge",
"name" : "Responsible AI Fundamentals",
"description" : "Foundation badge: bias auditing, fairness metrics, and model explainability (SHAP/LIME).",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/responsible-ai.png",
"type" : "Image"
}
} ]
},
"result" : [ {
"type" : [ "Result" ],
"resultDescription" : "urn:uuid:rd-msc-ai-overall-2025",
"status" : "Completed",
"value" : "Distinction",
"achievedLevel" : "https://www.northgate-tech.edu/grading/distinction"
}, {
"type" : [ "Result" ],
"resultDescription" : "urn:uuid:rd-capstone-2025",
"status" : "Completed",
"value" : "92/100",
"achievedLevel" : "https://www.northgate-tech.edu/grading/distinction"
} ],
"evidence" : [ {
"id" : "https://github.com/aisha-yilmaz/msc-capstone-2025",
"type" : [ "Evidence" ],
"name" : "Capstone Project — Adaptive Fraud Detection with Federated Learning",
"description" : "Public repository containing the full implementation, experiment logs, and technical report for the capstone project. The model achieved 97.4% AUC on a hold-out test set drawn from a synthetic financial transaction dataset.",
"genre" : "Research Project",
"audience" : "Academic Review Panel"
}, {
"id" : "https://www.northgate-tech.edu/transcripts/verify?ref=STU-2024-ML-0471",
"type" : [ "Evidence" ],
"name" : "Official Academic Transcript",
"description" : "Verifiable link to the official academic transcript issued by Northgate Institute of Technology confirming 180 credits completed with Distinction across all modules.",
"genre" : "Transcript",
"audience" : "Employers, Academic Institutions"
} ]
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"validFrom" : "",
"validUntil" : ""
},
"w3cVersion" : "W3CV2"
}
},
"[w3c-vc-dm-1.1] profile with x509" : {
"value" : {
"name" : "W3C VC DM 1.1 profile with x509 (EIDAS)",
"credentialConfigurationId" : "OpenBadgeCredential_jwt_vc_json",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIICMDCCAdWgAwIBAgIUXl1kSxL8SRSOTmYevI+iDAECdy4wCgYIKoZIzj0EAwIw\nKjELMAkGA1UEBhMCVVMxGzAZBgNVBAMMEldhbHQgQ0xJIFRlc3QgSUFDQTAeFw0y\nNjA1MjIxNDQ2MjBaFw0yNzA4MjIxNDQ2MjBaMEQxCzAJBgNVBAYTAlVTMTUwMwYD\nVQQDDCxGaW5hbmNpYWwgU2VydmljZXMgQXV0aG9yaXR5IERvY3VtZW50IFNpZ25l\ncjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBgwesTZVWtn+Vsu8MnCdkDpsAXu\nUF/bpp1JWF/G9hnIrf1dkSGHFuChnSRRS8+wa5cw6Ai63mamAQrGu4uNuG2jgb4w\ngbswHwYDVR0jBBgwFoAUmK8RITk6hvP5QrEfCFfKSNIVWjgwHQYDVR0OBBYEFI87\nc9FDLPION8e44GjdzLBB6UETMA4GA1UdDwEB/wQEAwIHgDAoBgNVHRIEITAfhh1o\ndHRwczovL3dhbHQtY2xpLmV4YW1wbGUvaWFjYTAVBgNVHSUBAf8ECzAJBgcogYxd\nBQECMCgGA1UdHwQhMB8wHaAboBmGF2h0dHBzOi8vZ292LmV4YW1wbGUvY3JsMAoG\nCCqGSM49BAMCA0kAMEYCIQDtfVmq3LOtThIIu6B+5pjSXVrTOSNN4BWv09CZwrSo\n/QIhAIpN8aSVk30QkraKYS6RwbJq+Ocg3g7LEKqtbtn7+9Nt\n-----END CERTIFICATE-----"
}, {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIUZyzaVHaCGc8QIgXmChB7FMzcH5YwCgYIKoZIzj0EAwIw\nKjELMAkGA1UEBhMCVVMxGzAZBgNVBAMMEldhbHQgQ0xJIFRlc3QgSUFDQTAeFw0y\nNjA1MjIxNDQ2MTlaFw00NjA1MTcxNDQ2MTlaMCoxCzAJBgNVBAYTAlVTMRswGQYD\nVQQDDBJXYWx0IENMSSBUZXN0IElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\nAASrTGLbW652GQLVAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfI\nOYpnj4CjzzVaWKB5rEy9n+Iqo28wbTAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfK\nSNIVWjgwEgYDVR0TAQH/BAgwBgEB/wIBADAoBgNVHRIEITAfhh1odHRwczovL3dh\nbHQtY2xpLmV4YW1wbGUvaWFjYTAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwID\nSAAwRQIgflBFqPJu3WA0N10GiqtAZ2bb/p/J5XJ0VXzLljV/zoMCIQClWNsoQLkP\nZXjMGWVR+oY+vVSYNoLom14adr3ulFCN1w==\n-----END CERTIFICATE-----"
} ],
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
}
}
},
"[mdoc-photo-id] profile" : {
"value" : {
"name" : "mDoc photo ID profile",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
}
}
},
"[mdoc-photo-id] profile with data functions" : {
"value" : {
"name" : "mDoc photo ID profile with data functions",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"mapping" : {
"org.iso.23220.photoid.1" : {
"family_name_unicode" : "",
"issuance_date" : "",
"expiry_date" : ""
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
},
"msoData" : {
"validUntil" : "",
"expectedUpdate" : ""
}
}
},
"[mdoc-photo-id] profile - x509 store hosted x5c" : {
"value" : {
"name" : "mDoc photo ID profile",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "x509-store-stored-certificate-descriptor",
"storedCertificateId" : "org1.tenant1.x509-store1.certificate1"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "Credential profile created successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfile"
},
"examples" : {
"[sd-jwt-vc] profile response" : {
"value" : {
"profileId" : "profile-sd-jwt-vc-default",
"name" : "SD-JWT VC profile",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[sd-jwt-vc] profile with x509 response" : {
"value" : {
"profileId" : "profile-sd-jwt-vc-x509",
"name" : "SD-JWT VC profile with x509",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIICujCCAmCgAwIBAgIQe2sGqmM7RsuiZRfQHUziAzAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjBwMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSkwJwYDVQQDDCBFbnRlcnByaXNlIElz\nc3VlcjIgU0QtSldUIFNpZ25lcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBli\nqXS94z6DyecCoEgPo8Uto4KfmVAxOrCEG3gfOrxdF3xAwH96/xVciV7mFQslU/eR\nQgP+5pSZiNf8bjMoGfqjgdcwgdQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC\nB4AwHQYDVR0OBBYEFO0uPS0noP3tKJ30+OBVWy/60ip7MB8GA1UdIwQYMBaAFPCS\n4p9uoj7P5OJ52xfdd7V4yh+0MDQGA1UdEgQtMCuGKWh0dHBzOi8vZW50ZXJwcmlz\nZS1pc3N1ZXIuZXhhbXBsZS9hdC9pYWNhMD4GA1UdHwQ3MDUwM6AxoC+GLWh0dHBz\nOi8vZW50ZXJwcmlzZS1pc3N1ZXIuZXhhbXBsZS9hdC9pYWNhLmNybDAKBggqhkjO\nPQQDAgNIADBFAiEAglNfkcic8iJDhrWwJMS1Z6hBeNnx1qxOZ4p6afoxhD4CIAUj\no4YlNdIgYfr25xUYFie2RmFgnRRxBPUiJDvR8n+p\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[sd-jwt-vc] profile response with selective disclosures" : {
"value" : {
"profileId" : "profile-sd-jwt-vc-default",
"name" : "SD-JWT VC profile with selective disclosure",
"credentialConfigurationId" : "identity_credential",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"given_name" : "Jane",
"family_name" : "Doe",
"email" : "johndoe@example.com",
"phone_number" : "+1-202-555-0101",
"address" : {
"street_address" : "123 Main St",
"locality" : "Anytown",
"region" : "Anystate",
"country" : "US"
},
"birthdate" : "1940-01-01",
"is_over_18" : true,
"is_over_21" : true,
"is_over_65" : true
},
"mapping" : {
"iat" : "",
"nbf" : "",
"exp" : ""
},
"selectiveDisclosure" : {
"fields" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.family_name",
"$.given_name" : "$.given_name"
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[w3c-vc-dm-1.1] profile response" : {
"value" : {
"profileId" : "profile-w3c-vc-dm-1.1-default",
"name" : "W3C VC DM 1.1 profile",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[w3c-vc-dm-2.0] OpenBadge profile response" : {
"value" : {
"profileId" : "profile-w3c-vc-dm-2.0-open-badge",
"name" : "W3C VC DM 2.0 OpenBadge profile",
"credentialConfigurationId" : "open_badge_credential",
"issuerDid" : "",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"credentialData" : {
"@context" : [ "https://www.w3.org/ns/credentials/v2", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "Certified Machine Learning Engineer — Graduate Level",
"description" : "Awarded to graduates who have demonstrated advanced competency in machine learning theory, model engineering, and production deployment as part of the MSc Artificial Intelligence programme.",
"validFrom" : "2025-07-22T09:02:24Z",
"validUntil" : "2028-07-22T00:00:00Z",
"issuer" : {
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"type" : [ "Profile" ],
"name" : "Northgate Institute of Technology",
"url" : "https://www.northgate-tech.edu/",
"email" : "credentials@northgate-tech.edu",
"description" : "Northgate Institute of Technology is an accredited research university specialising in engineering, computer science, and applied AI.",
"image" : {
"id" : "https://www.northgate-tech.edu/assets/logo-official.png",
"type" : "Image"
},
"address" : {
"type" : "Address",
"addressCountry" : "GB",
"addressLocality" : "Manchester"
},
"otherIdentifier" : [ {
"type" : "IdentifierEntry",
"identifier" : "0033-UK-NORTHGATE",
"identifierType" : "ext:UKPRN"
} ],
"accreditation" : {
"type" : "Profile",
"name" : "Quality Assurance Agency for Higher Education (QAA)",
"url" : "https://www.qaa.ac.uk/"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"name" : "John Doe",
"email" : "j.doe@student.edu",
"identifier" : [ {
"type" : "IdentifierEntry",
"identifier" : "STU-2024-ML-0471",
"identifierType" : "ext:studentId"
} ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"achievementType" : "Degree",
"name" : "Certified Machine Learning Engineer — Graduate Level",
"description" : "This badge certifies that the holder has completed the MSc Artificial Intelligence programme with a specialisation in machine learning engineering, covering the full model lifecycle from research to production.",
"humanCode" : "NIT-ML-G3",
"fieldOfStudy" : "Artificial Intelligence / Machine Learning",
"specialization" : "Production ML Systems",
"inLanguage" : "en-GB",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/ml-engineer-graduate.png",
"type" : "Image"
},
"criteria" : {
"type" : "Criteria",
"narrative" : "To earn this credential the candidate must: (1) complete 180 credits of postgraduate study across core ML modules with a minimum grade of Merit; (2) deliver a capstone research project demonstrating novel application of ML techniques, assessed by an independent panel; (3) pass a practical deployment examination requiring the candidate to train, evaluate, and serve a model via a REST API under examination conditions; and (4) adhere to the university's Academic Integrity and Responsible AI guidelines throughout the programme.",
"id" : "https://www.northgate-tech.edu/programmes/msc-ai/criteria"
},
"alignment" : [ {
"type" : "Alignment",
"targetType" : "ext:ESCO",
"targetName" : "Machine learning engineer",
"targetCode" : "http://data.europa.eu/esco/occupation/0f39db14-94b4-4b9e-93f6-027b6c1c1e56",
"targetUrl" : "https://esco.ec.europa.eu/en/classification/occupation?uri=http%3A%2F%2Fdata.europa.eu%2Fesco%2Foccupation%2F0f39db14-94b4-4b9e-93f6-027b6c1c1e56",
"targetFramework" : "European Skills, Competences, Qualifications and Occupations (ESCO) v1.2"
}, {
"type" : "Alignment",
"targetType" : "ext:ONET",
"targetName" : "Computer and Information Research Scientists",
"targetCode" : "15-1221.00",
"targetUrl" : "https://www.onetonline.org/link/summary/15-1221.00",
"targetFramework" : "O*NET 28.0"
} ],
"tag" : [ "machine-learning", "deep-learning", "mlops", "python", "pytorch", "model-deployment", "graduate" ],
"relatedAction" : [ {
"id" : "urn:uuid:f1a2b3c4-0001-4d5e-8f6a-7b8c9d0e1f2a",
"type" : [ "Achievement" ],
"achievementType" : "Badge",
"name" : "MLOps Practitioner",
"description" : "Intermediate stackable badge: CI/CD pipelines for ML models, experiment tracking, and model registry management.",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/mlops-practitioner.png",
"type" : "Image"
}
}, {
"id" : "urn:uuid:f1a2b3c4-0002-4d5e-8f6a-7b8c9d0e1f2b",
"type" : [ "Achievement" ],
"achievementType" : "Badge",
"name" : "Responsible AI Fundamentals",
"description" : "Foundation badge: bias auditing, fairness metrics, and model explainability (SHAP/LIME).",
"image" : {
"id" : "https://www.northgate-tech.edu/badges/responsible-ai.png",
"type" : "Image"
}
} ]
},
"result" : [ {
"type" : [ "Result" ],
"resultDescription" : "urn:uuid:rd-msc-ai-overall-2025",
"status" : "Completed",
"value" : "Distinction",
"achievedLevel" : "https://www.northgate-tech.edu/grading/distinction"
}, {
"type" : [ "Result" ],
"resultDescription" : "urn:uuid:rd-capstone-2025",
"status" : "Completed",
"value" : "92/100",
"achievedLevel" : "https://www.northgate-tech.edu/grading/distinction"
} ],
"evidence" : [ {
"id" : "https://github.com/aisha-yilmaz/msc-capstone-2025",
"type" : [ "Evidence" ],
"name" : "Capstone Project — Adaptive Fraud Detection with Federated Learning",
"description" : "Public repository containing the full implementation, experiment logs, and technical report for the capstone project. The model achieved 97.4% AUC on a hold-out test set drawn from a synthetic financial transaction dataset.",
"genre" : "Research Project",
"audience" : "Academic Review Panel"
}, {
"id" : "https://www.northgate-tech.edu/transcripts/verify?ref=STU-2024-ML-0471",
"type" : [ "Evidence" ],
"name" : "Official Academic Transcript",
"description" : "Verifiable link to the official academic transcript issued by Northgate Institute of Technology confirming 180 credits completed with Distinction across all modules.",
"genre" : "Transcript",
"audience" : "Employers, Academic Institutions"
} ]
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"validFrom" : "",
"validUntil" : ""
},
"w3cVersion" : "W3CV2",
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[w3c-vc-dm-1.1] profile with x509 response" : {
"value" : {
"profileId" : "profile-w3c-vc-x509-eidas",
"name" : "W3C VC DM 1.1 profile with x509 (EIDAS)",
"credentialConfigurationId" : "OpenBadgeCredential_jwt_vc_json",
"issuerKeyId" : "waltid.tenant1.kms1.key1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIICMDCCAdWgAwIBAgIUXl1kSxL8SRSOTmYevI+iDAECdy4wCgYIKoZIzj0EAwIw\nKjELMAkGA1UEBhMCVVMxGzAZBgNVBAMMEldhbHQgQ0xJIFRlc3QgSUFDQTAeFw0y\nNjA1MjIxNDQ2MjBaFw0yNzA4MjIxNDQ2MjBaMEQxCzAJBgNVBAYTAlVTMTUwMwYD\nVQQDDCxGaW5hbmNpYWwgU2VydmljZXMgQXV0aG9yaXR5IERvY3VtZW50IFNpZ25l\ncjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBgwesTZVWtn+Vsu8MnCdkDpsAXu\nUF/bpp1JWF/G9hnIrf1dkSGHFuChnSRRS8+wa5cw6Ai63mamAQrGu4uNuG2jgb4w\ngbswHwYDVR0jBBgwFoAUmK8RITk6hvP5QrEfCFfKSNIVWjgwHQYDVR0OBBYEFI87\nc9FDLPION8e44GjdzLBB6UETMA4GA1UdDwEB/wQEAwIHgDAoBgNVHRIEITAfhh1o\ndHRwczovL3dhbHQtY2xpLmV4YW1wbGUvaWFjYTAVBgNVHSUBAf8ECzAJBgcogYxd\nBQECMCgGA1UdHwQhMB8wHaAboBmGF2h0dHBzOi8vZ292LmV4YW1wbGUvY3JsMAoG\nCCqGSM49BAMCA0kAMEYCIQDtfVmq3LOtThIIu6B+5pjSXVrTOSNN4BWv09CZwrSo\n/QIhAIpN8aSVk30QkraKYS6RwbJq+Ocg3g7LEKqtbtn7+9Nt\n-----END CERTIFICATE-----"
}, {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIUZyzaVHaCGc8QIgXmChB7FMzcH5YwCgYIKoZIzj0EAwIw\nKjELMAkGA1UEBhMCVVMxGzAZBgNVBAMMEldhbHQgQ0xJIFRlc3QgSUFDQTAeFw0y\nNjA1MjIxNDQ2MTlaFw00NjA1MTcxNDQ2MTlaMCoxCzAJBgNVBAYTAlVTMRswGQYD\nVQQDDBJXYWx0IENMSSBUZXN0IElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\nAASrTGLbW652GQLVAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfI\nOYpnj4CjzzVaWKB5rEy9n+Iqo28wbTAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfK\nSNIVWjgwEgYDVR0TAQH/BAgwBgEB/wIBADAoBgNVHRIEITAfhh1odHRwczovL3dh\nbHQtY2xpLmV4YW1wbGUvaWFjYTAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwID\nSAAwRQIgflBFqPJu3WA0N10GiqtAZ2bb/p/J5XJ0VXzLljV/zoMCIQClWNsoQLkP\nZXjMGWVR+oY+vVSYNoLom14adr3ulFCN1w==\n-----END CERTIFICATE-----"
} ],
"credentialData" : {
"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ],
"id" : "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)",
"type" : [ "VerifiableCredential", "OpenBadgeCredential" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"issuanceDate" : "2025-07-22T09:02:24.362335948Z",
"issuer" : {
"type" : [ "Profile" ],
"name" : "Jobs for the Future (JFF)",
"url" : "https://www.jff.org/",
"id" : "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoiM1lOZDlGbng5Smx5UFZZd2dXRkUzN0UzR3dJMGVHbENLOHdGbFd4R2ZwTSIsIngiOiJGb3ZZMjFMQUFPVGxnLW0tTmVLV2haRUw1YUZyblIwdWNKakQ1VEtwR3VnIiwieSI6IkNyRkpmR1RkUDI5SkpjY3BRWHV5TU8zb2h0enJUcVB6QlBCSVRZajBvZ0EifQ",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-1-2022/images/JFF_LogoLockup.png",
"type" : "Image"
}
},
"credentialSubject" : {
"id" : "did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqfT52v9YLEfQUPrXyti2rgGK8fz3WUAzLDjruHQFKuWoHpqrdHDSFXcfTG7apCkfgD7mxwdddt8HmcpLkedgymDAeTmy2gaEsCYD5jrzCtZGBT9fVyvzwQSxgBmz45qNtU",
"type" : [ "AchievementSubject" ],
"achievement" : {
"id" : "urn:uuid:ac254bd5-8fad-4bb1-9d29-efd938536926",
"type" : [ "Achievement" ],
"name" : "JFF x vc-edu PlugFest 3 Interoperability",
"description" : "This wallet supports the use of W3C Verifiable Credentials and has demonstrated interoperability during the presentation request workflow during JFF x VC-EDU PlugFest 3.",
"criteria" : {
"type" : "Criteria",
"narrative" : "Wallet solutions providers earned this badge by demonstrating interoperability during the presentation request workflow. This includes successfully receiving a presentation request, allowing the holder to select at least two types of verifiable credentials to create a verifiable presentation, returning the presentation to the requestor, and passing verification of the presentation and the included credentials.",
"image" : {
"id" : "https://w3c-ccg.github.io/vc-ed/plugfest-3-2023/images/JFF-VC-EDU-PLUGFEST3-badge-image.png",
"type" : "Image"
}
}
}
}
},
"mapping" : {
"id" : "",
"issuer" : {
"id" : ""
},
"credentialSubject" : {
"id" : ""
},
"issuanceDate" : "",
"expirationDate" : ""
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[mdoc-photo-id] profile response" : {
"value" : {
"profileId" : "profile-mdoc-photo-id-default",
"name" : "mDoc photo ID profile",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
},
"[mdoc-photo-id] profile with data functions response" : {
"value" : {
"profileId" : "profile-mdoc-photo-id-data-functions",
"name" : "mDoc photo ID profile with data functions",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"mapping" : {
"org.iso.23220.photoid.1" : {
"family_name_unicode" : "",
"issuance_date" : "",
"expiry_date" : ""
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
},
"msoData" : {
"validUntil" : "",
"expectedUpdate" : ""
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Delete credential profile",
"description" : "Permissions: ANY OF: [ES_ISSUER_DELETE_CREDENTIAL_PROFILE] \nOperation: 'issuer-credential-profile-delete' \nAccepts targets: [StoredCredentialProfile2] \nRequires authentication. \n\n---\nPermanently delete a credential profile addressed by target.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Profile successfully deleted. Also returned if the profile is not found.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/credentials/profiles/list" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "List credential profiles",
"description" : "Permissions: ANY OF: [ES_ISSUER_GET_CREDENTIAL_PROFILE] \nOperation: 'issuer-credential-profile-list' \nAccepts targets: [IssuerServiceReference2] \nRequires authentication. \n\n---\nList credential profiles for this issuer service. Use includeInactive=true to include inactive profiles.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Credential profiles",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialProfile"
},
"title" : "ArrayList"
},
"examples" : {
"List profiles response" : {
"value" : [ {
"profileId" : "profile-mdoc-photo-id-default",
"name" : "mDoc photo ID profile",
"credentialConfigurationId" : "org.iso.23220.photoid.1",
"issuerKeyId" : "waltid.tenant1.kms1.ecKey1",
"x5Chain" : [ {
"type" : "pem-encoded-x509-certificate-descriptor",
"pemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIC1DCCAnmgAwIBAgIQCkKn9xUnSWy/CZNoV2jiAjAKBggqhkjOPQQDAjB0MQsw\nCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50ZXJwcmlz\nZSBJc3N1ZXIyIFRlc3QgUEtJMS0wKwYDVQQDDCR3YWx0LmlkIEVudGVycHJpc2Ug\nSXNzdWVyMiBUZXN0IElBQ0EwHhcNMjYwODA2MDkzNzI1WhcNMjcwODA2MDkzNzI1\nWjByMQswCQYDVQQGEwJBVDEQMA4GA1UECgwHd2FsdC5pZDEkMCIGA1UECwwbRW50\nZXJwcmlzZSBJc3N1ZXIyIFRlc3QgUEtJMSswKQYDVQQDDCJFbnRlcnByaXNlIElz\nc3VlcjIgRG9jdW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\nGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT\n95FCA/7mlJmI1/xuMygZ+qOB7jCB6zAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE\nAwIHgDAVBgNVHSUBAf8ECzAJBgcogYxdBQECMB0GA1UdDgQWBBTtLj0tJ6D97Sid\n9PjgVVsv+tIqezAfBgNVHSMEGDAWgBTwkuKfbqI+z+TiedsX3Xe1eMoftDA0BgNV\nHRIELTArhilodHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4YW1wbGUvYXQvaWFj\nYTA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovL2VudGVycHJpc2UtaXNzdWVyLmV4\nYW1wbGUvYXQvaWFjYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAIGXeoExGekZqE6X\nLGp3DOIkSUXAHLgpLqdDNHGKBAmZAiEA33Q+VYZwLkTEL4n+w+KKLPVGK1I0lu6C\n8fH6BcR87jk=\n-----END CERTIFICATE-----\n"
} ],
"credentialData" : {
"org.iso.23220.photoid.1" : {
"age_over_18" : true,
"issuing_country" : "AT",
"given_name_unicode" : "GnameU",
"family_name_unicode" : "FnameU",
"birth_date" : "2003-12-21",
"issuance_date" : "2025-12-13",
"issuing_authority_unicode" : "walt.id Issuer",
"expiry_date" : "2026-12-13",
"portrait" : "/9j/4AAQSkZJRgABAQIAJQAlAAD/4QBiRXhpZgAATU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAMAAAITAAMAAAABAAEAAAAAAAAAAAAlAAAAAQAAACUAAAAB/9sAQwADAgICAgIDAgICAwMDAwQGBAQEBAQIBgYFBgkICgoJCAkJCgwPDAoLDgsJCQ0RDQ4PEBAREAoMEhMSEBMPEBAQ/8AACwgBsQFoAQERAP/EAB4AAQABBAMBAQAAAAAAAAAAAAABAgcICQMEBgoF/8QASRAAAQMDAwMCBQAHBAYGCwAAAQACAwQFEQYHEgghMQlBEyJRYXEUIzJCUoGRFWJyshgzOHWCwhZDobHR8CQlJjQ1REaFs8PU/9oACAEBAAA/ANqL/ZSPClERERERERERERERERERERERERERERUv9vypHhSiIiIiIiIi4Q93/k5I/Psvy7/qiw6Vtk961LfaG1W+mbzmqq2pZTwsbj9oveQGjse5IH3Vir16hnRpYq6S31u/thfNE7DjSRVNXFn7SQxPa4fgrqD1J+iR/wCxvxbj/wDa7gP/ANC/E1f6pPRhpaifUUu51VqCpa3Io7RZqt8z/wAOljZEP+J4Vuz60HS04fq9GbnfztND/wD2LyJ9bDa4ainp27M6pdYW5+BXfp8H6U/s0/NT44M7kj/Wu8L8mq9bvTUdZPHQ9Pd1nphK4QSS6jjje6MeHOYKd3B31bycB7OXYqfW30T+kUYpNi72ad7miqfLeImvYD5MYbE4Px93NVwZ/WQ6WYqlsAse4UzBHHI+aC1Uvw2lzWuMeX1IcXMyWO+XBcxxa4tw53vtLeqP0YanjgbNunPY6mVveC6WesiLHfwue2N0Y/Iesk9F670luLYabVWhtTW++WirGYauhnbLE7/ibnv9shejRERERERERERUv9vypHhSiIiIiIijIX5V6vtu07bKq9Xy501voKCB9TU1NRK2KGGJgy973uOGtaO5JIA8Ela5t5vWY0pp7UE9j2W0B/0opaaV0ZutxqX00VRxdjMUQHMtJ/ZLi0keWrEDfD1N+pzeCpMNs1M3RVoc3j+gWF5j5fd8zsyH+RasbNS7n7k6ypP7P1buHqS90jZPitguN1nqYw/+INkcRnv5XmCSexPhEySMEnAQEjwSnJx8uP8AVTyd/Ef6pyd3+Y9/Pfyge8Yw89vHfwo5O+pVydpuoPenZKsM+1m4d3sTXSfEkpoJS6CQ/V0Tg5hP5C2JdNnrERzPp9MdS1mFO48YxqK0U5c0Euxymp25+UDuXMz/AIXLZbpTWGntb2Ci1TpC/Ul5s9yiZNSV1FM2aCVjs9w9p748HuDkY/aBC/fyFKIiIiIiIiKl/t+VI8KURERERRkfVdK43KitlHLcLhcKekpIGfFlmnlDGMZ/E5xIDR9z2WIPUJ6oPTxs02W1aSvTNf6gAcBTWWpa+lheOwEtSAYwM+zC4/XitPu8PUzvPvdqC63vWuvr1LT3Ob4ptcddIyiiZz5RxthDuBDfqRlWlyfGShJPknsiIiIiIiZP1VTXuJ7uJ8nz9fKvv0zdXe7/AEwaghuGjL1UVFikmDq6xVUhdSVLB+3huPkecftNwR75W7jpv6v9nOp2xCs0BqNkd7hjY64WKsIiraJ3FvLLCf1rORAD4+QPIAlrsht9GOLhnPnwqh4UoiIiIiIipf7flSPClERERFB8K12/m/m33Ttt/Xbg7hXcU9NSjFNSxvBqK6Y/sxRM8kl2AfZoBJ+UFaZOsT1B9fdVdJT6Uo7QNK6UpZnSuoYKovfWOPYGd/ytOG/ugYysRnPz4Kjk7OeRz9cqEREREREREU83YI5HBxkZ8r9vSurNS6HvtLqXSN7rbNdaJwkgq6SZ0U0Z98EHJB75Hus/Omz1dtyNJV9Hp7qApRqqxktjddKSJkdxp2+73BoDJh3OR8rhjsVte2z3R0JvFouh17ttqilvlkr2coqmne5pYWn5mPY4B0cjT+0x7Q4HsQAvYZb9VUiIiIiIipf7flSPClERERF4vdXdLR+zWgLzuVr28C32ayUxnne7HKR2QGRRtP7Ukji1jWeSXADHcrQj1k9WN16rtxo9WSWR1ms1ugNLbaAzukw3k4mR/fjzcCMhoAGBhY85I8EoiIiIiIiIiIiZOMZU8nYI5HBOSMq+nS71abldK+sf7b0VXGostdLH/a1kmcTTVjB5IHlkgGeLx3GRnK3v9P3UJt51Jbe0e4e3V1E8M2I62ieQKi3VAALoZmeWuwcg+HN4ubkOBN0g5rhkFVIiIiIiKl/t+VI8KURERF1pKhkeXukwG+SQcAfnOMDySfZaS/U96vnb27iO2m0TdXS6K0hUPY+SneTDX1wy18vbs5rAXNaT7lx+iwU5HOcnP1RERERERERERERE5H6lXn6Yep3X/S3uFHrjRtQailnaIbpapXEQ3CnySQ7HhwJPF3kZOFvq6c+oHRPUttbQboaFndHT1DjTV1HKQZrfWMDTJBJjsDhzHA+C17XeCALroiIiIiKl/t+VI8KURERFrd9UPreOgbTV9O21l1lh1LdIf/aC4U7+JoqRzDmna7yJXjHI+zPl8uHHT2ZHZJ8E+VSiIiIiIiIiIiIiIp5OHhx/qspegrq6uvSzueyS4zSz6K1G+OmvlKCeMBzgVTR/EweR7sJ/hC36W250d2oKa522qZU0tZEyeGVjgQ+N4Ba4Y7EEEH+a7yIiIiIqX+35UjwpRERF1KqshoKeWsq52xQQsdJJI92A1gBJJz2wACST9F81fUHraPcXfLXWuKOsdWU13vlZUU0/f9ZAJSI3j6Dg1uPsrbIiIiIiIiIiIiIiIiqD3e3t2W5n0jepiu3J23r9kNVVj57toWJklrnleC6W2PPFsZ9/1TsN/wALox4C2GoiIiIipf7flSPClEREWIXqi7nXvbDpJv79P1bqWr1VXU2nDO1+HMhna90wb75dFDI37CRx8gLQq4nx7fRQiIiIiIiIiIiIiIiIskugzqEh6dOoexasulVwsN2YbPeXPGGx00zwBIT7CNwZJgecFfQZSVcVZBHVU0okgmjbJG9juTS0jIcD75BBXaRERERUv9vypHhSiIiLU960u7sNZdNE7JUTnl1vEl+uAz8vKRpjhbjxkN59/wC+tXCIiIiIiIiIiIiIiIiKQ5w8OI9/K3++nJv1Qb5dNFha74kd60bHFpy6xySc3ySQwsMdQCe/GVhae/hwkb4asqkREREVL/b8qR4UoiIi0ber+T/pcTDPjT9v/wArlhAiIiIiIiIiIiIiIiIiLZF6K2sqm3bua60BLWsbRXqwxXFkLnY+JPTzhgLR9fhzSE/YLcKCD4KlERERUv8Ab8qR4UoiIi0besAT/pczdv8A6ft/+VywgRERERERERERERERERFkF0Kbnt2m6p9Bamq68UlBUXFtrrpSwvAgqmmEjiO+fmAz7eV9EDMeGuOCBj8fUELmREREVL/b8qR4UoiIi0besAR/pcz+f/gFv/yuWECIiIiIiIiIiIiIiIiIuSnnnp5o56eZ8UsTg+N7HFrmuB7EEeCPqvpd6fNbU24uymiNb0tQ6Vl4sVJUF7hhxcY2h+e5+bkDkexJHsrjoiIiKl/t+VI8KURERaNvV/8A9rmb/cFD/lcsIERERERERERERERERERS3yt43pBatOoekdljfE9h0xqS4Wscz2c14jqwQP3R/wClHt9QSs4URERFS/2/KkeFKIiItG/rAf7XE3+4Lf8A5XLB9EREREREREREREREREUt8ra56I2pbu+3bqaPkqy61001rucFO5o4x1ErZ45XNI8l7IYgQfHwxj95bS0RERFS/wBvypHhSiIiLRt6wP8Atcz/AO4Lf/lcsIEREREREREREREREREFnr6P+5dZo/qRr9BTOlFHrWzTQFpIDG1FMfixyHIySGiZgwcD4hJBwt17Hl2Sexb7LkRERFS/wBvypHhSiIiLRr6vzg7q7qG/Sw2/wDyuWEKIiIiIiIiIiIiIiIiIivn0WsrH9V21kdDK5lQdSUgif27Hlj7/ugjB8ecr6MYuOMg5JXIiIiKl/t+VI8KURERaPPWAs90o+rJ1yrKb4dJcNP0MlI/OfitZljj9sODv6LBpEREREREREREREREUs7nus7PR/0db9RdU1XfK0P+PprTNXcKZjQCHufJDTkkEfuiY4wQeWM5GVu2jAGcBcqIiIqX+35UjwpRERFqP9aPb7UrtYaI3WdC+SwutxsImAbiOpEks7Wu7/ALzXOI9vkJ+gWsh3lQiIiIiIiIiIiIiIiIiePC2ieiDSRS3/AHZrJG/rIqO0RNz44vdUk/z+Qf1W2PAHgBSiIiKl/t+VI8KURERWL6zNoX759NeundvKWNz7jVW8VttDSGn9LpntnhZyPYB74+DneQyRxHcBfOpU00tLNLS1EL4pYnFj2PbhzXNJBBHsRggj6hdZERERERERERUuUjwpRERERERUPaXsLQ4j7grgp7fS0vzRRAPPfk7uf6rscV0LpaYLpCY5gAR2Y4DuFiP1PbOUWltaaf3qs9DM6RwfY7t+h07nvkE5DYJZQHD5GPBbni7HPPysa4ho+5VX6RDLRu4SR4EQhdwIz57lZH6B1z/AG7Rspbm9jatrMveHDB+xx4K9uD9e2fGCutXUdNXU0tFWRMkhnHGRjh5B8fzz3/K0keqBt1U7cbhWm0Ptc8lNI2eeiujiXNkgJaTEfbmHZJHjzhYPOc/JHJ3bHv9PC2U+jztJqW56s1huNX2uJ2kn28WOYyO5ionJZJwDAD+yOJcTjGQAPPHbpFTwxwtihaAwM4tbjtj6YXKY2kEAYz9F5/VulKHVFtdTTt+HNH88Ew8xSfULq6Mu1wbG/TuocC50AwXAYE8X7rx9Tjz916nLs+FWiIiIiIiIiKl/spHhSiIiIiIiKMBSowfqvxdU6coNVWCv07XtBhuETo3nGcEtwHfkEAg/ZYn26xXDQl+msN2gIkp5CwF2eTmt/ex44kYcD58hfvamrqegsT6p1RiWHlIwDLMOHjBH1X73T/1N2fXlSNKXi6U0lyc+RlJUtfls72OLHxHsAHNeOGM5LwW+V39+t/aPbyGutc1bFQVVG01LpZZOLGRBpPxeZ7YbguJOAOBBI+bOInWXeouqzovuO49rt8kGodt70aW+UrYHu5RxOLDM3IB+E6N7Zg4FzQ1xwTjksC+k3pV1t1Vbix6V09G6js1Fxmvd2czLKSE9+Lc9nSu7ho/Lj2AX0A7cbb6O2p0ZbNCaHssFss9ogEFPDG3j2Hklx7ucTlxd5JJPuvW4HjClUkDzgdvC/MuNmiqqmK5RH4dVB3ZJ9R/Cft9l3YJXyN/WDi8ftN/h/n7rsIiIiIiIiIipf7flSPClEREREREREUcW5zjurC70X+x2/dHQmiX2urqrxreWppqZ8FOHsp2UzPiPmmPJpbGAex75JwvH9RmnnaC25rtUagmdFZ6KJ1RVPow97qYNbycSA3Lm8QQMd8rSnrjdJzt1arXm11TX2FrHOdTSh7mTlzub5HuaXODS573HA+VpwQFslgvtn64emHSu5d6t0N01VpCWGh1FR8S7408JAZUcPl+U8g/95gD3Ak91cTpg6drTSaH3O2baKqm05q23/BdTtbxjpjIz4buBHcuyS8vdl3doPFvEDJjp86e9uOm/Q8eiNu7WYIHETVVTJl0tVNxa1z3P9yeOQB27lXUDGNxxYBjsMDwqkRU8fupwPOApRERERERERFS/wBvypHhSiIiIiIiIijIXE57I2Oke/i1uS4k9gB5OT7LGbYvWOm9+9/debqWuOtmodBudo2gnnje2CSUPL6qWHm0ZLXMYwu9+IPuOX6HVVufbLJpQ6ZLppZq95iayGN0oyGucS4gfKz5S3m75cuxnl2WgnWNqo7Lqm8Wukke9lDcqqlIbFxY1rJS1hB5OzyDc/b2yrrdL3VTrDpgv13r7NRtu1qvVukpqu1TPLKeaXAEUj/lJzGQR2+p+gW+zY+Ww3XazTOptOvMtDqK20t5hlexzC9tREJWkBwBxh3YFvurghjB4aB49voqkRERERERERERERQfClEREREREREXXMxbOIPhvy5vLljsD9FwXO20t3oKi2V8ZdBUxvjkDXFp4Hz3C8PT6Q0ztNo8WDbPRQt9NM88o7ZSPc8y8cCWV2C+RxIAdJIS45ySsO+qay71DQt0u2ituNU3+7syKWlprJU1L+T3NbyDGMJeG5JIA7gLWTF0l9WV7ufw3dO2576qrkc901Xpiuja5zgS4vlkiABPfJc4ZJ+qyzsXp7a10L0xul1FoK7XDcfcu7Wu2QQ0Vtmq3aYoHTtMstV8Np4AYDnjsAAAXHBW2bQGnrLpDR9n0hpygkorVp6jhtFFC9paWwUzBCwDPzEAMADj3d5XqERERERERERERERFB8KURERERERERUDwPypb4/mf+9daf/3ln+GT/KFVL5f/AIz/APjU/wDWf8X/ADKlnhv5b/yLl/6w/wCP/lXKiIiIiIiIiIiIiIv/2Q=="
}
},
"idTokenClaimsMapping" : {
"$.family_name" : "$.['org.iso.23220.photoid.1'].family_name_unicode",
"$.given_name" : "$.['org.iso.23220.photoid.1'].given_name_unicode"
},
"mDocNameSpacesDataMappingConfig" : {
"org.iso.23220.photoid.1" : {
"entriesConfigMap" : {
"issuance_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"birth_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"expiry_date" : {
"type" : "string",
"conversionType" : "stringToFullDate"
},
"portrait" : {
"type" : "string",
"conversionType" : "base64StringToByteString"
}
}
}
},
"createdAt" : 1710000000000,
"updatedAt" : 1710000000000
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/sessions" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "List issuance sessions",
"description" : "Permissions: ANY OF: [ES_ISSUER_GET_SESSION] \nOperation: 'issuer-sessions-list' \nAccepts targets: [IssuerServiceReference2, StoredCredentialProfile2] \nRequires authentication. \n\n---\nList persisted issuer2 issuance sessions. The target may be an issuer service or a credential profile.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
}, {
"name" : "status",
"in" : "query",
"description" : "Optional issuance session status filter.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "sessionId",
"in" : "query",
"description" : "Optional session id filter.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "profileId",
"in" : "query",
"description" : "Optional credential profile id filter.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "authMethod",
"in" : "query",
"description" : "Optional authentication method filter. Supported values: authorized, preauthorized.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "createdAfter",
"in" : "query",
"description" : "Optional lower bound for the session creation timestamp (ISO-8601 instant).",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "createdBefore",
"in" : "query",
"description" : "Optional upper bound for the session creation timestamp (ISO-8601 instant).",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Issuance sessions listed successfully.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.SingleStoredIssuanceSession"
}, {
"$ref" : "#/components/schemas/stored-issuance-session2"
} ]
}
}
}
}
},
"400" : {
"description" : "Invalid query parameter.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/credentials/offers" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Create a credential offer",
"description" : "Permissions: ANY OF: [ES_ISSUER_ISSUE_CREDENTIAL] \nOperation: 'issuer-credential-offer-create' \nAccepts targets: [IssuerServiceReference2, StoredCredentialProfile2] \nRequires authentication. \n\n---\nCreate a profile-derived OpenID4VCI credential offer URL and the backing issuance session.\n\nChoose the request format based on the URL target in `/v2/{target}/issuer-service-api/credentials/offers`:\n\n- Single-profile offer: use the credential profile as the URL target and send the offer options\n with optional `runtimeOverrides`. The profile is selected by the URL, not a `profileId` in the body.\n- Multi-credential offer: use the issuer service as the URL target and send a non-empty\n `credentials` array. Each entry contains a `profileId` and optional `runtimeOverrides`.\n Select different profiles to offer different credential formats, or repeat a profile with\n different `credentialData` overrides to offer different datasets.\n\nThe batch limit is advertised as `batch_credential_issuance.batch_size` in issuer metadata.\n\nWhen using `credentials`, put overrides inside each entry and omit top-level `profileId`\nand `runtimeOverrides` entirely, rather than setting them to null. A profile-target request\nreturns a response containing `profileId` and the `profileVersion` used for the offer.\nAn issuer-target request returns the offer response without profile fields or a `credentials`\narray, even when only one entry was supplied.\n\nOptional runtime overrides can be applied per credential for this offer only. Supported override\nfields are: issuerDid, issuerKeyId, x5Chain, credentialData, mapping, selectiveDisclosure,\nidTokenClaimsMapping, mDocNameSpacesDataMappingConfig, msoData, notifications, loaAchieved, and identityProofingRefId.\nruntimeOverrides.msoData is rejected unless the profile credential configuration format is mso_mdoc.\nBlank or whitespace msoData.validFrom, validUntil, and expectedUpdate values are rejected.\nOmitted override keys inherit the profile. JSON null for expectedUpdate clears the profile\nvalue so the MSO omits it; JSON null for validFrom or validUntil still inherits.\nISO 18013-5 requires signed <= validFrom < validUntil. expectedUpdate is optional and is\nnot bounded by that ISO rule unless an issuer enables the opt-in window policy (off by default).\nOmitting msoData.validUntil uses the 365-day default, rounded to a 12-hour UTC bucket.\nExplicit timestamps, data functions, and legacy IssuanceRequest.validUntil are kept as given.\nloaAchieved / identityProofingRefId record external identity-proofing results on the eIDAS\nCREDENTIAL_ISSUED audit entry (LoA is typically established outside this stack).\nNotifications can be configured at the profile level and optionally overridden per offer.\nAuthorization-code offers omit issuer_state unless issuerStateMode is INCLUDE. Because\nruntimeOverrides are offer-scoped, AUTHORIZED offers with runtimeOverrides require issuerStateMode\nINCLUDE; use issuerStateMode OMIT only for profile-based offers without runtime overrides.\nOffer/session expiry is configured with expiresInSeconds on this request. The default is 5 minutes.\nUse -1 for no expiry.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "X-Request-ID",
"in" : "header",
"description" : "Call-ID for request tracing",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialOfferCreateRequest"
}, {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.MultiCredentialOfferCreateRequest"
} ]
},
"examples" : {
"[authorized][single][by-reference]" : {
"value" : {
"authMethod" : "AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
},
"[authorized][single][by-value]" : {
"value" : {
"authMethod" : "AUTHORIZED",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300
}
},
"[authorized][single][by-value][issuer_state included]" : {
"value" : {
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300
}
},
"[authorized][multiple][by-reference][W3C VC + mDoc]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default"
}, {
"profileId" : "profile-mdoc-photo-id-default"
} ],
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
},
"[authorized][multiple][by-value][W3C VC + SD-JWT VC]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default"
}, {
"profileId" : "profile-sd-jwt-vc-default"
} ],
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300
}
},
"[authorized][multiple][by-reference][runtime overrides]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default",
"runtimeOverrides" : {
"credentialData" : {
"credentialSubject" : {
"achievement" : {
"name" : {
"content" : "OpenID4VCI Implementation",
"string" : true
},
"description" : {
"content" : "Implemented an OpenID4VCI issuer with batch issuance",
"string" : true
},
"criteria" : {
"narrative" : {
"content" : "The holder implemented and tested an interoperable issuer.",
"string" : true
}
}
}
}
}
}
}, {
"profileId" : "profile-sd-jwt-vc-default",
"runtimeOverrides" : {
"credentialData" : {
"given_name" : {
"content" : "Alice",
"string" : true
},
"family_name" : {
"content" : "Doe",
"string" : true
},
"birthdate" : {
"content" : "1990-01-01",
"string" : true
}
},
"selectiveDisclosure" : {
"family_name" : {
"sd" : true
},
"birthdate" : {
"sd" : true
}
}
}
} ],
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
},
"[pre-authorized][single][by-reference]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
},
"[pre-authorized][single][by-value]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300
}
},
"[pre-authorized][single][by-reference][provided tx_code]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"txCode" : {
"inputMode" : "numeric",
"length" : 6,
"description" : "tx code as input"
},
"txCodeValue" : "123456"
}
},
"[pre-authorized][single][by-reference][generated tx_code]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"txCode" : {
"inputMode" : "numeric",
"length" : 6,
"description" : "tx code as generated"
}
}
},
"[pre-authorized][single][by-reference][expires in 2 minutes]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 120
}
},
"[pre-authorized][single][by-reference][no expiry]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : -1
}
},
"[pre-authorized][single][by-reference][credentialData override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"credentialData" : {
"given_name" : {
"content" : "Alice",
"string" : true
},
"family_name" : {
"content" : "Doe-Override",
"string" : true
},
"email" : {
"content" : "alice.doe@example.com",
"string" : true
},
"phone_number" : {
"content" : "+1-202-555-0199",
"string" : true
},
"address" : {
"street_address" : {
"content" : "500 Override St",
"string" : true
},
"locality" : {
"content" : "Override City",
"string" : true
},
"region" : {
"content" : "Override State",
"string" : true
},
"country" : {
"content" : "US",
"string" : true
}
},
"birthdate" : {
"content" : "1991-02-03",
"string" : true
},
"is_over_18" : {
"content" : "true",
"string" : false
},
"is_over_21" : {
"content" : "true",
"string" : false
},
"is_over_65" : {
"content" : "false",
"string" : false
}
}
}
}
},
"[pre-authorized][single][by-reference][credential status override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"credentialStatus" : {
"status" : {
"initialStatus" : "0x0",
"statusCredentialConfig-klVQYXI" : "waltid.tenant1.credential-status.suspension"
},
"credentialStatusServiceRef-klVQYXI" : "waltid.tenant1.credential-status"
}
}
}
},
"[pre-authorized][single][by-reference][LoA and identity-proofing override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"loaAchieved" : "HIGH",
"identityProofingRefId" : "external-id-proofing-session-42"
}
}
},
"[pre-authorized][single][by-reference][selective disclosure override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"selectiveDisclosure" : {
"birthdate" : {
"sd" : true
},
"family_name" : {
"sd" : false
}
}
}
}
},
"[pre-authorized][single][by-reference][notifications override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"notifications" : {
"webhook" : {
"url" : {
"host" : "example.com",
"specifiedPort" : 0,
"parameters" : {
"caseInsensitiveName" : true,
"empty" : true
},
"fragment" : "",
"trailingQuery" : false,
"pathSegments" : [ "", "webhook", "issuance-status" ],
"rawSegments" : [ "", "webhook", "issuance-status" ],
"protocolOrNull" : {
"name" : "https",
"defaultPort" : 443
},
"protocol" : {
"name" : "https",
"defaultPort" : 443
},
"port" : 443,
"encodedFragment" : "",
"encodedPath" : "/webhook/issuance-status",
"encodedQuery" : "",
"segments" : [ "webhook", "issuance-status" ],
"encodedPathAndQuery" : "/webhook/issuance-status"
},
"bearerToken" : "your-api-key-here"
}
}
}
}
},
"[pre-authorized][single][by-value][credential data model version override]" : {
"value" : {
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300,
"runtimeOverrides" : {
"w3cVersion" : "W3CV2CredentialBuilder"
}
}
},
"[pre-authorized][multiple][by-reference]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default"
}, {
"profileId" : "profile-mdoc-photo-id-default"
} ],
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
},
"[pre-authorized][multiple][by-value]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default"
}, {
"profileId" : "profile-mdoc-photo-id-default"
} ],
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_VALUE",
"expiresInSeconds" : 300
}
},
"[pre-authorized][multiple][by-reference][runtime overrides]" : {
"value" : {
"credentials" : [ {
"profileId" : "profile-w3c-vc-dm-1.1-default",
"runtimeOverrides" : {
"credentialData" : {
"credentialSubject" : {
"achievement" : {
"name" : {
"content" : "OpenID4VCI Implementation",
"string" : true
},
"description" : {
"content" : "Implemented an OpenID4VCI issuer with batch issuance",
"string" : true
},
"criteria" : {
"narrative" : {
"content" : "The holder implemented and tested an interoperable issuer.",
"string" : true
}
}
}
}
}
}
}, {
"profileId" : "profile-sd-jwt-vc-default",
"runtimeOverrides" : {
"credentialData" : {
"given_name" : {
"content" : "Alice",
"string" : true
},
"family_name" : {
"content" : "Doe",
"string" : true
},
"birthdate" : {
"content" : "1990-01-01",
"string" : true
}
},
"selectiveDisclosure" : {
"family_name" : {
"sd" : true
},
"birthdate" : {
"sd" : true
}
}
}
} ],
"authMethod" : "PRE_AUTHORIZED",
"valueMode" : "BY_REFERENCE",
"expiresInSeconds" : 300
}
}
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "Credential offer created successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.CredentialOfferCreateResponse"
}, {
"$ref" : "#/components/schemas/id.walt.enterprise.services.issuer2.models.MultiCredentialOfferCreateResponse"
} ]
},
"examples" : {
"Offer response by reference" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"profileId" : "profile-mdoc-photo-id-default",
"profileVersion" : 1,
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "OMIT",
"expiresAt" : 1710003600000,
"credentialOffer" : "openid-credential-offer://?credential_offer_uri=https://issuer.example/openid4vci/credential-offer?id=8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb"
}
},
"Offer response by value" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"profileId" : "profile-w3c-vc-dm-1.1-default",
"profileVersion" : 1,
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "OMIT",
"expiresAt" : 1710003600000,
"credentialOffer" : "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example%2Fv2%2Fissuer-service-api%2Fopenid4vci%22%2C%22credential_configuration_ids%22%3A%5B%22open_badge_credential%22%5D%2C%22grants%22%3A%7B%22authorization_code%22%3A%7B%7D%7D%7D"
}
},
"Offer response by value with issuer_state included" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"profileId" : "profile-w3c-vc-dm-1.1-default",
"profileVersion" : 1,
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"expiresAt" : 1710003600000,
"credentialOffer" : "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example%2Fv2%2Fissuer-service-api%2Fopenid4vci%22%2C%22credential_configuration_ids%22%3A%5B%22open_badge_credential%22%5D%2C%22grants%22%3A%7B%22authorization_code%22%3A%7B%22issuer_state%22%3A%228d951f32-2a14-4d26-8d0c-2f6d10e8bcdb%22%7D%7D%7D"
}
},
"Multiple-credential offer response by reference" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"expiresAt" : 1710003600000,
"credentialOffer" : "openid-credential-offer://?credential_offer_uri=https%3A%2F%2Fissuer.example%2Fopenid4vci%2Fcredential-offer%3Fid%3D8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb"
}
},
"Multiple-credential offer response by value" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"authMethod" : "AUTHORIZED",
"issuerStateMode" : "INCLUDE",
"expiresAt" : 1710003600000,
"credentialOffer" : "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example%2Fopenid4vci%22%2C%22credential_configuration_ids%22%3A%5B%22OpenBadgeCredential_jwt_vc_json%22%2C%22identity_credential%22%5D%2C%22grants%22%3A%7B%22authorization_code%22%3A%7B%22issuer_state%22%3A%228d951f32-2a14-4d26-8d0c-2f6d10e8bcdb%22%7D%7D%7D"
}
},
"Pre-authorized offer response with generated tx_code" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"profileId" : "profile-mdoc-photo-id-default",
"profileVersion" : 1,
"authMethod" : "PRE_AUTHORIZED",
"expiresAt" : 1710003600000,
"txCodeValue" : "483921",
"credentialOffer" : "openid-credential-offer://?credential_offer_uri=https://issuer.example/openid4vci/credential-offer?id=8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb"
}
},
"Pre-authorized offer response with provided tx_code" : {
"value" : {
"offerId" : "8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb",
"profileId" : "profile-mdoc-photo-id-default",
"profileVersion" : 1,
"authMethod" : "PRE_AUTHORIZED",
"expiresAt" : 1710003600000,
"txCodeValue" : "123456",
"credentialOffer" : "openid-credential-offer://?credential_offer_uri=https://issuer.example/openid4vci/credential-offer?id=8d951f32-2a14-4d26-8d0c-2f6d10e8bcdb"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/events" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Receive issuer lifecycle events via Server-Sent Events (SSE)",
"description" : "Establishes an SSE connection to receive issuer-level or issuance-session OpenID4VCI lifecycle events.\n\n**Use Cases:**\n- Monitor issuance session progress in real-time\n- Receive notifications when wallet resolves credential offer\n- Track token requests and credential issuance status\n\n**Events:**\n- `credential_offer_created` / `credential_offer_retrieved`\n- `pushed_authorization_request_succeeded` / `pushed_authorization_request_failed`\n- `authorization_request_succeeded` / `authorization_request_failed`\n- `token_request_authorization_code_succeeded` / `token_request_authorization_code_failed`\n- `token_request_pre_authorized_code_succeeded` / `token_request_pre_authorized_code_failed`\n- `token_request_refresh_token_succeeded` / `token_request_refresh_token_failed`\n- `token_request_failed` when no supported grant can be identified\n- `nonce_request_succeeded` / `nonce_request_failed`\n- `credential_request_sd_jwt_vc_succeeded` / `credential_request_sd_jwt_vc_failed`\n- `credential_request_w3c_vc_succeeded` / `credential_request_w3c_vc_failed`\n- `credential_request_mso_mdoc_succeeded` / `credential_request_mso_mdoc_failed`\n- `credential_request_failed` before a credential format can be resolved\n- `issuance_status_changed`\n\n**Important Notes:**\n- `events` is keyed by issuer service and includes uncorrelated endpoint outcomes\n- `issuance-session/{issuance-session}/events` contains only events correlated to that session\n- Connection remains open until the client disconnects\n- Events are sent as JSON objects in SSE format\n- Failures use top-level `error` and `error_description` fields\n- Session events are also sent to the session's configured webhook notifications\n- Successful credential-request events expose the issued credential as `session.data.credential`\n- Batch success events additionally expose every issued credential in response order as `session.data.credentials`; `credential` remains an alias for the first item\n- Successful batch requests record one operational `IssuanceEvent` per returned credential\n- When eIDAS auditing is enabled, successful batch requests also record one `CredentialIssued` entry per returned credential and one `CredentialLifecycle.ISSUED` entry per successful Credential Request\n\nFor more information, see the documentation.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "issuance-session",
"in" : "path",
"description" : "Issuance session identifier (the offer ID returned when creating a credential offer)",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "550e8400-e29b-41d4-a716-446655440000"
} ],
"responses" : {
"200" : {
"description" : "SSE connection established, events will be streamed. Response content type is text/event-stream.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
},
"404" : {
"description" : "Issuance session not found",
"headers" : { }
},
"400" : {
"description" : "Invalid issuance session identifier",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/issuance-session/{issuance-session}/events" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - Credential Issuance" ],
"summary" : "Receive issuer lifecycle events via Server-Sent Events (SSE)",
"description" : "Establishes an SSE connection to receive issuer-level or issuance-session OpenID4VCI lifecycle events.\n\n**Use Cases:**\n- Monitor issuance session progress in real-time\n- Receive notifications when wallet resolves credential offer\n- Track token requests and credential issuance status\n\n**Events:**\n- `credential_offer_created` / `credential_offer_retrieved`\n- `pushed_authorization_request_succeeded` / `pushed_authorization_request_failed`\n- `authorization_request_succeeded` / `authorization_request_failed`\n- `token_request_authorization_code_succeeded` / `token_request_authorization_code_failed`\n- `token_request_pre_authorized_code_succeeded` / `token_request_pre_authorized_code_failed`\n- `token_request_refresh_token_succeeded` / `token_request_refresh_token_failed`\n- `token_request_failed` when no supported grant can be identified\n- `nonce_request_succeeded` / `nonce_request_failed`\n- `credential_request_sd_jwt_vc_succeeded` / `credential_request_sd_jwt_vc_failed`\n- `credential_request_w3c_vc_succeeded` / `credential_request_w3c_vc_failed`\n- `credential_request_mso_mdoc_succeeded` / `credential_request_mso_mdoc_failed`\n- `credential_request_failed` before a credential format can be resolved\n- `issuance_status_changed`\n\n**Important Notes:**\n- `events` is keyed by issuer service and includes uncorrelated endpoint outcomes\n- `issuance-session/{issuance-session}/events` contains only events correlated to that session\n- Connection remains open until the client disconnects\n- Events are sent as JSON objects in SSE format\n- Failures use top-level `error` and `error_description` fields\n- Session events are also sent to the session's configured webhook notifications\n- Successful credential-request events expose the issued credential as `session.data.credential`\n- Batch success events additionally expose every issued credential in response order as `session.data.credentials`; `credential` remains an alias for the first item\n- Successful batch requests record one operational `IssuanceEvent` per returned credential\n- When eIDAS auditing is enabled, successful batch requests also record one `CredentialIssued` entry per returned credential and one `CredentialLifecycle.ISSUED` entry per successful Credential Request\n\nFor more information, see the documentation.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "issuance-session",
"in" : "path",
"description" : "Issuance session identifier (the offer ID returned when creating a credential offer)",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "550e8400-e29b-41d4-a716-446655440000"
} ],
"responses" : {
"200" : {
"description" : "SSE connection established, events will be streamed. Response content type is text/event-stream.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
},
"404" : {
"description" : "Issuance session not found",
"headers" : { }
},
"400" : {
"description" : "Invalid issuance session identifier",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/issuer-service-api/openid4vci/jwks" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get public key jwks",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Public key jwks",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/credential-offer" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get a credential offer based on the session id",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "id",
"in" : "query",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Credential offer",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/par" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Pushed Authorization Request (PAR)",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nRFC 9126 PAR endpoint: submit authorization parameters and receive a request_uri.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Authorization request parameters (form-encoded)",
"content" : {
"application/x-www-form-urlencoded" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
}
}
},
"required" : false
},
"responses" : {
"201" : {
"description" : "PAR response with request_uri",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.responses.par.PushedAuthorizationResponse"
}
}
}
},
"400" : {
"description" : "Invalid PAR request",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"500" : {
"description" : "PAR processing failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/authorize" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Authorization endpoint",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Authorization response",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/token" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get access token",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "DPoP",
"in" : "header",
"description" : "RFC 9449 DPoP proof JWT for this token request",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Requires body of JSON value for Parameters.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.Polymorphic"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Access token",
"headers" : { }
},
"400" : {
"description" : "Invalid token request",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"401" : {
"description" : "Client authentication failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"429" : {
"description" : "Too many failed token requests",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"500" : {
"description" : "Token processing failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/nonce" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get a fresh nonce",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Nonce",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/credential" : {
"post" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Credential endpoint",
"description" : "Issue one or more credentials for a single credential target. Plaintext JSON and encrypted\nJWT requests are accepted.\n\nFor batch issuance, provide multiple proof JWTs in `proofs.jwt`. Credentials returned by one\nrequest share the Credential Format and Credential Dataset selected by either\n`credential_identifier` or `credential_configuration_id`; each proof supplies the cryptographic\nbinding data for one issued credential. Use separate Credential Endpoint requests for different\nformats or datasets. The maximum accepted batch size is advertised as\n`batch_credential_issuance.batch_size` in Credential Issuer metadata.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "Authorization",
"in" : "header",
"description" : "Bearer or DPoP access-token authorization",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "DPoP",
"in" : "header",
"description" : "Required when presenting a DPoP-bound access token",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "X-Request-ID",
"in" : "header",
"description" : "Call-ID for request tracing",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "105a3d4b-fe91-47f5-bf46-fa998b25b56d"
} ],
"requestBody" : {
"description" : "Encrypted Credential Request as compact JWE",
"content" : {
"application/jwt" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
},
"required" : false
},
"responses" : {
"200" : {
"description" : "Credential response",
"headers" : { },
"content" : {
"application/jwt" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
},
"400" : {
"description" : "Invalid credential request",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.CredentialError"
}
}
}
},
"401" : {
"description" : "Credential authorization failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"403" : {
"description" : "Credential access is insufficiently scoped",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"415" : {
"description" : "Unsupported credential request media type",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.CredentialError"
}
}
}
},
"429" : {
"description" : "Too many failed credential requests",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
},
"500" : {
"description" : "Credential processing failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.OAuthError"
}
}
}
}
},
"deprecated" : false
}
},
"/v2/{target}/issuer-service-api/openid4vci/status-list-aggregation" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get status list aggregation",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Status list aggregation",
"headers" : { }
}
},
"deprecated" : false
}
},
"/.well-known/openid-credential-issuer/v2/{target}/issuer-service-api/openid4vci" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get Credential Issuer metadata",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "Accept",
"in" : "header",
"description" : "Use application/jwt or application/openidvci-issuer-metadata+jwt for signed metadata; defaults to application/json.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Unsigned JSON or signed OpenID4VCI Credential Issuer metadata",
"headers" : { },
"content" : {
"application/jwt" : {
"schema" : {
"type" : "string",
"title" : "String"
}
},
"application/openidvci-issuer-metadata+jwt" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
}
},
"deprecated" : false
}
},
"/.well-known/oauth-authorization-server/v2/{target}/issuer-service-api/openid4vci" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get Authorization Server metadata",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Authorization Server metadata",
"headers" : { }
}
},
"deprecated" : false
}
},
"/.well-known/vct/v2/{target}/issuer-service-api/openid4vci/{type}" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get VCT type metadata",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "VCT type metadata",
"headers" : { }
}
},
"deprecated" : false
}
},
"/.well-known/jwt-vc-issuer/v2/{target}/issuer-service-api/openid4vci" : {
"get" : {
"tags" : [ "Service | Issuer Service API v2 - OpenID4VCI" ],
"summary" : "Get JWT-VC issuer metadata",
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "JWT-VC issuer metadata",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v1/{target}/kms-service-api/keys/configuration/view" : {
"get" : {
"tags" : [ "Service | Key Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [KeyManagementServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/configuration/update" : {
"put" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [KeyManagementServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Key Management Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kms"
},
"examples" : {
"Update KMS Service" : {
"value" : {
"type" : "kms"
}
},
"Update KMS Service - AWS" : {
"value" : {
"type" : "kms",
"defaultKeyGenerationRequests" : {
"aws" : {
"auth" : {
"region" : "eu-central-1"
}
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/list" : {
"get" : {
"tags" : [ "Service | Key Management" ],
"summary" : "List all keys in the Key Management Service",
"description" : "Permissions: ANY OF: [ES_KMS_LIST_KEYS] \nOperation: 'list-keys' \nAccepts targets: [KeyManagementServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all key IDs stored in the Key Management Service.\nThis endpoint returns only the key identifiers (paths), not the full key data, making it efficient for large key stores.\n\n**Use Cases:**\n- Audit all keys in a KMS\n- Check if a specific key exists\n- Get an overview of stored keys\n- Iterate through keys without loading full key data\n\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
} ],
"responses" : {
"200" : {
"description" : "List of key IDs stored in the Key Management Service",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Key IDs" : {
"value" : [ "waltid.tenant1.kms1.key1", "waltid.tenant1.kms1.key2" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/view" : {
"get" : {
"tags" : [ "Service | Key Management" ],
"summary" : "View a stored key",
"description" : "Permissions: ANY OF: [ES_KMS_GET_KEY] \nOperation: 'view-key' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nRetrieves detailed information about a specific key stored in the Key Management Service.\nReturns the full key resource including the key data, metadata, and associated information.\n\n\n**Security Note:**\nThe response includes the full key data. Handle this information securely as it provides access to cryptographic operations.\n\n**Use Cases:**\n- Retrieve key information for cryptographic operations\n- Access key metadata\n- Verify key existence and properties\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The requested key with its full data and metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/key"
}
}
}
},
"404" : {
"description" : "Key not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this key",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/remove" : {
"delete" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Remove a key from local storage",
"description" : "Permissions: ANY OF: [ES_KMS_REMOVE_KEY] \nOperation: 'remove-key' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nRemoves a key from the local Key Management Service storage only.\nThis operation does not delete the key from remote KMS backends (e.g., AWS KMS, Azure Key Vault).\n\n**Important:**\n- The key is removed from local storage immediately\n- The key remains in remote KMS backends (if applicable)\n- This operation is useful for cleaning up local references\n- Use the delete endpoint to remove keys from both local and remote storage\n\n**Use Cases:**\n- Remove local key references without affecting remote storage\n- Clean up keys that are no longer needed locally\n- Remove keys that have been migrated to another KMS\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"202" : {
"description" : "Key removed from local storage successfully",
"headers" : { }
},
"404" : {
"description" : "Key not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/delete" : {
"delete" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Delete a key from local and remote storage",
"description" : "Permissions: ANY OF: [ES_KMS_DELETE_KEY] \nOperation: 'delete-key' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nPermanently deletes a key from both local storage and the remote Key Management Service backend.\nThis operation removes the key from local storage and schedules it for deletion in remote systems (e.g., AWS KMS, Azure Key Vault).\n\n**Important:**\n- The key is removed from local storage immediately\n- The key is scheduled for deletion in remote KMS backends\n- This operation is irreversible once completed\n- Remote deletion may be asynchronous depending on the backend\n- Ensure you have backups if the key data is important\n\n**Multi-Region Keys (AWS KMS):**\n- For AWS multi-region keys, deletion is cascaded to all replica regions\n- All replicas are scheduled for deletion before the primary key\n- AWS enforces a 7-day pending deletion window for recovery\n- The operation may take longer due to cross-region coordination\n\n**Difference from Remove:**\n- Remove: Only removes from local storage\n- Delete: Removes from both local and remote storage\n\n**Use Cases:**\n- Permanently delete keys that are no longer needed\n- Comply with key rotation policies\n- Remove compromised keys from all systems\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"202" : {
"description" : "Key deleted or scheduled for deletion in remote KMS",
"headers" : { }
},
"404" : {
"description" : "Key not found at the specified target path",
"headers" : { }
},
"400" : {
"description" : "Failed to schedule key deletion in remote KMS",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to delete keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/generate" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Generate and store a new key",
"description" : "Permissions: ANY OF: [ES_KMS_GENERATE_KEY] \nOperation: 'generate-key' \nRequires authentication. \n\n---\nGenerates a new cryptographic key based on the provided KeyGenerationRequest and stores it in the Key Management Service.\n\n**Supported Backends:**\n- JWK: Local key generation (Ed25519, RSA, EC, etc.)\n- AWS: AWS Key Management Service (KMS)\n- Azure: Azure Key Vault\n- OCI: Oracle Cloud Infrastructure Key Management\n- TSE: HashiCorp Vault Transit Secrets Engine\n\n**Key Generation:**\n- Supports multiple key types (Ed25519, secp256r1, RSA, etc.)\n- Can generate keys locally or in cloud KMS backends\n- Automatically stores the generated key in the KMS\n- Optional key ID can be specified, otherwise uses key fingerprint\n\n**AWS Multi-Region Keys:**\nFor disaster recovery and high availability, AWS KMS supports multi-region keys:\n- Set `multiRegion: true` to create a multi-region primary key\n- Set `replicaRegions: [\"eu-west-1\", \"us-east-1\"]` to create replicas in those regions\n- Replicas share the same key material and key ID (prefixed with `mrk-`)\n- Set `enableFailover: true` to automatically use replicas when primary region is unavailable\n- Optionally set `failoverOrder` to control the order of failover regions\n\n**Default Configurations:**\nThe KMS can have default key generation configurations per backend, which will be merged with the request configuration.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Key generation request specifying backend, key type, and backend-specific configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.crypto.keys.KeyGenerationRequest"
},
"examples" : {
"JWK (direct)" : {
"value" : {
"backend" : "jwk",
"keyType" : "Ed25519"
}
},
"Generate KMS Key - AWS" : {
"value" : {
"backend" : "aws",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"region" : "eu-central-1"
},
"keyName" : "waltid-key",
"tags" : {
"project" : "waltid",
"owner" : "identity-team"
}
}
}
},
"Generate KMS Key - AWS Multi-Region" : {
"value" : {
"backend" : "aws",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"region" : "eu-central-1"
},
"keyName" : "waltid-multi-region-key",
"tags" : {
"project" : "waltid",
"owner" : "identity-team"
},
"multiRegion" : true,
"replicaRegions" : [ "eu-west-1", "us-east-1" ]
}
}
},
"Generate KMS Key - AWS Multi-Region with Failover" : {
"value" : {
"backend" : "aws",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"region" : "eu-central-1"
},
"keyName" : "waltid-multi-region-key-failover",
"tags" : {
"project" : "waltid",
"owner" : "identity-team"
},
"multiRegion" : true,
"replicaRegions" : [ "eu-west-1", "us-east-1" ],
"enableFailover" : true,
"failoverOrder" : [ "eu-west-1", "us-east-1" ]
}
}
},
"Generate KMS Key - AWS (AccessKeyId)" : {
"value" : {
"backend" : "aws-rest-api",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"accessKeyId" : "AKIA...",
"secretAccessKey" : "6YD...",
"region" : "eu-central-1"
}
}
}
},
"Generate KMS Key - AWS (RoleName)" : {
"value" : {
"backend" : "aws",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"region" : "eu-central-1",
"roleName" : "roleName"
}
}
}
},
"Generate KMS Key - Azure" : {
"value" : {
"backend" : "azure-rest-api",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"clientId" : "your-client-id",
"clientSecret" : "your-client-secret",
"tenantId" : "your-tenant-id",
"keyVaultUrl" : "https://your-key-vault-name.vault.azure.net/"
}
}
}
},
"Generate KMS Key - Azure SDK (RBAC)" : {
"value" : {
"backend" : "azure",
"keyType" : "secp256r1",
"config" : {
"auth" : {
"keyVaultUrl" : "https://your-key-vault-name.vault.azure.net/"
},
"keyName" : "waltid-key",
"tags" : {
"project" : "waltid",
"owner" : "identity-team"
}
}
}
},
"Generate KMS Key - OCI" : {
"value" : {
"backend" : "oci-rest-api",
"keyType" : "secp256r1",
"config" : {
"tenancyOcid" : "ocid1.tenancy.oc1..XYZ",
"compartmentOcid" : "ocid1.tenancy.oc1..XYZ",
"userOcid" : "ocid1.user.oc1..XYZ",
"fingerprint" : "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
"managementEndpoint" : "xyz-management.kms.eu-frankfurt-1.oraclecloud.com",
"cryptoEndpoint" : "xyz-crypto.kms.eu-frankfurt-1.oraclecloud.com",
"signingKeyPem" : "-----BEGIN PRIVATE KEY-----\nABCXYZ\n-----END PRIVATE KEY-----\n"
}
}
},
"Generate KMS Key - Vault TSE (AppRole)" : {
"value" : {
"backend" : "tse",
"config" : {
"server" : "http://127.0.0.1:8200/v1/transit",
"auth" : {
"roleId" : "6823b3c7-60f7-db0b-c663-7359f17c0c30",
"secretId" : "aba4f28b-524c-db63-bae2-67a0e094f46a"
}
}
}
},
"Generate KMS Key - Vault TSE (UserPass)" : {
"value" : {
"backend" : "tse",
"config" : {
"server" : "http://127.0.0.1:8200/v1/transit",
"auth" : {
"username" : "myuser",
"password" : "mypassword"
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Key generated and stored successfully in the KMS",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/key"
}
}
}
},
"400" : {
"description" : "Invalid key generation request - unsupported backend, invalid key type, or missing required configuration",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to generate keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/store" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Store an existing key",
"description" : "Permissions: ANY OF: [ES_KMS_STORE_KEY] \nOperation: 'store-key' \nRequires authentication. \n\n---\nStores a pre-existing key object in the Key Management Service.\nThis endpoint allows you to store keys that have already been created or obtained from another source.\n\n**Key Format:**\nThe key must be provided as a serialized Key object (JSON format).\nThe key will be stored with the specified key ID, or a default ID will be generated.\n\n**Use Cases:**\n- Store keys obtained from external sources\n- Migrate keys between KMS instances\n- Store keys that were created outside the system\n\n**Important:**\n- The key must be in a valid serialized format\n- If a key ID is specified in the path, that ID will be used\n- If no key ID is specified, a default ID will be generated\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The key object to be stored in the Key Management Service",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.Polymorphic"
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Key stored successfully in the KMS",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/key"
}
}
}
},
"400" : {
"description" : "Invalid key format or key already exists at target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to store keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/import/jwk" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Import a key from JWK format",
"description" : "Permissions: ANY OF: [ES_KMS_IMPORT_KEY_JWK] \nOperation: 'import-key-jwk' \nRequires authentication. \n\n---\nImports a key from JSON Web Key (JWK) format and stores it in the Key Management Service.\nThis allows you to import keys that were created or exported in JWK format.\n\n**JWK Format:**\nThe request body must be a valid JWK object following RFC 7517 specification.\nCommon key types supported include:\n- Ed25519 (OKP curve)\n- EC keys (P-256, P-384, P-521, secp256k1)\n- RSA keys\n- Octet keys\n\n**Key ID:**\n- If a key ID is specified in the path, that ID will be used\n- If no key ID is specified, the key ID from the JWK (kid field) will be used\n- If neither is available, a default ID will be generated\n\n**Use Cases:**\n- Import keys from other systems that export JWK format\n- Migrate keys between different key management systems\n- Store keys that were created using external tools\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "JWK object in JSON format following RFC 7517",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"JWK" : {
"value" : {
"kid" : "Example key based on JWK",
"kty" : "OKP",
"alg" : "EdDSA",
"crv" : "Ed25519",
"use" : "sig",
"d" : "LjxmEnd5oC7hFabwjKQFyeIgMG0OVZ_EBZQ0ZTKBZQs",
"x" : "UDiPRbt76NoaAye5AonMirL7jjTKppMSzAXH0ZwuenU"
}
},
"ECKey-JWK" : {
"value" : {
"kid" : "waltid.tenant1.kms1.ecKey1",
"kty" : "EC",
"crv" : "P-256",
"use" : "sig",
"d" : "KJ4k3Vcl5Sj9Mfq4rrNXBm2MoPoY3_Ak_PIR_EgsFhQ",
"x" : "G0RINBiF-oQUD3d5DGnegQuXenI29JDaMGoMvioKRBM",
"y" : "ed3eFGs2pEtrp7vAZ7BLcbrUtpKkYWAT2JPUQK4lN4E"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Key imported successfully from JWK format",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/key"
}
}
}
},
"400" : {
"description" : "Invalid JWK format, malformed JSON, or unsupported key type",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to import keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/import/pem" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Import a key from PEM format",
"description" : "Permissions: ANY OF: [ES_KMS_IMPORT_KEY_PEM] \nOperation: 'import-key-pem' \nRequires authentication. \n\n---\nImports a key from PEM (Privacy-Enhanced Mail) format and stores it in the Key Management Service.\nThis allows you to import keys that were created or exported in PEM format.\n\n**PEM Format:**\nThe request body must be a valid PEM-encoded key string.\nCommon PEM formats supported include:\n- Private keys (RSA, EC, Ed25519)\n- Public keys\n- Certificate keys\n\n**Key ID:**\n- If a key ID is specified in the path, that ID will be used\n- If no key ID is specified, a default ID will be generated based on the key\n\n**Use Cases:**\n- Import keys from OpenSSL or other tools that export PEM format\n- Migrate keys from traditional key management systems\n- Store keys that were created using command-line tools\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "PEM-encoded key string",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"PEM Private Key" : {
"value" : "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----"
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Key imported successfully from PEM format",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/key"
}
}
}
},
"400" : {
"description" : "Invalid PEM format, malformed key data, or unsupported key type",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to import keys",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/sign" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Sign data with a key",
"description" : "Permissions: ANY OF: [ES_KMS_SIGN] \nOperation: 'sign-data' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nTesting endpoint for signing data with a key.\n\nSupports signing with raw and JWS formats.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Sign request containing the plaintext to be signed",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.kms.models.KeyManagementSignRequest"
},
"examples" : {
"Sign Data" : {
"value" : {
"plaintext" : "Hello, World!"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Data signed successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.kms.models.KeyManagementSignResponse"
},
"examples" : {
"Signature" : {
"value" : {
"signature" : "MEUCIQDxF7X8h9..."
}
}
}
}
}
},
"400" : {
"description" : "Key cannot sign or invalid request",
"headers" : { }
},
"404" : {
"description" : "Key not found at the specified path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to sign with this key",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/metadata/view" : {
"get" : {
"tags" : [ "Service | Key Management" ],
"summary" : "View metadata",
"description" : "Permissions: ANY OF: [VIEW_METADATA] \nOperation: 'view-metadata' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nRetrieves the metadata associated with this resource. Metadata provides additional information, tags, descriptions, or custom attributes that can be used for organization, search, and filtering.\n\n**Use Cases:**\n- Retrieve custom attributes and tags\n- Access resource descriptions and annotations\n- Review metadata for organization and categorization\n- Export metadata for documentation or reporting\n\n**Important Notes:**\n- Metadata is optional and may not exist for all resources\n- Returns 404 if no metadata has been set\n- Metadata is stored as a JSON object allowing flexible structure\n- Metadata does not affect core resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with data" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
}
},
"404" : {
"description" : "No metadata stored for this resource",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/metadata/set" : {
"put" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Set metadata",
"description" : "Permissions: ANY OF: [SET_METADATA] \nOperation: 'set-metadata' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nSets or replaces the complete metadata for this resource. This operation replaces any existing metadata with the provided metadata object.\n\n**Use Cases:**\n- Initialize metadata for a new resource\n- Replace existing metadata completely\n- Set custom attributes and tags\n- Add resource descriptions and annotations\n\n**Important Notes:**\n- This operation completely replaces existing metadata\n- To update specific fields, use the update endpoint with JSON Patch\n- Metadata is stored as a JSON object\n- Setting metadata to an empty object is valid\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Metadata to set for this resource",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Metadata with description and tags" : {
"value" : {
"description" : "Example metadata",
"tags" : [ "tag1", "tag2" ]
}
},
"Empty metadata" : {
"value" : { }
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata was set for this resource",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON object",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to set metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/metadata/purge" : {
"delete" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Purge metadata",
"description" : "Permissions: ANY OF: [PURGE_METADATA] \nOperation: 'purge-metadata' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nPermanently removes all metadata associated with this resource. After this operation, the resource will have no metadata until new metadata is set.\n\n**Use Cases:**\n- Remove metadata that is no longer needed\n- Clean up test or temporary metadata\n- Reset metadata to a clean state\n- Remove sensitive information from metadata\n\n**Important Notes:**\n- This operation is irreversible\n- The resource itself is not affected, only its metadata\n- After purging, the view endpoint will return 404 until new metadata is set\n- Purging metadata does not affect resource functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The metadata stored for this resource was deleted",
"headers" : { }
},
"404" : {
"description" : "Resource not found or no metadata exists to purge",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to purge metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/metadata/update" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "Update metadata (with JSON Patch)",
"description" : "Permissions: ANY OF: [UPDATE_METADATA] \nOperation: 'update-metadata' \nAccepts targets: [KeyManagementStoredKey] \nRequires authentication. \n\n---\nUpdates the metadata for this resource using JSON Patch format (RFC 6902). This allows partial updates to specific fields without replacing the entire metadata object.\n\n**Use Cases:**\n- Update specific metadata fields without replacing the entire object\n- Add new fields to existing metadata\n- Remove specific fields from metadata\n- Modify nested metadata structures\n\n**Important Notes:**\n- Uses RFC 6902 JSON Patch format for updates\n- If no metadata exists, an empty object is used as the base\n- Supports add, remove, replace, move, copy, and test operations\n- Partial updates preserve other metadata fields\n- Invalid patch operations will result in an error\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "JSON Patch document following RFC 6902 format - array of patch operations. Each operation must have 'op', 'path', and optionally 'value' fields.",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"title" : "JsonArray"
},
"examples" : {
"Single replace operation" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
} ]
},
"Multiple operations (replace, add, remove)" : {
"value" : [ {
"op" : "replace",
"path" : "/description",
"value" : "Updated description"
}, {
"op" : "add",
"path" : "/tags/-",
"value" : "new-tag"
}, {
"op" : "remove",
"path" : "/oldField"
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Metadata updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed JSON Patch, invalid patch operation, or patch cannot be applied",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/kms-service-api/keys/metadata/query" : {
"post" : {
"tags" : [ "Service | Key Management" ],
"summary" : "List by metadata matching query",
"description" : "Permissions: ANY OF: [QUERY_BY_METADATA] \nOperation: 'query-by-metadata' \nAccepts targets: [TraversableServiceReference] \nRequires authentication. \n\n---\nQueries and returns resources that match the specified metadata constraints. This allows you to find resources based on their metadata attributes using field-based filtering.\n\n**Use Cases:**\n- Find resources by tags or custom attributes\n- Filter resources based on metadata values\n- Search for resources with specific metadata fields\n- Implement metadata-based resource discovery\n\n**Important Notes:**\n- Query uses field constraints to match metadata\n- Returns a map of matching resource targets to their metadata\n- Resources without metadata are not included in results\n- Query constraints follow the Presentation Definition Input Descriptor format\n- Empty query returns all resources with metadata\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "List of field constraints to match against metadata",
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.definitionparser.PresentationDefinition.InputDescriptor.Constraints.Field"
},
"title" : "ArrayList"
},
"examples" : {
"Query by tags field" : {
"value" : [ {
"path" : [ "tags" ]
} ]
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Map of matching resource targets to their metadata",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"title" : "LinkedHashMap"
}
}
}
},
"400" : {
"description" : "Invalid request - malformed query constraints",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to query metadata",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/list" : {
"get" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "List all holder policies in the policy store",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_LIST_POLICIES] \nOperation: 'list-policies' \nAccepts targets: [PolicyStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all holder policies stored in the Policy Store.\nEach policy includes its full policy definition, identifier, and associated information.\n\n**Use Cases:**\n- Audit stored holder policies\n- Retrieve all holder policies for a specific store\n- Export holder policies for backup or migration\n- Review holder policy configurations\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "List of all policies stored in the Policy Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/policy-entry"
},
"title" : "ArrayList<>"
},
"examples" : {
"List of policies" : {
"value" : [ {
"_id" : "org.policystore.policy1",
"policy" : {
"priority" : 10,
"description" : "Example holder policy",
"direction" : "PRESENT",
"apply" : {
"type" : "basic",
"issuer" : "did:web:issuer.example.org"
},
"check" : {
"type" : "basic",
"claims_present" : [ "claim1" ]
},
"action" : "BLOCK"
},
"parent" : "org.policystore"
} ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list policies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/list-ids" : {
"get" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "List all holder policy IDs in the policy store",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_LIST_POLICY_IDS] \nOperation: 'list-policy-ids' \nAccepts targets: [PolicyStoreServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all holder policy IDs (paths) stored in the Policy Store.\nThis endpoint returns only the identifiers, not the full policy data, making it more efficient for large stores.\n\n**Use Cases:**\n- Check if a holder policy exists\n- Get a quick overview of stored holder policies\n- Iterate through holder policies without loading full data\n- Validate holder policy references\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "List of policy IDs (paths) stored in the Policy Store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"List of policy IDs" : {
"value" : [ "org.policystore.policy1", "org.policystore.policy2", "org.policystore.policy3" ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list policy IDs",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/view" : {
"get" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "View a specific holder policy",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_GET_POLICY] \nOperation: 'view-policy' \nAccepts targets: [PolicyStoreStoredPolicy] \nRequires authentication. \n\n---\nRetrieves detailed information about a specific holder policy stored in the Policy Store.\nReturns the full holder policy resource including the holder policy identifier and the complete HolderPolicy definition.\n\n**Use Cases:**\n- Retrieve holder policy details for verification flows\n- Review holder policy configuration\n- Validate holder policy structure\n- Access holder policy for verification\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "The requested policy with its full definition",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/policy-entry"
},
"examples" : {
"Policy details" : {
"value" : {
"_id" : "org.policystore.policy1",
"policy" : {
"priority" : 10,
"description" : "Example holder policy",
"direction" : "PRESENT",
"apply" : {
"type" : "basic",
"issuer" : "did:web:issuer.example.org"
},
"check" : {
"type" : "basic",
"claims_present" : [ "claim1" ]
},
"action" : "BLOCK"
},
"parent" : "org.policystore"
}
}
}
}
}
},
"404" : {
"description" : "Policy not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this policy",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/add" : {
"post" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "Store a new holder policy",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_ADD_POLICY] \nOperation: 'add-policy' \nAccepts parent targets: [PolicyStoreServiceReference] \nRequires authentication. \n\n---\nStores a new holder policy in the Policy Store. \nHolder policies define rules and constraints for credential presentation and verification flows.\n\n\n**Important Notes:**\n- The holder policy ID in the request body will be overridden by the target path\n- Holder policies are scoped to the Policy Store where they are created\n- Each holder policy must have a unique identifier within its store\n\n**Use Cases:**\n- Create new verification holder policies\n- Define credential presentation holder requirements\n- Set up holder policy templates for reuse\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The policy to be stored in the Policy Store",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/policy-entry"
},
"examples" : {
"Policy example" : {
"value" : {
"_id" : "org.policystore.policy1",
"policy" : {
"priority" : 10,
"description" : "Example holder policy",
"direction" : "PRESENT",
"apply" : {
"type" : "basic",
"issuer" : "did:web:issuer.example.org"
},
"check" : {
"type" : "basic",
"claims_present" : [ "claim1" ]
},
"action" : "BLOCK"
},
"parent" : "org.policystore"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Policy successfully created and stored",
"headers" : { }
},
"400" : {
"description" : "Invalid policy format or policy already exists at target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add policies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/update" : {
"put" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "Update an existing policy",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_UPDATE_POLICY] \nOperation: 'update-policy' \nAccepts targets: [PolicyStoreStoredPolicy] \nRequires authentication. \n\n---\nUpdates an existing policy in the Policy Store. \nThis endpoint allows you to modify the holder policy definition while maintaining the same holder policy identifier.\n\n**Update Behavior:**\n- If the policy ID matches the target path, the policy is updated in place\n- If the policy ID differs but the parent Policy Store is the same, the old policy is removed and the new one is added\n- The parent Policy Store must remain the same for all updates\n\n**Important Notes:**\n- Only the policy name (identifier) can change, the parent Policy Store must stay the same\n- Policy updates are atomic operations\n- Updating a policy affects all references to that policy\n\n**Use Cases:**\n- Modify holder policy rules and constraints\n- Update holder policy definitions based on changing requirements\n- Rename holder policies within the same store\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "The updated policy definition",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/policy-entry"
},
"examples" : {
"Updated policy" : {
"value" : {
"_id" : "org.policystore.policy1",
"policy" : {
"priority" : 10,
"description" : "Example holder policy",
"direction" : "PRESENT",
"apply" : {
"type" : "basic",
"issuer" : "did:web:issuer.example.org"
},
"check" : {
"type" : "basic",
"claims_present" : [ "claim1" ]
},
"action" : "BLOCK"
},
"parent" : "org.policystore"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Policy successfully updated",
"headers" : { }
},
"400" : {
"description" : "Invalid policy format, policy not found, or parent Policy Store mismatch",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update policies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/policy-store-service-api/policies/remove" : {
"delete" : {
"tags" : [ "Service | Policy Store Service" ],
"summary" : "Remove a holder policy from the policy store",
"description" : "Permissions: ANY OF: [ES_POLICY_STORE_DELETE_POLICY] \nOperation: 'remove-policy' \nAccepts targets: [PolicyStoreStoredPolicy] \nRequires authentication. \n\n---\nRemoves a specific holder policy from the Policy Store.\nThis operation permanently deletes the holder policy from the store.\n\n**Important Notes:**\n- This operation is irreversible\n- Removing a policy may affect verification flows that reference it\n- Ensure no active references exist before removing a policy\n\n**Use Cases:**\n- Remove obsolete or deprecated holder policies\n- Clean up unused holder policies\n- Delete test or temporary holder policies\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "Policy successfully removed from the Policy Store",
"headers" : { }
},
"404" : {
"description" : "Policy not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove policies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/configuration/view" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/configuration/update" : {
"put" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Verifier2Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.Verifier2ServiceReferenceView"
},
"examples" : {
"Update Verifier2 with minimal configuration" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123"
}
},
"Update Verifier2 with client metadata" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123"
}
},
"Update Verifier2 with internationalized metadata" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "decentralized_identifier:did:key:abc123",
"clientMetadata" : {
"client_name" : "Age Verification Service",
"logo_uri" : "https://verifier.example.com/logo.png",
"tos_uri" : "https://verifier.example.com/terms",
"policy_uri" : "https://verifier.example.com/privacy",
"client_uri" : "https://verifier.example.com",
"client_name#fr-FR" : "Service de Vérification d'Âge",
"client_name#de" : "Altersverifizierungsdienst",
"client_name#es-ES" : "Servicio de Verificación de Edad",
"logo_uri#fr-FR" : "https://verifier.example.com/logo-fr.png",
"logo_uri#de" : "https://verifier.example.com/logo-de.png",
"tos_uri#fr-FR" : "https://verifier.example.com/terms-fr",
"tos_uri#de" : "https://verifier.example.com/terms-de",
"policy_uri#fr-FR" : "https://verifier.example.com/privacy-fr",
"client_uri#fr-FR" : "https://verifier.example.com/fr",
"client_uri#de" : "https://verifier.example.com/de"
}
}
},
"Update Verifier2 with inline x5c" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "x509_san_dns:verifier.example.com",
"x5c" : [ "MIIBljCCAT2gAwIBAgIUP/xM+biohoGvcYdfgGxd0CQBT28wCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjYxMDAxMTFaFw0yNzAxMjYxMDAxMTFaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOQMWbqm+DvDO1RRPsVYzbNc2vgdVOw9zZhu+n+8NZqqMbW+qJuXQZ2rxiUzIvzqtQHITjSozNGHmyNbN9b1JxOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRHt/+svL7jM/XYPvNMjwWM3JlYSjAfBgNVHSMEGDAWgBRHCT92dpAI1vlPm7tTUfYYjgkfwDAKBggqhkjOPQQDAgNHADBEAiALQcUEt5xjuTdYRZ+flY2dXXr7lW961XTJbxQsSDSJxQIgHK8ZyQrwkMjfze81axgISEmb+AZBUY8LCPtJ8MpNcWI=" ]
}
},
"Update Verifier2 with x5cReferences" : {
"value" : {
"type" : "verifier2",
"baseUrl" : "http://waltid.enterprise.localhost:3000",
"clientId" : "x509_san_dns:verifier.example.com",
"x5cReferences" : [ "waltid.tenant1.x509-store.cert1" ]
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.trust-registry.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.x509-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, trust-registry, x509-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"trust-registry dependency" : {
"value" : {
"dependency" : "waltid.tenant1.trust-registry.main"
}
},
"x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove trust-registry dependency" : {
"value" : {
"dependency" : "waltid.tenant1.trust-registry.main"
}
},
"Remove x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/default-requests" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Verifier2Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"create-verification-session" : {
"flow_type" : "cross_device",
"core_flow" : {
"signed_request" : false,
"encrypted_response" : false,
"expiration_duration" : "PT5M",
"dcql_query" : {
"credentials" : [ {
"id" : "sdjwt_pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "urn:eudi:pid:1", "eu.europa.ec.eudi.pid.1" ]
},
"claims" : [ {
"id" : "family_name",
"path" : [ "family_name" ]
}, {
"id" : "given_name",
"path" : [ "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "issuing_country" ]
} ]
}, {
"id" : "iso_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"id" : "family_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"id" : "given_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "sdjwt_pid" ], [ "iso_pid" ] ]
} ]
},
"policies" : {
"vc_policies" : [ "signature", {
"policy" : "etsi-trust-list",
"expectedEntityType" : "PID_PROVIDER"
}, {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"value" : 0
}
} ]
}
}
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Verifier2Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-verification-session — EUDI PID SD-JWT or mdoc" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"signed_request" : false,
"encrypted_response" : false,
"expiration_duration" : "PT5M",
"dcql_query" : {
"credentials" : [ {
"id" : "sdjwt_pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "urn:eudi:pid:1", "eu.europa.ec.eudi.pid.1" ]
},
"claims" : [ {
"id" : "family_name",
"path" : [ "family_name" ]
}, {
"id" : "given_name",
"path" : [ "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "issuing_country" ]
} ]
}, {
"id" : "iso_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"id" : "family_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"id" : "given_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "sdjwt_pid" ], [ "iso_pid" ] ]
} ]
},
"policies" : {
"vc_policies" : [ "signature", {
"policy" : "etsi-trust-list",
"expectedEntityType" : "PID_PROVIDER"
}, {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"value" : 0
}
} ]
}
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Verifier2Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-verification-session — EUDI PID SD-JWT or mdoc" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"signed_request" : false,
"encrypted_response" : false,
"expiration_duration" : "PT5M",
"dcql_query" : {
"credentials" : [ {
"id" : "sdjwt_pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "urn:eudi:pid:1", "eu.europa.ec.eudi.pid.1" ]
},
"claims" : [ {
"id" : "family_name",
"path" : [ "family_name" ]
}, {
"id" : "given_name",
"path" : [ "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "issuing_country" ]
} ]
}, {
"id" : "iso_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"id" : "family_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"id" : "given_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "sdjwt_pid" ], [ "iso_pid" ] ]
} ]
},
"policies" : {
"vc_policies" : [ "signature", {
"policy" : "etsi-trust-list",
"expectedEntityType" : "PID_PROVIDER"
}, {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"value" : 0
}
} ]
}
}
}
},
"create-verification-session — cross-device SD-JWT VC" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"signed_request" : false,
"encrypted_response" : false,
"expiration_duration" : "PT5M",
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "https://credentials.example.com/identity_credential" ]
},
"claims" : [ {
"path" : [ "family_name" ]
} ]
} ]
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-verification-session — EUDI PID SD-JWT or mdoc" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"signed_request" : false,
"encrypted_response" : false,
"expiration_duration" : "PT5M",
"dcql_query" : {
"credentials" : [ {
"id" : "sdjwt_pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "urn:eudi:pid:1", "eu.europa.ec.eudi.pid.1" ]
},
"claims" : [ {
"id" : "family_name",
"path" : [ "family_name" ]
}, {
"id" : "given_name",
"path" : [ "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "issuing_country" ]
} ]
}, {
"id" : "iso_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"id" : "family_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"id" : "given_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "sdjwt_pid" ], [ "iso_pid" ] ]
} ]
},
"policies" : {
"vc_policies" : [ "signature", {
"policy" : "etsi-trust-list",
"expectedEntityType" : "PID_PROVIDER"
}, {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"value" : 0
}
} ]
}
}
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Verifier Service API v2 - Service Management" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Verifier2Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/transaction-data-profiles" : {
"get" : {
"tags" : [ "Transaction Data", "Service | Verifier Service API v2 - Transaction Data" ],
"summary" : "List available transaction data type profiles",
"description" : "Permissions: ANY OF: [ES_VERIFIER_CREATE_VERIFIER_SESSION] \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Transaction Data", "Service | Verifier Service API v2 - Transaction Data" ],
"summary" : "Create a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'create-transaction-data-profile' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
},
"required" : false
},
"responses" : {
"201" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"409" : {
"description" : "Profile type already exists",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/transaction-data-profiles/{type}" : {
"get" : {
"tags" : [ "Transaction Data", "Service | Verifier Service API v2 - Transaction Data" ],
"summary" : "Get a transaction data type profile",
"description" : "Permissions: ANY OF: [ES_VERIFIER_CREATE_VERIFIER_SESSION] \nOperation: 'get-transaction-data-profile' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Transaction Data", "Service | Verifier Service API v2 - Transaction Data" ],
"summary" : "Replace a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'replace-transaction-data-profile' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Transaction Data", "Service | Verifier Service API v2 - Transaction Data" ],
"summary" : "Delete a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'delete-transaction-data-profile' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "Profile deleted",
"headers" : { }
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/verification-session/create" : {
"post" : {
"tags" : [ "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "Create new verification session",
"description" : "Permissions: ANY OF: [ES_VERIFIER_CREATE_VERIFIER_SESSION] \nOperation: 'create-verification-session' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\n Creates a new verification session with a DCQL query specifying which credentials and claims are required, along with optional verification policies.\n\n**Use Cases:**\n- Request identity credentials from wallet holders\n- Verify specific claims from verifiable credentials\n- Apply verification policies (signature validation, revocation checks, status list validation)\n- Support multiple credential formats (JWT VC, SD-JWT VC, ISO mDoc)\n\n**Important Notes:**\n- Returns both bootstrap and full authorization request URLs for wallet interaction\n- Supports multiple verification policies including signature, revocation, status list, and VICAL validation\n- DCQL query allows requesting specific claims from credentials using JSON path notation\n- Sessions expire after 10 minutes if unused and are retained for 10 years by default\n- Session status can be tracked via SSE events endpoint\n\nFor more information, see: the docs\n \n **X.509 certificate chain:** provide an inline PEM/base64 chain as `core.x5c`, or x509-store certificate targets as top-level `x5cReferences`. Session `x5cReferences` override session `core.x5c`, which override service `x5cReferences`, which override service `x5c`.\n \n **Request signing and response encryption**\n \n `response_mode` is derived, never supplied. Set the two flags on `core_flow`:\n - `signed_request: true` serves the Request Object as a JAR (`application/oauth-authz-req+jwt`) with the configured `x5c` in its header. Required by the `x509_hash`, `x509_san_dns`, `decentralized_identifier` and `verifier_attestation` Client Identifier Prefixes, since a wallet cannot authenticate them from an unsigned request.\n - `encrypted_response: true` turns a `cross_device` session's `response_mode` into `direct_post.jwt` (and a DC API session's into `dc_api.jwt`). The response encryption key is a fresh per-session P-256 ECDH-ES key, published in `client_metadata.jwks`; there is nothing to configure.\n \n Neither flag can be defaulted on the verifier2 service resource - both default to `false` and must be sent per session.\n \n **Signing key selection**, in precedence order:\n 1. `core_flow.key` in this request body - inline key material.\n 2. `keyReference` in this request body - the full path of a key resource in a KMS dependency of this verifier, for example `...`. This is the only way to sign with a key that cannot be exported, such as a PKCS#11/HSM key, because there is no persisted key reference on the verifier2 resource.\n 3. The verifier2 service resource's own `key` / `requestSigningStoredKey`.\n \n A key is required as soon as either flag above is set.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "X-Request-Id",
"in" : "header",
"description" : "Optional request ID for tracing",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Verification session setup with DCQL query and optional policies",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.verifier2.data.VerificationSessionSetup"
},
"examples" : {
"[openid4vp-http][w3c vc] default jwt_vc_json" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] basic w3c policies (signature, expiration, not-before, allowed-issuer, regex)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "signature"
}, {
"policy" : "expiration"
}, {
"policy" : "not-before"
}, {
"policy" : "allowed-issuer",
"allowed_issuer" : [ "https://university.example/issuers/565049" ]
}, {
"policy" : "regex",
"path" : "$.credentialSubject.degree.name",
"regex" : "^Bachelor of Science and Arts$"
} ]
}
}
}
},
"[openid4vp-http][w3c vc] credential status for BitstringStatusList" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "credential-status",
"argument" : {
"discriminator" : "w3c",
"value" : 0,
"purpose" : "Revocation",
"type" : "BitstringStatusList"
}
} ]
}
}
}
},
"[openid4vp-http][w3c vc] credential status for BitstringStatusList (multiple allowed values)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "credential-status",
"argument" : {
"discriminator" : "w3c",
"values" : [ 0, 1 ],
"purpose" : "Revocation",
"type" : "BitstringStatusList"
}
} ]
}
}
}
},
"[openid4vp-http][w3c vc] credential status for multiple BitstringStatusList" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "credential-status",
"argument" : {
"discriminator" : "w3c-list",
"list" : [ {
"value" : 0,
"purpose" : "Revocation",
"type" : "BitstringStatusList"
}, {
"value" : 0,
"purpose" : "Suspension",
"type" : "BitstringStatusList"
} ]
}
} ]
}
}
}
},
"[openid4vp-http][w3c vc] webhook" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "webhook",
"url" : "https://your-backend.com"
} ]
}
}
}
},
"[openid4vp-http][w3c vc] presentation policies (jwt_vc_json/*)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
},
"policies" : {
"vp_policies" : {
"jwt_vc_json" : [ "jwt_vc_json/audience-check", "jwt_vc_json/nonce-check", "jwt_vc_json/envelope_signature" ],
"dc+sd-jwt" : [ ],
"mso_mdoc" : [ ]
}
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: W3C credential with path-based claims" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: W3C credential with empty meta" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : { },
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: Nested presentation request for W3C credentials" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "credentialSubject", "achievement", "description" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: Nested presentation request with multiple claims" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "credentialSubject", "achievement", "description" ]
}, {
"path" : [ "credentialSubject", "achievement", "criteria", "type" ]
}, {
"path" : [ "name" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: W3C credential with type values only" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: W3C credential without claims" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "OpenBadgeCredential" ] ]
}
} ]
}
}
}
},
"[openid4vp-http][w3c vc] DCQL: W3C credential with claims and value constraints" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_openbadge_jwt_vc",
"format" : "jwt_vc_json",
"meta" : {
"type_values" : [ [ "VerifiableCredential", "OpenBadgeCredential" ] ]
},
"claims" : [ {
"path" : [ "name" ],
"values" : [ "JFF x vc-edu PlugFest 3 Interoperability" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][ietf sd-jwt vc] default dc+sd-jwt" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
}
}
}
},
"[openid4vp-http][ietf sd-jwt vc] expiration_duration" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
},
"expiration_duration" : "PT15M"
}
}
},
"[openid4vp-http][ietf sd-jwt vc] expiration_date" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
},
"expiration_date" : "2035-07-06T15:30:00Z"
}
}
},
"[openid4vp-http][ietf sd-jwt vc] basic w3c policies (signature, expiration, not-before, allowed-issuer, regex)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "signature"
}, {
"policy" : "expiration"
}, {
"policy" : "not-before"
}, {
"policy" : "allowed-issuer",
"allowed_issuer" : [ "https://university.example/issuers/565049" ]
}, {
"policy" : "regex",
"path" : "$.credentialSubject.degree.name",
"regex" : "^Bachelor of Science and Arts$"
} ]
}
}
}
},
"[openid4vp-http][ietf sd-jwt vc] presentation policies (dc+sd-jwt/*)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
},
"policies" : {
"vp_policies" : {
"jwt_vc_json" : [ ],
"dc+sd-jwt" : [ "dc+sd-jwt/audience-check", "dc+sd-jwt/kb-jwt_signature", "dc+sd-jwt/nonce-check", "dc+sd-jwt/sd_hash-check" ],
"mso_mdoc" : [ ]
}
}
}
}
},
"[openid4vp-http][ietf sd-jwt vc] transaction_data payment authorization" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "http://waltid.enterprise.localhost:3000/v1/waltid.issuer/issuer-service-api/openid4vc/draft13/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
} ]
} ]
}
},
"openid" : {
"transactionData" : [ {
"type" : "org.waltid.transaction-data.payment-authorization",
"credential_ids" : [ "pid" ],
"require_cryptographic_holder_binding" : true,
"transaction_data_hashes_alg" : [ "sha-256" ],
"amount" : "42.00",
"currency" : "EUR",
"payee" : "ACME Corp",
"reference" : "INV-2026-042"
} ]
}
}
},
"[openid4vp-http][sd-jwt pid]" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "https://credentials.example.com/identity_credential" ]
},
"claims" : [ {
"path" : [ "given_name" ]
}, {
"path" : [ "family_name" ]
}, {
"path" : [ "address", "street_address" ]
} ]
} ]
}
},
"redirects" : {
"success_redirect_uri" : "https://example.com/success",
"error_redirect_uri" : "https://example.com/not-successful"
}
}
},
"[openid4vp-http][iso pid]" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_birth_year" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_21" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name_birth" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name_birth" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_place" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_country" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuance_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "expiry_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_authority" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ]
}
},
"redirects" : {
"success_redirect_uri" : "https://example.com/success",
"error_redirect_uri" : "https://example.com/not-successful"
}
}
},
"[openid4vp-http][sd-jwt or iso pid]" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "sdjwt_pid",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "eu.europa.ec.eudi.pid.1", "urn:eudi:pid:1" ]
},
"claims" : [ {
"id" : "family_name",
"path" : [ "family_name" ]
}, {
"id" : "given_name",
"path" : [ "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "issuing_country" ]
} ]
}, {
"id" : "iso_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"id" : "family_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"id" : "given_name",
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"id" : "birth_date",
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"id" : "age_over_18",
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"id" : "issuing_country",
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "sdjwt_pid" ], [ "iso_pid" ] ]
} ]
}
},
"redirects" : {
"success_redirect_uri" : "https://example.com/success",
"error_redirect_uri" : "https://example.com/not-successful"
}
}
},
"[openid4vp-http][iso mdl & photo-id]" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "mdl-id",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"id" : "given_name",
"path" : [ "org.iso.18013.5.1", "given_name" ]
}, {
"id" : "family_name",
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"id" : "portrait",
"path" : [ "org.iso.18013.5.1", "portrait" ]
} ]
}, {
"id" : "mdl-address",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"id" : "resident_address",
"path" : [ "org.iso.18013.5.1", "resident_address" ]
}, {
"id" : "resident_country",
"path" : [ "org.iso.18013.5.1", "resident_country" ]
} ]
}, {
"id" : "photo_card-id",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.23220.photoid.1"
},
"claims" : [ {
"id" : "given_name",
"path" : [ "org.iso.23220.photoid.1", "given_name" ]
}, {
"id" : "family_name",
"path" : [ "org.iso.23220.photoid.1", "family_name" ]
}, {
"id" : "portrait",
"path" : [ "org.iso.23220.photoid.1", "portrait" ]
} ]
}, {
"id" : "photo_card-address",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.23220.photoid.1"
},
"claims" : [ {
"id" : "resident_address",
"path" : [ "org.iso.23220.photoid.1", "resident_address" ]
}, {
"id" : "resident_country",
"path" : [ "org.iso.23220.photoid.1", "resident_country" ]
} ]
} ],
"credential_sets" : [ {
"options" : [ [ "mdl-id" ], [ "photo_card-id" ] ]
}, {
"options" : [ [ "mdl-address" ], [ "photo_card-address" ] ],
"required" : false
} ]
}
},
"redirects" : {
"success_redirect_uri" : "https://example.com/success",
"error_redirect_uri" : "https://example.com/not-successful"
}
}
},
"[openid4vp-http][iso mdl] credential status for TokenStatusList" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"value" : 0
}
} ]
}
}
}
},
"[openid4vp-http][iso mdl] credential status for TokenStatusList (multiple allowed values)" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "example_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "credential-status",
"argument" : {
"discriminator" : "ietf",
"values" : [ 0, 1 ]
}
} ]
}
}
}
},
"[openid4vp-http][iso photo-id] vical" : {
"value" : {
"flow_type" : "cross_device",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_photoid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.23220.photoid.1"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name_unicode" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name_unicode" ]
}, {
"path" : [ "org.iso.18013.5.1", "issuing_authority_unicode" ]
}, {
"path" : [ "org.iso.18013.5.1", "resident_postal_code" ],
"values" : [ 1180, 1190, 1200, 1210 ]
}, {
"path" : [ "org.iso.18013.5.1", "issuing_country" ],
"values" : [ "AT" ]
}, {
"path" : [ "org.iso.23220.photoid.1", "person_id" ]
}, {
"path" : [ "org.iso.23220.photoid.1", "resident_street" ]
}, {
"path" : [ "org.iso.23220.photoid.1", "administrative_number" ]
}, {
"path" : [ "org.iso.23220.photoid.1", "travel_document_number" ]
}, {
"path" : [ "org.iso.23220.dtc.1", "dtc_version" ]
}, {
"path" : [ "org.iso.23220.dtc.1", "dtc_dg1" ]
} ]
} ]
},
"policies" : {
"vc_policies" : [ {
"policy" : "signature"
}, {
"policy" : "vical",
"vical" : "",
"enableDocumentTypeValidation" : true
} ]
}
}
}
},
"[openid4vp-dc_api][iso mdl] unsigned & unencrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "age_over_21" ]
} ]
} ]
},
"clientId" : "x509_hash:OPpTDyXlg6WRu2-Qn4rpQcA9uVqSrNExCS8kCYUe09A",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"d" : "AEb4k1BeTR9xt2NxYZggdzkFLLUkhyyWvyUOq3qSiwA",
"crv" : "P-256",
"kid" : "_nd-T2YRYLSmuKkJZlRI641zrCIJLTpiHeqMwXuvdug",
"x" : "G_TgBc0BkmMipiQ_6gkamIn3mmp7hcTrZuyrLTmknP0",
"y" : "VkRMZdXYXSMff5AJLrnHiN0x5MV6u_8vrAcytGUe4z4"
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][iso mdl] unsigned & encrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "age_over_21" ]
} ]
} ]
},
"encrypted_response" : true,
"clientId" : "x509_hash:OPpTDyXlg6WRu2-Qn4rpQcA9uVqSrNExCS8kCYUe09A",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"d" : "AEb4k1BeTR9xt2NxYZggdzkFLLUkhyyWvyUOq3qSiwA",
"crv" : "P-256",
"kid" : "_nd-T2YRYLSmuKkJZlRI641zrCIJLTpiHeqMwXuvdug",
"x" : "G_TgBc0BkmMipiQ_6gkamIn3mmp7hcTrZuyrLTmknP0",
"y" : "VkRMZdXYXSMff5AJLrnHiN0x5MV6u_8vrAcytGUe4z4"
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][iso mdl] signed & unencrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "age_over_21" ]
} ]
} ]
},
"signed_request" : true,
"clientId" : "x509_hash:kZ5SI3MAFaLDPRxza8xguw-o6b8LYfmP2ZvrqVSRWng",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-521",
"x" : "APWg4T3FQIeJD_xQN0kap5Mzp7lJ17Ctg_T8Gy24lwOp_EIhDzBK9MoCufSIITRolWlcjFTj3Ty91C9rctTuSf0F",
"y" : "AEnFDKiecuqnZ8XMKgt7dFZWRfmzPFrgQmauwlbXDC0kHCZhV76VOgCoWdzfSLegLKGn-nINAIRqPR9n2KPpQwKn",
"d" : "AZT9f0qOOSMQl25qXwvFs23rq0PIUOV1R8YcG1iqRNKEYYs5k8gXNNuud4W6amuItCGWCrKSXRoHmgj6C5NUDzhA"
}
},
"x5c" : [ "MIIB7TCCAZOgAwIBAgIUXrHFKoaAx6+CFOOHp6fZ7Rs2EzgwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAwwSQ3VzdG9tSW50ZXJtZWRpYXRlMB4XDTI2MDEyMjE1NTY0OFoXDTI3MDEyMjE1NTY0OFowEzERMA8GA1UEAwwIVmVyaWZpZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAD1oOE9xUCHiQ/8UDdJGqeTM6e5SdewrYP0/BstuJcDqfxCIQ8wSvTKArn0iCE0aJVpXIxU4908vdQva3LU7kn9BQBJxQyonnLqp2fFzCoLe3RWVkX5szxa4EJmrsJW1wwtJBwmYVe+lToAqFnc30i3oCyhp/pyDQCEaj0fZ9ij6UMCp6N4MHYwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0RBA8wDYILZXhhbXBsZS5jb20wHQYDVR0OBBYEFFAdasyU1haLdvQdEizJEaAO+cmWMB8GA1UdIwQYMBaAFGVh3m3K6y5gABHGIuD7ibTR+AG6MAoGCCqGSM49BAMCA0gAMEUCIQDT9GYMvTTyEOmKDvilHmgejcbLWQ6ACUzlmbZDk67ztAIge2kWDxRetz6xIDtnfg4vlCW6pLbdBWasMrfm1eppDww=", "MIIBlzCCAT2gAwIBAgIUZFEF4iwIsLuJO7pJ9bU7vo9Dg3kwCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjIxNTU1NDJaFw0zNjAxMjAxNTU1NDJaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvlBFSSRWetJJSj5rvGoXtPnfw97YRHbJj4/kspQbSwxVN3RtofsSu0DevrISGx2MCPqqxHXdfSeu9SKgen6IOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlYd5tyusuYAARxiLg+4m00fgBujAfBgNVHSMEGDAWgBQ+D1YkeDpF+qaxAhlnb3XSkGZWCTAKBggqhkjOPQQDAgNIADBFAiEA789kIQsGTa/GJEgYaOID9VVoO0PyeeYEwub7P0a1+ZICIHI9bYi72XTca9e8rqGJuYmKz8qEQodLvaXdgwCfQ4KZ" ]
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][iso mdl] signed & encrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_mdl",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.18013.5.1.mDL"
},
"claims" : [ {
"path" : [ "org.iso.18013.5.1", "family_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "given_name" ]
}, {
"path" : [ "org.iso.18013.5.1", "age_over_21" ]
} ]
} ]
},
"signed_request" : true,
"encrypted_response" : true,
"clientId" : "x509_hash:kZ5SI3MAFaLDPRxza8xguw-o6b8LYfmP2ZvrqVSRWng",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-521",
"x" : "APWg4T3FQIeJD_xQN0kap5Mzp7lJ17Ctg_T8Gy24lwOp_EIhDzBK9MoCufSIITRolWlcjFTj3Ty91C9rctTuSf0F",
"y" : "AEnFDKiecuqnZ8XMKgt7dFZWRfmzPFrgQmauwlbXDC0kHCZhV76VOgCoWdzfSLegLKGn-nINAIRqPR9n2KPpQwKn",
"d" : "AZT9f0qOOSMQl25qXwvFs23rq0PIUOV1R8YcG1iqRNKEYYs5k8gXNNuud4W6amuItCGWCrKSXRoHmgj6C5NUDzhA"
}
},
"x5c" : [ "MIIB7TCCAZOgAwIBAgIUXrHFKoaAx6+CFOOHp6fZ7Rs2EzgwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAwwSQ3VzdG9tSW50ZXJtZWRpYXRlMB4XDTI2MDEyMjE1NTY0OFoXDTI3MDEyMjE1NTY0OFowEzERMA8GA1UEAwwIVmVyaWZpZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAD1oOE9xUCHiQ/8UDdJGqeTM6e5SdewrYP0/BstuJcDqfxCIQ8wSvTKArn0iCE0aJVpXIxU4908vdQva3LU7kn9BQBJxQyonnLqp2fFzCoLe3RWVkX5szxa4EJmrsJW1wwtJBwmYVe+lToAqFnc30i3oCyhp/pyDQCEaj0fZ9ij6UMCp6N4MHYwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0RBA8wDYILZXhhbXBsZS5jb20wHQYDVR0OBBYEFFAdasyU1haLdvQdEizJEaAO+cmWMB8GA1UdIwQYMBaAFGVh3m3K6y5gABHGIuD7ibTR+AG6MAoGCCqGSM49BAMCA0gAMEUCIQDT9GYMvTTyEOmKDvilHmgejcbLWQ6ACUzlmbZDk67ztAIge2kWDxRetz6xIDtnfg4vlCW6pLbdBWasMrfm1eppDww=", "MIIBlzCCAT2gAwIBAgIUZFEF4iwIsLuJO7pJ9bU7vo9Dg3kwCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjIxNTU1NDJaFw0zNjAxMjAxNTU1NDJaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvlBFSSRWetJJSj5rvGoXtPnfw97YRHbJj4/kspQbSwxVN3RtofsSu0DevrISGx2MCPqqxHXdfSeu9SKgen6IOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlYd5tyusuYAARxiLg+4m00fgBujAfBgNVHSMEGDAWgBQ+D1YkeDpF+qaxAhlnb3XSkGZWCTAKBggqhkjOPQQDAgNIADBFAiEA789kIQsGTa/GJEgYaOID9VVoO0PyeeYEwub7P0a1+ZICIHI9bYi72XTca9e8rqGJuYmKz8qEQodLvaXdgwCfQ4KZ" ]
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][iso photo-id] signed & encrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_photoid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "org.iso.23220.photoid.1"
},
"claims" : [ {
"path" : [ "org.iso.23220.photoid.1", "person_id" ]
} ]
} ]
},
"signed_request" : true,
"encrypted_response" : true,
"clientId" : "x509_hash:kZ5SI3MAFaLDPRxza8xguw-o6b8LYfmP2ZvrqVSRWng",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-521",
"x" : "APWg4T3FQIeJD_xQN0kap5Mzp7lJ17Ctg_T8Gy24lwOp_EIhDzBK9MoCufSIITRolWlcjFTj3Ty91C9rctTuSf0F",
"y" : "AEnFDKiecuqnZ8XMKgt7dFZWRfmzPFrgQmauwlbXDC0kHCZhV76VOgCoWdzfSLegLKGn-nINAIRqPR9n2KPpQwKn",
"d" : "AZT9f0qOOSMQl25qXwvFs23rq0PIUOV1R8YcG1iqRNKEYYs5k8gXNNuud4W6amuItCGWCrKSXRoHmgj6C5NUDzhA"
}
},
"x5c" : [ "MIIB7TCCAZOgAwIBAgIUXrHFKoaAx6+CFOOHp6fZ7Rs2EzgwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAwwSQ3VzdG9tSW50ZXJtZWRpYXRlMB4XDTI2MDEyMjE1NTY0OFoXDTI3MDEyMjE1NTY0OFowEzERMA8GA1UEAwwIVmVyaWZpZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAD1oOE9xUCHiQ/8UDdJGqeTM6e5SdewrYP0/BstuJcDqfxCIQ8wSvTKArn0iCE0aJVpXIxU4908vdQva3LU7kn9BQBJxQyonnLqp2fFzCoLe3RWVkX5szxa4EJmrsJW1wwtJBwmYVe+lToAqFnc30i3oCyhp/pyDQCEaj0fZ9ij6UMCp6N4MHYwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0RBA8wDYILZXhhbXBsZS5jb20wHQYDVR0OBBYEFFAdasyU1haLdvQdEizJEaAO+cmWMB8GA1UdIwQYMBaAFGVh3m3K6y5gABHGIuD7ibTR+AG6MAoGCCqGSM49BAMCA0gAMEUCIQDT9GYMvTTyEOmKDvilHmgejcbLWQ6ACUzlmbZDk67ztAIge2kWDxRetz6xIDtnfg4vlCW6pLbdBWasMrfm1eppDww=", "MIIBlzCCAT2gAwIBAgIUZFEF4iwIsLuJO7pJ9bU7vo9Dg3kwCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjIxNTU1NDJaFw0zNjAxMjAxNTU1NDJaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvlBFSSRWetJJSj5rvGoXtPnfw97YRHbJj4/kspQbSwxVN3RtofsSu0DevrISGx2MCPqqxHXdfSeu9SKgen6IOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlYd5tyusuYAARxiLg+4m00fgBujAfBgNVHSMEGDAWgBQ+D1YkeDpF+qaxAhlnb3XSkGZWCTAKBggqhkjOPQQDAgNIADBFAiEA789kIQsGTa/GJEgYaOID9VVoO0PyeeYEwub7P0a1+ZICIHI9bYi72XTca9e8rqGJuYmKz8qEQodLvaXdgwCfQ4KZ" ]
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][iso pid] signed & encrypted" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "my_pid",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.pid.1"
},
"claims" : [ {
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_birth_year" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_18" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "age_over_21" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "family_name_birth" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "given_name_birth" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_place" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "birth_country" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuance_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "expiry_date" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_authority" ]
}, {
"path" : [ "eu.europa.ec.eudi.pid.1", "issuing_country" ]
} ]
} ]
},
"signed_request" : true,
"encrypted_response" : true,
"clientId" : "x509_hash:kZ5SI3MAFaLDPRxza8xguw-o6b8LYfmP2ZvrqVSRWng",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-521",
"x" : "APWg4T3FQIeJD_xQN0kap5Mzp7lJ17Ctg_T8Gy24lwOp_EIhDzBK9MoCufSIITRolWlcjFTj3Ty91C9rctTuSf0F",
"y" : "AEnFDKiecuqnZ8XMKgt7dFZWRfmzPFrgQmauwlbXDC0kHCZhV76VOgCoWdzfSLegLKGn-nINAIRqPR9n2KPpQwKn",
"d" : "AZT9f0qOOSMQl25qXwvFs23rq0PIUOV1R8YcG1iqRNKEYYs5k8gXNNuud4W6amuItCGWCrKSXRoHmgj6C5NUDzhA"
}
},
"x5c" : [ "MIIB7TCCAZOgAwIBAgIUXrHFKoaAx6+CFOOHp6fZ7Rs2EzgwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAwwSQ3VzdG9tSW50ZXJtZWRpYXRlMB4XDTI2MDEyMjE1NTY0OFoXDTI3MDEyMjE1NTY0OFowEzERMA8GA1UEAwwIVmVyaWZpZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAD1oOE9xUCHiQ/8UDdJGqeTM6e5SdewrYP0/BstuJcDqfxCIQ8wSvTKArn0iCE0aJVpXIxU4908vdQva3LU7kn9BQBJxQyonnLqp2fFzCoLe3RWVkX5szxa4EJmrsJW1wwtJBwmYVe+lToAqFnc30i3oCyhp/pyDQCEaj0fZ9ij6UMCp6N4MHYwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0RBA8wDYILZXhhbXBsZS5jb20wHQYDVR0OBBYEFFAdasyU1haLdvQdEizJEaAO+cmWMB8GA1UdIwQYMBaAFGVh3m3K6y5gABHGIuD7ibTR+AG6MAoGCCqGSM49BAMCA0gAMEUCIQDT9GYMvTTyEOmKDvilHmgejcbLWQ6ACUzlmbZDk67ztAIge2kWDxRetz6xIDtnfg4vlCW6pLbdBWasMrfm1eppDww=", "MIIBlzCCAT2gAwIBAgIUZFEF4iwIsLuJO7pJ9bU7vo9Dg3kwCgYIKoZIzj0EAwIwFTETMBEGA1UEAwwKQ3VzdG9tUm9vdDAeFw0yNjAxMjIxNTU1NDJaFw0zNjAxMjAxNTU1NDJaMB0xGzAZBgNVBAMMEkN1c3RvbUludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvlBFSSRWetJJSj5rvGoXtPnfw97YRHbJj4/kspQbSwxVN3RtofsSu0DevrISGx2MCPqqxHXdfSeu9SKgen6IOjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlYd5tyusuYAARxiLg+4m00fgBujAfBgNVHSMEGDAWgBQ+D1YkeDpF+qaxAhlnb3XSkGZWCTAKBggqhkjOPQQDAgNIADBFAiEA789kIQsGTa/GJEgYaOID9VVoO0PyeeYEwub7P0a1+ZICIHI9bYi72XTca9e8rqGJuYmKz8qEQodLvaXdgwCfQ4KZ" ]
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[openid4vp-dc_api][sd-jwt demo payment] urn:eudi:sca:payment:1" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "sca_payment",
"format" : "dc+sd-jwt",
"meta" : {
"vct_values" : [ "https://issuer2.demo.walt.id/openid4vci/sca_payment_card_sd_jwt" ]
},
"claims" : [ {
"path" : [ "card_scheme" ]
}, {
"path" : [ "card_last4" ]
}, {
"path" : [ "card_holder_name" ]
} ]
} ]
},
"signed_request" : true,
"encrypted_response" : true,
"clientId" : "x509_san_dns:verifier.example.com"
},
"openid" : {
"transactionData" : [ {
"type" : "urn:eudi:sca:payment:1",
"credential_ids" : [ "sca_payment" ],
"require_cryptographic_holder_binding" : true,
"transaction_data_hashes_alg" : [ "sha-256" ],
"payload" : {
"transaction_id" : "8D8AC610-566D-4EF0-9C22-186B2A5ED793",
"payee" : {
"name" : "Super Store",
"id" : "merchant-001"
},
"currency" : "EUR",
"amount" : 11.56
}
} ]
},
"expectedOrigins" : [ "https://digital-credentials.walt.id" ]
}
},
"[openid4vp-dc_api][sca + age] urn:eudi:sca:payment:1" : {
"value" : {
"flow_type" : "dc_api_openid4vp",
"core_flow" : {
"dcql_query" : {
"credentials" : [ {
"id" : "sca_payment_card",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.eudi.sca.payment_card.1"
},
"claims" : [ {
"path" : [ "eu.europa.ec.eudi.sca.payment_card.1", "card_scheme" ]
}, {
"path" : [ "eu.europa.ec.eudi.sca.payment_card.1", "card_last4" ]
}, {
"path" : [ "eu.europa.ec.eudi.sca.payment_card.1", "pan_reference" ]
}, {
"path" : [ "eu.europa.ec.eudi.sca.payment_card.1", "card_holder_name" ]
}, {
"path" : [ "eu.europa.ec.eudi.sca.payment_card.1", "expiry_date" ]
} ]
}, {
"id" : "proof_of_age",
"format" : "mso_mdoc",
"meta" : {
"doctype_value" : "eu.europa.ec.av.1"
},
"claims" : [ {
"path" : [ "eu.europa.ec.av.1", "age_over_18" ]
} ]
} ]
}
},
"openid" : {
"transactionData" : [ {
"type" : "urn:eudi:sca:payment:1",
"credential_ids" : [ "sca_payment_card" ],
"require_cryptographic_holder_binding" : true,
"transaction_data_hashes_alg" : [ "sha-256" ],
"payload" : {
"transaction_id" : "8D8AC610-566D-4EF0-9C22-186B2A5ED793",
"payee" : {
"name" : "Super Store",
"id" : "merchant-001"
},
"currency" : "EUR",
"amount" : 11.56
}
} ]
},
"expectedOrigins" : [ "https://digital-credentials.walt.id" ]
}
},
"[iso-18013-7-dc_api][iso mdl]" : {
"value" : {
"flow_type" : "dc_api_18013_7",
"core_flow" : {
"requestedElements" : {
"org.iso.18013.5.1.mDL" : {
"org.iso.18013.5.1" : [ "family_name", "given_name", "birth_date", "issue_date", "expiry_date", "issuing_country", "issuing_authority", "driving_privileges", "age_birth_year", "age_over_18", "age_over_21", "age_over_65", "issuing_jurisdiction", "nationality" ]
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[iso-18013-7-dc_api][iso pid]" : {
"value" : {
"flow_type" : "dc_api_18013_7",
"core_flow" : {
"requestedElements" : {
"eu.europa.ec.eudi.pid.1" : {
"eu.europa.ec.eudi.pid.1" : [ "family_name", "given_name", "birth_date", "age_birth_year", "age_over_18", "age_over_21", "age_over_65", "family_name_birth", "given_name_birth", "birth_place", "birth_country", "issuance_date", "expiry_date", "issuing_authority", "issuing_country" ]
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[iso-18013-7-dc_api][iso photo-id]" : {
"value" : {
"flow_type" : "dc_api_18013_7",
"core_flow" : {
"requestedElements" : {
"org.iso.23220.photoid.1" : {
"org.iso.23220.1" : [ "family_name", "family_name_viz", "given_name", "given_name_viz", "issue_date", "expiry_date", "issuing_authority_unicode", "issuing_country", "age_over_18", "age_over_21", "age_over_65", "age_birth_year", "portrait_capture_date", "birthplace", "name_at_birth", "resident_address", "resident_city", "resident_postal_code", "resident_country", "resident_city_latin1", "nationality", "document_number", "issuing_subdivision", "family_name_latin1", "given_name_latin1" ],
"org.iso.23220.photoid.1" : [ "person_id", "birth_country", "birth_state", "birth_city", "administrative_number", "resident_street", "resident_house_number", "travel_document_type", "travel_document_number", "travel_document_mrz", "resident_state" ]
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[iso-18013-7-dc_api][iso mdl + photo-id]" : {
"value" : {
"flow_type" : "dc_api_18013_7",
"core_flow" : {
"requestedElements" : {
"org.iso.18013.5.1.mDL" : {
"org.iso.18013.5.1" : [ "family_name", "given_name", "birth_date", "issue_date", "expiry_date", "issuing_country", "issuing_authority", "driving_privileges", "age_birth_year", "age_over_18", "age_over_21", "age_over_65", "issuing_jurisdiction", "nationality" ]
},
"org.iso.23220.photoid.1" : {
"org.iso.23220.1" : [ "family_name", "family_name_viz", "given_name", "given_name_viz", "issue_date", "expiry_date", "issuing_authority_unicode", "issuing_country", "age_over_18", "age_over_21", "age_over_65", "age_birth_year", "portrait_capture_date", "birthplace", "name_at_birth", "resident_address", "resident_city", "resident_postal_code", "resident_country", "resident_city_latin1", "nationality", "document_number", "issuing_subdivision", "family_name_latin1", "given_name_latin1" ],
"org.iso.23220.photoid.1" : [ "person_id", "birth_country", "birth_state", "birth_city", "administrative_number", "resident_street", "resident_house_number", "travel_document_type", "travel_document_number", "travel_document_mrz", "resident_state" ]
}
}
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
},
"[iso-18013-7-dc_api][iso mdl] signed" : {
"value" : {
"flow_type" : "dc_api_18013_7",
"core_flow" : {
"requestedElements" : {
"org.iso.18013.5.1.mDL" : {
"org.iso.18013.5.1" : [ "family_name", "given_name", "birth_date", "issue_date", "expiry_date", "issuing_country", "issuing_authority", "driving_privileges", "age_birth_year", "age_over_18", "age_over_21", "age_over_65", "issuing_jurisdiction", "nationality" ]
}
},
"signed_request" : true,
"clientId" : "x509_hash:1i4VjAVXdxwhPVuPM19mNtMpWJhQ",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "zi6Qj0Ggd8xiMqaiRZzkYyI3sMkFAA89kEdceHCa5AQ",
"y" : "-JyeRcamM-uCS1N-naE0itVbs7fQ_5xbujSSK9pYdb4",
"d" : "1xgojLKBT4hmuTjgjhz0l6RTHgmlLlVb5bnwuZkNBaA"
}
},
"x5c" : [ "MIIBsTCCAVegAwIBAgIUJklaRrIjkEZlDdPk2+qPneHHD6kwCgYIKoZIzj0EAwIwLjEQMA4GA1UEAwwHRXhhbXBsZTENMAsGA1UECgwEVGVzdDELMAkGA1UEBhMCVVMwHhcNMjYwMzMxMDkwNDMwWhcNMjcwMzMxMDkwNDMwWjAuMRAwDgYDVQQDDAdFeGFtcGxlMQ0wCwYDVQQKDARUZXN0MQswCQYDVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABM4ukI9BoHfMYjKmokWc5GMiN7DJBQAPPZBHXHhwmuQE+JyeRcamM+uCS1N+naE0itVbs7fQ/5xbujSSK9pYdb6jUzBRMB0GA1UdDgQWBBSwjqgulcWH4AqTJwPjBGj3VGIAsTAfBgNVHSMEGDAWgBSwjqgulcWH4AqTJwPjBGj3VGIAsTAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQCoWAleGRqR+kb+5SeRt/scogZPiQiM7wJ69tadEPPJwQIgdygIZSMQSXlxXbZ10QKtN6qSjggqFVUV4/Z2/pnBUBk=" ]
},
"expectedOrigins" : [ "https://portal2.demo.walt.id" ]
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Verification session created successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.verifier2.handlers.sessioncreation.VerificationSessionCreationResponse"
}
}
}
},
"400" : {
"description" : "Invalid request - malformed DCQL query or invalid policy configuration",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to create verification sessions",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/sessions" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "List verification sessions",
"description" : "Permissions: ANY OF: [ES_VERIFIER_GET_VERIFIER_SESSION] \nOperation: 'list-verification-sessions' \nAccepts targets: [Verifier2ServiceReference] \nRequires authentication. \n\n---\nLists persisted verifier2 verification sessions.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
}, {
"name" : "status",
"in" : "query",
"description" : "Optional exact session status filter. Mutually exclusive with 'outcome'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "outcome",
"in" : "query",
"description" : "Optional grouped session outcome filter. Supported values: in_progress, successful, failed, expired. Expired includes sessions with status EXPIRED or non-terminal sessions past expirationDate. Mutually exclusive with 'status'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "sessionId",
"in" : "query",
"description" : "Optional session id filter.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "flowType",
"in" : "query",
"description" : "Optional flow type filter. Supported values: cross_device, same_device, dc_api.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "createdAfter",
"in" : "query",
"description" : "Optional lower bound for the session creation timestamp (ISO-8601 instant).",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
}, {
"name" : "createdBefore",
"in" : "query",
"description" : "Optional upper bound for the session creation timestamp (ISO-8601 instant).",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Verification sessions listed successfully.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/verifier2-session"
},
"title" : "ArrayList<>"
}
}
}
},
"400" : {
"description" : "Invalid query parameter.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/verification-session/info" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "View verification session information",
"description" : "Permissions: ANY OF: [ES_VERIFIER_GET_VERIFIER_SESSION] \nOperation: 'view-verification-session' \nAccepts targets: [Verifier2StoredVerificationSession] \nRequires authentication. \n\n---\nRetrieves information about a verification session including status, DCQL query, policies, and presented credentials.\n\n**Use Cases:**\n- Check session status and progress\n- View DCQL query and verification policies\n- Access presented credentials and policy results after wallet interaction\n\n**Important Notes:**\n- Presented credentials and policy results are only available after wallet has submitted a response\n- Session status reflects current verification state (OPEN, IN_USE, SUCCESSFUL, FAILED)\n- Session status updates are available via SSE events endpoint\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Verification session information retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/verifier2-session"
}
}
}
},
"404" : {
"description" : "Verification session not found or expired",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view this verification session",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/verification-session" : {
"delete" : {
"tags" : [ "Verification Sessions", "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "Delete a verification session",
"description" : "Permissions: ANY OF: [ES_VERIFIER_DELETE_VERIFIER_SESSION] \nOperation: 'delete-verification-session' \nAccepts targets: [Verifier2StoredVerificationSession] \nRequires authentication. \n\n---\nRemoves the session and everything recorded about the verification. To keep the record but remove the personal data, use the pii endpoint instead.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "Session deleted",
"headers" : { }
},
"404" : {
"description" : "No such session",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/verification-session/pii" : {
"delete" : {
"tags" : [ "Verification Sessions", "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "Purge the personal data of a verification session",
"description" : "Permissions: ANY OF: [ES_VERIFIER_UPDATE_VERIFIER_SESSION] \nOperation: 'purge-verification-session-pii' \nAccepts targets: [Verifier2StoredVerificationSession] \nRequires authentication. \n\n---\nKeeps the session and its outcome, and removes the presented credentials, the raw presentation, the ephemeral keys and the per-policy detail. For answering an erasure request without losing the audit trail that a verification took place.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"204" : {
"description" : "Personal data purged",
"headers" : { }
},
"404" : {
"description" : "No such session",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/verification-session/events" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Verification Sessions" ],
"summary" : "Receive verification session update events via Server-Sent Events (SSE)",
"description" : "Establishes an SSE connection to receive real-time updates about a verification session including wallet interactions, credential validation, and policy evaluation results.\n\n**Use Cases:**\n- Monitor session progress in real-time\n- Receive notifications when wallet presents credentials\n- Track credential validation and policy evaluation status\n\n**Important Notes:**\n- Connection remains open until client disconnects or session completes\n- Events are sent as JSON objects in SSE format\n- Connection automatically closes when session reaches terminal state (SUCCESSFUL or FAILED)\n- No authentication required (uses session ID for authorization)\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "verification-session",
"in" : "path",
"description" : "Verification session identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "550e8400-e29b-41d4-a716-446655440000"
} ],
"responses" : {
"200" : {
"description" : "SSE connection established, events will be streamed. Response content type is text/event-stream.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
},
"404" : {
"description" : "Verification session not found",
"headers" : { }
},
"400" : {
"description" : "Invalid verification session identifier",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/verifier-service-api/{verification-session}/request" : {
"get" : {
"tags" : [ "Service | Verifier Service API v2 - Wallet interaction" ],
"summary" : "Get authorization request for verification session",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nRetrieves the OpenID4VP authorization request containing the DCQL query specifying which credentials and claims are required.\n\n**Use Cases:**\n- Wallets fetch authorization requests to understand verification requirements\n- Support cross-device and same-device verification flows\n\n**Important Notes:**\n- This endpoint is publicly accessible (no authentication required)\n- Authorization request contains DCQL query with credential requirements\n- Request includes nonce and state for security and session tracking\n- State parameter must match state in wallet response\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "verification-session",
"in" : "path",
"description" : "Verification session identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "550e8400-e29b-41d4-a716-446655440000"
} ],
"responses" : {
"200" : {
"description" : "Authorization request retrieved successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.verifier.openid.models.authorization.AuthorizationRequest"
}
}
}
},
"404" : {
"description" : "Verification session not found or expired",
"headers" : { }
},
"400" : {
"description" : "Invalid verification session identifier",
"headers" : { }
}
},
"deprecated" : false
},
"post" : {
"tags" : [ "Service | Verifier Service API v2 - Wallet interaction" ],
"description" : "Permissions: None required \nNo target restriction. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Requires body of JSON value for String.",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
},
"required" : true
},
"responses" : { },
"deprecated" : false
}
},
"/v2/{target}/verifier-service-api/{verification-session}/response" : {
"post" : {
"tags" : [ "Service | Verifier Service API v2 - Wallet interaction" ],
"summary" : "Submit authorization response from wallet",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nReceives the authorization response from a wallet containing verifiable presentations. Validates credentials against the DCQL query, applies verification policies, and updates the session status.\n\n**Use Cases:**\n- Receive verifiable presentations from wallets\n- Validate credentials against DCQL query requirements\n- Apply verification policies to presented credentials\n\n**Important Notes:**\n- This endpoint is publicly accessible (no authentication required)\n- Request body contains vp_token with verifiable presentations\n- State parameter must match the state from authorization request\n- Credentials are validated against DCQL query and verification policies\n- Session status transitions to SUCCESSFUL or FAILED based on results\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "verification-session",
"in" : "path",
"description" : "Verification session identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "550e8400-e29b-41d4-a716-446655440000"
}, {
"name" : "X-Request-Id",
"in" : "header",
"description" : "Optional request ID for tracing",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Authorization response containing vp_token and state parameter in form-encoded format",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Direct POST response" : {
"value" : "vp_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2cCI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudGF0aW9uIl19fQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c&state=xyz987"
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Authorization response received and processed successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
},
"examples" : {
"Success response" : {
"value" : {
"status" : "received",
"message" : "Presentation received and is being processed."
}
},
"Redirect response" : {
"value" : {
"redirect_uri" : "https://verifier.example.com/success"
}
}
}
}
}
},
"400" : {
"description" : "Invalid request - missing state, invalid vp_token, validation failure, or DCQL not fulfilled",
"headers" : { }
},
"404" : {
"description" : "Verification session not found or expired",
"headers" : { }
}
},
"deprecated" : false
}
},
"/v2/{target}/wallet-service-api/configuration/view" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/configuration/update" : {
"put" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Wallet2Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/wallet2"
},
"examples" : {
"Wallet2 with static did and key" : {
"value" : {
"type" : "wallet2",
"configuration" : {
"staticDid" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
"staticKey" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.did-store.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.credential-store.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.client-attester.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.policy-store.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.trust-registry.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, did-store, credential-store, client-attester, policy-store, trust-registry)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
},
"credential-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.credential-store.main"
}
},
"client-attester dependency" : {
"value" : {
"dependency" : "waltid.tenant1.client-attester.main"
}
},
"policy-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.policy-store.main"
}
},
"trust-registry dependency" : {
"value" : {
"dependency" : "waltid.tenant1.trust-registry.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove did-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.did-store.main"
}
},
"Remove credential-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.credential-store.main"
}
},
"Remove client-attester dependency" : {
"value" : {
"dependency" : "waltid.tenant1.client-attester.main"
}
},
"Remove policy-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.policy-store.main"
}
},
"Remove trust-registry dependency" : {
"value" : {
"dependency" : "waltid.tenant1.trust-registry.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/default-requests" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Wallet2Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"wallet2-present-credential" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"runPolicies" : true
},
"wallet2-receive-credential-authorized" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"clientId" : "wallet-client",
"redirectUri" : "openid://"
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Wallet2Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"wallet2-present-credential — holder key and DID" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"runPolicies" : true
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Wallet2Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"wallet2-present-credential — holder key and DID" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"runPolicies" : true
}
},
"wallet2-receive-credential-authorized — holder key and DID" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"clientId" : "wallet-client",
"redirectUri" : "openid://"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"wallet2-present-credential — holder key and DID" : {
"value" : {
"keyReference" : "waltid.tenant1.kms1.holder-key",
"didReference" : "waltid.tenant1.didstore.holder-did",
"runPolicies" : true
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Wallet2 Service - Management" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Wallet2Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/client-attestation/obtain" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Client Attestation" ],
"summary" : "Obtain and store a client attestation JWT for this wallet",
"description" : "Permissions: ANY OF: [ES_WALLET_OBTAIN_CLIENT_ATTESTATION] \nOperation: 'obtain-client-attestation' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nCalls the linked ClientAttesterService, binds the attestation to the wallet instance's public key, and stores the result. If an attestation already exists it is refreshed.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Requires body of JSON value for Obtain Client Attestation Request.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.walletattestation.ObtainClientAttestationRequest"
}
}
},
"required" : true
},
"responses" : {
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/client-attestation/current" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Client Attestation" ],
"summary" : "View the currently stored client attestation JWT for this wallet",
"description" : "Permissions: ANY OF: [ES_WALLET_GET_CURRENT_CLIENT_ATTESTATION] \nOperation: 'view-current-client-attestation' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/keys" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Key Management" ],
"summary" : "List keys in the wallet",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'list-wallet2-keys' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns metadata for all keys across all key stores attached to this wallet. Key management (create, import, delete) is handled by the Key Management Service. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.wallet2.data.WalletKeyInfo"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/dids" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Key Management" ],
"summary" : "List DIDs in the wallet",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'list-wallet2-dids' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns all DID entries stored in the wallet's DID store. DID management (create, import, delete) is handled by the DID Service. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.wallet2.data.WalletDidEntry"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Key Management" ],
"summary" : "List credentials in the wallet (metadata only)",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'list-wallet2-credentials' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns metadata for all credentials stored in the wallet's credential store(s). Raw credential data is not included - use the single-credential endpoint to retrieve it. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.wallet2.data.StoredCredentialMetadata"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/{credentialId}" : {
"get" : {
"tags" : [ "Service | Wallet2 Service - Key Management" ],
"summary" : "Get a credential including raw credential data",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'get-wallet2-credential' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns the full stored credential including the parsed digital credential. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "credentialId",
"in" : "path",
"description" : "The ID of the credential to retrieve",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.data.StoredCredential"
}
}
}
},
"404" : {
"description" : "Credential not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/import" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Key Management" ],
"summary" : "Import and store a raw credential",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'import-wallet2-credential' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nAuto-detects and parses a JWT VC, SD-JWT VC, or mdoc credential, then stores it in this wallet. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ImportCredentialRequest"
}
}
},
"required" : false
},
"responses" : {
"201" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.data.StoredCredential"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance" ],
"summary" : "Receive credential(s) - full pre-authorized code flow",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'wallet2-receive-credential' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nResolves the offer, requests a token, signs proof-of-possession, fetches the credential(s) and stores them in the wallet's credential store. Returns the IDs of stored credentials. For deferred credentials, returns transaction IDs that can be used with the /deferred endpoint. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Credential receive request. Provide either offerUrl or offerJson (not both). Use key for an inline JWK, or keyReference for a key stored in an attached KMS. For DID holder binding supply did (inline) or didReference (Target path into a DID store); did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2ReceiveCredentialRequest"
},
"examples" : {
"Offer URL – inline key and DID" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
}
},
"Offer URL – DID reference from store" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"keyReference" : "org1.tenant1.kms.holder-key",
"didReference" : "org1.tenant1.didstore.holder-did"
}
},
"Offer URL – key reference (enterprise KMS)" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"keyReference" : "org1.tenant1.kms.holder-key"
}
},
"Inline JSON offer – wallet default key" : {
"value" : {
"offerJson" : {
"credential_issuer" : "https://issuer.example.org",
"credential_configuration_ids" : [ "UniversityDegree_JWT" ],
"grants" : {
"urn:ietf:params:oauth:grant-type:pre-authorized_code" : {
"pre-authorized_code" : "SplxlOBeZQQYbYS6WxSbIA"
}
}
}
}
},
"Offer URL – with PIN (tx_code required)" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"txCode" : "493536"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ReceiveCredentialResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/pre-authorized" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance" ],
"summary" : "Receive credential(s) - dedicated pre-authorized code flow",
"description" : "Permissions: ANY OF: [ES_WALLET_RECEIVE_CREDENTIALS_FULL] \nOperation: 'wallet2-receive-credential-pre-authorized' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nDedicated pre-authorized-code receive endpoint (full server-side flow). Functionally equivalent to /credentials/receive for pre-authorized offers; provided for parity with the previous authorized/pre-authorized split. Supports inline key (key) or attached key-store key (keyReference), inline DID (did) or attached-store DID (didReference), tx_code, and automatic attestation-based client authentication when one client attester is linked and if the OAuth Server supports it. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Pre-authorized-code receive request. Provide either offerUrl or offerJson (not both). Use key for an inline JWK, keyReference for an enterprise KMS key, and txCode when the issuer requires a transaction PIN. For DID holder binding supply did (inline) or didReference (Target path into a DID store); did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2PreAuthorizedReceiveRequest"
},
"examples" : {
"Offer URL – inline key" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
},
"Offer URL – key reference (enterprise KMS)" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"keyReference" : "org1.tenant1.kms.holder-key"
}
},
"Offer URL – with DID holder binding" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
}
},
"Offer URL – DID reference from store" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"keyReference" : "org1.tenant1.kms.holder-key",
"didReference" : "org1.tenant1.didstore.holder-did"
}
},
"Offer URL – with PIN (tx_code)" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"txCode" : "493536"
}
},
"Inline JSON offer" : {
"value" : {
"offerJson" : {
"credential_issuer" : "https://issuer.example.org",
"credential_configuration_ids" : [ "UniversityDegree_JWT" ],
"grants" : {
"urn:ietf:params:oauth:grant-type:pre-authorized_code" : {
"pre-authorized_code" : "SplxlOBeZQQYbYS6WxSbIA"
}
}
},
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ReceiveCredentialResult"
}
}
}
},
"400" : {
"description" : "Invalid request, invalid offer, or unavailable client attester",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/authorized" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance" ],
"summary" : "Receive credential(s) - authorization code flow (continue from code)",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_RECEIVE_CREDENTIAL] \nOperation: 'wallet2-receive-credential-authorized' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nCompletes the authorization-code grant from a previously obtained authorization code: resolves authorization server metadata from credentialIssuer, exchanges the code for a token, signs proof-of-possession and fetches + stores the credential(s) with issuer display metadata (`issuerDisplay`) and configuration labels, matching the pre-authorized receive path. Obtain the authorization code via the isolated /credentials/receive/authorization-url step and a browser redirect. Supports inline key (key) or attached key-store key, inline/attached DID, and automatic attestation-based client authentication when one client attester is linked and if the OAuth Server supports it. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Authorization-code receive request. Provide the code from the redirect callback together with credentialIssuer, credentialEndpoint, and credentialConfigurationId returned by the /authorization-url step. Include codeVerifier when PKCE was used. For DID holder binding supply did (inline) or didReference (Target path into a DID store); did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2AuthorizedReceiveRequest"
},
"examples" : {
"Authorization code – inline key" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuer" : "https://issuer.example.org",
"credentialEndpoint" : "https://issuer.example.org/credential",
"credentialConfigurationId" : "UniversityDegree_JWT",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
},
"Authorization code – PKCE and key reference" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"codeVerifier" : "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
"credentialIssuer" : "https://issuer.example.org",
"credentialEndpoint" : "https://issuer.example.org/credential",
"credentialConfigurationId" : "UniversityDegree_JWT",
"keyReference" : "org1.tenant1.kms.holder-key"
}
},
"Authorization code – DID and label override" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuer" : "https://issuer.example.org",
"credentialEndpoint" : "https://issuer.example.org/credential",
"credentialConfigurationId" : "UniversityDegree_JWT",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
"label" : "My University Degree"
}
},
"Authorization code – DID reference from store" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuer" : "https://issuer.example.org",
"credentialEndpoint" : "https://issuer.example.org/credential",
"credentialConfigurationId" : "UniversityDegree_JWT",
"keyReference" : "org1.tenant1.kms.holder-key",
"didReference" : "org1.tenant1.didstore.holder-did"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ReceiveCredentialResult"
}
}
}
},
"400" : {
"description" : "Invalid request or authorization code exchange failure",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/transaction-data-profiles" : {
"get" : {
"tags" : [ "Transaction Data", "Service | Wallet2 Service - Transaction Data" ],
"summary" : "List available transaction data type profiles",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL, ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-list-transaction-data-profiles' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nReturns the OpenID4VP transaction-data types this Wallet2 service recognizes (HOCON seed plus this service's runtime overlay). Used by consent UIs and discovery. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
},
"title" : "ArrayList"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Transaction Data", "Service | Wallet2 Service - Transaction Data" ],
"summary" : "Create a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'wallet2-create-transaction-data-profile' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nAdds a runtime overlay entry on this Wallet2 service. Seeded HOCON types remain the durable default; overlay changes do not require a restart.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
},
"required" : false
},
"responses" : {
"201" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"409" : {
"description" : "Profile type already exists",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/transaction-data-profiles/{type}" : {
"get" : {
"tags" : [ "Transaction Data", "Service | Wallet2 Service - Transaction Data" ],
"summary" : "Get a transaction data type profile",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL, ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-get-transaction-data-profile' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Transaction Data", "Service | Wallet2 Service - Transaction Data" ],
"summary" : "Replace a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'wallet2-replace-transaction-data-profile' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.commons.config.list.TransactionDataProfile"
}
}
}
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Transaction Data", "Service | Wallet2 Service - Transaction Data" ],
"summary" : "Delete a transaction data type profile",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'wallet2-delete-transaction-data-profile' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nHides a seeded type on this Wallet2 service until it is created again.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "type",
"in" : "path",
"description" : "Transaction data type identifier",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "Profile deleted",
"headers" : { }
},
"404" : {
"description" : "Profile not found",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Present credential(s) - full DCQL flow",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL] \nOperation: 'wallet2-present-credential' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nResolves the VP request, DCQL-matches credentials from the wallet's credential stores, constructs and signs the presentation(s), and submits to the verifier's response_uri. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Presentation request. Provide requestUrl (openid4vp://... or https://). Use key for an inline JWK, keyReference for an enterprise KMS key, and did (inline) or didReference (Target path into a DID store) for DID holder binding; did takes precedence. Set runPolicies=true to evaluate presentation policies.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2PresentCredentialRequest"
},
"examples" : {
"Present from wallet – inline key" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
},
"Present from wallet – key reference (enterprise KMS)" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"keyReference" : "org1.tenant1.kms.holder-key"
}
},
"Present from wallet – DID holder binding" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
}
},
"Present from wallet – DID reference from store" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"didReference" : "org1.tenant1.didstore.holder-did"
}
},
"Present from wallet – with policy evaluation" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"runPolicies" : true
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.waltid.openid4vp.wallet.WalletPresentFunctionality2.WalletPresentResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/isolated" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Present credential(s) - stateless, inline credentials",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-present-credential-isolated' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nSame as /present but credentials are supplied inline in the request body instead of being loaded from the wallet's credential stores. Useful for stateless deployments. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Isolated presentation request. Provide requestUrl, a credentials array of stored credential objects, and a key or keyReference for signing. For DID holder binding supply did (inline) or didReference (Target path into a DID store); did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2PresentCredentialIsolatedRequest"
},
"examples" : {
"Isolated present – inline credentials and key" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
} ]
}
},
"Isolated present – key reference" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"keyReference" : "org1.tenant1.kms.holder-key",
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
} ]
}
},
"Isolated present – DID holder binding" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
} ]
}
},
"Isolated present – DID reference from store" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"didReference" : "org1.tenant1.didstore.holder-did",
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
} ]
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.waltid.openid4vp.wallet.WalletPresentFunctionality2.WalletPresentResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/resolve-request" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Isolated: parse and resolve a VP authorization request",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL] \nOperation: 'wallet2-resolve-vp-request' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nFetches and parses the VP authorization request URL, returning the nonce, client ID, response URI, DCQL query, and complete authenticated request for later steps. Does not require credentials. Stateless. Use this to display verifier information to the user before consent. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "VP request resolver. Provide the requestUrl from the verifier's QR code or deep-link.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ResolveVpRequestRequest"
},
"examples" : {
"Resolve VP request URL" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ResolveVpRequestResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/match-credentials" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Isolated: DCQL-match supplied credentials against a query",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL] \nOperation: 'wallet2-match-credentials' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nStateless DCQL matching - credentials must be supplied inline. Use /match-credentials-from-store to match against the wallet's own credential stores. Returns which credentials match which query IDs for consent-preview UIs. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "DCQL match request. Provide the dcqlQuery from the resolved VP request and a credentials array of StoredCredential objects to match against.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.MatchCredentialsRequest"
},
"examples" : {
"DCQL match against supplied credentials" : {
"value" : {
"dcqlQuery" : {
"credentials" : {
"pid_query" : {
"id" : "pid_query",
"format" : {
"vc+sd-jwt" : {
"vct_values" : [ "urn:eu.europa.ec.eudi:pid:1" ]
}
}
}
}
},
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
} ]
}
},
"DCQL match – multiple credentials" : {
"value" : {
"dcqlQuery" : {
"credentials" : {
"pid_query" : {
"id" : "pid_query",
"format" : {
"vc+sd-jwt" : {
"vct_values" : [ "urn:eu.europa.ec.eudi:pid:1" ]
}
}
}
}
},
"credentials" : [ {
"id" : "cred-01J8X4K2M9P3Q5R7S6T",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~WyJzYWx0IiwiZ2l2ZW5fbmFtZSIsIkpvaG4iXQ~"
},
"label" : "EU Digital Identity"
}, {
"id" : "cred-01J8X4K2M9P3Q5R7S6U",
"credential" : {
"format" : "vc+sd-jwt",
"compactSdJwt" : "eyJhbGciOiJFZERTQSJ9.eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6bWRsOjEiLCJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyJ9.sig~"
},
"label" : "Driving Licence"
} ]
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.MatchCredentialsResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/match-credentials-from-store" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "DCQL-match wallet's stored credentials against a query",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL] \nOperation: 'wallet2-match-credentials-from-store' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nLoads credentials from the wallet's credential store(s) and runs DCQL matching. No credentials need to be supplied inline. Use this to show the user which of their stored credentials satisfy the verifier's request before asking for consent. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "DCQL match against credential store. Provide the dcqlQuery from the resolved VP request.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.MatchCredentialsFromStoreRequest"
},
"examples" : {
"DCQL match against wallet credential store" : {
"value" : {
"dcqlQuery" : {
"credentials" : {
"pid_query" : {
"id" : "pid_query",
"format" : {
"vc+sd-jwt" : {
"vct_values" : [ "urn:eu.europa.ec.eudi:pid:1" ]
}
}
}
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.MatchCredentialsResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/build-vp-token" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Build a VP token from selected credentials",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-build-vp-token' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRe-resolves and revalidates the original requestUrl, then builds and signs the VP token from the credential options (and optional claim disclosures) selected after /preview, or from selectedCredentialIds after match-credentials-from-store. Do not echo the preview authorizationRequest — pass the same requestUrl used for /preview, and pass the Ready preview keyId so build signs with the same key preview validated against. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "VP token build request. Provide requestUrl and selectedCredentialOptions (queryId + credentialId). For SD-JWT selective disclosure add selectedDisclosureOptions per claim path. Use key or keyReference for signing; did (inline) or didReference (Target path into a DID store) for DID holder binding; did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2BuildVpTokenRequest"
},
"examples" : {
"Build VP token – selectedCredentialOptions (preferred)" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"selectedCredentialOptions" : [ {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T"
} ]
}
},
"Build VP token – key reference" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"keyReference" : "org1.tenant1.kms.holder-key",
"selectedCredentialOptions" : [ {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T"
} ]
}
},
"Build VP token – with selective disclosure" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"selectedCredentialOptions" : [ {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T"
} ],
"selectedDisclosureOptions" : [ {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T",
"path" : "given_name"
}, {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T",
"path" : "family_name"
} ]
}
},
"Build VP token – DID reference from store" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"didReference" : "org1.tenant1.didstore.holder-did",
"selectedCredentialOptions" : [ {
"queryId" : "pid_query",
"credentialId" : "cred-01J8X4K2M9P3Q5R7S6T"
} ]
}
},
"Build VP token – legacy selectedCredentialIds" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"selectedCredentialIds" : {
"pid_query" : [ "cred-01J8X4K2M9P3Q5R7S6T" ]
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.BuildVpTokenResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/send-response" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Send an authorization response to the verifier",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-send-authorization-response' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRe-resolves and revalidates the original requestUrl, then transmits the VP token according to the response mode / URI / encryption from that freshly resolved OpenID4VP request. Do not echo the preview authorizationRequest. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Authorization response submission. Provide requestUrl and the vpToken from /build-vp-token. Include idToken when the verifier requested SIOPv2 authentication.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.SendAuthorizationResponseRequest"
},
"examples" : {
"Send VP token response" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"vpToken" : "eyJhbGciOiJFZERTQSIsInR5cCI6InZwK2p3dCJ9.eyJ2cCI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSJdLCJ0eXBlIjpbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXSwidmVyaWZpYWJsZUNyZWRlbnRpYWwiOltdfX0.sig"
}
},
"Send VP token with ID token (SIOPv2)" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"vpToken" : "eyJhbGciOiJFZERTQSIsInR5cCI6InZwK2p3dCJ9.eyJ2cCI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSJdLCJ0eXBlIjpbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXSwidmVyaWZpYWJsZUNyZWRlbnRpYWwiOltdfX0.sig",
"idToken" : "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyIsImlzcyI6ImRpZDprZXk6ejZNa2hhWGdCWkR2b3REa0w1MjU3ZmFpenRpR2lDMlF0S0xHcGJuOEVHdGEyZG9LIiwiYXVkIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLm9yZyJ9.sig"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.waltid.openid4vp.wallet.WalletPresentFunctionality2.WalletPresentResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/preview" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Preview an OpenID4VP request for consent (verifier + credentials + claim disclosures)",
"description" : "Permissions: ANY OF: [ES_WALLET_PRESENT_CREDENTIALS_FULL] \nOperation: 'wallet2-preview-presentation' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nResolves and validates the VP request and returns the authorization request (display-only), verifier metadata, transaction data, response-encryption state, and matching credentials with per-claim selective-disclosure options. Optional request keyId selects the signing key for capability checks; Ready responses include that keyId. Stateless: no preview handle. Complete with /build-vp-token + /send-response using the original requestUrl and the preview keyId (do not echo authorizationRequest), or /reject with requestUrl. If the request is invalid but a response can still be sent, valid=false with an error. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "VP preview request. Provide requestUrl (verifier's QR code / deep-link URL). Optionally supply key or keyReference to pre-select the signing key for capability checks.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2PreviewPresentationRequest"
},
"examples" : {
"Preview VP request – no key (wallet default)" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123"
}
},
"Preview VP request – inline key" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
},
"Preview VP request – key reference" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"keyReference" : "org1.tenant1.kms.holder-key"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.preview.Wallet2PresentPreviewResponse"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/present/reject" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Presentation" ],
"summary" : "Reject a presentation request",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_PRESENT_CREDENTIALS] \nOperation: 'wallet2-reject-presentation' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nRe-resolves the OpenID4VP request from requestUrl and returns the wallet's error response to the verifier when a response channel is available. No preview handle. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Presentation rejection request. Provide requestUrl to identify the VP request. Optionally supply errorCode and errorDescription for an OAuth 2.0 error response.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.preview.Wallet2RejectPresentationRequest"
},
"examples" : {
"Reject without error details" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123"
}
},
"Reject with error code and description" : {
"value" : {
"requestUrl" : "openid4vp://authorize?client_id=verifier.example.org&request_uri=https%3A%2F%2Fverifier.example.org%2Frequest%2Fab123",
"errorCode" : "access_denied",
"errorDescription" : "The user declined to share the requested credentials."
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.waltid.openid4vp.wallet.WalletPresentFunctionality2.WalletPresentResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/resolve-offer" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Isolated: resolve a credential offer (with issuer/credential preview)",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_RESOLVE_OFFER] \nOperation: 'wallet2-resolve-offer' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nFetches and parses the credential offer and returns the offer summary (grant type, endpoints, pre-authorized code, transaction-code requirement) together with issuer display metadata and offered-credential display/claims for a consent-first review UI. Stateless - no preview handle is retained; complete issuance with the pre-authorized or authorization-code endpoints. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Credential offer source. Provide either offerUrl (openid-credential-offer://...) or offerJson (inline credential offer object), not both.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ResolveOfferRequest"
},
"examples" : {
"Offer URL" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123"
}
},
"Inline JSON offer – pre-authorized code" : {
"value" : {
"offerJson" : {
"credential_issuer" : "https://issuer.example.org",
"credential_configuration_ids" : [ "UniversityDegree_JWT" ],
"grants" : {
"urn:ietf:params:oauth:grant-type:pre-authorized_code" : {
"pre-authorized_code" : "SplxlOBeZQQYbYS6WxSbIA"
}
}
}
}
},
"Inline JSON offer – authorization code" : {
"value" : {
"offerJson" : {
"credential_issuer" : "https://issuer.example.org",
"credential_configuration_ids" : [ "UniversityDegree_JWT" ],
"grants" : {
"authorization_code" : {
"issuer_state" : "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyJ9.sig"
}
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.preview.Wallet2ResolveOfferResponse"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/request-token" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Isolated: exchange pre-authorized code for access token",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_TOKEN_SEND_REQUEST] \nOperation: 'wallet2-request-token' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nSends a token request to the issuer's token endpoint. Uses the wallet's linked client attester automatically when issuer metadata advertises attestation-based client authentication. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Token request. Provide tokenEndpoint and preAuthorizedCode from the resolved offer. Include txCode when the offer requires a transaction PIN. Provide credentialIssuer to enable attestation-based client authentication.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.RequestTokenRequest"
},
"examples" : {
"Basic pre-authorized code" : {
"value" : {
"tokenEndpoint" : "https://issuer.example.org/token",
"preAuthorizedCode" : "SplxlOBeZQQYbYS6WxSbIA"
}
},
"With PIN (tx_code)" : {
"value" : {
"tokenEndpoint" : "https://issuer.example.org/token",
"preAuthorizedCode" : "SplxlOBeZQQYbYS6WxSbIA",
"txCode" : "493536"
}
},
"With credential issuer – enables attestation-based client auth" : {
"value" : {
"tokenEndpoint" : "https://issuer.example.org/token",
"preAuthorizedCode" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuer" : "https://issuer.example.org"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.RequestTokenResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/request-nonce" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Isolated: obtain a fresh credential proof nonce",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_REQUEST_NONCE] \nOperation: 'wallet2-request-nonce' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nResolves the credential issuer metadata and requests a fresh proof nonce from its advertised nonce endpoint. Returns a null nonce when the issuer does not advertise one. Call this after obtaining an access token and before signing the proof of possession. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Nonce request. Provide the credential issuer base URL.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.RequestNonceRequest"
},
"examples" : {
"Request nonce from credential issuer" : {
"value" : {
"credentialIssuer" : "https://issuer.example.org"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.RequestNonceResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/sign-proof" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Isolated: sign a proof-of-possession JWT",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_PROOF_OF_POSSESSION] \nOperation: 'wallet2-sign-proof' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nSigns a proof-of-possession JWT using the wallet's holder key. Requires credentialConfigurationId so the proof algorithm can be negotiated against that configuration's proof_types_supported from the issuer metadata at issuerUrl. Requires the wallet to have at least one key store or a static key. Pass clientId so the proof JWT iss claim matches the OAuth client_id used at the token endpoint; omit it for anonymous pre-authorized access. When this wallet has a linked client attester, iss is the wallet service path. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Proof-of-possession sign request. Provide issuerUrl and credentialConfigurationId so the algorithm is negotiated from issuer metadata. Include nonce when available. Use key for an inline JWK, keyReference for an enterprise KMS key, and did (inline) or didReference (Target path into a DID store) to produce a DID-bound proof; did takes precedence.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.wallet2.Wallet2SignProofRequest"
},
"examples" : {
"Inline key with nonce" : {
"value" : {
"issuerUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT",
"nonce" : "tZignsnFbp224",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
},
"Key reference (enterprise KMS)" : {
"value" : {
"issuerUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT",
"nonce" : "tZignsnFbp224",
"keyReference" : "org1.tenant1.kms.holder-key"
}
},
"DID-bound proof (inline key + DID)" : {
"value" : {
"issuerUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT",
"nonce" : "tZignsnFbp224",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
},
"did" : "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
}
},
"DID reference from store" : {
"value" : {
"issuerUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT",
"nonce" : "tZignsnFbp224",
"keyReference" : "org1.tenant1.kms.holder-key",
"didReference" : "org1.tenant1.didstore.holder-did"
}
},
"No nonce – issuer does not advertise a nonce endpoint" : {
"value" : {
"issuerUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT",
"key" : {
"type" : "jwk",
"jwk" : {
"kty" : "OKP",
"d" : "kdZ8pbtRpQ1jD6TBNJa-edK4q3zUDO3G-iTXwiuEGKk",
"crv" : "Ed25519",
"kid" : "h9Tzy1HYpSA3CQNhGc8EXovLcy0U0iuJxofYQGvhvlU",
"x" : "hwOPVGLOsUaI0zBBr7PCG5II2u_TnrC7MgMCW5catKk"
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.SignProofResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/fetch-credential" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Isolated: fetch a credential from the issuer's credential endpoint",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_RECEIVE_CREDENTIAL] \nOperation: 'wallet2-fetch-credential' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nFetches the credential(s) from the issuer using the access token and proof. Returns raw credential strings. When storeInWallet is true, the credentials are also stored in this wallet and counted against the license usage allowance. Pass credentialIssuerBaseUrl when storing so issuer display metadata (`issuerDisplay`) and credential labels are persisted the same way as the full receive path. If the issuer returns invalid_nonce, request a fresh nonce, sign a new proof, and repeat this step. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Credential fetch request. Provide credentialEndpoint, accessToken, credentialConfigurationId, and the proofJwt from sign-proof. Set storeInWallet=true and pass credentialIssuerBaseUrl to persist issuer display metadata.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.FetchCredentialRequest"
},
"examples" : {
"Stateless fetch – do not store" : {
"value" : {
"credentialEndpoint" : "https://issuer.example.org/credential",
"accessToken" : "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ3YWxsZXQtY2xpZW50In0.sig",
"credentialConfigurationId" : "UniversityDegree_JWT",
"proofJwt" : "eyJhbGciOiJFZERTQSIsInR5cCI6Im9wZW5pZDR2Y2ktcHJvb2Yrand0In0.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyIsImF1ZCI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUub3JnIiwiaWF0IjoxNzI0MDAwMDAwLCJub25jZSI6InRaaWduc25GYnAyMjQifQ.sig",
"storeInWallet" : false
}
},
"Fetch and store – with issuer metadata" : {
"value" : {
"credentialEndpoint" : "https://issuer.example.org/credential",
"accessToken" : "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ3YWxsZXQtY2xpZW50In0.sig",
"credentialConfigurationId" : "UniversityDegree_JWT",
"proofJwt" : "eyJhbGciOiJFZERTQSIsInR5cCI6Im9wZW5pZDR2Y2ktcHJvb2Yrand0In0.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyIsImF1ZCI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUub3JnIiwiaWF0IjoxNzI0MDAwMDAwLCJub25jZSI6InRaaWduc25GYnAyMjQifQ.sig",
"storeInWallet" : true,
"credentialIssuerBaseUrl" : "https://issuer.example.org"
}
},
"Fetch and store – with label override" : {
"value" : {
"credentialEndpoint" : "https://issuer.example.org/credential",
"accessToken" : "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ3YWxsZXQtY2xpZW50In0.sig",
"credentialConfigurationId" : "UniversityDegree_JWT",
"proofJwt" : "eyJhbGciOiJFZERTQSIsInR5cCI6Im9wZW5pZDR2Y2ktcHJvb2Yrand0In0.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3BibjhFR3RhMmRvSyIsImF1ZCI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUub3JnIiwiaWF0IjoxNzI0MDAwMDAwLCJub25jZSI6InRaaWduc25GYnAyMjQifQ.sig",
"storeInWallet" : true,
"credentialIssuerBaseUrl" : "https://issuer.example.org",
"label" : "My University Degree"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.FetchCredentialResult"
}
}
}
},
"400" : {
"description" : "The issuer rejected the credential request",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.openid4vci.errors.CredentialError"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/authorization-url" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Auth-code grant: generate authorization redirect URL",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_RESOLVE_OFFER] \nOperation: 'wallet2-authorization-url' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nResolves the offer and builds the OAuth 2.0 authorization URL for the authorization-code grant flow. The caller must redirect to this URL and capture the returned authorization code. The response includes credentialIssuerBaseUrl and credentialConfigurationId as caller-carried continuation data for later token and credential requests. Enterprise uses the wallet service path as client id. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Authorization URL generation request. Provide either offerUrl or offerJson. Set useScope=true for scope-based authorization (requires the issuer to publish a scope). PKCE is enabled by default (usePkce=true); the codeVerifier is returned for later use.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.GenerateAuthorizationUrlRequest"
},
"examples" : {
"From offer URL – authorization_details (default)" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123"
}
},
"From offer URL – scope-based request" : {
"value" : {
"offerUrl" : "openid-credential-offer://issuer.example.org/?credential_offer_uri=https%3A%2F%2Fissuer.example.org%2FcredentialOffer%3Fab123",
"useScope" : true
}
},
"From inline JSON offer – authorization code grant" : {
"value" : {
"offerJson" : {
"credential_issuer" : "https://issuer.example.org",
"credential_configuration_ids" : [ "UniversityDegree_JWT" ],
"grants" : {
"authorization_code" : {
"issuer_state" : "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyJ9.sig"
}
}
}
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.GenerateAuthorizationUrlResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/exchange-code" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Auth-code grant: exchange authorization code for access token",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_TOKEN_SEND_REQUEST] \nOperation: 'wallet2-exchange-code' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nExchanges the authorization code (from the redirect callback) for an access token. credentialIssuerBaseUrl is used to resolve authorization server metadata, including the token endpoint and supported token endpoint client authentication methods. If the issuer supports attestation-based client authentication, Enterprise uses the wallet key and linked client attester to create the token request headers automatically. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Authorization code exchange request. Provide the code from the redirect callback and credentialIssuerBaseUrl for AS metadata resolution. Include codeVerifier when PKCE was used during the authorization-url step.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ExchangeCodeRequest"
},
"examples" : {
"Basic code exchange" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuerBaseUrl" : "https://issuer.example.org"
}
},
"With PKCE code verifier" : {
"value" : {
"code" : "SplxlOBeZQQYbYS6WxSbIA",
"credentialIssuerBaseUrl" : "https://issuer.example.org",
"codeVerifier" : "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.RequestTokenResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v2/{target}/wallet-service-api/credentials/receive/deferred" : {
"post" : {
"tags" : [ "Service | Wallet2 Service - Issuance Isolated Steps" ],
"summary" : "Poll deferred credential endpoint",
"description" : "Permissions: ANY OF: [ES_WALLET_ISOLATED_RECEIVE_CREDENTIAL] \nOperation: 'wallet2-poll-deferred' \nAccepts targets: [Wallet2ServiceReference] \nRequires authentication. \n\n---\nPolls the issuer's deferred credential endpoint using the transaction ID returned by a previous /receive call. Returns the stored credential IDs once the issuer has issued them. Pass credentialIssuerBaseUrl (and optionally credentialConfigurationId) so issuer display metadata and labels are stored the same way as the full receive path. For more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Deferred credential poll request. Provide deferredCredentialEndpoint, transactionId, and accessToken from the original receive response. Pass credentialIssuerBaseUrl to persist issuer display metadata alongside the credential.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.PollDeferredRequest"
},
"examples" : {
"Basic deferred credential poll" : {
"value" : {
"deferredCredentialEndpoint" : "https://issuer.example.org/deferred",
"transactionId" : "8xLOxBtZp8",
"accessToken" : "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ3YWxsZXQtY2xpZW50In0.sig"
}
},
"With issuer URL for display metadata" : {
"value" : {
"deferredCredentialEndpoint" : "https://issuer.example.org/deferred",
"transactionId" : "8xLOxBtZp8",
"accessToken" : "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ3YWxsZXQtY2xpZW50In0.sig",
"credentialIssuerBaseUrl" : "https://issuer.example.org",
"credentialConfigurationId" : "UniversityDegree_JWT"
}
}
}
}
},
"required" : false
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.wallet2.handlers.ReceiveCredentialResult"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.x509-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, x509-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/configuration/view" : {
"get" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/configuration/update" : {
"put" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Vical Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/vical-service"
},
"examples" : {
"Update VICAL Service" : {
"value" : {
"type" : "vical-service",
"signingKeyId" : "waltid.kms.key",
"signerCertificateId" : "waltid.x509-store.signer-cert",
"signerCertificateChainIds" : [ "waltid.x509-store.signer-chain-root" ]
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/default-requests" : {
"get" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Vical Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"publish-vical" : {
"vicalProvider" : "Example VICAL Provider"
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Vical Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"publish-vical — provider name" : {
"value" : {
"vicalProvider" : "Example VICAL Provider"
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Vical Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"publish-vical — provider name" : {
"value" : {
"vicalProvider" : "Example VICAL Provider"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"publish-vical — provider name" : {
"value" : {
"vicalProvider" : "Example VICAL Provider"
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Vical Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/publish" : {
"post" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "Publish a new VICAL version",
"description" : "Permissions: ANY OF: [ES_VICAL_PUBLISH] \nOperation: 'publish-vical' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nSigns and stores a new signed VICAL version for the targeted VICAL service.\n\n**Publication behavior:**\n- The service reads all linked X.509 stores and includes all stored `vical-entry` certificates in the published VICAL\n- A successful publication creates a new published version that can be resolved through the registry endpoints\n- The response contains the stored version identifier path and the manifest data of the newly published version",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Publication request containing the top-level VICAL data supplied by the caller.\n\n**Fields:**\n- `vicalProvider`: provider string written into the published VICAL\n- `versionId`: optional registry-facing identifier; if omitted, a UUID is generated\n- `issuanceDate`: optional publication timestamp (defaults to current time if omitted)\n- `nextUpdate`: optional next planned update timestamp",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalPublicationRequest"
},
"examples" : {
"Explicit version id" : {
"value" : {
"vicalProvider" : "Example mDL Trust Provider",
"versionId" : "production-2026-03-23",
"issuanceDate" : "2026-03-23T10:15:30Z",
"nextUpdate" : "2026-04-23T10:15:30Z"
}
},
"Auto-generated version id" : {
"value" : {
"vicalProvider" : "Example mDL Trust Provider",
"issuanceDate" : "2026-03-23T10:15:30Z",
"nextUpdate" : "2026-04-23T10:15:30Z"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalPublicationResponse"
},
"examples" : {
"Published version" : {
"value" : {
"versionIdPath" : "org1.tenant1.vical-service.versions.production-2026-03-23",
"version" : "1.0",
"entryCount" : 3,
"vicalProvider" : "Example mDL Trust Provider",
"date" : "2026-03-23T10:15:30Z",
"vicalIssueId" : 12,
"nextUpdate" : "2026-04-23T10:15:30Z"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/versions/ids" : {
"get" : {
"tags" : [ "Service | VICAL Service | Publication Management" ],
"summary" : "List published VICAL version identifier targets",
"description" : "Permissions: ANY OF: [ES_VICAL_LIST] \nOperation: 'list-vical-ids' \nAccepts targets: [VicalServiceReference] \nRequires authentication. \n\n---\nReturns all published version identifier targets for the targeted VICAL service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "Target"
},
"title" : "ArrayList"
},
"examples" : {
"Published version targets" : {
"value" : [ "org1.tenant1.vical-service.versions.production-2026-03-20", "org1.tenant1.vical-service.versions.production-2026-03-23" ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/vical-service-api/latest" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve the latest published VICAL artifact",
"description" : "Permissions: None required \nOperation: 'vical-latest-artifact' \nNo target restriction. \n\n---\nRetrieves the signed artifact of the latest published VICAL version for the targeted VICAL service.\n\n**Artifact encoding:**\n- By default, the endpoint returns the signed VICAL as a hex-encoded string\n- Use the optional `format` query parameter to request `base64` or raw `cbor`",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "format",
"in" : "query",
"description" : "Optional artifact encoding.\n\nSupported values:\n- `hex`: hex-encoded signed VICAL artifact (default)\n- `base64`: Base64-encoded signed VICAL artifact\n- `cbor`: raw tagged CBOR bytes returned with `application/cbor`",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "hex"
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Hex artifact (default)" : {
"value" : "d28443a10126a1045820aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899"
},
"Base64 artifact" : {
"value" : "0oRDoQEmoQRYIKq7zN3u/wARIjNEVWZ3iJmqu8zd7v8AESIzRFVmd4iZ"
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/vical-service-api/latest/manifest" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve the manifest of the latest published VICAL version",
"description" : "Permissions: None required \nOperation: 'vical-latest-manifest' \nNo target restriction. \n\n---\nRetrieves the stored manifest describing the latest published VICAL version for the targeted VICAL service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalManifestResponse"
},
"examples" : {
"Version manifest" : {
"value" : {
"version" : "1.0",
"entryCount" : 3,
"vicalProvider" : "Example mDL Trust Provider",
"date" : "2026-03-23T10:15:30Z",
"vicalIssueId" : 12,
"nextUpdate" : "2026-04-23T10:15:30Z"
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/vical-service-api/latest/trust-material" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve the trust material of the latest published VICAL version",
"description" : "Permissions: None required \nOperation: 'vical-latest-trust-material' \nNo target restriction. \n\n---\nRetrieves the signer certificate and optional signer certificate chain snapshot stored alongside the latest\npublished VICAL version for the targeted VICAL service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalTrustMaterialResponse"
},
"examples" : {
"Trust material" : {
"value" : {
"signerCertificatePem" : "-----BEGIN CERTIFICATE-----\nMIIB4zCCAYmgAwIBAgIUGXdzY2JjYXNlLWV4YW1wbGUtMDAxMAoGCCqGSM49BAMC\nMCQxCzAJBgNVBAYTAkFUMRUwEwYDVQQDDAxFeGFtcGxlIFZJQ0FMMB4XDTI2MDMy\nMzEwMTUzMFoXDTI3MDMyMzEwMTUzMFowJDELMAkGA1UEBhMCQVQxFTATBgNVBAMM\nDEV4YW1wbGUgVklDQUwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARd3h1N5Qm3\nc8pM9v5RrQj6Hq7n1vZ2m8zjWQyW3m6vPq4QqzF7nT4qz2M5Wj0SZ3Q8n7c5mN4b\nvV2d9cP9s8Odo2MwYTAdBgNVHQ4EFgQUY2hhcGhhLXNpZ25lci1leGFtcGxlMAsG\nA1UdDwQEAwIHgDAPBgNVHRMBAf8EBTADAQH/MCIGA1UdEQQbMBmBF2V4YW1wbGVA\nd2FsdC5pZC5ldTAKBggqhkjOPQQDAgNIADBFAiEAk2pG4w7v0m7aQ7c0S5q1lS8L\ny9vQ1r8m8N6T2lB6pQACIA0m4pL4Q8B9Q0g1Q2E6nU5Zx7J5R6F4u3k2l1u9Y2lN\n-----END CERTIFICATE-----",
"signerCertificateChainPem" : [ "-----BEGIN CERTIFICATE-----\nMIIB8TCCAZegAwIBAgIUSW50ZXJtZWRpYXRlLWNlcnQtZXhhbXBsZTAKBggqhkjO\nPQQDAjAlMQswCQYDVQQGEwJBVDEWMBQGA1UEAwwNRXhhbXBsZSBSb290IENBMB4X\nDTI2MDMyMzEwMTUzMFoXDTMxMDMyMjEwMTUzMFowJDELMAkGA1UEBhMCQVQxFTAT\nBgNVBAMMDEV4YW1wbGUgVklDQUwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASF\n4m3dT6r2vN8q1S5r9b6x2t5w4m8p7c6n1l2q5v7r9c2m4t8w1x6y3z5r7n8m0p2q\nl4s6d8f0g2h4j6k8l0mwo2MwYTAdBgNVHQ4EFgQUaW50ZXJtZWRpYXRlLWNoYWlu\nLWV4YW1wbGUwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wIQYDVR0RBBow\nGIEWY2hhaW4tZXhhbXBsZUB3YWx0LmlkMAoGCCqGSM49BAMCA0gAMEUCIB0l0E5V\nR2xjR1xQx9R6Q2k7m5s6m8x2v4n6p8r0t2sPAiEAj5s7k9q1r3t5v7x9z1B3D5F7\nH9J1L3N5P7R9T1V3X5c=\n-----END CERTIFICATE-----" ]
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/vical-service-api/versions" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve a specific published VICAL artifact",
"description" : "Permissions: None required \nOperation: 'vical-version-get' \nNo target restriction. \n\n---\nRetrieves the signed artifact of one specific published VICAL version.\n\n**Artifact encoding:**\n- By default, the endpoint returns the signed VICAL as a hex-encoded string\n- Use the optional `format` query parameter to request `base64` or raw `cbor`",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "format",
"in" : "query",
"description" : "Optional artifact encoding.\n\nSupported values:\n- `hex`: hex-encoded signed VICAL artifact (default)\n- `base64`: Base64-encoded signed VICAL artifact\n- `cbor`: raw tagged CBOR bytes returned with `application/cbor`",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "hex"
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Hex artifact (default)" : {
"value" : "d28443a10126a1045820aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899"
},
"Base64 artifact" : {
"value" : "0oRDoQEmoQRYIKq7zN3u/wARIjNEVWZ3iJmqu8zd7v8AESIzRFVmd4iZ"
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/vical-service-api/versions/manifest" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve the manifest of a specific published VICAL version",
"description" : "Permissions: None required \nOperation: 'vical-version-manifest-get' \nNo target restriction. \n\n---\nRetrieves the manifest stored for one specific published VICAL version.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalManifestResponse"
},
"examples" : {
"Version manifest" : {
"value" : {
"version" : "1.0",
"entryCount" : 3,
"vicalProvider" : "Example mDL Trust Provider",
"date" : "2026-03-23T10:15:30Z",
"vicalIssueId" : 12,
"nextUpdate" : "2026-04-23T10:15:30Z"
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/vical-service-api/versions/trust-material" : {
"get" : {
"tags" : [ "Service | VICAL Service | Public Registry" ],
"summary" : "Resolve the trust material of a specific published VICAL version",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nRetrieves the signer certificate and optional signer certificate chain snapshot stored for one specific\npublished VICAL version.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.vical.models.controller.VicalTrustMaterialResponse"
},
"examples" : {
"Trust material" : {
"value" : {
"signerCertificatePem" : "-----BEGIN CERTIFICATE-----\nMIIB4zCCAYmgAwIBAgIUGXdzY2JjYXNlLWV4YW1wbGUtMDAxMAoGCCqGSM49BAMC\nMCQxCzAJBgNVBAYTAkFUMRUwEwYDVQQDDAxFeGFtcGxlIFZJQ0FMMB4XDTI2MDMy\nMzEwMTUzMFoXDTI3MDMyMzEwMTUzMFowJDELMAkGA1UEBhMCQVQxFTATBgNVBAMM\nDEV4YW1wbGUgVklDQUwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARd3h1N5Qm3\nc8pM9v5RrQj6Hq7n1vZ2m8zjWQyW3m6vPq4QqzF7nT4qz2M5Wj0SZ3Q8n7c5mN4b\nvV2d9cP9s8Odo2MwYTAdBgNVHQ4EFgQUY2hhcGhhLXNpZ25lci1leGFtcGxlMAsG\nA1UdDwQEAwIHgDAPBgNVHRMBAf8EBTADAQH/MCIGA1UdEQQbMBmBF2V4YW1wbGVA\nd2FsdC5pZC5ldTAKBggqhkjOPQQDAgNIADBFAiEAk2pG4w7v0m7aQ7c0S5q1lS8L\ny9vQ1r8m8N6T2lB6pQACIA0m4pL4Q8B9Q0g1Q2E6nU5Zx7J5R6F4u3k2l1u9Y2lN\n-----END CERTIFICATE-----",
"signerCertificateChainPem" : [ "-----BEGIN CERTIFICATE-----\nMIIB8TCCAZegAwIBAgIUSW50ZXJtZWRpYXRlLWNlcnQtZXhhbXBsZTAKBggqhkjO\nPQQDAjAlMQswCQYDVQQGEwJBVDEWMBQGA1UEAwwNRXhhbXBsZSBSb290IENBMB4X\nDTI2MDMyMzEwMTUzMFoXDTMxMDMyMjEwMTUzMFowJDELMAkGA1UEBhMCQVQxFTAT\nBgNVBAMMDEV4YW1wbGUgVklDQUwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASF\n4m3dT6r2vN8q1S5r9b6x2t5w4m8p7c6n1l2q5v7r9c2m4t8w1x6y3z5r7n8m0p2q\nl4s6d8f0g2h4j6k8l0mwo2MwYTAdBgNVHQ4EFgQUaW50ZXJtZWRpYXRlLWNoYWlu\nLWV4YW1wbGUwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wIQYDVR0RBBow\nGIEWY2hhaW4tZXhhbXBsZUB3YWx0LmlkMAoGCCqGSM49BAMCA0gAMEUCIB0l0E5V\nR2xjR1xQx9R6Q2k7m5s6m8x2v4n6p8r0t2sPAiEAj5s7k9q1r3t5v7x9z1B3D5F7\nH9J1L3N5P7R9T1V3X5c=\n-----END CERTIFICATE-----" ]
}
}
}
}
}
}
},
"deprecated" : false
}
},
"/v1/{target}/x509-service-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.x509-store.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, x509-store)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove x509-store dependency" : {
"value" : {
"dependency" : "waltid.tenant1.x509-store.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/default-requests" : {
"get" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for X509Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"create-iaca-certificate" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"create-document-signer-certificate" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
},
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl.example.com",
"issuerAltNameUri" : "https://iaca.example.com"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of X509Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-iaca-certificate — org identity and KMS key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of X509Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-iaca-certificate — org identity and KMS key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
}
},
"create-document-signer-certificate — subject, CRL, and keys" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
},
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl.example.com",
"issuerAltNameUri" : "https://iaca.example.com"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"create-iaca-certificate — org identity and KMS key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of X509Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/csrs" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create a PKCS#10 certificate signing request.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_CREATE_CSR] \nOperation: 'create-csr' \nAccepts targets: [X509ServiceReference] \nRequires authentication. \n\n---\nCreates a stateless PKCS#10 CSR from a subject key descriptor.\n\nThe service does not persist CSR state. Clients submit the returned `csrPEM` later as a subject public key source when creating a certificate.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Profile-specific CSR creation request. Use `generic` for arbitrary X.509 subjects or `iso-document-signer` for ISO mDL Document Signer profile subjects.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.csr.LegacyCreateCsrRequest"
},
"examples" : {
"Generic CSR: subject metadata & signing key hosted in linked KMS" : {
"value" : {
"type" : "generic",
"subjectKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
},
"subjectName" : {
"commonName" : "Example Leaf",
"country" : "US",
"organizationName" : "Example Org"
},
"subjectAlternativeNames" : {
"dnsNames" : [ "leaf.example.com" ]
}
}
},
"Generic CSR: subject metadata & JWK-encoded signing key" : {
"value" : {
"type" : "generic",
"subjectKeyDescriptor" : {
"type" : "jwk-encoded-key-descriptor",
"jwk" : {
"kty" : "EC",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"crv" : "P-256",
"kid" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
},
"subjectName" : {
"commonName" : "Example Leaf",
"country" : "US"
}
}
},
"ISO Document Signer CSR: profile metadata & signing key hosted in linked KMS" : {
"value" : {
"type" : "iso-document-signer",
"subjectKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "CSR PEM and parsed CSR metadata.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.csr.CreateCsrResponse"
},
"examples" : {
"Generic CSR response" : {
"value" : {
"csrPEM" : "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...example...\n-----END CERTIFICATE REQUEST-----",
"csrData" : {
"subjectName" : {
"commonName" : "Example Leaf",
"country" : "US",
"organizationName" : "Example Org"
},
"subjectAlternativeNames" : {
"dnsNames" : [ "leaf.example.com" ]
},
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/certificates" : {
"put" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create a X.509 certificate.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_UPSERT_CERTIFICATE] \nOperation: 'upsert-certificate' \nAccepts parent targets: [X509ServiceReference] \nRequires authentication. \n\n---\nCreates or updates a X.509 CA or leaf certificate.\n\nThe subject public key can be supplied directly through a key reference or JWK or by submitting a CSR PEM.\nCSR signature is verified before the certificate is issued. Fulfilled certificates are optionally stored in \nattached X.509 store(s).\n\nID of the certificate must be set by using a child target reference of the service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Request payload for creating a new certificate or update an existing certificate\\n\n \nRequest body attributes :\n\nStore persistence:\n\n- `upsertStrategy`: strategy controlling how an already existing certificate is updated across the attached store(s).\n- `successStrategy`: strategy determining when a multi-store persist operation is considered successful.\n- `storeRef`: target reference of the X.509 store to persist the certificate in (e.g., `org.tenant.x509-store-1`). When omitted, certificate is stored in accordance with updateStrategy.\n\nCertificate creation:\n- `certificateProfile`: name of the certificate profile to apply; the certificate is created in accordance with this profile (e.g., 'iso-iaca-root','iso-document-signer','etsi-pid-provider','etsi-wallet-provider','etsi-wrpac','etsi-wrprc').\n- `signatureAlgorithm`: signature algorithm used to sign the certificate (`SignatureAlgorithm`, optional). Defaults to an algorithm derived from the issuer key.\n\nIssuer (signing) key & issuer DN:\n- `issuerKeyRef`: target key reference of the issuer/signing key (e.g., `org.tenant.key-1`).\n- `issuerKeyJwk`: JWK-encoded issuer/signing key. Mutually exclusive with `issuerKeyRef`.\n- `selfSigned`: set to `true` to produce a self-signed certificate (issuer key equals subject key). Defaults to `false`.\n- `issuerCertificateRef`: issuer certificate target reference; used to copy the issuer's subject DN into the new certificate's issuer DN.\n- `issuerCertificatePem`: issuer certificate PEM; used to copy the issuer's subject DN into the new certificate's issuer DN.\n\nSubject public key & subject DN:\n- `csrPem`: PKCS#10 CSR PEM to create the certificate from. Subject DN and subject alternative names are extracted from the CSR and its signature is verified for proof-of-possession.\n- `subjectKeyRef`: target key reference to use for the certificate subject key (e.g., `org.tenant.key-1`).\n- `subjectKeyJwk`: JWK to use for the certificate subject key.\n- `subjectDn`: subject DN to use for the certificate (e.g., `CN=Example Leaf,O=Example,C=US`). Must not be set when a CSR is provided.\n\nValidity (required):\n- `validFrom`: certificate validity start (`notBefore`), ISO-8601 instant.\n- `validTo`: certificate validity end (`notAfter`), ISO-8601 instant.\n\nExtensions:\n- `keyUsage`: [Key Usage] set of key usage bits (e.g., `keyCertSign`, `cRLSign`, `digitalSignature`).\n- `extendedKeyUsageOids`: [Extended Key Usage] set of OID strings identifying extended key usages.\n- `basicConstraintsCa`: [Basic Constraints] CA flag; `true` for CA certificates.\n- `basicConstraintsPathLength`: [Basic Constraints] maximum number of intermediate CA certificates permitted below this certificate.\n- `subjectAlternativeNames`: [Subject Alternative Name] list of SAN entries. Overrides the SANs extracted from the CSR when both are present.\n- `issuerAlternativeNames`: [Issuer Alternative Name] list of IAN entries.\n- `crlDistributionPointUri`: [CRL Distribution Points] URI of the CRL distribution point (e.g., `http://crl.example.com/ca.crl`).\n- `authorityInfoAccessCaIssuerUris`: [Authority Information Access] URI(s) of the CA issuer access location(s).\n- `authorityInfoAccessOcspResponderUris`: [Authority Information Access] URI(s) of the OCSP responder access location(s).\n- `certificatePolicyOids`: [Certificate Policies] list of policy OID strings asserted by the certificate (e.g., a TSP-defined or ETSI policy OID).\n- `qcStatements`: [QC Statements] qualified certificate statements (`QcStatementsData`, optional):\n - `qcCompliance`: certificate is a qualified certificate (QcCompliance statement). Defaults to `false`.\n - `qcSscd`: the private key resides in a qualified signature/seal creation device (QcSSCD statement). Defaults to `false`.\n - `qcTypeOids`: OID(s) naming the certificate type(s) asserted by the QcType statement (e.g., `id-etsi-qct-esign`/`-eseal`/`-web`).\n - `otherStatementIds`: additional statement OIDs not covered above; `statementInfo` is not supported and is omitted.\n\nMetadata:\n- `metadata`: additional JSON metadata to attach to the stored certificate.\n\nIn addition to the caller-supplied `metadata`, the service evaluates the request and attaches the following entries to the stored certificate. They are merged on top of `metadata`, so an automatically added entry overrides a caller-supplied entry with the same key:\n- `issuerKeyRef`: target reference of the resolved issuer/signing key. Omitted when the issuer key is supplied as a JWK (`issuerKeyJwk`).\n- `subjectKeyRef`: target reference of the resolved subject key. Omitted when the subject key is supplied as a JWK (`subjectKeyJwk`) or extracted from a CSR (`csrPem`). For a self-signed certificate this equals `issuerKeyRef`.\n- `issuerCertRef`: target reference of the resolved issuer certificate. Added only when the issuer is supplied via `issuerCertificateRef`.\n\nThe following `metadata` entries are read by the VICAL service when it builds a VICAL from the self-signed IACA certificates in linked X.509 store(s). An IACA certificate is included as a VICAL entry only when its metadata contains a non-empty `vicalDocType`. Provide them as part of `metadata` (they are not added automatically):\n- `vicalDocType`: JSON array of mdoc document type strings the IACA is authorized to issue (e.g., `[\"org.iso.18013.5.1.mDL\"]`). Required for the certificate to appear in a VICAL.\n\n`GeneralName` entry (used by `subjectAlternativeNames` and `issuerAlternativeNames`):\n- `type`: one of `dnsName`, `email`, `uri`, `ipAddress`.\n- `name`: the general name value (e.g., `leaf.example.com`, `ca@example.com`, `https://iaca.example.com`, `192.0.2.1`). \n ",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.UpsertGeneratedCertificateRequest"
},
"examples" : {
"Minimal required data fields" : {
"value" : {
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example Root CA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-01-01T00:00:00Z"
}
},
"Self-signed IACA root certificate (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-iaca-root",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example IACA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2036-09-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
}, {
"type" : "email",
"name" : "iaca@example.com"
} ],
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ]
}
}
},
"IACA-issued Document Signer certificate (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-iaca",
"subjectKeyRef" : "my-org.tenant.ds-key-id-01",
"subjectDn" : "cn=Example Document Signer, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"Self-signed IACA root certificate & JWK-encoded subject key (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-iaca-root",
"selfSigned" : true,
"subjectKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
},
"subjectDn" : "cn=Example IACA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2036-09-01T00:00:00Z",
"basicConstraintsPathLength" : 0,
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "https://crl.example.com/iaca.crl",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ]
}
}
},
"IACA-issued Document Signer certificate & issuer certificate PEM (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerKeyRef" : "my-org.tenant.iaca-key-id-01",
"issuerCertificatePem" : "-----BEGIN CERTIFICATE-----\nMIIB...placeholder...\n-----END CERTIFICATE-----",
"subjectKeyRef" : "my-org.tenant.ds-key-id-01",
"subjectDn" : "cn=Example Document Signer, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"IACA-issued Document Signer certificate & CSR-verified subject key (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-iaca",
"csrPem" : "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...placeholder...\n-----END CERTIFICATE REQUEST-----",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"Self-signed ETSI PID Provider certificate (ETSI TS 119 412-6)" : {
"value" : {
"certificateProfile" : "etsi-pid-provider",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example PID Provider, o=Example PID Provider AT, organizationIdentifier=VATAT-U12345678, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-09-01T00:00:00Z",
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.1.1" ]
}
},
"Self-signed ETSI Wallet Provider certificate (ETSI TS 119 412-6)" : {
"value" : {
"certificateProfile" : "etsi-wallet-provider",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example Wallet Provider, o=Example Wallet Provider AT, organizationIdentifier=VATAT-U87654321, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-09-01T00:00:00Z",
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.2.1" ]
}
},
"CA-issued ETSI Wallet Relying Party Access Certificate (ETSI TS 119 411-8)" : {
"value" : {
"certificateProfile" : "etsi-wrpac",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-wrp-national-provider",
"subjectKeyRef" : "my-org.tenant.wrp-key-id-01",
"subjectDn" : "cn=Example Relying Party, o=Example Relying Party AT, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-09-01T00:00:00Z",
"subjectAlternativeNames" : [ {
"type" : "uri",
"name" : "https://relying-party.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/wrpac.crl",
"authorityInfoAccessCaIssuerUris" : [ "http://ca.example.com/wrp-national-provider.crt" ],
"certificatePolicyOids" : [ "0.4.0.194118.1.2" ]
}
},
"CA-issued ETSI Wallet Relying Party Registration Certificate (ETSI TS 119 475)" : {
"value" : {
"certificateProfile" : "etsi-wrprc",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-wrp-national-provider",
"subjectKeyRef" : "my-org.tenant.wrp-key-id-02",
"subjectDn" : "cn=Example Relying Party, o=Example Relying Party AT, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-09-01T00:00:00Z",
"authorityInfoAccessCaIssuerUris" : [ "http://ca.example.com/wrp-national-provider.crt" ],
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.3.1" ]
}
},
"Required data fields, VICAL metadata & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"subjectDn" : "C=US,CN=Example IACA",
"finalNotBefore" : {
"epochSeconds" : 1790867966,
"nanosecondsOfSecond" : 953058614
},
"finalNotAfter" : {
"epochSeconds" : 2421587966,
"nanosecondsOfSecond" : 953202837
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
},
"vicalEntryComplementaryMetadata" : {
"docType" : [ "org.iso.18013.5.1.mDL" ],
"certificateProfile" : [ "org.iso.18013.5.1.iaca" ],
"jsonMetaData" : {
"vicalDocType" : [ {
"content" : "org.iso.18013.5.1.mDL",
"string" : true
} ],
"vicalCertProfile" : [ {
"content" : "org.iso.18013.5.1.iaca",
"string" : true
} ]
}
}
}
},
"Required data fields & JWK-encoded signing key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"subjectDn" : "C=US,CN=Example IACA",
"finalNotBefore" : {
"epochSeconds" : 1790867966,
"nanosecondsOfSecond" : 955587390
},
"finalNotAfter" : {
"epochSeconds" : 2421587966,
"nanosecondsOfSecond" : 955617049
}
},
"iacaKeyDesc" : {
"jwk" : {
"kty" : {
"content" : "EC",
"string" : true
},
"d" : {
"content" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"string" : true
},
"crv" : {
"content" : "P-256",
"string" : true
},
"kid" : {
"content" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"string" : true
},
"x" : {
"content" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"string" : true
},
"y" : {
"content" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io",
"string" : true
}
}
}
}
},
"Custom validity period & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "DE",
"commonName" : "Bundesdruckerei IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://ca.bund.de"
},
"notBefore" : {
"epochSeconds" : 1748434981,
"nanosecondsOfSecond" : 0
},
"notAfter" : {
"epochSeconds" : 2221474981,
"nanosecondsOfSecond" : 0
},
"subjectDn" : "C=DE,CN=Bundesdruckerei IACA",
"finalNotBefore" : {
"epochSeconds" : 1748434981,
"nanosecondsOfSecond" : 0
},
"finalNotAfter" : {
"epochSeconds" : 2221474981,
"nanosecondsOfSecond" : 0
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
},
"All data fields & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "GR",
"commonName" : "Η καλυτερότερη αρχή πιστοποίησης στον κόσμο",
"issuerAlternativeNameConf" : {
"email" : "iaca@gov.gr",
"uri" : "https://iaca.gov.gr"
},
"stateOrProvinceName" : "Αττική",
"organizationName" : "Υπουργείο Μεταφορών",
"notBefore" : {
"epochSeconds" : 1735689600,
"nanosecondsOfSecond" : 0
},
"notAfter" : {
"epochSeconds" : 2240611200,
"nanosecondsOfSecond" : 0
},
"crlDistributionPointUri" : "https://crl.gov.gr/iaca.crl",
"subjectDn" : "C=GR,CN=Η καλυτερότερη αρχή πιστοποίησης στον κόσμο,ST=Αττική,O=Υπουργείο Μεταφορών",
"finalNotBefore" : {
"epochSeconds" : 1735689600,
"nanosecondsOfSecond" : 0
},
"finalNotAfter" : {
"epochSeconds" : 2240611200,
"nanosecondsOfSecond" : 0
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Successful certificate update response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.UpsertCertificateResponse"
}
}
}
},
"201" : {
"description" : "Successful certificate creation response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.UpsertCertificateResponse"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create a X.509 certificate.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_CREATE_CERTIFICATE] \nOperation: 'create-certificate' \nRequires authentication. \n\n---\nCreates a generic X.509 CA or leaf certificate.\n\nThe subject public key can be supplied directly through a key reference or JWK or by submitting a CSR PEM.\nCSR signature is verified before the certificate is issued. Fulfilled certificates are optionally stored in \nattached X.509 store(s).\n\nID of the certificate can be set by using a child target reference of the service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Request payload for creating a new certificate \\n\n \nRequest body attributes :\n\nStore persistence:\n- `createStrategy`: strategy controlling how the certificate is created across the attached X.509 store(s).\n\n- `successStrategy`: strategy determining when a multi-store persist operation is considered successful.\n- `storeRef`: target reference of the X.509 store to persist the certificate in (e.g., `org.tenant.x509-store-1`). When omitted, certificate is stored in accordance with createStrategy.\n\nCertificate creation:\n- `certificateProfile`: name of the certificate profile to apply; the certificate is created in accordance with this profile (e.g., 'iso-iaca-root','iso-document-signer','etsi-pid-provider','etsi-wallet-provider','etsi-wrpac','etsi-wrprc').\n- `signatureAlgorithm`: signature algorithm used to sign the certificate (`SignatureAlgorithm`, optional). Defaults to an algorithm derived from the issuer key.\n\nIssuer (signing) key & issuer DN:\n- `issuerKeyRef`: target key reference of the issuer/signing key (e.g., `org.tenant.key-1`).\n- `issuerKeyJwk`: JWK-encoded issuer/signing key. Mutually exclusive with `issuerKeyRef`.\n- `selfSigned`: set to `true` to produce a self-signed certificate (issuer key equals subject key). Defaults to `false`.\n- `issuerCertificateRef`: issuer certificate target reference; used to copy the issuer's subject DN into the new certificate's issuer DN.\n- `issuerCertificatePem`: issuer certificate PEM; used to copy the issuer's subject DN into the new certificate's issuer DN.\n\nSubject public key & subject DN:\n- `csrPem`: PKCS#10 CSR PEM to create the certificate from. Subject DN and subject alternative names are extracted from the CSR and its signature is verified for proof-of-possession.\n- `subjectKeyRef`: target key reference to use for the certificate subject key (e.g., `org.tenant.key-1`).\n- `subjectKeyJwk`: JWK to use for the certificate subject key.\n- `subjectDn`: subject DN to use for the certificate (e.g., `CN=Example Leaf,O=Example,C=US`). Must not be set when a CSR is provided.\n\nValidity (required):\n- `validFrom`: certificate validity start (`notBefore`), ISO-8601 instant.\n- `validTo`: certificate validity end (`notAfter`), ISO-8601 instant.\n\nExtensions:\n- `keyUsage`: [Key Usage] set of key usage bits (e.g., `keyCertSign`, `cRLSign`, `digitalSignature`).\n- `extendedKeyUsageOids`: [Extended Key Usage] set of OID strings identifying extended key usages.\n- `basicConstraintsCa`: [Basic Constraints] CA flag; `true` for CA certificates.\n- `basicConstraintsPathLength`: [Basic Constraints] maximum number of intermediate CA certificates permitted below this certificate.\n- `subjectAlternativeNames`: [Subject Alternative Name] list of SAN entries. Overrides the SANs extracted from the CSR when both are present.\n- `issuerAlternativeNames`: [Issuer Alternative Name] list of IAN entries.\n- `crlDistributionPointUri`: [CRL Distribution Points] URI of the CRL distribution point (e.g., `http://crl.example.com/ca.crl`).\n- `authorityInfoAccessCaIssuerUris`: [Authority Information Access] URI(s) of the CA issuer access location(s).\n- `authorityInfoAccessOcspResponderUris`: [Authority Information Access] URI(s) of the OCSP responder access location(s).\n- `certificatePolicyOids`: [Certificate Policies] list of policy OID strings asserted by the certificate (e.g., a TSP-defined or ETSI policy OID).\n- `qcStatements`: [QC Statements] qualified certificate statements (`QcStatementsData`, optional):\n - `qcCompliance`: certificate is a qualified certificate (QcCompliance statement). Defaults to `false`.\n - `qcSscd`: the private key resides in a qualified signature/seal creation device (QcSSCD statement). Defaults to `false`.\n - `qcTypeOids`: OID(s) naming the certificate type(s) asserted by the QcType statement (e.g., `id-etsi-qct-esign`/`-eseal`/`-web`).\n - `otherStatementIds`: additional statement OIDs not covered above; `statementInfo` is not supported and is omitted.\n\nMetadata:\n- `metadata`: additional JSON metadata to attach to the stored certificate.\n\nIn addition to the caller-supplied `metadata`, the service evaluates the request and attaches the following entries to the stored certificate. They are merged on top of `metadata`, so an automatically added entry overrides a caller-supplied entry with the same key:\n- `issuerKeyRef`: target reference of the resolved issuer/signing key. Omitted when the issuer key is supplied as a JWK (`issuerKeyJwk`).\n- `subjectKeyRef`: target reference of the resolved subject key. Omitted when the subject key is supplied as a JWK (`subjectKeyJwk`) or extracted from a CSR (`csrPem`). For a self-signed certificate this equals `issuerKeyRef`.\n- `issuerCertRef`: target reference of the resolved issuer certificate. Added only when the issuer is supplied via `issuerCertificateRef`.\n\nThe following `metadata` entries are read by the VICAL service when it builds a VICAL from the self-signed IACA certificates in linked X.509 store(s). An IACA certificate is included as a VICAL entry only when its metadata contains a non-empty `vicalDocType`. Provide them as part of `metadata` (they are not added automatically):\n- `vicalDocType`: JSON array of mdoc document type strings the IACA is authorized to issue (e.g., `[\"org.iso.18013.5.1.mDL\"]`). Required for the certificate to appear in a VICAL.\n\n`GeneralName` entry (used by `subjectAlternativeNames` and `issuerAlternativeNames`):\n- `type`: one of `dnsName`, `email`, `uri`, `ipAddress`.\n- `name`: the general name value (e.g., `leaf.example.com`, `ca@example.com`, `https://iaca.example.com`, `192.0.2.1`). \n ",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.UpsertGeneratedCertificateRequest"
},
"examples" : {
"Minimal required data fields" : {
"value" : {
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example Root CA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-01-01T00:00:00Z"
}
},
"Self-signed IACA root certificate (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-iaca-root",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example IACA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2036-09-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
}, {
"type" : "email",
"name" : "iaca@example.com"
} ],
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ]
}
}
},
"IACA-issued Document Signer certificate (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-iaca",
"subjectKeyRef" : "my-org.tenant.ds-key-id-01",
"subjectDn" : "cn=Example Document Signer, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"Self-signed IACA root certificate & JWK-encoded subject key (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-iaca-root",
"selfSigned" : true,
"subjectKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
},
"subjectDn" : "cn=Example IACA, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2036-09-01T00:00:00Z",
"basicConstraintsPathLength" : 0,
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "https://crl.example.com/iaca.crl",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ]
}
}
},
"IACA-issued Document Signer certificate & issuer certificate PEM (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerKeyRef" : "my-org.tenant.iaca-key-id-01",
"issuerCertificatePem" : "-----BEGIN CERTIFICATE-----\nMIIB...placeholder...\n-----END CERTIFICATE-----",
"subjectKeyRef" : "my-org.tenant.ds-key-id-01",
"subjectDn" : "cn=Example Document Signer, o=Example, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"IACA-issued Document Signer certificate & CSR-verified subject key (ISO/IEC 18013-5)" : {
"value" : {
"certificateProfile" : "iso-document-signer",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-iaca",
"csrPem" : "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...placeholder...\n-----END CERTIFICATE REQUEST-----",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-11-01T00:00:00Z",
"issuerAlternativeNames" : [ {
"type" : "uri",
"name" : "https://iaca.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/ds.crl"
}
},
"Self-signed ETSI PID Provider certificate (ETSI TS 119 412-6)" : {
"value" : {
"certificateProfile" : "etsi-pid-provider",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example PID Provider, o=Example PID Provider AT, organizationIdentifier=VATAT-U12345678, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-09-01T00:00:00Z",
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.1.1" ]
}
},
"Self-signed ETSI Wallet Provider certificate (ETSI TS 119 412-6)" : {
"value" : {
"certificateProfile" : "etsi-wallet-provider",
"selfSigned" : true,
"subjectKeyRef" : "my-org.tenant.key-id-01",
"subjectDn" : "cn=Example Wallet Provider, o=Example Wallet Provider AT, organizationIdentifier=VATAT-U87654321, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2031-09-01T00:00:00Z",
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.2.1" ]
}
},
"CA-issued ETSI Wallet Relying Party Access Certificate (ETSI TS 119 411-8)" : {
"value" : {
"certificateProfile" : "etsi-wrpac",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-wrp-national-provider",
"subjectKeyRef" : "my-org.tenant.wrp-key-id-01",
"subjectDn" : "cn=Example Relying Party, o=Example Relying Party AT, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-09-01T00:00:00Z",
"subjectAlternativeNames" : [ {
"type" : "uri",
"name" : "https://relying-party.example.com"
} ],
"crlDistributionPointUri" : "http://crl.example.com/wrpac.crl",
"authorityInfoAccessCaIssuerUris" : [ "http://ca.example.com/wrp-national-provider.crt" ],
"certificatePolicyOids" : [ "0.4.0.194118.1.2" ]
}
},
"CA-issued ETSI Wallet Relying Party Registration Certificate (ETSI TS 119 475)" : {
"value" : {
"certificateProfile" : "etsi-wrprc",
"issuerCertificateRef" : "my-org.tenant.x509-service.example-wrp-national-provider",
"subjectKeyRef" : "my-org.tenant.wrp-key-id-02",
"subjectDn" : "cn=Example Relying Party, o=Example Relying Party AT, c=AT",
"validFrom" : "2026-09-01T00:00:00Z",
"validTo" : "2027-09-01T00:00:00Z",
"authorityInfoAccessCaIssuerUris" : [ "http://ca.example.com/wrp-national-provider.crt" ],
"certificatePolicyOids" : [ "1.3.6.1.4.1.55555.3.1" ]
}
},
"Required data fields, VICAL metadata & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"subjectDn" : "C=US,CN=Example IACA",
"finalNotBefore" : {
"epochSeconds" : 1790867966,
"nanosecondsOfSecond" : 958235467
},
"finalNotAfter" : {
"epochSeconds" : 2421587966,
"nanosecondsOfSecond" : 958269166
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
},
"vicalEntryComplementaryMetadata" : {
"docType" : [ "org.iso.18013.5.1.mDL" ],
"certificateProfile" : [ "org.iso.18013.5.1.iaca" ],
"jsonMetaData" : {
"vicalDocType" : [ {
"content" : "org.iso.18013.5.1.mDL",
"string" : true
} ],
"vicalCertProfile" : [ {
"content" : "org.iso.18013.5.1.iaca",
"string" : true
} ]
}
}
}
},
"Required data fields & JWK-encoded signing key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"subjectDn" : "C=US,CN=Example IACA",
"finalNotBefore" : {
"epochSeconds" : 1790867966,
"nanosecondsOfSecond" : 958362720
},
"finalNotAfter" : {
"epochSeconds" : 2421587966,
"nanosecondsOfSecond" : 958370039
}
},
"iacaKeyDesc" : {
"jwk" : {
"kty" : {
"content" : "EC",
"string" : true
},
"d" : {
"content" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"string" : true
},
"crv" : {
"content" : "P-256",
"string" : true
},
"kid" : {
"content" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"string" : true
},
"x" : {
"content" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"string" : true
},
"y" : {
"content" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io",
"string" : true
}
}
}
}
},
"Custom validity period & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "DE",
"commonName" : "Bundesdruckerei IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://ca.bund.de"
},
"notBefore" : {
"epochSeconds" : 1748434981,
"nanosecondsOfSecond" : 0
},
"notAfter" : {
"epochSeconds" : 2221474981,
"nanosecondsOfSecond" : 0
},
"subjectDn" : "C=DE,CN=Bundesdruckerei IACA",
"finalNotBefore" : {
"epochSeconds" : 1748434981,
"nanosecondsOfSecond" : 0
},
"finalNotAfter" : {
"epochSeconds" : 2221474981,
"nanosecondsOfSecond" : 0
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
},
"All data fields & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "GR",
"commonName" : "Η καλυτερότερη αρχή πιστοποίησης στον κόσμο",
"issuerAlternativeNameConf" : {
"email" : "iaca@gov.gr",
"uri" : "https://iaca.gov.gr"
},
"stateOrProvinceName" : "Αττική",
"organizationName" : "Υπουργείο Μεταφορών",
"notBefore" : {
"epochSeconds" : 1735689600,
"nanosecondsOfSecond" : 0
},
"notAfter" : {
"epochSeconds" : 2240611200,
"nanosecondsOfSecond" : 0
},
"crlDistributionPointUri" : "https://crl.gov.gr/iaca.crl",
"subjectDn" : "C=GR,CN=Η καλυτερότερη αρχή πιστοποίησης στον κόσμο,ST=Αττική,O=Υπουργείο Μεταφορών",
"finalNotBefore" : {
"epochSeconds" : 1735689600,
"nanosecondsOfSecond" : 0
},
"finalNotAfter" : {
"epochSeconds" : 2240611200,
"nanosecondsOfSecond" : 0
}
},
"iacaKeyDesc" : {
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Successful certificate creation response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.UpsertCertificateResponse"
}
}
}
},
"409" : {
"description" : "Certificate already exists.",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/certificate" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create a generic X.509 certificate.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_CREATE_CERTIFICATE] \nOperation: 'create-generic-certificate' \nRequires authentication. \n\n---\nCreates a generic X.509 CA or leaf certificate.\n\nThe subject public key can be supplied directly through a key descriptor or by submitting a CSR PEM.\nCSR input is verified for proof-of-possession before the certificate is issued. Fulfilled certificates are optionally stored in attached X.509 stores using the same storage semantics as ISO certificate creation.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Generic X.509 certificate creation request. The subject public key is supplied via `subjectPublicKeySource` (key descriptor or CSR PEM). The issuer is either self-signed or CA-signed using an issuer key descriptor.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.generic.GenericCreateCertificateRequest"
},
"examples" : {
"Self-signed leaf: signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"subjectName" : {
"commonName" : "Example Leaf",
"country" : "US"
},
"keyUsage" : [ "DigitalSignature" ]
},
"subjectPublicKeySource" : {
"type" : "key-descriptor",
"keyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.leaf-secp256r1"
}
},
"issuer" : {
"type" : "self-signed"
}
}
},
"CA-signed leaf: issuer and subject keys hosted in linked KMS" : {
"value" : {
"certificateData" : {
"subjectName" : {
"commonName" : "Example Intermediate CA",
"country" : "US"
},
"isCertificateAuthority" : true,
"pathLengthConstraint" : 0,
"keyUsage" : [ "KeyCertSign", "CRLSign" ]
},
"subjectPublicKeySource" : {
"type" : "key-descriptor",
"keyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"issuer" : {
"type" : "ca-signed",
"issuerKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.root-secp256r1"
}
}
}
},
"CA-signed leaf: subject key from CSR PEM (documentation placeholder)" : {
"value" : {
"storedCertificateId" : "generic-leaf-01",
"certificateData" : {
"subjectName" : {
"commonName" : "Example Leaf From CSR",
"country" : "US"
},
"keyUsage" : [ "DigitalSignature" ]
},
"subjectPublicKeySource" : {
"type" : "csr",
"csrPEM" : "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...placeholder...\n-----END CERTIFICATE REQUEST-----"
},
"issuer" : {
"type" : "ca-signed",
"issuerKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Generic certificate creation response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.generic.GenericCreateCertificateResponse"
},
"examples" : {
"Self-signed leaf, no attached X.509 stores" : {
"value" : {
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIIB...example...\n-----END CERTIFICATE-----",
"certificateData" : {
"subjectName" : {
"commonName" : "Example Leaf",
"country" : "US"
},
"issuerName" : {
"commonName" : "Example Leaf",
"country" : "US"
},
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2026-05-28T12:23:01Z",
"isCertificateAuthority" : false,
"keyUsage" : [ "DigitalSignature" ],
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
}
},
"CA-signed leaf, with attached X.509 stores" : {
"value" : {
"storedCertificateIds" : [ "org.tenant.x509-store-1.generic-leaf-01" ],
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIIB...example...\n-----END CERTIFICATE-----",
"certificateData" : {
"subjectName" : {
"commonName" : "Example Leaf From CSR",
"country" : "US"
},
"issuerName" : {
"commonName" : "Example IACA",
"country" : "US"
},
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2026-05-28T12:23:01Z",
"isCertificateAuthority" : false,
"keyUsage" : [ "DigitalSignature" ],
"publicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : true,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/iso/iacas" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create an Issuing Authority Certification Authority (IACA) X.509 digital certificate.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_CREATE_IACA_CERTIFICATE] \nOperation: 'create-iaca-certificate' \nRequires authentication. \n\n---\nCreates a self-signed X.509 root certificate representing an Issuing Authority Certification Authority (IACA),\ncompliant with the ISO/IEC 18013-5 specification for mobile driver's licenses (mDL). The generated certificate\nserves as a trust anchor in the mDL public key infrastructure (PKIX).\n\nThe certificate includes:\n- Basic Constraints: `CA=true`, `pathLenConstraint=0`\n- Key Usage: `keyCertSign`, `cRLSign` (marked critical)\n- Subject Key Identifier\n- Issuer Alternative Name(s) (URI and/or email)\n- Optional CRL Distribution Point (URI)\n\n### Validations:\n- `country` must be a valid ISO 3166-1 alpha-2 country code (e.g., `\"US\"`)\n- `issuerAlternativeNameConf` must include at least one non-blank `uri` or `email`\n- Optional fields (`stateOrProvinceName`, `organizationName`, `crlDistributionPointUri`) must not be blank if specified\n- `notAfter`, if present, must be greater than `notBefore` and the current time\n- The certificate's validity period cannot exceed 20 years\n\n### Defaults:\n- If `notBefore` is not provided, the current system time is used\n- If `notAfter` is not provided, it defaults to 20 years after `notBefore`\n\n### Notes:\n- Supported keys: `secp256r1`, `secp384r1` and `secp521r1`\n\n### Storage:\n- If X.509 store dependencies are attached, the issued certificate is stored in all attached stores using one shared `storedCertificateId` (provided or generated)\n- `storedCertificateId`, when provided, must be a single child ID segment (not blank and not containing `.` or `/`)\n- If `vicalEntryComplementaryMetadata` is provided, the generated certificate is stored as a `vical-entry`; otherwise it is stored as `base`\n- If no X.509 store dependency is attached, no store write is attempted and `storedCertificateIds` is omitted from the response\n\n### Failure:\n- KMS-hosted key descriptors must resolve to a key in an attached KMS dependency; JWK-encoded keys are read directly from the request\n- The request fails if a linked dependency target is missing, if `storedCertificateId` already exists in any attached store, or if any store write fails\n- No partial persistence is kept",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Request payload for creating a new IACA (Issuing Authority Certification Authority) root certificate\n in compliance with ISO/IEC 18013-5. The request includes metadata required to generate the self-signed\n X.509 root certificate that will serve as a trust anchor in the mDL ecosystem.\n\n Optional fields:\n - `storedCertificateId`: child ID to use when storing the generated certificate in attached X.509 stores; generated when omitted.\n - `vicalEntryComplementaryMetadata`: when provided, store as VICAL entry; otherwise store as generic certificate.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.iaca.IACACreateCertificateRequest"
},
"examples" : {
"Required data fields, VICAL metadata & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
},
"vicalEntryComplementaryMetadata" : {
"docType" : [ "org.iso.18013.5.1.mDL" ],
"certificateProfile" : [ "org.iso.18013.5.1.iaca" ]
}
}
},
"Required data fields & JWK-encoded signing key" : {
"value" : {
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "jwk-encoded-key-descriptor",
"jwk" : {
"kty" : "EC",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"crv" : "P-256",
"kid" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
}
},
"Custom validity period & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "DE",
"commonName" : "Bundesdruckerei IACA",
"issuerAlternativeNameConf" : {
"uri" : "https://ca.bund.de"
},
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z"
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
},
"All data fields & signing key hosted in linked KMS" : {
"value" : {
"certificateData" : {
"country" : "GR",
"commonName" : "Η καλυτερότερη αρχή πιστοποίησης στον κόσμο",
"issuerAlternativeNameConf" : {
"email" : "iaca@gov.gr",
"uri" : "https://iaca.gov.gr"
},
"stateOrProvinceName" : "Αττική",
"organizationName" : "Υπουργείο Μεταφορών",
"notBefore" : "2025-01-01T00:00:00Z",
"notAfter" : "2041-01-01T00:00:00Z",
"crlDistributionPointUri" : "https://crl.gov.gr/iaca.crl"
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.secp256r1"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Successful IACA certificate creation response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.iaca.IACACreateCertificateResponse"
},
"examples" : {
"Required data fields, no attached X.509 stores" : {
"value" : {
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIIBtTCCAVqgAwIBAgIUNlgkpoam39UxORhMNRkwuFzD9pQwCgYIKoZIzj0EAwIwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1MjgxMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxFeGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASf9vUaZlNISGKgrfPwwapxvufFerKMVotH458o6eynBZxkVb7h07RAGdR44HS2i2Z2Ma5IkVf3uFdls9KlVmvjo2owaDAdBgNVHQ4EFgQUjCMRsfolTeK5Ds6MqOWj5Nx01BQwEgYDVR0TAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5jb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0kAMEYCIQCnUfp3OyxcaPCT34SQ4dTNyNN0qgxKWpWIDeUXkrs7HwIhALFYrMrINeAats4ZWRxZMK6bykb9dcOwkmBCv96MoZVi\n-----END CERTIFICATE-----\n",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
}
}
},
"All data fields, with attached X.509 stores" : {
"value" : {
"storedCertificateIds" : [ "org.tenant.x509-store-1.cert-id-01", "org.tenant.x509-store-2.cert-id-01" ],
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIIC/TCCAqSgAwIBAgIUBAlgS9FXMuQksnLjqOTIVlYurbwwCgYIKoZIzj0EAwIw\ngbAxCzAJBgNVBAYTAkdSMVowWAYDVQQDDFHOlyDOus6xzrvPhc+EzrXPgc+Mz4TO\ntc+BzrcgzrHPgc+Hzq4gz4DOuc+Dz4TOv8+Azr/Or863z4POt8+CIM+Dz4TOv869\nIM66z4zPg868zr8xFTATBgNVBAgMDM6Rz4TPhM65zrrOrjEuMCwGA1UECgwlzqXP\ngM6/z4XPgc6zzrXOr86/IM6czrXPhM6xz4bOv8+Bz47OvTAeFw0yNTA1MjgxMjIz\nMDFaFw00MDA1MjQxMjIzMDFaMIGwMQswCQYDVQQGEwJHUjFaMFgGA1UEAwxRzpcg\nzrrOsc67z4XPhM61z4HPjM+EzrXPgc63IM6xz4HPh86uIM+AzrnPg8+Ezr/PgM6/\nzq/Ot8+DzrfPgiDPg8+Ezr/OvSDOus+Mz4POvM6/MRUwEwYDVQQIDAzOkc+Ez4TO\nuc66zq4xLjAsBgNVBAoMJc6lz4DOv8+Fz4HOs861zq/OvyDOnM61z4TOsc+Gzr/P\ngc+Ozr0wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLVAzKR9ivI\n31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5rEy9n+Iq\no4GZMIGWMB0GA1UdDgQWBBSYrxEhOTqG8/lCsR8IV8pI0hVaODASBgNVHRMBAf8E\nCDAGAQH/AgEAMCMGA1UdEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAO\nBgNVHQ8BAf8EBAMCAQYwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cHM6Ly9jcmwuZ292\nLmdyL2lhY2EuY3JsMAoGCCqGSM49BAMCA0cAMEQCIFPWHi68eADZxb8fid1vWBKt\npb5ucDMPXAP6IZxcvLMqAiB8vwu0dPhMJ20Bl0LWfM1h/jZa27o9Vm6YmjtNdMna\nSA==\n-----END CERTIFICATE-----",
"certificateData" : {
"country" : "GR",
"commonName" : "Η καλυτερότερη αρχή πιστοποίησης στον κόσμο",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"stateOrProvinceName" : "Αττική",
"organizationName" : "Υπουργείο Μεταφορών",
"crlDistributionPointUri" : "https://crl.gov.gr/iaca.crl"
}
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : true,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-service-api/iso/document-signers" : {
"post" : {
"tags" : [ "Service | X.509 Certificate Service" ],
"summary" : "Create a Document Signer (DS) X.509 digital certificate.",
"description" : "Permissions: ANY OF: [ES_X509_SERVICE_CREATE_DS_CERTIFICATE] \nOperation: 'create-document-signer-certificate' \nRequires authentication. \n\n---\nIssues an X.509 Document Signer (DS) certificate compliant with ISO/IEC 18013-5 for signing\nmobile driver's license (mDL) documents. The certificate is issued by an IACA and includes\nall required fields and extensions for mDL conformance.\n\nThe certificate includes:\n- Key Usage: `digitalSignature` (marked critical)\n- Extended Key Usage: `1.0.18013.5.1.2` (Document Signer)\n- Subject Key and Authority Key identifiers\n- Issuer Alternative Name (URI and/or email, from IACA)\n- CRL Distribution Point (URI)\n\n### Validations:\n- `iacaSigner` can provide IACA certificate data or a PEM-encoded IACA certificate\n- `country` and `stateOrProvinceName` (if specified) must match those of the IACA\n- `country` must be a valid ISO 3166-1 alpha-2 code\n- `crlDistributionPointUri` must not be blank\n- Optional strings (`organizationName`, `stateOrProvinceName`, `localityName`) must not be blank if provided\n- `notAfter`, if present, must be greater than `notBefore` and the current time\n- The certificate's validity period cannot exceed 457 days and must fit within the IACA validity window\n\n### Defaults:\n- If `notBefore` is not provided, the current system time is used\n- If `notAfter` is not provided, it defaults to 457 days after `notBefore`\n\n### Subject public key:\n- Provide either `dsKeyDescriptor` (direct key) or `dsPublicKeySource` (key descriptor or CSR PEM with proof-of-possession)\n- `dsKeyDescriptor` and `dsPublicKeySource` are mutually exclusive\n\n### Notes:\n- Supported keys: `secp256r1`, `secp384r1` and `secp521r1`\n\n### Storage:\n- If X.509 store dependencies are attached, the issued certificate is stored in all attached stores using one shared `storedCertificateId` (provided or generated)\n- `storedCertificateId`, when provided, must be a single child ID segment (not blank and not containing `.` or `/`)\n- Document Signer certificates are stored as `base` X.509 certificates\n- If no X.509 store dependency is attached, no store write is attempted and `storedCertificateIds` is omitted from the response\n\n### Failure:\n- KMS-hosted key descriptors must resolve to a key in an attached KMS dependency; JWK-encoded keys are read directly from the request\n- The request fails if a linked dependency target is missing, if `storedCertificateId` already exists in any attached store, or if any store write fails\n- No partial persistence is kept",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Input for issuing a new Document Signer (DS) certificate. The request must provide an IACA signer\n(certificate data or PEM certificate), subject metadata, revocation configuration, and a DS subject public key source.\n\nOptional fields:\n- `storedCertificateId`: child ID to use when storing the generated certificate in attached X.509 stores; generated when omitted.\n- `dsKeyDescriptor`: direct DS signing key (legacy; use `dsPublicKeySource` for CSR-based issuance).\n- `dsPublicKeySource`: DS signing key via key descriptor or CSR PEM.\n",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.documentsigner.DocumentSignerCreateCertificateRequest"
},
"examples" : {
"Document Signer: Required data fields & CSR subject key - IACA: Certificate data & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"issuerAltNameUri" : "https://walt.id"
},
"dsPublicKeySource" : {
"type" : "csr",
"csrPEM" : "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...placeholder...\n-----END CERTIFICATE REQUEST-----"
}
}
},
"Document Signer: Required data fields & key hosted in linked KMS - IACA: Certificate data & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"issuerAltNameUri" : "https://walt.id"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
},
"Document Signer: Required data fields & JWK-encoded key - IACA: Certificate data & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"issuerAltNameUri" : "https://walt.id"
},
"dsKeyDescriptor" : {
"type" : "jwk-encoded-key-descriptor",
"jwk" : {
"kty" : "EC",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"crv" : "P-256",
"kid" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
}
},
"Document Signer: Required data fields & key hosted in linked KMS - IACA: X.509 certificate & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-pem-cert-descriptor",
"iacaPemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"issuerAltNameUri" : "https://walt.id"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
},
"Document Signer: Required data fields & key hosted in linked KMS - IACA: Certificate data & JWK-encoded signing key" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-pem-cert-descriptor",
"iacaPemEncodedCertificate" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"iacaKeyDesc" : {
"type" : "jwk-encoded-key-descriptor",
"jwk" : {
"kty" : "EC",
"d" : "5zvesctW1c9KlWtExySUUdu6CBEc-X4HzAt1dA4HvH8",
"crv" : "P-256",
"kid" : "S6TxkuUd6jyMlc5XV4ttsiTZKb24Z-G4DPHe6KhJVEc",
"x" : "q0xi21uudhkC1QMykfYryN9bcDx480iJLSaRI05CWgY",
"y" : "NhD-09xqrUgE2-qSt8g5imePgKPPNVpYoHmsTL2f4io"
}
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"issuerAltNameUri" : "https://walt.id"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
},
"Document Signer: Custom validity period & key hosted in linked KMS - IACA: Certificate data & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
}
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"notBefore" : "2025-11-01T00:00:00Z",
"notAfter" : "2027-01-01T00:00:00Z",
"issuerAltNameEmail" : "office@walt.id"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
},
"Document Signer: All data fields & key hosted in linked KMS - IACA: Certificate data & signing key hosted in linked KMS" : {
"value" : {
"iacaSigner" : {
"type" : "iaca-cert-data-descriptor",
"certificateData" : {
"country" : "US",
"commonName" : "Example IACA",
"notBefore" : "2025-05-28T12:23:01Z",
"notAfter" : "2040-05-24T12:23:01Z",
"issuerAlternativeNameConf" : {
"uri" : "https://iaca.example.com"
},
"stateOrProvinceName" : "Aidaho"
},
"iacaKeyDesc" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.iaca-secp256r1"
}
},
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"crlDistributionPointUri" : "https://crl-example.com",
"stateOrProvinceName" : "Aidaho",
"organizationName" : "Cool Org Name",
"localityName" : "Mountain View",
"notBefore" : "2025-11-01T00:00:00Z",
"notAfter" : "2027-01-01T00:00:00Z",
"issuerAltNameEmail" : "office@walt.id",
"issuerAltNameUri" : "https://walt.id"
},
"dsKeyDescriptor" : {
"type" : "kms-hosted-key-descriptor",
"keyIdPath" : "waltid.tenant1.kms1.ds-secp256r1"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Successful Document Signer certificate creation response.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.documentsigner.DocumentSignerCreateCertificateResponse"
},
"examples" : {
"Required data fields, no attached X.509 stores" : {
"value" : {
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIICATCCAaigAwIBAgIUQlHlduYHihpBPedBULoMQ7ruja4wCgYIKoZIzj0EAwIwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTEyMDQwODIwMzhaFw0yNzAzMDYwODIwMzhaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApFeGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBkvoNOHI/oLhz12kbgZDjsvroTR1B50t54/7GARpZQtbmHyd/42WtWdHC5AzkffbRf9ZyhEvXsQ/dnl8tl5VNKOBuTCBtjAfBgNVHSMEGDAWgBSYrxEhOTqG8/lCsR8IV8pI0hVaODAdBgNVHQ4EFgQUVCwrii2yRpt5g7/WSPWPzxrZ9rowDgYDVR0PAQH/BAQDAgeAMCMGA1UdEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgcogYxdBQECMCgGA1UdHwQhMB8wHaAboBmGF2h0dHBzOi8vY3JsLWV4YW1wbGUuY29tMAoGCCqGSM49BAMCA0cAMEQCIGNi8ymTZmJ5jbnMlV9Z6/7d0pst9zWd2l2fTKPttcE/AiAedqpYlhvEMfpYAWVXjGOt2eif1Xo4QgJAF3CrqpsqSg==\n-----END CERTIFICATE-----",
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"notBefore" : "2025-12-04T08:20:38Z",
"notAfter" : "2027-03-06T08:20:38Z",
"crlDistributionPointUri" : "https://crl-example.com"
}
}
},
"All data fields, with attached X.509 stores" : {
"value" : {
"storedCertificateIds" : [ "org.tenant.x509-store-1.cert-id-01", "org.tenant.x509-store-2.cert-id-01" ],
"certificatePEM" : "-----BEGIN CERTIFICATE-----\nMIICVDCCAfqgAwIBAgIUIKVfFvdkEANKevGJRNXRRw/cDNAwCgYIKoZIzj0EAwIwNTELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTEPMA0GA1UECAwGQWlkYWhvMB4XDTI1MTEwMTAwMDAwMFoXDTI3MDEwMTAwMDAwMFowYzELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMxDzANBgNVBAgMBkFpZGFobzEWMBQGA1UECgwNQ29vbCBPcmcgTmFtZTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFr0g3PaGAvgZvIasHhKktdcPE3AsdoJG1uvFFFk6id8Z1wO15bUmcrvJczOyWQj7T7LGsNhYnQBqkfTvfNnhIGjgbkwgbYwHwYDVR0jBBgwFoAUmK8RITk6hvP5QrEfCFfKSNIVWjgwHQYDVR0OBBYEFOQ6LjkZuIDrF9mThyxfv5vkV/0gMA4GA1UdDwEB/wQEAwIHgDAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5jb20wFQYDVR0lAQH/BAswCQYHKIGMXQUBAjAoBgNVHR8EITAfMB2gG6AZhhdodHRwczovL2NybC1leGFtcGxlLmNvbTAKBggqhkjOPQQDAgNIADBFAiEA7b48Ri2VD1RJk7PAz7IMKDJhXRPykc+/p7vAgkxyGrgCIDrQJUiYYd50d3z10yMUcQT77d666rrzu0BLiGKU7LWu\n-----END CERTIFICATE-----",
"certificateData" : {
"country" : "US",
"commonName" : "Example DS",
"notBefore" : "2025-11-01T00:00:00Z",
"notAfter" : "2027-01-01T00:00:00Z",
"crlDistributionPointUri" : "https://crl-example.com",
"stateOrProvinceName" : "Aidaho",
"organizationName" : "Cool Org Name",
"localityName" : "Mountain View"
}
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : true,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-store-api/certificates" : {
"get" : {
"tags" : [ "Service | X.509 Certificate Store" ],
"summary" : "Retrieve stored X.509 certificate(s)",
"description" : "Permissions: ANY OF: [ES_X509_STORE_GET_CERTIFICATES] \nOperation: 'list-store-certificates' \nAccepts targets: [X509StoreServiceReference, StoredX509Certificate] \nRequires authentication. \n\n---\nWhen targeting a **X509StoreServiceReference**:\n \nRetrieves all stored certificates for the targeted X.509 store.\nEach entry contains the stored certificate metadata and its PEM-encoded payload.\n\nWhen targeting a **X509StoredCertificate**:\n\nRetrieves a single stored certificate by its full target path.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
}, {
"name" : "sort",
"in" : "query",
"description" : "Optional sort selector. Supported values: 'createdDateTime', 'createdDateTime:asc', 'createdDateTime:desc', 'updatedDateTime', 'updatedDateTime:asc', 'updatedDateTime:desc'.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
},
"example" : "createdDateTime:asc"
} ],
"responses" : {
"200" : {
"description" : "Stored certificate response. Store targets return a list; certificate targets return one certificate.",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonElement"
},
"examples" : {
"Store target: list of stored certificates" : {
"value" : [ {
"_id" : "org1.tenant1.x509-store-1.base-001",
"createdAt" : "2026-10-01T15:19:18.464358283Z",
"updatedAt" : "2026-10-01T15:19:18.464358283Z",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example DS",
"subjectDnHex" : "3022310b30090603550406130255533113301106035504030c0a4578616d706c65204453",
"validFrom" : "2026-08-01T00:00:00Z",
"validTo" : "2027-10-31T00:00:00Z",
"parent" : "org1.tenant1.x509-store-1"
}, {
"_id" : "org1.tenant1.x509-store-1.vical-001",
"createdAt" : "2026-10-01T15:19:18.469248083Z",
"updatedAt" : "2026-10-01T15:19:18.469248083Z",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ],
"vicalCertProfile" : [ "1.0.18013.5.1.7" ]
},
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example IACA",
"subjectDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"validFrom" : "2025-05-28T12:23:01Z",
"validTo" : "2040-05-24T12:23:01Z",
"parent" : "org1.tenant1.x509-store-1"
} ]
},
"Certificate target: stored certificate" : {
"value" : {
"_id" : "org1.tenant1.x509-store-1.base-001",
"createdAt" : "2026-10-01T15:19:18.464358283Z",
"updatedAt" : "2026-10-01T15:19:18.464358283Z",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example DS",
"subjectDnHex" : "3022310b30090603550406130255533113301106035504030c0a4578616d706c65204453",
"validFrom" : "2026-08-01T00:00:00Z",
"validTo" : "2027-10-31T00:00:00Z",
"parent" : "org1.tenant1.x509-store-1"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | X.509 Certificate Store" ],
"summary" : "Update or insert a X.509 stored certificate",
"description" : "Permissions: ANY OF: [ES_X509_STORE_UPDATE_CERTIFICATE] \nOperation: 'update-store-certificate' \nAccepts parent targets: [X509StoreServiceReference] \nRequires authentication. \n\n---\nInserts a new or updates an existing stored certificate identified by the target path.\nThe request body replaces the stored certificate data with a new certificate payload and metadata.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated or insert X.509 certificate in an idempotent manner. Existing entries are replaced.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonElement"
},
"examples" : {
"Updated certificate without metadata" : {
"value" : {
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n"
}
},
"Updated with VICAL metadata" : {
"value" : {
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ],
"vicalCertProfile" : [ "1.0.18013.5.1.7" ]
}
}
},
"DEPRECATED - Base update" : {
"value" : {
"type" : "base",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n"
}
},
"DEPRECATED - VICAL entry update" : {
"value" : {
"type" : "vical-entry",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"complementaryMetadata" : {
"docType" : [ "org.iso.18013.5.1.mDL" ],
"certificateProfile" : [ "1.0.18013.5.1.7" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Certificate updated successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/stored-x509-certificate"
},
"examples" : {
"base" : {
"value" : {
"_id" : "org1.tenant1.x509-store-1.base-001",
"createdAt" : "2026-10-01T15:19:18.464358283Z",
"updatedAt" : "2026-10-01T15:19:18.464358283Z",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example DS",
"subjectDnHex" : "3022310b30090603550406130255533113301106035504030c0a4578616d706c65204453",
"validFrom" : "2026-08-01T00:00:00Z",
"validTo" : "2027-10-31T00:00:00Z",
"parent" : "org1.tenant1.x509-store-1"
}
}
}
}
}
},
"201" : {
"description" : "Certificate inserted successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/stored-x509-certificate"
},
"examples" : {
"with metadata" : {
"value" : {
"_id" : "org1.tenant1.x509-store-1.vical-001",
"createdAt" : "2026-10-01T15:19:18.469248083Z",
"updatedAt" : "2026-10-01T15:19:18.469248083Z",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ],
"vicalCertProfile" : [ "1.0.18013.5.1.7" ]
},
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example IACA",
"subjectDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"validFrom" : "2025-05-28T12:23:01Z",
"validTo" : "2040-05-24T12:23:01Z",
"parent" : "org1.tenant1.x509-store-1"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"post" : {
"tags" : [ "Service | X.509 Certificate Store" ],
"summary" : "Add a X.509 certificate to the store",
"description" : "Permissions: ANY OF: [ES_X509_STORE_ADD_CERTIFICATE] \nOperation: 'add-store-certificate' \nRequires authentication. \n\n---\nStores a new X.509 certificate.\n \nWhen targeting a **X509StoreServiceReference**:\n\nA unique child certificate ID is generated and its full target path is returned in the response.\n\nWhen targeting a **X509StoredCertificate**:\n\nIf the targeted certificate already exists, an error is returned. If you prefer idempotent behavior,\nuse the `PUT` method instead.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "X.509 certificate payload. The stored certificate ID is derived from the target path.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonElement"
},
"examples" : {
"Generic certificate" : {
"value" : {
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n"
}
},
"IACA certificate with metadata for VICAL entry" : {
"value" : {
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ],
"vicalCertProfile" : [ "1.0.18013.5.1.7" ]
}
}
},
"DEPRECATED - Base (generic) certificate" : {
"value" : {
"type" : "base",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n"
}
},
"DEPRECATED - VICAL entry with IACA certificate and metadata" : {
"value" : {
"type" : "vical-entry",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"complementaryMetadata" : {
"docType" : [ "org.iso.18013.5.1.mDL" ],
"certificateProfile" : [ "1.0.18013.5.1.7" ]
}
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Certificate stored successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/stored-x509-certificate"
},
"examples" : {
"Stored base certificate" : {
"value" : {
"_id" : "org1.tenant1.x509-store-1.base-001",
"createdAt" : "2026-10-01T15:19:18.464358283Z",
"updatedAt" : "2026-10-01T15:19:18.464358283Z",
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIICAzCCAamgAwIBAgIQccjQkC9/w0C6ZXXW+MexKzAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI2MDgwMTAwMDAwMFoXDTI3MTAzMTAwMDAwMFowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM+g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB/ev8VXIle5hULJVP3kUID/uaUmYjX/G4zKBn6o4G+MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo+TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv+tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB/wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNIADBFAiEAhu0yR21NTtJoLO8u11zwlexwA0q/rHr4oAy/FzZFGIMCIE3yEYAgt4EWOSvyxjX/PnG3eSGTsw4td6Je3HSawbWD\n-----END CERTIFICATE-----\n",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example DS",
"subjectDnHex" : "3022310b30090603550406130255533113301106035504030c0a4578616d706c65204453",
"validFrom" : "2026-08-01T00:00:00Z",
"validTo" : "2027-10-31T00:00:00Z",
"parent" : "org1.tenant1.x509-store-1"
}
},
"Stored VICAL entry certificate" : {
"value" : {
"_id" : "org1.tenant1.x509-store-1.vical-001",
"createdAt" : "2026-10-01T15:19:18.469248083Z",
"updatedAt" : "2026-10-01T15:19:18.469248083Z",
"metadata" : {
"vicalDocType" : [ "org.iso.18013.5.1.mDL" ],
"vicalCertProfile" : [ "1.0.18013.5.1.7" ]
},
"certificatePem" : "-----BEGIN CERTIFICATE-----\nMIIBtDCCAVqgAwIBAgIUTEBApuzyNump/cYzKXVdgubtZIwwCgYIKoZIzj0EAwIw\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjgx\nMjIzMDFaFw00MDA1MjQxMjIzMDFaMCQxCzAJBgNVBAYTAlVTMRUwEwYDVQQDDAxF\neGFtcGxlIElBQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrTGLbW652GQLV\nAzKR9ivI31twPHjzSIktJpEjTkJaBjYQ/tPcaq1IBNvqkrfIOYpnj4CjzzVaWKB5\nrEy9n+Iqo2owaDAdBgNVHQ4EFgQUmK8RITk6hvP5QrEfCFfKSNIVWjgwEgYDVR0T\nAQH/BAgwBgEB/wIBADAjBgNVHRIEHDAahhhodHRwczovL2lhY2EuZXhhbXBsZS5j\nb20wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQCN8SX5ojwspuyL\nW/XZBSTYpFj3bqpAOWthCLoxW29pNAIgSYLq8sE43y2Bf1pDvKu5cYjtkJ8hel53\nz4eL4VJvD1A=\n-----END CERTIFICATE-----",
"issuerDn" : "C=US,CN=Example IACA",
"issuerDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"subjectDn" : "C=US,CN=Example IACA",
"subjectDnHex" : "3024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341",
"validFrom" : "2025-05-28T12:23:01Z",
"validTo" : "2040-05-24T12:23:01Z",
"parent" : "org1.tenant1.x509-store-1"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | X.509 Certificate Store" ],
"summary" : "Delete a X.509 stored certificate",
"description" : "Permissions: ANY OF: [ES_X509_STORE_DELETE_CERTIFICATE] \nOperation: 'delete-store-certificate' \nAccepts targets: [StoredX509Certificate] \nRequires authentication. \n\n---\nDeletes a stored certificate by its full target path.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Certificate deleted successfully",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/x509-store-api/certificates/ids" : {
"get" : {
"tags" : [ "Service | X.509 Certificate Store" ],
"summary" : "Retrieve stored X.509 certificate IDs",
"description" : "Permissions: ANY OF: [ES_X509_STORE_GET_CERTIFICATES_IDS] \nOperation: 'list-store-certificate-ids' \nAccepts targets: [X509StoreServiceReference] \nRequires authentication. \n\n---\nRetrieves all certificate identifiers (paths) stored in the targeted X.509 store.\nThis endpoint returns only the IDs, making it more efficient when you do not need full payloads.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "limit",
"in" : "query",
"description" : "Maximum number of entries to return.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 100
}, {
"name" : "offset",
"in" : "query",
"description" : "Number of entries to skip.",
"required" : false,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"example" : 0
} ],
"responses" : {
"200" : {
"description" : "List of certificate IDs stored in the X.509 store",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Certificate IDs" : {
"value" : [ "org1.tenant1.x509-store-1.base-001", "org1.tenant1.x509-store-1.vical-001" ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/configuration/view" : {
"get" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/configuration/update" : {
"put" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Client Attester Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/client-attester"
},
"examples" : {
"Update Client Attester Service" : {
"value" : {
"type" : "client-attester",
"signingKeyId" : "waltid.kms.key"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/default-requests" : {
"get" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Client Attester Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"attest-client" : {
"expirationSeconds" : 3600
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Client Attester Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"attest-client — attestation lifetime" : {
"value" : {
"expirationSeconds" : 3600
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Client Attester Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"attest-client — attestation lifetime" : {
"value" : {
"expirationSeconds" : 3600
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"attest-client — attestation lifetime" : {
"value" : {
"expirationSeconds" : 3600
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Client Attester Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/client-attester-api/attest" : {
"post" : {
"tags" : [ "Service | Client Attester Service" ],
"summary" : "Issue a client attestation JWT",
"description" : "Permissions: ANY OF: [ES_CLIENT_ATTESTER_ATTEST] \nOperation: 'attest-client' \nAccepts targets: [ClientAttesterServiceReference] \nRequires authentication. \n\n---\nIssues a signed OAuth 2.0 client attestation JWT that binds a client identifier\nto an instance-specific public key.\n\nThis endpoint is called by wallet services (or other OAuth clients) to obtain\nan attestation that proves their identity and binds their instance key.\n\n**Specification**: draft-ietf-oauth-attestation-based-client-auth §4\n\n**Authentication**: The wallet must authenticate to the attester service.\n\n**Use Case**: \nThe returned attestation JWT is used with the OAuth-Client-Attestation HTTP header\nwhen requesting access tokens from issuers. Combined with a PoP (Proof-of-Possession)\nJWT, it provides strong client authentication without shared secrets.\n\n**JWT Structure**:\n- Header: {\"typ\": \"oauth-client-attestation+jwt\", \"alg\": \"ES256\"}\n- Payload: {\"sub\": \"\", \"iat\": , \"exp\": , \"cnf\": {\"jwk\": {...}}}\n- Signature: Signed by the attester's private key\n\n**Security Notes**:\n- The cnf.jwk must be a public key only (no private key material)\n- The attestation lifetime should be limited (default 24 hours)\n- Wallets should refresh attestations before expiry\n- The attester's signing key must be trusted by the issuer",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.clientattestation.models.ClientAttestationRequest"
},
"examples" : {
"Default (24h)" : {
"value" : {
"clientId" : "org.example.tenant.wallet-service",
"instancePublicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
"y" : "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE"
}
}
},
"Short-lived (1h)" : {
"value" : {
"clientId" : "org.example.tenant.wallet-service",
"instancePublicKeyJwk" : {
"kty" : "EC",
"crv" : "P-256",
"x" : "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
"y" : "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE"
},
"expirationSeconds" : 3600
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Successfully issued client attestation JWT.\n\nThe response contains:\n- clientAttestationJwt: The signed attestation JWT (use with OAuth-Client-Attestation header)\n- expiresAt: Unix timestamp when the attestation expires\n\n**Next Steps**:\n1. Store the attestation JWT securely\n2. When requesting tokens, build a PoP JWT signed by the instance key\n3. Send both as HTTP headers:\n - OAuth-Client-Attestation: \n - OAuth-Client-Attestation-PoP: ",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.clientattestation.models.ClientAttestationResponse"
},
"examples" : {
"Attestation Issued" : {
"value" : {
"clientAttestationJwt" : "eyJ0eXAiOiJvYXV0aC1jbGllbnQtYXR0ZXN0YXRpb24rand0IiwiYWxnIjoiRVMyNTYifQ.eyJzdWIiOiJvcmcuZXhhbXBsZS50ZW5hbnQud2FsbGV0LXNlcnZpY2UiLCJpYXQiOjE3MTM0NTA2MDAsImV4cCI6MTcxMzUzNzAwMCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwieCI6IldLbi1aSUdldmN3R0l5eXJ6Rm9aTkJkYXE5X1RzcXpHbDk2b2MwQ1d1aXMiLCJ5IjoieTc3dC1SdkFIUktUc1NHZElZVWZ3ZXVPdndydkRELVEzSHY1SjBmU0tiRSJ9fX0.MEUCIQDx-vZ9Z0H9YqYW4jK3F_4rP8wJ0xH5TQc9y8vQ1Qq5XwIgJ8oPc7j2R4mN1sQ6w7xZ3y5fTbE0pL9uN2vQ8xR3y4E",
"expiresAt" : 1713537000
}
}
}
}
}
},
"400" : {
"description" : "Invalid request: malformed JWK, missing required fields, or invalid clientId",
"headers" : { }
},
"401" : {
"description" : "Authentication required or insufficient permissions",
"headers" : { }
},
"403" : {
"description" : "Caller does not have ES_CLIENT_ATTESTER_ATTEST permission",
"headers" : { }
},
"404" : {
"description" : "Client Attester Service not found at the specified target",
"headers" : { }
},
"500" : {
"description" : "Server error during attestation signing (e.g., KMS failure)",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/configuration/view" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/configuration/update" : {
"put" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Trust Registry Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/trust-registry"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/default-requests" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "View all default requests",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-requests' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nLists the default requests configured for Trust Registry Service instance, keyed by operation.\n\nA default request is a partial request body that is deep-merged *underneath* the body supplied\nwhen the operation is invoked, so values sent per request always win. Operations without an\nentry behave exactly as if the feature were not in use.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Default requests currently stored on this service, keyed by operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"Configured defaults" : {
"value" : {
"resolve-certificate" : {
"expectedEntityType" : "PID_PROVIDER"
}
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/default-requests/{operation}" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "View default request of an operation",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_DEFAULT_REQUESTS] \nOperation: 'view-default-request' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nReturns the default request configured for one operation of Trust Registry Service instance.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"200" : {
"description" : "Default request stored for the named operation",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"resolve-certificate — expected entity type" : {
"value" : {
"expectedEntityType" : "PID_PROVIDER"
}
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"put" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Set default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'set-default-request' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nStores a default request for one operation of Trust Registry Service instance. The body is a partial request body\nof that operation: send only the fields that should be defaulted, and omit the rest.\n\nThe stored document is deep-merged underneath the body supplied when the operation is invoked\n(nested objects merge; arrays and primitives are replaced wholesale). Once a default request is\nconfigured, the operation may be invoked with a body containing only what varies per call - or\nwith no body at all, if the default is complete.\n\nThe submitted document is validated against the operation's request model, so misspelled or\nunknown fields are rejected here rather than surfacing later as a failing operation. Fields that\nare still missing are accepted, since the caller supplies them per request. Named examples are\nlabelled with the operation they belong to; put that operation in the path when you try them.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"requestBody" : {
"description" : "Partial JSON object body of the named operation. Send only the fields that should be defaulted.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"resolve-certificate — expected entity type" : {
"value" : {
"expectedEntityType" : "PID_PROVIDER"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Default request stored",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"examples" : {
"resolve-certificate — expected entity type" : {
"value" : {
"expectedEntityType" : "PID_PROVIDER"
}
}
}
}
}
},
"400" : {
"description" : "The document is not a valid partial request body for this operation",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
},
"delete" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Clear default request of an operation",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_DEFAULT_REQUESTS] \nOperation: 'clear-default-request' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nRemoves the default request of one operation of Trust Registry Service instance, restoring the behaviour of the\noperation to using only the request body supplied by the caller.\n\nIdempotent: clearing an operation that has no default request configured succeeds as well.\n\nRequires the permission of the operation itself in addition to `update-default-requests`.\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
}, {
"name" : "operation",
"in" : "path",
"description" : "Identifier of the operation the default request applies to. This is the value shown as `Operation: ''` in the description of the corresponding endpoint (e.g. `create-verification-session`). `GET default-requests` lists the ones that are set. The named examples on this endpoint are labelled with the operation they belong to.",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "String"
}
} ],
"responses" : {
"204" : {
"description" : "No default request is configured for this operation any more",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions",
"headers" : { }
},
"404" : {
"description" : "Service not found, or the operation does not exist / does not support default requests",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/resolve/certificate" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Resolve trust by certificate",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_RESOLVE] \nOperation: 'resolve-certificate' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nDetermines whether a certificate is trusted by looking it up across all loaded trust sources.\n\nProvide the certificate in PEM format or base64-encoded DER.\n\nOptionally filter by `expectedEntityType` (e.g. WALLET_PROVIDER, PID_PROVIDER) and/or\n`expectedServiceType` to narrow the resolution scope.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Certificate resolution request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.ResolveCertificateRequest"
},
"examples" : {
"Basic certificate lookup" : {
"value" : {
"certificatePemOrDer" : "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA...",
"instant" : "2026-06-01T00:00:00Z"
}
},
"With entity type filter" : {
"value" : {
"certificatePemOrDer" : "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA...",
"instant" : "2026-06-01T00:00:00Z",
"expectedEntityType" : "WALLET_PROVIDER",
"expectedServiceType" : "WALLET_INSTANCE_ATTESTATION"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Trust decision result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustDecision"
},
"examples" : {
"Trusted" : {
"value" : {
"decision" : "TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"matchedSource" : {
"sourceId" : "eu-wallets",
"sourceFamily" : "LOTE",
"displayName" : "EU Wallet Providers",
"format" : "ETSI_TS_119_602_JSON",
"sourceUrl" : "https://trust.example.eu/wallet-providers.json",
"territory" : "EU",
"issueDate" : "2026-01-01T00:00:00Z",
"nextUpdate" : "2026-07-01T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
},
"matchedEntity" : {
"entityId" : "AT-WALLET-001",
"sourceId" : "eu-wallets",
"entityType" : "WALLET_PROVIDER",
"legalName" : "Demo Wallet Provider GmbH",
"country" : "AT"
},
"matchedService" : {
"serviceId" : "wallet-service",
"sourceId" : "eu-wallets",
"entityId" : "AT-WALLET-001",
"serviceType" : "WALLET_INSTANCE_ATTESTATION",
"status" : "GRANTED",
"statusStart" : "2026-01-01T00:00:00Z"
}
}
},
"Not trusted" : {
"value" : {
"decision" : "NOT_TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"warnings" : [ "No matching identity found across 2 loaded sources" ]
}
},
"Stale source warning" : {
"value" : {
"decision" : "STALE_SOURCE",
"sourceFreshness" : "EXPIRED",
"warnings" : [ "Source 'eu-wallets' has expired nextUpdate: 2025-12-31T00:00:00Z" ]
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/resolve/certificate-chain" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Resolve a certificate chain against registry trust anchors",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_RESOLVE] \nOperation: 'resolve-certificate-chain' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nValidates a leaf-first certificate chain against certificate trust anchors stored in\nthe Trust Registry. The presented chain should contain the signing certificate and any\nrequired intermediates, but omit the root trust anchor where the credential profile\nrequires it (including OpenID4VC HAIP).",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Leaf-first certificate chain resolution request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.ResolveCertificateChainRequest"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Trust decision including certificate-path evidence",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustDecision"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/resolve/certificate-sha256" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Resolve trust by certificate SHA-256",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_RESOLVE] \nOperation: 'resolve-certificate-sha256' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nDetermines whether a certificate is trusted by its SHA-256 fingerprint.\nThis is faster than resolving by full certificate content.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Certificate SHA-256 resolution request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.ResolveCertificateSha256Request"
},
"examples" : {
"Basic SHA-256 lookup" : {
"value" : {
"certificateSha256Hex" : "9f3df3b70633c3d23f5ef04d5d1e7f1d715b9683d8744cd38ec1a8114ec99f00",
"instant" : "2026-06-01T00:00:00Z"
}
},
"With entity type filter" : {
"value" : {
"certificateSha256Hex" : "9f3df3b70633c3d23f5ef04d5d1e7f1d715b9683d8744cd38ec1a8114ec99f00",
"instant" : "2026-06-01T00:00:00Z",
"expectedEntityType" : "WALLET_PROVIDER",
"expectedServiceType" : "WALLET_INSTANCE_ATTESTATION"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Trust decision result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustDecision"
},
"examples" : {
"Trusted" : {
"value" : {
"decision" : "TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"matchedSource" : {
"sourceId" : "eu-wallets",
"sourceFamily" : "LOTE",
"displayName" : "EU Wallet Providers",
"format" : "ETSI_TS_119_602_JSON",
"sourceUrl" : "https://trust.example.eu/wallet-providers.json",
"territory" : "EU",
"issueDate" : "2026-01-01T00:00:00Z",
"nextUpdate" : "2026-07-01T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
},
"matchedEntity" : {
"entityId" : "AT-WALLET-001",
"sourceId" : "eu-wallets",
"entityType" : "WALLET_PROVIDER",
"legalName" : "Demo Wallet Provider GmbH",
"country" : "AT"
},
"matchedService" : {
"serviceId" : "wallet-service",
"sourceId" : "eu-wallets",
"entityId" : "AT-WALLET-001",
"serviceType" : "WALLET_INSTANCE_ATTESTATION",
"status" : "GRANTED",
"statusStart" : "2026-01-01T00:00:00Z"
}
}
},
"Not trusted" : {
"value" : {
"decision" : "NOT_TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"warnings" : [ "No matching identity found across 2 loaded sources" ]
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/resolve/public-key" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Resolve trust by public key (JWK)",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_RESOLVE] \nOperation: 'ES_TRUST_REGISTRY_RESOLVE' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nDetermines whether an issuer is trusted by its public key JWK, for issuers registered\nin the trust list by public key alone (no X.509 certificate) — a valid registration\nmethod under ETSI TS 119 602. Matching is performed by RFC 7638 SHA-256 JWK thumbprint.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Public key (JWK) resolution request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.ResolvePublicKeyRequest"
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Trust decision result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustDecision"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/resolve/provider-id" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Resolve trust by provider ID",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_RESOLVE] \nOperation: 'resolve-provider-id' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nDetermines whether a provider is trusted by looking up its entity ID across all loaded\ntrust sources. This is useful when the caller knows the provider identifier (e.g.\nfrom a credential's `iss` field) but does not have the raw certificate.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Provider ID resolution request",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.ResolveProviderIdRequest"
},
"examples" : {
"Simple provider lookup" : {
"value" : {
"providerId" : "AT-WALLET-001",
"instant" : "2026-06-01T00:00:00Z"
}
},
"PID Provider lookup" : {
"value" : {
"providerId" : "AT-PID-001",
"instant" : "2026-06-01T00:00:00Z",
"expectedEntityType" : "PID_PROVIDER"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Trust decision result",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustDecision"
},
"examples" : {
"Trusted" : {
"value" : {
"decision" : "TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"matchedSource" : {
"sourceId" : "eu-wallets",
"sourceFamily" : "LOTE",
"displayName" : "EU Wallet Providers",
"format" : "ETSI_TS_119_602_JSON",
"sourceUrl" : "https://trust.example.eu/wallet-providers.json",
"territory" : "EU",
"issueDate" : "2026-01-01T00:00:00Z",
"nextUpdate" : "2026-07-01T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
},
"matchedEntity" : {
"entityId" : "AT-WALLET-001",
"sourceId" : "eu-wallets",
"entityType" : "WALLET_PROVIDER",
"legalName" : "Demo Wallet Provider GmbH",
"country" : "AT"
},
"matchedService" : {
"serviceId" : "wallet-service",
"sourceId" : "eu-wallets",
"entityId" : "AT-WALLET-001",
"serviceType" : "WALLET_INSTANCE_ATTESTATION",
"status" : "GRANTED",
"statusStart" : "2026-01-01T00:00:00Z"
}
}
},
"Not trusted" : {
"value" : {
"decision" : "NOT_TRUSTED",
"sourceFreshness" : "FRESH",
"sourceAssurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"warnings" : [ "No matching identity found across 2 loaded sources" ]
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/sources/health" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Get source health",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_READ] \nOperation: 'view-sources-health' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nReturns health information for all loaded trust sources, including freshness\nstate, authenticity state, and entity counts.\n\n**Freshness States:**\n- `FRESH` — Source is within its validity period\n- `EXPIRING_SOON` — nextUpdate is approaching\n- `EXPIRED` — Source has passed its nextUpdate date\n\n**Authenticity States:**\n- `AUTHENTICATED` — Signature valid and signer independently trusted\n- `INTEGRITY_VERIFIED` — Signature valid; signer authorization not established\n- `UNVERIFIED` — Unsigned source or verification explicitly disabled\n- `FAILED` — Signature validation failed",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Health information for all sources",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustSourceHealth"
},
"title" : "ArrayList"
},
"examples" : {
"Health response" : {
"value" : [ {
"sourceId" : "eu-wallets",
"displayName" : "EU Wallet Providers",
"sourceFamily" : "LOTE",
"freshnessState" : "FRESH",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"nextUpdate" : "2026-07-01T00:00:00Z",
"entityCount" : 3,
"serviceCount" : 4
}, {
"sourceId" : "at-national-tl",
"displayName" : "Austria National Trusted List",
"sourceFamily" : "TSL",
"freshnessState" : "FRESH",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"nextUpdate" : "2026-07-15T00:00:00Z",
"entityCount" : 12,
"serviceCount" : 28
}, {
"sourceId" : "de-national-tsl",
"displayName" : "Germany National Trusted List",
"sourceFamily" : "TSL",
"freshnessState" : "FRESH",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"nextUpdate" : "2026-07-15T00:00:00Z",
"entityCount" : 30,
"serviceCount" : 978
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/sources/load" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Load a trust source",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_MANAGE] \nOperation: 'load-source' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nLoads a trust list into the registry. Provide **either** `content` (raw trust list)\n**or** `url` (to fetch from HTTP). The service auto-detects the format:\n\n- **TSL XML** — ETSI TS 119 612 national trusted lists\n- **LoTL XML** — ETSI TS 119 612 list of pointers (`EUlistofthelists`); same XML syntax as TSL\n- **LoTE JSON/XML** — ETSI TS 119 602 V1.1.1 normative bindings\n\n**Working Trust List URLs:**\n- Austria TSL: `https://www.signatur.rtr.at/vertrauensliste.xml`\n- Germany TSL: `https://tl.bundesnetzagentur.de/TL-DE.xml` (RSASSA-PSS/MGF1-SHA256 signed)\n- Italy TSL: `https://eidas.agid.gov.it/TL/TSL-IT.xml`\n- EU LoTL: `https://ec.europa.eu/tools/lotl/eu-lotl.xml` (pointers only)\n\n**Note:** The EU LoTL is a \"List of Lists\" — it contains pointers to member state\ntrust lists, not actual Trust Service Providers. The service validates and identifies the LoTL and reports\nits pointer count, but does not automatically fetch its member-state TSLs.\n\nSelect an explicit `acceptancePolicy`. Use `REQUIRE_AUTHENTICATED` with independently\nconfigured signer certificates for the strongest assurance, `REQUIRE_VALID_SIGNATURE`\nfor signature-integrity validation, or `ALLOW_UNSIGNED` for an intentionally unsigned list.\n`ALLOW_UNVERIFIED` disables verification and should be limited to controlled testing.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Source load request (content or URL)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.trustregistry.models.LoadSourceRequest"
},
"examples" : {
"Load Austrian TSL (recommended - fast & reliable)" : {
"value" : {
"sourceId" : "at-national-tsl",
"url" : "https://www.signatur.rtr.at/vertrauensliste.xml",
"acceptancePolicy" : "REQUIRE_VALID_SIGNATURE"
}
},
"Load German TSL (RSASSA-PSS signed)" : {
"value" : {
"sourceId" : "de-national-tsl",
"url" : "https://tl.bundesnetzagentur.de/TL-DE.xml",
"acceptancePolicy" : "REQUIRE_VALID_SIGNATURE"
}
},
"Load Italian TSL" : {
"value" : {
"sourceId" : "it-national-tsl",
"url" : "https://eidas.agid.gov.it/TL/TSL-IT.xml",
"acceptancePolicy" : "REQUIRE_VALID_SIGNATURE"
}
},
"Load EU LoTL (contains pointers only)" : {
"value" : {
"sourceId" : "eu-lotl",
"url" : "https://ec.europa.eu/tools/lotl/eu-lotl.xml",
"acceptancePolicy" : "REQUIRE_VALID_SIGNATURE"
}
},
"Load from LoTE JSON content" : {
"value" : {
"sourceId" : "eu-wallet-providers",
"content" : "{\"LoTE\":{\"ListAndSchemeInformation\":{\"LoTEVersionIdentifier\":1,\"LoTESequenceNumber\":1,\"LoTEType\":\"http://uri.etsi.org/19602/LoTEType/EUWalletProvidersList\",\"SchemeOperatorName\":[{\"lang\":\"en\",\"value\":\"Example operator\"}],\"ListIssueDateTime\":\"2026-07-21T00:00:00Z\",\"NextUpdate\":\"2026-08-21T00:00:00Z\"}}}",
"sourceUrl" : "https://trust.example.eu/wallet-providers.json",
"acceptancePolicy" : "ALLOW_UNSIGNED"
}
},
"Load from TSL XML content" : {
"value" : {
"sourceId" : "at-national-tl",
"content" : "AT",
"sourceUrl" : "https://ec.europa.eu/tools/lotl/at-tl.xml",
"acceptancePolicy" : "ALLOW_UNSIGNED"
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Source loaded successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.RefreshResult"
},
"examples" : {
"Austrian TSL loaded" : {
"value" : {
"sourceId" : "at-national-tsl",
"success" : true,
"entitiesLoaded" : 9,
"servicesLoaded" : 42,
"identitiesLoaded" : 42
}
},
"German TSL loaded" : {
"value" : {
"sourceId" : "de-national-tsl",
"success" : true,
"entitiesLoaded" : 30,
"servicesLoaded" : 978,
"identitiesLoaded" : 1942
}
}
}
}
}
},
"422" : {
"description" : "Source could not be loaded",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.RefreshResult"
},
"examples" : {
"Network failure" : {
"value" : {
"sourceId" : "unreachable-source",
"success" : false,
"error" : "Failed to fetch from https://example.com/trust-list.xml: Connection timed out"
}
},
"Signature validation failed" : {
"value" : {
"sourceId" : "tampered-source",
"success" : false,
"error" : "XMLDSig signature validation failed: Signature validation failed - digest mismatch"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/sources/{sourceId}/refresh" : {
"post" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "Refresh a trust source",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_MANAGE] \nOperation: 'refresh-source' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nRe-fetches and re-parses a previously loaded source using its stored URL.\nThe source must have been loaded with a URL for refresh to succeed.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "Source refreshed successfully",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.RefreshResult"
},
"examples" : {
"Refresh success" : {
"value" : {
"sourceId" : "at-national-tsl",
"success" : true,
"entitiesLoaded" : 9,
"servicesLoaded" : 42,
"identitiesLoaded" : 42
}
},
"Refresh success (German TSL)" : {
"value" : {
"sourceId" : "de-national-tsl",
"success" : true,
"entitiesLoaded" : 30,
"servicesLoaded" : 978,
"identitiesLoaded" : 1942
}
}
}
}
}
},
"422" : {
"description" : "Refresh failed",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.trust.model.RefreshResult"
},
"examples" : {
"Network failure" : {
"value" : {
"sourceId" : "unreachable-source",
"success" : false,
"error" : "Failed to fetch from https://example.com/trust-list.xml: Connection timed out"
}
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/sources" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "List trust sources",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_READ] \nOperation: 'list-sources' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nReturns metadata for every trust source currently registered in the service.",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of trust sources",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustSource"
},
"title" : "ArrayList"
},
"examples" : {
"Sources list" : {
"value" : [ {
"sourceId" : "at-national-tsl",
"sourceFamily" : "TSL",
"displayName" : "Austria National Trusted List",
"format" : "ETSI_TS_119_612_TRUST_LIST_XML",
"sourceUrl" : "https://www.signatur.rtr.at/vertrauensliste.xml",
"territory" : "AT",
"issueDate" : "2026-01-15T00:00:00Z",
"nextUpdate" : "2026-07-15T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
}, {
"sourceId" : "de-national-tsl",
"sourceFamily" : "TSL",
"displayName" : "Germany National Trusted List",
"format" : "ETSI_TS_119_612_TRUST_LIST_XML",
"sourceUrl" : "https://tl.bundesnetzagentur.de/TL-DE.xml",
"territory" : "DE",
"issueDate" : "2026-01-15T00:00:00Z",
"nextUpdate" : "2026-07-15T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
}, {
"sourceId" : "eu-wallets",
"sourceFamily" : "LOTE",
"displayName" : "EU Wallet Providers",
"format" : "ETSI_TS_119_602_JSON",
"sourceUrl" : "https://trust.example.eu/wallet-providers.json",
"territory" : "EU",
"issueDate" : "2026-01-01T00:00:00Z",
"nextUpdate" : "2026-07-01T00:00:00Z",
"assurance" : {
"signatureStatus" : "VALID",
"signerTrust" : "TRUSTED",
"authenticityState" : "AUTHENTICATED",
"accepted" : true
},
"freshnessState" : "FRESH"
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/trust-registry-api/entities" : {
"get" : {
"tags" : [ "Service | Trust Registry Service" ],
"summary" : "List trusted entities",
"description" : "Permissions: ANY OF: [ES_TRUST_REGISTRY_READ] \nOperation: 'list-entities' \nAccepts targets: [TrustRegistryServiceReference] \nRequires authentication. \n\n---\nReturns all trusted entities across all loaded sources, with optional filtering\nby source family, entity type, country, or trust status.\n\n**Query Parameters:**\n- `sourceFamily` — broad family: `TSL` or `LOTE`\n- `format` — concrete syntax/role, including `ETSI_TS_119_612_LIST_OF_TRUST_LISTS_XML`\n- `entityType` — WALLET_PROVIDER, PID_PROVIDER, ATTESTATION_PROVIDER, etc.\n- `country` — ISO 3166-1 alpha-2 code (e.g. AT, DE, IT)\n- `onlyCurrentlyTrusted` — true to filter out revoked/expired entities",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of trusted entities",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.trust.model.TrustedEntity"
},
"title" : "ArrayList"
},
"examples" : {
"Entities list" : {
"value" : [ {
"entityId" : "AT-WALLET-001",
"sourceId" : "eu-wallets",
"entityType" : "WALLET_PROVIDER",
"legalName" : "Demo Wallet Provider GmbH",
"country" : "AT"
}, {
"entityId" : "DE-WALLET-002",
"sourceId" : "eu-wallets",
"entityType" : "WALLET_PROVIDER",
"legalName" : "Beispiel Wallet AG",
"country" : "DE"
}, {
"entityId" : "AT-PID-001",
"sourceId" : "eu-wallets",
"entityType" : "PID_PROVIDER",
"legalName" : "Demo PID Provider",
"country" : "AT"
} ]
}
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/configuration/view" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "View service configuration",
"description" : "Permissions: ANY OF: [VIEW_SERVICE_CONFIGURATION] \nOperation: 'view-service-configuration' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n\n---\nRetrieves the current configuration for this service. Service configuration defines how the service operates, including its settings, parameters, and service-specific options.\n\n**Use Cases:**\n- Review service settings and parameters\n- Audit service configuration\n- Export configuration for backup or migration\n- Verify service setup\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"404" : {
"description" : "Service not found at the specified target path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to view service configuration",
"headers" : { }
},
"200" : {
"description" : "The configuration for this service",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/configuration/update" : {
"put" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "Update service configuration",
"description" : "Permissions: ANY OF: [UPDATE_SERVICE_CONFIGURATION] \nOperation: 'update-service-configuration' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n\n---\nUpdates the configuration for Oidc Bridge Service instance. This allows you to modify service settings, parameters, and options that control how the service operates.\n\n**Use Cases:**\n- Modify service settings and parameters\n- Update service configuration after initial setup\n- Adjust service behavior through configuration changes\n- Migrate service configurations between environments\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Updated service configuration",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/oidc-bridge"
},
"examples" : {
"Update OIDC Bridge - Keycloak (mDL)" : {
"value" : {
"type" : "oidc-bridge",
"issuerUrl" : "http://waltid.enterprise.localhost:3000",
"clients" : {
"keycloak" : {
"clientId" : "keycloak",
"clientSecret" : "keycloak-client-secret",
"redirectUris" : [ "http://keycloak.localhost:8080/realms/waltid-vc/broker/waltid-vc/endpoint" ]
}
},
"defaultClaimMappings" : [ {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"document_number\"]",
"oidcClaim" : "sub"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"given_name\"]",
"oidcClaim" : "given_name"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"family_name\"]",
"oidcClaim" : "family_name"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"birth_date\"]",
"oidcClaim" : "birthdate"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"document_number\"]",
"oidcClaim" : "document_number"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issue_date\"]",
"oidcClaim" : "issue_date"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"expiry_date\"]",
"oidcClaim" : "expiry_date"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issuing_country\"]",
"oidcClaim" : "issuing_country"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"issuing_authority\"]",
"oidcClaim" : "issuing_authority"
}, {
"credentialPath" : "$[\"org.iso.18013.5.1\"][\"un_distinguishing_sign\"]",
"oidcClaim" : "un_distinguishing_sign"
} ],
"flows" : {
"qr" : {
"enabled" : true,
"buttonLabel" : "Scan QR Code"
},
"dc_api" : {
"enabled" : true,
"buttonLabel" : "Browser Wallet (DC API)"
},
"deep_link" : {
"enabled" : true,
"buttonLabel" : "Open Mobile Wallet"
},
"web_wallet" : {
"enabled" : true,
"buttonLabel" : "Open Web Wallet",
"targetUrl" : "https://waltid.enterprise.localhost"
}
},
"uiConfig" : {
"logoUrl" : "https://example.com/logo.png",
"brandName" : "walt.id Enterprise",
"primaryColor" : "#3B82F6",
"webWalletBaseUrl" : "https://waltid.enterprise.localhost"
}
}
}
}
}
},
"required" : true
},
"responses" : {
"200" : {
"description" : "Service configuration updated successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - malformed configuration, invalid settings, or service not found",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to update service configuration",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/dependencies/list" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "List service dependencies",
"description" : "Permissions: ANY OF: [LIST_SERVICE_DEPENDENCIES] \nOperation: 'list-dependencies' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n\n---\nRetrieves a list of all service dependencies attached to this service. Service dependencies define which other services this service utilizes or depends on for its operations.\n\n**Use Cases:**\n- Review service dependencies and relationships\n- Audit service architecture and dependencies\n- Understand service integration points\n- Export dependency information for documentation\n\n**Important Notes:**\n- Dependencies are represented as service target paths\n- Returns an empty list if no dependencies are configured\n- Dependencies define service-to-service relationships\n- Removing a dependency may affect service functionality\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"200" : {
"description" : "List of service paths that this service depends on or will utilize",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"examples" : {
"Service dependencies" : {
"value" : [ {
"dependency" : {
"content" : "waltid.tenant1.kms.main",
"string" : true
}
}, {
"dependency" : {
"content" : "waltid.tenant1.verifier2.main",
"string" : true
}
} ]
},
"No dependencies" : {
"value" : [ ]
}
}
}
}
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to list service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/dependencies/add" : {
"post" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "Attach new service dependency",
"description" : "Permissions: ANY OF: [ADD_SERVICE_DEPENDENCY] \nOperation: 'add-dependency' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n\n---\nAttaches a new service dependency to this service. This establishes a relationship where this service will utilize or depend on the specified service for its operations.\n\n**Use Cases:**\n- Configure service-to-service relationships\n- Set up service integration points\n- Define service dependencies for orchestration\n- Link services for composite functionality\n\n**Important Notes:**\n- Requires permissions to add dependencies to this service\n- Requires permissions to delegate the dependency service as a dependency\n- The dependency service must exist and be accessible\n- Adding a dependency does not automatically configure integration\n- Duplicate dependencies may be handled based on service implementation\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to attach as dependency (accepted types: kms, verifier2)",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest"
},
"examples" : {
"kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"verifier2 dependency" : {
"value" : {
"dependency" : "waltid.tenant1.verifier2.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"201" : {
"description" : "Service dependency attached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found, invalid path, or dependency cannot be added",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to add service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/dependencies/remove" : {
"post" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "Detach service dependency",
"description" : "Permissions: ANY OF: [REMOVE_SERVICE_DEPENDENCY] \nOperation: 'remove-dependency' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n\n---\nRemoves a service dependency from this service. This breaks the relationship between this service and the specified dependency service.\n\n**Use Cases:**\n- Remove unused or obsolete service dependencies\n- Restructure service relationships\n- Clean up service architecture\n- Disconnect services that are no longer needed\n\n**Important Notes:**\n- Removing a dependency may affect service functionality\n- The dependency service itself is not affected\n- Removing a non-existent dependency is handled gracefully\n- Service operations may fail if they depend on the removed service\n\nFor more information, see: the docs",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Path to service to detach as dependency",
"content" : {
"application/json" : {
"schema" : {
"type" : "string",
"title" : "String"
},
"examples" : {
"Remove kms dependency" : {
"value" : {
"dependency" : "waltid.tenant1.kms.main"
}
},
"Remove verifier2 dependency" : {
"value" : {
"dependency" : "waltid.tenant1.verifier2.main"
}
}
}
}
},
"required" : true
},
"responses" : {
"204" : {
"description" : "Service dependency detached successfully",
"headers" : { }
},
"400" : {
"description" : "Invalid request - service not found or invalid path",
"headers" : { }
},
"401" : {
"description" : "Authentication required",
"headers" : { }
},
"403" : {
"description" : "Insufficient permissions to remove service dependencies",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/clients" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - Management" ],
"summary" : "List registered OIDC clients",
"description" : "Permissions: ANY OF: [VIEW_METADATA] \nOperation: 'list-clients' \nAccepts targets: [OidcBridgeServiceReference] \nRequires authentication. \n",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : {
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/v1/{target}/oidc-bridge-api/.well-known/openid-configuration" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "OIDC Discovery Document",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nReturns OpenID Provider metadata for client configuration",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/jwks" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "JSON Web Key Set",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nReturns public keys for token verification",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/authorize" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "OIDC Authorization Endpoint",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nInitiates the authorization flow with credential presentation",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/sessions/{sessionId}/status" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "Check session status",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nPoll for verification session completion",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/sessions/create" : {
"post" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "Create verification session",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nCreate a verification session for a specific flow type (lazy session creation)",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"requestBody" : {
"description" : "Requires body of JSON value for Create Session Http Request.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.oidcbridge.models.CreateSessionHttpRequest"
}
}
},
"required" : true
},
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/token" : {
"post" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "OIDC Token Endpoint",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nExchange authorization code for tokens",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/v1/{target}/oidc-bridge-api/userinfo" : {
"get" : {
"tags" : [ "Service | OIDC Bridge - OIDC" ],
"summary" : "OIDC UserInfo Endpoint",
"description" : "Permissions: None required \nNo target restriction. \n\n---\nReturns claims about the authenticated user",
"parameters" : [ {
"name" : "target",
"in" : "path",
"description" : "Target to use / apply service operation on",
"required" : true,
"deprecated" : false,
"explode" : false,
"schema" : {
"type" : "string",
"title" : "Target"
}
} ],
"responses" : { },
"deprecated" : false
}
},
"/license/status" : {
"get" : {
"tags" : [ "License" ],
"summary" : "License status",
"description" : "Current license restriction state, expiry countdown, and warning message.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "License status",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.license.LicenseManager.LicenseStatus"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/license/usage" : {
"get" : {
"tags" : [ "License" ],
"summary" : "Usage snapshot",
"description" : "Cumulative fleet-wide usage counters for the current license period. JSON, unsigned.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Usage snapshot",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.enterprise.license.UsageService.UsageSnapshot"
}
}
}
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/license/usage-report" : {
"get" : {
"tags" : [ "License" ],
"summary" : "Signed usage report credential",
"description" : "Signed UsageReportCredential SD-JWT VC bound to this installation's key. Used for offline delivery to walt.id.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "SD-JWT VC string",
"headers" : { },
"content" : {
"text/plain" : {
"schema" : {
"type" : "string",
"title" : "String"
}
}
}
},
"503" : {
"description" : "Failed to create report (e.g. installation key not available)",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
},
"/license/usage-report/export" : {
"post" : {
"tags" : [ "License" ],
"summary" : "Export cumulative usage reports",
"description" : "Produces a versioned bundle for every dirty accounting period without resetting counters.",
"parameters" : [ ],
"responses" : {
"200" : {
"description" : "Export bundle with signed report credentials",
"headers" : { },
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/id.walt.license.base.UsageReportBundle"
}
}
}
},
"503" : {
"description" : "Failed to export report",
"headers" : { }
},
"401" : {
"description" : "Invalid authentication",
"headers" : { }
}
},
"deprecated" : false,
"security" : [ {
"auth-cookie" : [ ]
}, {
"auth-bearer" : [ ]
} ]
}
}
},
"components" : {
"schemas" : {
"id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformation" : {
"type" : "object",
"properties" : {
"features" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
},
"total" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
}
},
"required" : [ "features", "total" ],
"title" : "FeatureFlagInformationModule.FeatureFlagInformation"
},
"id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformations" : {
"type" : "object",
"properties" : {
"enabled" : {
"$ref" : "#/components/schemas/id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformation"
},
"disabled" : {
"$ref" : "#/components/schemas/id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformation"
},
"defaultedDisabled" : {
"$ref" : "#/components/schemas/id.walt.commons.web.modules.FeatureFlagInformationModule.FeatureFlagInformation"
}
},
"required" : [ "defaultedDisabled", "disabled", "enabled" ],
"title" : "FeatureFlagInformationModule.FeatureFlagInformations"
},
"id.walt.ktorauthnz.methods.EmailPass.EmailPassCredentials" : {
"type" : "object",
"properties" : {
"email" : {
"type" : "string",
"title" : "String"
},
"password" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "email", "password" ],
"title" : "EmailPass.EmailPassCredentials"
},
"id.walt.ktorauthnz.sessions.AuthSessionStatus" : {
"type" : "string",
"enum" : [ "INIT", "OK", "SUCCESS", "CONTINUE_NEXT_FLOW", "CONTINUE_NEXT_STEP", "FAILURE" ],
"title" : "AuthSessionStatus"
},
"id.walt.ktorauthnz.sessions.AuthSessionNextStep" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/custom"
}, {
"$ref" : "#/components/schemas/redirect"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "AuthSessionNextStep"
},
"custom" : {
"type" : "object",
"properties" : {
"id" : {
"type" : "string",
"title" : "String"
},
"parameters" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "id", "parameters" ],
"title" : ""
},
"kotlinx.serialization.json.JsonElement" : {
"type" : "object",
"title" : "JsonElement"
},
"redirect" : {
"type" : "object",
"properties" : {
"url" : {
"type" : "string",
"title" : "Url"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "url" ],
"title" : ""
},
"id.walt.ktorauthnz.sessions.AuthSessionInformation" : {
"type" : "object",
"properties" : {
"session_id" : {
"type" : "string",
"title" : "String"
},
"status" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.sessions.AuthSessionStatus"
},
"current_method" : {
"type" : "string",
"title" : "String"
},
"next_method" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"next_step" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.sessions.AuthSessionNextStep"
},
"next_step_description" : {
"type" : "string",
"title" : "String"
},
"next_step_informational_message" : {
"type" : "string",
"title" : "String"
},
"token" : {
"type" : "string",
"title" : "String"
},
"expiration" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
}
},
"required" : [ "session_id", "status" ],
"title" : "AuthSessionInformation"
},
"id.walt.enterprise.global.account.Account.AccountProfile" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"email" : {
"type" : "string",
"title" : "String"
},
"addressCountry" : {
"type" : "string",
"title" : "String"
},
"address" : {
"type" : "string",
"title" : "String"
},
"phone" : {
"type" : "string",
"title" : "String"
},
"profileImage" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "address", "addressCountry", "email", "name" ],
"title" : "Account.AccountProfile"
},
"id.walt.enterprise.global.account.Account.AccountPreferences" : {
"type" : "object",
"properties" : {
"timeZone" : {
"type" : "string",
"title" : "String"
},
"languagePreference" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "languagePreference", "timeZone" ],
"title" : "Account.AccountPreferences"
},
"id.walt.ktorauthnz.methods.initalauth.AuthMethodRegistration" : {
"type" : "object",
"properties" : {
"type" : {
"type" : "string",
"title" : "String"
},
"identifier" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier"
},
"data" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.storeddata.AuthMethodStoredData"
},
"config" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.config.AuthMethodConfiguration"
}
},
"required" : [ "identifier", "type" ],
"title" : "AuthMethodRegistration"
},
"id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/email"
}, {
"$ref" : "#/components/schemas/jwt"
}, {
"$ref" : "#/components/schemas/ldap"
}, {
"$ref" : "#/components/schemas/oidc"
}, {
"$ref" : "#/components/schemas/radius"
}, {
"$ref" : "#/components/schemas/userpass"
}, {
"$ref" : "#/components/schemas/web3"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "AccountIdentifier"
},
"email" : {
"type" : "object",
"properties" : {
"email" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "email" ],
"title" : ""
},
"jwt" : {
"type" : "object",
"properties" : {
"subject" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "subject" ],
"title" : ""
},
"ldap" : {
"type" : "object",
"properties" : {
"host" : {
"type" : "string",
"title" : "String"
},
"name" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "host", "name" ],
"title" : ""
},
"oidc" : {
"type" : "object",
"properties" : {
"issuer" : {
"type" : "string",
"title" : "String"
},
"subject" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "issuer", "subject" ],
"title" : ""
},
"radius" : {
"type" : "object",
"properties" : {
"host" : {
"type" : "string",
"title" : "String"
},
"name" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "host", "name" ],
"title" : ""
},
"userpass" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "name" ],
"title" : ""
},
"web3" : {
"type" : "object",
"properties" : {
"address" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "address" ],
"title" : ""
},
"id.walt.ktorauthnz.methods.storeddata.AuthMethodStoredData" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/email"
}, {
"$ref" : "#/components/schemas/totp"
}, {
"$ref" : "#/components/schemas/userpass"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "AuthMethodStoredData"
},
"totp" : {
"type" : "object",
"properties" : {
"secret" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "secret" ],
"title" : ""
},
"id.walt.ktorauthnz.methods.config.AuthMethodConfiguration" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/jwt-config"
}, {
"$ref" : "#/components/schemas/ldap-config"
}, {
"$ref" : "#/components/schemas/oidc-config"
}, {
"$ref" : "#/components/schemas/radius-config"
}, {
"$ref" : "#/components/schemas/vc-auth"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "AuthMethodConfiguration"
},
"jwt-config" : {
"type" : "object",
"properties" : {
"verifyKey" : {
"type" : "string",
"title" : "String"
},
"identifyClaim" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "identifyClaim", "verifyKey" ],
"title" : ""
},
"ldap-config" : {
"type" : "object",
"properties" : {
"ldapServerUrl" : {
"type" : "string",
"title" : "String"
},
"userDNFormat" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "ldapServerUrl", "userDNFormat" ],
"title" : ""
},
"oidc-config" : {
"type" : "object",
"properties" : {
"openIdConfigurationUrl" : {
"type" : "string",
"title" : "Url"
},
"openIdConfiguration" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.OIDC.OpenIdConfiguration"
},
"clientId" : {
"type" : "string",
"title" : "String"
},
"clientSecret" : {
"type" : "string",
"title" : "String"
},
"callbackUri" : {
"type" : "string",
"title" : "String"
},
"pkceEnabled" : {
"type" : "boolean",
"title" : "Boolean"
},
"redirectAfterLogin" : {
"type" : "string",
"title" : "Url"
},
"allowedRedirectUrls" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"postLogoutRedirectUri" : {
"type" : "string",
"title" : "Url"
},
"allowedPostLogoutRedirectUrls" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"accountIdentifierClaim" : {
"type" : "string",
"title" : "String"
},
"externalRoleExtraction" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.config.OidcExternalRoleExtractionConfiguration"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "accountIdentifierClaim", "allowedPostLogoutRedirectUrls", "allowedRedirectUrls", "callbackUri", "clientId", "clientSecret", "externalRoleExtraction", "pkceEnabled" ],
"title" : ""
},
"id.walt.ktorauthnz.methods.OIDC.OpenIdConfiguration" : {
"type" : "object",
"properties" : {
"issuer" : {
"type" : "string",
"title" : "String"
},
"authorization_endpoint" : {
"type" : "string",
"title" : "String"
},
"token_endpoint" : {
"type" : "string",
"title" : "String"
},
"userinfo_endpoint" : {
"type" : "string",
"title" : "String"
},
"jwks_uri" : {
"type" : "string",
"title" : "String"
},
"end_session_endpoint" : {
"type" : "string",
"title" : "String"
},
"backchannel_logout_supported" : {
"type" : "boolean",
"title" : "Boolean"
},
"frontchannel_logout_supported" : {
"type" : "boolean",
"title" : "Boolean"
},
"response_types_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"subject_types_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"id_token_signing_alg_values_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"scopes_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"token_endpoint_auth_methods_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"claims_supported" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
}
},
"required" : [ "authorization_endpoint", "backchannel_logout_supported", "claims_supported", "frontchannel_logout_supported", "id_token_signing_alg_values_supported", "issuer", "jwks_uri", "response_types_supported", "scopes_supported", "subject_types_supported", "token_endpoint", "token_endpoint_auth_methods_supported" ],
"title" : "OIDC.OpenIdConfiguration"
},
"id.walt.ktorauthnz.methods.config.OidcExternalRoleExtractionConfiguration" : {
"type" : "object",
"properties" : {
"enabled" : {
"type" : "boolean",
"title" : "Boolean"
},
"realmRolesClaimPath" : {
"type" : "string",
"title" : "String"
},
"clientRolesClaimPath" : {
"type" : "string",
"title" : "String"
},
"clientId" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "clientRolesClaimPath", "enabled", "realmRolesClaimPath" ],
"title" : "OidcExternalRoleExtractionConfiguration"
},
"radius-config" : {
"type" : "object",
"properties" : {
"radiusServerHost" : {
"type" : "string",
"title" : "String"
},
"radiusServerPort" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"radiusServerSecret" : {
"type" : "string",
"title" : "String"
},
"radiusNasIdentifier" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "radiusServerHost", "radiusServerPort", "radiusServerSecret" ],
"title" : ""
},
"vc-auth" : {
"type" : "object",
"properties" : {
"verification" : {
"type" : "object",
"additionalProperties" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonElement"
},
"title" : "LinkedHashMap"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "verification" ],
"title" : ""
},
"id.walt.enterprise.global.account.AccountService.UnwrappedAccountRegistrationRequest" : {
"type" : "object",
"properties" : {
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account.AccountProfile"
},
"preferences" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account.AccountPreferences"
},
"initialAuth" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.initalauth.AuthMethodRegistration"
}
},
"required" : [ "initialAuth", "preferences", "profile" ],
"title" : "AccountService.UnwrappedAccountRegistrationRequest"
},
"id.walt.enterprise.global.account.AccountType" : {
"type" : "string",
"enum" : [ "USER", "API" ],
"title" : "AccountType"
},
"id.walt.enterprise.global.account.Account" : {
"type" : "object",
"properties" : {
"_id" : {
"type" : "string",
"format" : "uuid",
"title" : "AccountId"
},
"type" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.AccountType"
},
"createdAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"updatedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account.AccountProfile"
},
"accountPreferences" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.Account.AccountPreferences"
},
"flags" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"roles" : {
"type" : "object",
"additionalProperties" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"title" : "LinkedHashMap>"
}
},
"required" : [ "_id", "accountPreferences", "flags", "profile", "roles", "type" ],
"title" : "Account"
},
"id.walt.enterprise.global.organization.Organization" : {
"type" : "object",
"properties" : {
"_id" : {
"type" : "string",
"title" : "OrganizationId"
},
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization.OrganizationProfile"
},
"billing" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.Organization.OrganizationBilling"
},
"configuration" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.organization.OrganizationConfiguration"
}
},
"required" : [ "_id", "configuration", "profile" ],
"title" : "Organization"
},
"id.walt.enterprise.global.organization.Organization.OrganizationProfile" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "name" ],
"title" : "Organization.OrganizationProfile"
},
"id.walt.enterprise.global.organization.Organization.OrganizationBilling" : {
"type" : "object",
"properties" : {
"billingCountry" : {
"type" : "string",
"title" : "String"
},
"billingAddress" : {
"type" : "string",
"title" : "String"
},
"vatNr" : {
"type" : "string",
"title" : "String"
},
"iban" : {
"type" : "string",
"title" : "String"
},
"swift" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "billingAddress", "billingCountry" ],
"title" : "Organization.OrganizationBilling"
},
"id.walt.enterprise.global.organization.OrganizationConfiguration" : {
"type" : "object",
"properties" : {
"rootDidRegistry" : {
"type" : "string",
"title" : "Target"
}
},
"title" : "OrganizationConfiguration"
},
"id.walt.ktorauthnz.methods.storeddata.IdentifiedStoredData" : {
"type" : "object",
"properties" : {
"identifier" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier"
},
"data" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.methods.storeddata.AuthMethodStoredData"
}
},
"required" : [ "data", "identifier" ],
"title" : "IdentifiedStoredData"
},
"id.walt.enterprise.authnz.AuthenticationService.IdentifiedMethod" : {
"type" : "object",
"properties" : {
"identifier" : {
"$ref" : "#/components/schemas/id.walt.ktorauthnz.accounts.identifiers.methods.AccountIdentifier"
},
"method" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "identifier", "method" ],
"title" : "AuthenticationService.IdentifiedMethod"
},
"id.walt.enterprise.persistence.interfaces.DataStoreMigrationService.MigrationRunInformation" : {
"type" : "object",
"properties" : {
"runId" : {
"type" : "string",
"title" : "String"
},
"action" : {
"$ref" : "#/components/schemas/id.walt.enterprise.persistence.interfaces.DataStoreMigrationService.MigrationAction"
},
"remark" : {
"type" : "string",
"title" : "String"
},
"startedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"completedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"totalItems" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"processedItems" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"success" : {
"type" : "boolean",
"title" : "Boolean"
},
"messages" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"errorMessage" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "action", "messages", "runId" ],
"title" : "DataStoreMigrationService.MigrationRunInformation"
},
"id.walt.enterprise.persistence.interfaces.DataStoreMigrationService.MigrationAction" : {
"type" : "string",
"enum" : [ "APPLY", "RUN", "DRY_RUN", "VALIDATE_PRECONDITIONS", "ROLLBACK" ],
"title" : "DataStoreMigrationService.MigrationAction"
},
"id.walt.enterprise.persistence.migration.DataStoreMigrationController.MigrationActionRequest" : {
"type" : "object",
"properties" : {
"action" : {
"$ref" : "#/components/schemas/id.walt.enterprise.persistence.interfaces.DataStoreMigrationService.MigrationAction"
},
"remark" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "action" ],
"title" : "DataStoreMigrationController.MigrationActionRequest"
},
"id.walt.enterprise.clusterstatus.EnterpriseClusterNodeStatus" : {
"type" : "object",
"properties" : {
"_id" : {
"type" : "string",
"title" : "String"
},
"heartbeat" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"dbVersion" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
}
},
"required" : [ "_id", "dbVersion", "heartbeat" ],
"title" : "EnterpriseClusterNodeStatus"
},
"id.walt.enterprise.global.admin.superadmin.SuperAdminRegistrationRequest" : {
"type" : "object",
"properties" : {
"token" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "token" ],
"title" : "SuperAdminRegistrationRequest"
},
"id.walt.enterprise.global.account.MinimalAccount" : {
"type" : "object",
"properties" : {
"_id" : {
"type" : "string",
"format" : "uuid",
"title" : "AccountId"
},
"type" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.AccountType"
},
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.global.account.MinimalAccount.MinimalProfile"
}
},
"required" : [ "_id", "profile", "type" ],
"title" : "MinimalAccount"
},
"id.walt.enterprise.global.account.MinimalAccount.MinimalProfile" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"email" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "email", "name" ],
"title" : "MinimalAccount.MinimalProfile"
},
"id.walt.commons.events.EventType" : {
"type" : "string",
"enum" : [ "IssuanceEvent", "VerificationEvent", "KeyEvent", "DIDEvent", "CredentialWalletEvent", "IssuanceWalletEvent", "PresentationWalletEvent" ],
"title" : "EventType"
},
"id.walt.commons.events.filter.IssuanceEventFilter" : {
"type" : "object",
"properties" : {
"credentialConfigurationId" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"format" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"proofType" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"holder" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
}
},
"title" : "IssuanceEventFilter"
},
"id.walt.commons.events.filter.VerificationEventFilter" : {
"type" : "object",
"properties" : {
"format" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"signatureAlgorithm" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"holder" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"credentialType" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"ecosystem" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"walletId" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"protocol" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"deviceFlow" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.events.DeviceFlow"
},
"title" : "LinkedHashSet"
},
"asyncFlow" : {
"type" : "array",
"items" : {
"type" : "boolean",
"title" : "Boolean"
},
"title" : "LinkedHashSet"
}
},
"title" : "VerificationEventFilter"
},
"id.walt.commons.events.DeviceFlow" : {
"type" : "string",
"enum" : [ "Multi", "Single" ],
"title" : "DeviceFlow"
},
"id.walt.commons.events.filter.KeyEventFilter" : {
"type" : "object",
"properties" : {
"keyEventType" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.events.KeyEventType"
},
"title" : "LinkedHashSet"
},
"keyAlgorithm" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
}
},
"title" : "KeyEventFilter"
},
"id.walt.commons.events.KeyEventType" : {
"type" : "string",
"enum" : [ "Create", "Import", "Export", "Rotation" ],
"title" : "KeyEventType"
},
"id.walt.commons.events.filter.DidEventFilter" : {
"type" : "object",
"properties" : {
"didEventType" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.events.DidEventType"
},
"title" : "LinkedHashSet"
},
"didMethod" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
}
},
"title" : "DidEventFilter"
},
"id.walt.commons.events.DidEventType" : {
"type" : "string",
"enum" : [ "Create", "Update", "Delete", "Resolve" ],
"title" : "DidEventType"
},
"id.walt.commons.events.filter.EventFilter" : {
"type" : "object",
"properties" : {
"eventType" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.commons.events.EventType"
},
"title" : "LinkedHashSet"
},
"status" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"action" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"fromTimestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"toTimestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"callId" : {
"type" : "string",
"title" : "String"
},
"target" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet"
},
"issuanceEventFilter" : {
"$ref" : "#/components/schemas/id.walt.commons.events.filter.IssuanceEventFilter"
},
"verificationEventFilter" : {
"$ref" : "#/components/schemas/id.walt.commons.events.filter.VerificationEventFilter"
},
"keyEventFilter" : {
"$ref" : "#/components/schemas/id.walt.commons.events.filter.KeyEventFilter"
},
"didEventFilter" : {
"$ref" : "#/components/schemas/id.walt.commons.events.filter.DidEventFilter"
}
},
"title" : "EventFilter"
},
"id.walt.enterprise.audit.AuditEntryType" : {
"type" : "string",
"enum" : [ "CREDENTIAL_ISSUED", "CREDENTIAL_LIFECYCLE", "PRESENTATION_VERIFICATION_COMPLETED" ],
"title" : "AuditEntryType"
},
"id.walt.enterprise.audit.EidasAuditLogFilter" : {
"type" : "object",
"properties" : {
"organizationId" : {
"type" : "string",
"title" : "String"
},
"target" : {
"type" : "string",
"title" : "String"
},
"entryTypes" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.AuditEntryType"
},
"title" : "LinkedHashSet"
},
"fromTimestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"toTimestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"nonce" : {
"type" : "string",
"title" : "String"
},
"fromSequence" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"toSequence" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"limit" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
}
},
"required" : [ "limit", "organizationId" ],
"title" : "EidasAuditLogFilter"
},
"id.walt.enterprise.audit.EidasAuditLogEntry" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/CREDENTIAL_ISSUED"
}, {
"$ref" : "#/components/schemas/CREDENTIAL_LIFECYCLE"
}, {
"$ref" : "#/components/schemas/PRESENTATION_VERIFICATION_COMPLETED"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "EidasAuditLogEntry"
},
"CREDENTIAL_ISSUED" : {
"type" : "object",
"properties" : {
"id" : {
"type" : "string",
"title" : "String"
},
"organizationId" : {
"type" : "string",
"title" : "String"
},
"target" : {
"type" : "string",
"title" : "String"
},
"timestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"sequenceNumber" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"prevEntryHash" : {
"type" : "string",
"title" : "String"
},
"entryHash" : {
"type" : "string",
"title" : "String"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"credentialConfigurationId" : {
"type" : "string",
"title" : "String"
},
"credentialIndex" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"format" : {
"type" : "string",
"title" : "String"
},
"credentialPayloadHash" : {
"type" : "string",
"title" : "String"
},
"holderBindingPublicKeyJwk" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"proofType" : {
"type" : "string",
"title" : "String"
},
"callId" : {
"type" : "string",
"title" : "String"
},
"loaAchieved" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.LevelOfAssurance"
},
"identityProofingRefId" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "credentialConfigurationId", "credentialIndex", "credentialPayloadHash", "entryHash", "format", "id", "loaAchieved", "organizationId", "prevEntryHash", "sequenceNumber", "sessionId", "target", "timestamp" ],
"title" : "CREDENTIAL_ISSUED"
},
"kotlinx.serialization.json.JsonObject" : {
"type" : "object",
"title" : "JsonObject"
},
"id.walt.enterprise.audit.LevelOfAssurance" : {
"type" : "string",
"enum" : [ "HIGH", "SUBSTANTIAL", "LOW", "NOT_APPLICABLE" ],
"title" : "LevelOfAssurance"
},
"CREDENTIAL_LIFECYCLE" : {
"type" : "object",
"properties" : {
"id" : {
"type" : "string",
"title" : "String"
},
"organizationId" : {
"type" : "string",
"title" : "String"
},
"target" : {
"type" : "string",
"title" : "String"
},
"timestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"sequenceNumber" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"prevEntryHash" : {
"type" : "string",
"title" : "String"
},
"entryHash" : {
"type" : "string",
"title" : "String"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"credentialConfigurationId" : {
"type" : "string",
"title" : "String"
},
"event" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.CredentialLifecycleEvent"
},
"reasonCode" : {
"type" : "string",
"title" : "String"
},
"operatorId" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "credentialConfigurationId", "entryHash", "event", "id", "organizationId", "prevEntryHash", "sequenceNumber", "sessionId", "target", "timestamp" ],
"title" : "CREDENTIAL_LIFECYCLE"
},
"id.walt.enterprise.audit.CredentialLifecycleEvent" : {
"type" : "string",
"enum" : [ "PROVISIONED", "ISSUED", "SUSPENDED", "UNSUSPENDED", "REVOKED" ],
"title" : "CredentialLifecycleEvent"
},
"PRESENTATION_VERIFICATION_COMPLETED" : {
"type" : "object",
"properties" : {
"id" : {
"type" : "string",
"title" : "String"
},
"organizationId" : {
"type" : "string",
"title" : "String"
},
"target" : {
"type" : "string",
"title" : "String"
},
"timestamp" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"sequenceNumber" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"prevEntryHash" : {
"type" : "string",
"title" : "String"
},
"entryHash" : {
"type" : "string",
"title" : "String"
},
"sessionId" : {
"type" : "string",
"title" : "String"
},
"nonceHash" : {
"type" : "string",
"title" : "String"
},
"dcqlQuery" : {
"type" : "string",
"title" : "String"
},
"requestObjectX5c" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"requestObjectHash" : {
"type" : "string",
"title" : "String"
},
"verifierInfo" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.verifier.openid.models.authorization.VerifierInfoItem"
},
"title" : "ArrayList"
},
"issuerSignatureEvidence" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationPolicyEvidence"
},
"title" : "ArrayList"
},
"issuerTrustEvidence" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationPolicyEvidence"
},
"title" : "ArrayList"
},
"holderBindingEvidence" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationPolicyEvidence"
},
"title" : "ArrayList"
},
"revocationStatusEvidence" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationPolicyEvidence"
},
"title" : "ArrayList"
},
"verifierTrustEvidence" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationPolicyEvidence"
},
"title" : "ArrayList"
},
"pairwiseSubjectId" : {
"type" : "string",
"title" : "String"
},
"outcome" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationOutcome"
},
"failureCategory" : {
"$ref" : "#/components/schemas/id.walt.enterprise.audit.VerificationFailureCategory"
},
"callId" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "dcqlQuery", "entryHash", "holderBindingEvidence", "id", "issuerSignatureEvidence", "issuerTrustEvidence", "nonceHash", "organizationId", "outcome", "prevEntryHash", "requestObjectX5c", "revocationStatusEvidence", "sequenceNumber", "sessionId", "target", "timestamp", "verifierInfo", "verifierTrustEvidence" ],
"title" : "PRESENTATION_VERIFICATION_COMPLETED"
},
"id.walt.verifier.openid.models.authorization.VerifierInfoItem" : {
"type" : "object",
"properties" : {
"format" : {
"$ref" : "#/components/schemas/id.walt.verifier.openid.models.credentials.AttestationFormat"
},
"data" : {
"type" : "string",
"title" : "String"
},
"credential_ids" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
}
},
"required" : [ "data", "format" ],
"title" : "VerifierInfoItem"
},
"id.walt.verifier.openid.models.credentials.AttestationFormat" : {
"type" : "string",
"enum" : [ "jwt", "registration_cert" ],
"title" : "AttestationFormat"
},
"id.walt.enterprise.audit.VerificationPolicyEvidence" : {
"type" : "object",
"properties" : {
"policyId" : {
"type" : "string",
"title" : "String"
},
"queryId" : {
"type" : "string",
"title" : "String"
},
"credentialIndex" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"success" : {
"type" : "boolean",
"title" : "Boolean"
},
"errors" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"evidence" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"evidenceCapturedAt" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
}
},
"required" : [ "errors", "evidenceCapturedAt", "policyId", "success" ],
"title" : "VerificationPolicyEvidence"
},
"id.walt.enterprise.audit.VerificationOutcome" : {
"type" : "string",
"enum" : [ "SUCCESS", "FAILED", "WALLET_ERROR" ],
"title" : "VerificationOutcome"
},
"id.walt.enterprise.audit.VerificationFailureCategory" : {
"type" : "string",
"enum" : [ "VP_POLICY", "VC_POLICY", "DCQL", "WALLET_ERROR" ],
"title" : "VerificationFailureCategory"
},
"id.walt.enterprise.audit.ChainVerificationResult" : {
"type" : "object",
"properties" : {
"intact" : {
"type" : "boolean",
"title" : "Boolean"
},
"checkedEntries" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"firstBrokenAt" : {
"type" : "integer",
"format" : "int64",
"title" : "Long"
},
"message" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "checkedEntries", "intact", "message" ],
"title" : "ChainVerificationResult"
},
"id.walt.permissions.Permission" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "PermissionedResourceTarget"
},
"action" : {
"type" : "string",
"title" : "String"
},
"operation" : {
"$ref" : "#/components/schemas/id.walt.permissions.PermissionOperation"
}
},
"required" : [ "action", "operation", "target" ],
"title" : "Permission"
},
"id.walt.permissions.PermissionOperation" : {
"type" : "string",
"enum" : [ "ADD", "REMOVE" ],
"title" : "PermissionOperation"
},
"id.walt.enterprise.services.tenants.TenantConfiguration" : {
"type" : "object",
"properties" : {
"didRegistry" : {
"type" : "string",
"title" : "Target"
}
},
"title" : "TenantConfiguration"
},
"id.walt.enterprise.resource.resources.NewTenantRequest" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"configuration" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.tenants.TenantConfiguration"
}
},
"title" : "NewTenantRequest"
},
"tenant" : {
"type" : "object",
"properties" : {
"traversable" : {
"type" : "boolean",
"title" : "Boolean"
},
"_id" : {
"type" : "string",
"title" : "Target"
},
"name" : {
"type" : "string",
"title" : "String"
},
"configuration" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.tenants.TenantConfiguration"
},
"createdAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"updatedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"parent" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "_id", "configuration", "parent", "traversable" ],
"title" : ""
},
"id.walt.enterprise.init.models.WalletComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"kms" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.KmsComposableConfig"
},
"didStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidStoreComposableConfig"
},
"didService" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidServiceComposableConfig"
},
"credentialStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.CredentialStoreComposableConfig"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "WalletComposableConfig"
},
"id.walt.enterprise.init.models.KmsComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"key" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.KeyComposableConfig"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "KmsComposableConfig"
},
"id.walt.enterprise.init.models.KeyComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/id.walt.crypto.keys.KeyGenerationRequest"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "KeyComposableConfig"
},
"id.walt.crypto.keys.KeyGenerationRequest" : {
"type" : "object",
"properties" : {
"backend" : {
"type" : "string",
"title" : "String"
},
"keyType" : {
"$ref" : "#/components/schemas/id.walt.crypto.keys.KeyType"
},
"name" : {
"type" : "string",
"title" : "String"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
},
"required" : [ "backend", "keyType" ],
"title" : "KeyGenerationRequest"
},
"id.walt.crypto.keys.KeyType" : {
"type" : "string",
"enum" : [ "Ed25519", "secp256k1", "secp256r1", "secp384r1", "secp521r1", "RSA", "RSA3072", "RSA4096" ],
"title" : "KeyType"
},
"id.walt.enterprise.init.models.DidStoreComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "DidStoreComposableConfig"
},
"id.walt.enterprise.init.models.DidServiceComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"dependencies" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "Target"
},
"title" : "ArrayList"
},
"did" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidComposableConfig"
}
},
"required" : [ "createIfNotFound", "dependencies", "target" ],
"title" : "DidServiceComposableConfig"
},
"id.walt.enterprise.init.models.DidComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"type" : {
"type" : "string",
"title" : "String"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
},
"required" : [ "createIfNotFound", "target", "type" ],
"title" : "DidComposableConfig"
},
"id.walt.enterprise.init.models.CredentialStoreComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "CredentialStoreComposableConfig"
},
"id.walt.enterprise.init.models.IssuerComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
},
"kms" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.KmsComposableConfig"
},
"didStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidStoreComposableConfig"
},
"didService" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidServiceComposableConfig"
},
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ProfileComposableConfig"
},
"x509" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IssuerX509ComposableConfig"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "IssuerComposableConfig"
},
"id.walt.enterprise.init.models.ProfileComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
},
"config" : {
"$ref" : "#/components/schemas/kotlinx.serialization.json.JsonObject"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "ProfileComposableConfig"
},
"id.walt.enterprise.init.models.IssuerX509ComposableConfig" : {
"type" : "object",
"properties" : {
"x509Service" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.X509ServiceComposableConfig"
},
"x509Store" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.X509StoreComposableConfig"
},
"iaca" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IacaCertComposableConfig"
},
"existingIacaPem" : {
"type" : "string",
"title" : "String"
},
"existingIacaKeyTarget" : {
"type" : "string",
"title" : "Target"
},
"dsc" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DscCertComposableConfig"
}
},
"required" : [ "dsc", "x509Service" ],
"title" : "IssuerX509ComposableConfig"
},
"id.walt.enterprise.init.models.X509ServiceComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "X509ServiceComposableConfig"
},
"id.walt.enterprise.init.models.X509StoreComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"target" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "createIfNotFound", "target" ],
"title" : "X509StoreComposableConfig"
},
"id.walt.enterprise.init.models.IacaCertComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"storedCertificateId" : {
"type" : "string",
"title" : "String"
},
"certificateData" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.iaca.IACACertificateRequestData"
},
"keyIdSuffix" : {
"type" : "string",
"title" : "String"
},
"keyGenerationRequest" : {
"$ref" : "#/components/schemas/id.walt.crypto.keys.KeyGenerationRequest"
}
},
"required" : [ "certificateData", "createIfNotFound", "keyIdSuffix" ],
"title" : "IacaCertComposableConfig"
},
"id.walt.enterprise.services.x509.service.models.iaca.IACACertificateRequestData" : {
"type" : "object",
"properties" : {
"country" : {
"type" : "string",
"title" : "String"
},
"commonName" : {
"type" : "string",
"title" : "String"
},
"issuerAlternativeNameConf" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.iaca.IACAIssuerAlternativeNameConfiguration"
},
"stateOrProvinceName" : {
"type" : "string",
"title" : "String"
},
"organizationName" : {
"type" : "string",
"title" : "String"
},
"notBefore" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"notAfter" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"crlDistributionPointUri" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "commonName", "country" ],
"title" : "IACACertificateRequestData"
},
"id.walt.enterprise.services.x509.service.models.iaca.IACAIssuerAlternativeNameConfiguration" : {
"type" : "object",
"properties" : {
"email" : {
"type" : "string",
"title" : "String"
},
"uri" : {
"type" : "string",
"title" : "String"
}
},
"title" : "IACAIssuerAlternativeNameConfiguration"
},
"id.walt.enterprise.init.models.DscCertComposableConfig" : {
"type" : "object",
"properties" : {
"createIfNotFound" : {
"type" : "boolean",
"title" : "Boolean"
},
"storedCertificateId" : {
"type" : "string",
"title" : "String"
},
"certificateData" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.x509.service.models.documentsigner.DocumentSignerCertificateRequestData"
},
"keyIdSuffix" : {
"type" : "string",
"title" : "String"
},
"keyGenerationRequest" : {
"$ref" : "#/components/schemas/id.walt.crypto.keys.KeyGenerationRequest"
}
},
"required" : [ "certificateData", "createIfNotFound", "keyIdSuffix" ],
"title" : "DscCertComposableConfig"
},
"id.walt.enterprise.services.x509.service.models.documentsigner.DocumentSignerCertificateRequestData" : {
"type" : "object",
"properties" : {
"country" : {
"type" : "string",
"title" : "String"
},
"commonName" : {
"type" : "string",
"title" : "String"
},
"crlDistributionPointUri" : {
"type" : "string",
"title" : "String"
},
"stateOrProvinceName" : {
"type" : "string",
"title" : "String"
},
"organizationName" : {
"type" : "string",
"title" : "String"
},
"localityName" : {
"type" : "string",
"title" : "String"
},
"notBefore" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"notAfter" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"issuerAltNameEmail" : {
"type" : "string",
"title" : "String"
},
"issuerAltNameUri" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "commonName", "country", "crlDistributionPointUri" ],
"title" : "DocumentSignerCertificateRequestData"
},
"id.walt.enterprise.init.models.ComposableInitRequest" : {
"type" : "object",
"properties" : {
"wallet" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.WalletComposableConfig"
},
"issuer" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IssuerComposableConfig"
}
},
"title" : "ComposableInitRequest"
},
"id.walt.enterprise.init.models.WalletComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"kms" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.KmsComposableResult"
},
"didStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
},
"didService" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidServiceComposableResult"
},
"credentialStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
}
},
"required" : [ "created", "target" ],
"title" : "WalletComposableResult"
},
"id.walt.enterprise.init.models.KmsComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"key" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
}
},
"required" : [ "created", "target" ],
"title" : "KmsComposableResult"
},
"id.walt.enterprise.init.models.ResourceComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
}
},
"required" : [ "created", "target" ],
"title" : "ResourceComposableResult"
},
"id.walt.enterprise.init.models.DidServiceComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"did" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidComposableResult"
}
},
"required" : [ "created", "target" ],
"title" : "DidServiceComposableResult"
},
"id.walt.enterprise.init.models.DidComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"did" : {
"type" : "string",
"title" : "String"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
}
},
"required" : [ "created", "did" ],
"title" : "DidComposableResult"
},
"id.walt.enterprise.init.models.IssuerComposableResult" : {
"type" : "object",
"properties" : {
"target" : {
"type" : "string",
"title" : "Target"
},
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"kms" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.KmsComposableResult"
},
"didStore" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
},
"didService" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DidServiceComposableResult"
},
"profile" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
},
"x509" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IssuerX509ComposableResult"
}
},
"required" : [ "created", "target" ],
"title" : "IssuerComposableResult"
},
"id.walt.enterprise.init.models.IssuerX509ComposableResult" : {
"type" : "object",
"properties" : {
"x509Service" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
},
"x509Store" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.ResourceComposableResult"
},
"iaca" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IacaCertComposableResult"
},
"dsc" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.DscCertComposableResult"
}
},
"required" : [ "dsc", "x509Service" ],
"title" : "IssuerX509ComposableResult"
},
"id.walt.enterprise.init.models.IacaCertComposableResult" : {
"type" : "object",
"properties" : {
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"storedCertificateId" : {
"type" : "string",
"title" : "String"
},
"certificatePem" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "certificatePem", "created" ],
"title" : "IacaCertComposableResult"
},
"id.walt.enterprise.init.models.DscCertComposableResult" : {
"type" : "object",
"properties" : {
"created" : {
"type" : "boolean",
"title" : "Boolean"
},
"storedCertificateId" : {
"type" : "string",
"title" : "String"
},
"certificatePem" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "certificatePem", "created" ],
"title" : "DscCertComposableResult"
},
"id.walt.enterprise.init.models.ComposableInitResponse" : {
"type" : "object",
"properties" : {
"wallet" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.WalletComposableResult"
},
"issuer" : {
"$ref" : "#/components/schemas/id.walt.enterprise.init.models.IssuerComposableResult"
}
},
"title" : "ComposableInitResponse"
},
"id.walt.enterprise.services.hostalias.HostAliasService.HostAliasCreationRequest" : {
"type" : "object",
"properties" : {
"domain" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "domain" ],
"title" : "HostAliasService.HostAliasCreationRequest"
},
"host-alias" : {
"type" : "object",
"properties" : {
"traversable" : {
"type" : "boolean",
"title" : "Boolean"
},
"_id" : {
"type" : "string",
"title" : "Target"
},
"domain" : {
"type" : "string",
"title" : "String"
},
"createdAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"updatedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"parent" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "_id", "domain", "parent", "traversable" ],
"title" : ""
},
"id.walt.enterprise.services.apikeys.ApiKeyService.ApiKeyCreationRequest" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"expiration" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "name" ],
"title" : "ApiKeyService.ApiKeyCreationRequest"
},
"id.walt.enterprise.services.apikeys.ApiKeyService.ApiKeyInformation" : {
"type" : "object",
"properties" : {
"_id" : {
"type" : "string",
"title" : "String"
},
"name" : {
"type" : "string",
"title" : "String"
},
"token" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "_id", "token" ],
"title" : "ApiKeyService.ApiKeyInformation"
},
"api-key" : {
"type" : "object",
"properties" : {
"traversable" : {
"type" : "boolean",
"title" : "Boolean"
},
"_id" : {
"type" : "string",
"title" : "Target"
},
"name" : {
"type" : "string",
"title" : "String"
},
"accountId" : {
"type" : "string",
"format" : "uuid",
"title" : "AccountId"
},
"tokenHash" : {
"type" : "string",
"title" : "String"
},
"createdAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"updatedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"tokenExpiration" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"expireAtEpochMs" : {
"type" : "integer",
"format" : "int64",
"title" : "KotlinInstantAsBsonDateTime"
},
"parent" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "_id", "accountId", "parent", "tokenHash", "traversable" ],
"title" : ""
},
"id.walt.enterprise.services.apikeys.ApiKeyDataTransferObject" : {
"type" : "object",
"properties" : {
"path" : {
"type" : "string",
"title" : "String"
},
"created" : {
"type" : "string",
"title" : "String"
},
"expiration" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "created", "path" ],
"title" : "ApiKeyDataTransferObject"
},
"id.walt.enterprise.resource.resources.ExternalMapping" : {
"type" : "object",
"properties" : {
"externalRole" : {
"type" : "string",
"title" : "String"
},
"providerId" : {
"type" : "string",
"title" : "String"
},
"conditions" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.MappingConditions"
},
"enabled" : {
"type" : "boolean",
"title" : "Boolean"
}
},
"required" : [ "enabled", "externalRole" ],
"title" : "ExternalMapping"
},
"id.walt.enterprise.resource.resources.MappingConditions" : {
"type" : "object",
"properties" : {
"emailDomains" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "ArrayList"
},
"requiredClaims" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
}
},
"title" : "MappingConditions"
},
"id.walt.enterprise.services.roles.RoleService.RoleCreationRequest" : {
"type" : "object",
"properties" : {
"name" : {
"type" : "string",
"title" : "String"
},
"permissions" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.permissions.Permission"
},
"title" : "ArrayList"
},
"externalMappings" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
},
"title" : "ArrayList"
}
},
"required" : [ "externalMappings", "permissions" ],
"title" : "RoleService.RoleCreationRequest"
},
"role" : {
"type" : "object",
"properties" : {
"traversable" : {
"type" : "boolean",
"title" : "Boolean"
},
"_id" : {
"type" : "string",
"title" : "Target"
},
"name" : {
"type" : "string",
"title" : "String"
},
"permissions" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.permissions.Permission"
},
"title" : "ArrayList"
},
"externalMappings" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
},
"title" : "ArrayList"
},
"createdAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"updatedAt" : {
"type" : "string",
"format" : "date-time",
"title" : "Instant"
},
"parent" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "_id", "externalMappings", "parent", "permissions", "traversable" ],
"title" : ""
},
"id.walt.enterprise.services.roles.RoleService.UserRoleAssigningRequest" : {
"type" : "object",
"properties" : {
"assigneeEmail" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "assigneeEmail" ],
"title" : "RoleService.UserRoleAssigningRequest"
},
"id.walt.enterprise.services.roles.RoleService.ApiKeyRoleAssigningRequest" : {
"type" : "object",
"properties" : {
"apikey" : {
"type" : "string",
"title" : "Target"
}
},
"required" : [ "apikey" ],
"title" : "RoleService.ApiKeyRoleAssigningRequest"
},
"id.walt.enterprise.services.roles.RoleService.UpdateExternalMappingsRequest" : {
"type" : "object",
"properties" : {
"externalMappings" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
},
"title" : "ArrayList"
}
},
"required" : [ "externalMappings" ],
"title" : "RoleService.UpdateExternalMappingsRequest"
},
"id.walt.enterprise.services.roles.RoleService.UpsertSingleMappingRequest" : {
"type" : "object",
"properties" : {
"providerId" : {
"type" : "string",
"title" : "String"
},
"conditions" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.MappingConditions"
},
"enabled" : {
"type" : "boolean",
"title" : "Boolean"
}
},
"required" : [ "enabled" ],
"title" : "RoleService.UpsertSingleMappingRequest"
},
"id.walt.enterprise.services.roles.RoleService.ExternalMappingListItem" : {
"type" : "object",
"properties" : {
"roleId" : {
"type" : "string",
"title" : "String"
},
"roleName" : {
"type" : "string",
"title" : "String"
},
"mapping" : {
"$ref" : "#/components/schemas/id.walt.enterprise.resource.resources.ExternalMapping"
}
},
"required" : [ "mapping", "roleId" ],
"title" : "RoleService.ExternalMappingListItem"
},
"id.walt.enterprise.services.roles.RoleService.ResolveExternalRolesRequest" : {
"type" : "object",
"properties" : {
"externalRoles" : {
"type" : "array",
"items" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashSet",
"uniqueItems" : true
},
"providerId" : {
"type" : "string",
"title" : "String"
},
"userEmail" : {
"type" : "string",
"title" : "String"
},
"userClaims" : {
"type" : "object",
"additionalProperties" : {
"type" : "string",
"title" : "String"
},
"title" : "LinkedHashMap"
}
},
"required" : [ "externalRoles" ],
"title" : "RoleService.ResolveExternalRolesRequest"
},
"id.walt.enterprise.services.roles.RoleService.ResolvedRole" : {
"type" : "object",
"properties" : {
"roleId" : {
"type" : "string",
"title" : "String"
},
"name" : {
"type" : "string",
"title" : "String"
},
"matchedExternalRole" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "matchedExternalRole", "roleId" ],
"title" : "RoleService.ResolvedRole"
},
"id.walt.enterprise.services.roles.RoleService.ResolveExternalRolesResponse" : {
"type" : "object",
"properties" : {
"resolvedRoles" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.enterprise.services.roles.RoleService.ResolvedRole"
},
"title" : "ArrayList"
}
},
"required" : [ "resolvedRoles" ],
"title" : "RoleService.ResolveExternalRolesResponse"
},
"id.walt.enterprise.services.extensions.dependencies.ServiceDependencyRequest" : {
"type" : "object",
"properties" : {
"dependency" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "dependency" ],
"title" : "ServiceDependencyRequest"
},
"id.walt.status.domain.credential.statuslist.StatusCredentialConfigurationBase" : {
"anyOf" : [ {
"$ref" : "#/components/schemas/TokenStatusList"
}, {
"$ref" : "#/components/schemas/BitstringStatusList"
}, {
"$ref" : "#/components/schemas/RevocationList2020"
}, {
"$ref" : "#/components/schemas/StatusList2021"
} ],
"discriminator" : {
"propertyName" : "type"
},
"title" : "StatusCredentialConfigurationBase"
},
"TokenStatusList" : {
"type" : "object",
"properties" : {
"statusSize" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"statuses" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.Status"
},
"title" : "ArrayList"
},
"format" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.StatusCredentialFormat"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "format", "statusSize", "statuses" ],
"title" : "TokenStatusList"
},
"id.walt.status.domain.credential.statuslist.Status" : {
"type" : "object",
"properties" : {
"status" : {
"type" : "string",
"title" : "String"
},
"message" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "message", "status" ],
"title" : "Status"
},
"id.walt.status.domain.credential.statuslist.StatusCredentialFormat" : {
"type" : "string",
"enum" : [ "JWT", "CWT" ],
"title" : "StatusCredentialFormat"
},
"BitstringStatusList" : {
"type" : "object",
"properties" : {
"statusSize" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"statuses" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.Status"
},
"title" : "ArrayList"
},
"purpose" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "purpose", "statusSize", "statuses" ],
"title" : "BitstringStatusList"
},
"RevocationList2020" : {
"type" : "object",
"properties" : {
"statusSize" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"statuses" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.Status"
},
"title" : "ArrayList"
},
"purpose" : {
"type" : "string",
"title" : "String"
},
"type" : {
"type" : "string",
"title" : "String"
}
},
"required" : [ "purpose", "statusSize", "statuses" ],
"title" : "RevocationList2020"
},
"StatusList2021" : {
"type" : "object",
"properties" : {
"statusSize" : {
"type" : "integer",
"format" : "int32",
"title" : "Int"
},
"statuses" : {
"type" : "array",
"items" : {
"$ref" : "#/components/schemas/id.walt.status.domain.credential.statuslist.Status"
},
"title" : "ArrayList