{ "openapi": "3.1.0", "info": { "title": "SVX Wallet API", "version": "4.0.1", "contact": {}, "description": "SVX Wallet is a multi-role API for holder, issuer, verifer and bridge functionalities. It provides an interface for managing digital wallets and for running verifiable credential workflows end-to-end across receiving, issuing, and presenting credentials.\n\nThe API is designed for flexible integration with mobile apps, web apps, backend services, and enterprise middleware. It combines personal wallet operations and organisation-grade issuer/verifier capabilities in one deployable service, while preserving clear endpoint boundaries.\n\n## Scope of this API\n\nThe current API surface includes:\n\n- Organisation operations: credential issuance setup, credential offers, issuer credentials, authorization server endpoints, well-known metadata, verifier presentation requests, presentation submissions, and SVX Verify sessions\n- Shared platform and governance operations: credential schemas and templates, presentation templates, status lists, trust anchors and operational endpoints\n- Holder wallet operations: wallet lifecycle management, wallet keys, DID management, credential import/list/get/update/delete/verify, OpenID4VCI receive flows, and OpenID4VP presentation flows\n- Bridge operations: mediator between IDPs and credential verifiers\n\n## SVX Wallet: Issuer and Verifier\n\nThe SVX Wallet part of the API is focused on issuer and verifier workflows.\n\n**Issuance**\n\nWallet endpoints support Credential Issuer metadata publication, credential configuration metadata, schema and template management, and credential offer creation for OpenID4VCI flows. Schema and template resources define credential structure, display metadata, supported format details, and validity policy used during issuance.\n\nIssuance can be initiated through credential offers (issuer-initiated) or through wallet-initiated flow using issuer metadata discovery and `scope` resolution against `credential_configurations_supported`. The API includes the Credential Issuer endpoints and the Authorization Server endpoints required for authorization code flow deployments.\n\nCredential offers support pre-authorized code and authorization code grants where configured, including issuance states and identifiers used to correlate subsequent token and credential requests. Offer, nonce, and authorization artifacts are exposed through dedicated endpoints used by wallets during proof-of-possession and credential retrieval steps.\n\nIssuance lifecycle endpoints allow clients to create, list, fetch, and delete offer and issuance state resources, enabling complete operational handling of OpenID4VCI issuance sessions from metadata discovery through credential delivery.\n\n**Verification**\n\nWallet endpoints support verifier request creation, presentation template management, and authorization request publication for OpenID4VP flows. Presentation templates define what a verifier requests from the wallet, including DCQL-based query structures or DIF Presentation Exchange (`presentation_definition`), response handling mode, and verifier redirect behavior.\n\nVerification requests are initiated as OpenID4VP authorization requests and can be represented directly or via `request_uri`. The API includes endpoints to publish and retrieve verifier request JWTs, collect authorization responses submitted by wallets, and persist request/response state for later inspection.\n\nPresentation submissions support `direct_post` and `direct_post.jwt` response modes, including encrypted JWT responses where required by verifier policy. When configured, verifier redirect URIs are returned to continue front-channel UX flows after successful submission.\n\nRequest and response lifecycle endpoints allow clients to create, list, fetch, and delete verification requests and their associated responses, enabling complete operational handling of OpenID4VP verification sessions.\n\n## SVX Wallet: Holder\n\nThe SVX Wallet part of the API is focused on personal wallet operations and credential consumption.\n\n**Wallet management**\n\nHolder wallet APIs (`/wallets/*`) support creating, loading, and managing multiple wallets. A wallet can be identified by an external identifier that matches an application's user identifier. When an external identifier is provided during wallet creation, the service can return an existing wallet reference instead of creating a duplicate.\n\n**Key management**\n\nCryptographic keys are managed custodially by the service. Private key material is stored encrypted and does not leave the service.\n\nSupported key operations include:\n\n- Create key\n- Delete key\n- Get key\n- Import key\n- Sign payload\n- Sign JWT\n- Encrypt JWE\n- Decrypt JWE\n\n**DID management**\n\nWallets can manage one or more DIDs and use them for credential key binding and presentation proofs. DID usage is optional and policy/profile dependent. DID support is intended for broad method compatibility, with common methods such as did:key (including EBSI variant) and did:jwk used by default in issuance/presentation workflows where enabled.\n\n**Credential lifecycle**\n\n- Receive / import credential\n- Verify credential\n- Present credential\n\nReceiving a credential from an issuer typically includes key binding, where the wallet provides a public key or DID and proof of control over the key material. Presenting a credential includes the credential and holder proof required by the selected presentation profile.\n\n**Authentication and authorization**\n\nThe service does not mandate a single built-in external auth pattern for all wallets. It is expected to run behind deployment-specific controls, for example:\n\n- API gateway policies\n- Backend-for-frontend layers\n- Service mesh or network perimeter controls\n\nDepending on endpoint and deployment mode, requests may be anonymous, bearer-token protected, or mutual-TLS secured.\n\n## Supported credential formats\n\n- `dc+sd-jwt`: SD-JWT VC with selective disclosure\n- `jwt_vc_json`: W3C Verifiable Credentials represented as JWT\n- `mso_mdoc`: ISO mobile document format\n\n## Supported standards and references\n\nThe API is aligned with the following standards and registries (final support depends on endpoint/profile):\n\n- [JWK: RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517)\n- [JWA: RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518)\n- [JWE: RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516)\n- [JOSE IANA registry](https://www.iana.org/assignments/jose/jose.xhtml)\n- [W3C Verifiable Credentials Data Model](https://www.w3.org/TR/vc-data-model/)\n- [IETF SD-JWT VC draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/)\n- [ISO/IEC 18013-5 (mDL/mDOC)](https://www.iso.org/standard/69064.html)\n- [OpenID for Verifiable Credential Issuance (OpenID4VCI 1.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)\n- [OpenID for Verifiable Presentations (OpenID4VP 1.0)](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)\n- [OpenID for Verifiable Credential High Assurance Interoperability Profile 1.0](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html)\n- [OAuth 2.0 Pushed Authorization Requests: RFC 9126](https://www.rfc-editor.org/info/rfc9126)\n\n## Deployment\n\nTypical deployments rely on platform services such as:\n\n- PostgreSQL for application persistence (credentials, presentation requests, configuration, holder wallet instances, issuance and presentation workflow states, etc.)\n- Redis for token/session/cache workloads\n- KMS for key management and cryptographic operations (e.g. AWS KMS)\n" }, "tags": [], "servers": [ { "url": "https://zyfla-wallet-sandbox.meeco.cloud", "description": "SVX Wallet deployment (relative)" } ], "security": [ {}, { "bearerAuth": [] }, { "mutualTLS": [] } ], "paths": { "/challenge": { "post": { "summary": "Generate attestation challenge Endpoint", "description": "Initiates an attestation process by generating a challenge that the Wallet must sign to prove possession of a key or credential. \nThe resulting signed attestation can then be submitted to complete the credential issuance or binding process.\n\n## Purpose\n\nThis endpoint enables the Issuer to verify the authenticity and integrity of the Wallet or Holder before issuing a Verifiable Credential.\n\n## Typical Flow\n\n1. The Wallet requests a challenge from the Issuer.\n2. The Issuer returns a challenge (e.g., nonce, payload, or proof request).\n3. The Wallet signs the challenge using its private key and returns the attestation proof to the Issuer.\n\n## Supported Standards\n\n- [OAuth 2.0 Attestation-Based Client Authentication](https://www.ietf.org/archive/id/draft-ietf-oauth-attestation-based-client-auth-07.html)\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AttestationChallengeResponseModelDto" } } }, "description": "OK" }, "400": { "description": "Invalid request / Too many requests", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/SlowDownError" } ] } } } }, "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "tags": ["Authorization Server"] } }, "/jwks": { "get": { "summary": "JSON Web Keys Endpoint", "description": "Host the JSON Web Key Set (JWKS) used to validate access tokens issued by the Wallet.\n", "responses": { "200": { "content": { "application/json": { "example": { "keys": [ { "alg": "ES256", "crv": "P-256", "kid": "ritDgnA8wOtvFEA3pd2AEGom7vgGgCwKH1gfhQUkY1k", "kty": "EC", "use": "sig", "x": "M4CRKG-wiOTEnTNqQ89fOz3gzznbNroG47FhbYLMZaE", "y": "p0BZN0a-2t9NTV40xU3uVaac-mHqC4zUYUS9nfLxink" } ] }, "schema": { "properties": { "keys": { "items": { "description": "JSON Web Key", "type": "object" }, "type": "array" } }, "type": "object" } } }, "description": "JSON Web Key Set" } }, "security": [], "tags": ["Authorization Server"] } }, "/authorize": { "get": { "summary": "Authorization Endpoint", "description": "Authorization Request endpoint as specified in the OpenID for Verifiable Credential Issuance specification.\n\nSupports wallet-initiated issuance requests via `scope` as per [Section 5.1.2 of OID4VCI](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-scope-parameter-to-re)\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 5)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-authorization-endpoint)\n- [RFC 6749 - The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)\n- [RFC 7636 - OAuth 2.0 Proof Key for Code Exchange (Section 4.3)](https://datatracker.ietf.org/doc/html/rfc7636#section-4.3)\n- [RFC 9396 - OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396)\n", "parameters": [ { "description": "A unique identifier for the client", "in": "query", "name": "client_id", "required": true, "schema": { "type": "string" } }, { "description": "Inform the authorization server of the desired grant type. MUST be `code`, which is used to initiate the authorization code flow", "in": "query", "name": "response_type", "required": false, "schema": { "enum": ["code"], "type": "string" } }, { "description": "Scope of the access request. Can be used to communicate credential template(s) to be issued.", "in": "query", "name": "scope", "required": false, "schema": { "enum": ["openid"], "type": "string" } }, { "description": "The URI to which the authorization server will redirect the user-agent with the authorization code after the authorization is completed", "in": "query", "name": "redirect_uri", "required": true, "schema": { "type": "string" } }, { "description": "Code challenge generated by the client's code verifier. MUST be used with `code_challenge_method`", "in": "query", "name": "code_challenge", "required": false, "schema": { "type": "string" } }, { "description": "The method used to dervice the code challenge. MUST be `S256`", "in": "query", "name": "code_challenge_method", "required": false, "schema": { "enum": ["S256"], "type": "string" } }, { "description": "Issuer state as provided in the credential offer claim `grants.authorization_code.issuer_state`. Required if the offer contained `issuer_state`.", "in": "query", "name": "issuer_state", "required": false, "schema": { "type": "string" } }, { "description": "Reference to the request object as returned by the Pushed Authorization Request (PAR) endpoint", "in": "query", "name": "request_uri", "required": false, "schema": { "type": "string" } }, { "description": "Serialized array of authorization details object defined in Section 2 of [RFC9396] used to convey the details about the Credentials the Wallet wants to obtain", "in": "query", "name": "authorization_details", "required": false, "schema": { "type": "string" } }, { "description": "Custom reference to the IDP that will be used for bridge interaction", "in": "query", "name": "connection", "required": false, "schema": { "type": "string", "enum": ["connect_id", "select_id"] } }, { "description": "Custom parameter to allow account based claims to be passed between bridge components. It is a comma separated list of claim names.", "in": "query", "name": "account_claims", "required": false, "schema": { "type": "string" } } ], "responses": { "303": { "description": "Redirect to Authentication page.\nIn case of error, response redirects to the URI provided via `redirect_uri` paramter with `error` and `error_description` properties.\nPossible error values:\n - invalid_request\n - invalid_grant\n - invalid_scope\n - invalid_client\n - unauthorized_client\n - unsupported_grant_type\n - server_error\n - temporary_unavailable\n", "headers": { "location": { "schema": { "type": "string" } } } }, "400": { "description": "Request is invalid and `redirect_uri` property was not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestError" } } } }, "500": { "description": "Internal Server Error. Unexpected error occurred.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "security": [], "tags": ["Authorization Server"] } }, "/par": { "post": { "summary": "Pushed Authorization Request Endpoint", "description": "Pushed Authorization Request endpoint as defined in [RFC 9126 - OAuth 2.0 Pushed Authorization Request (PAR)](https://www.rfc-editor.org/rfc/rfc9126.html#name-pushed-authorization-reques)\n\nUsed in the OpenID4VCI Authorization Code Flow, it supports a more secure way of sending the authorization request. Upon successfully verifying the request, it returns a `request_uri` which can be used in a subsequent call to the `/authorize` endpoint.\n\nIts usage is highly recommended in general, but mandatory when `require_pushed_authorization_requests` is set to `true` in the Authorization Server Metadata.\n", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "properties": { "client_id": { "description": "A unique identifier for the client", "type": "string" }, "response_type": { "description": "Inform the authorization server of the desired grant type. MUST be `code`, which is used to initiate the authorization code flow", "enum": ["code"], "type": "string" }, "scope": { "description": "Scope of the access request. Can be used to communicate credential template(s) to be issued.", "enum": ["openid"], "type": "string" }, "redirect_uri": { "description": "The URI to which the authorization server will redirect the user-agent with the authorization code after the authorization is completed", "type": "string" }, "code_challenge": { "description": "Code challenge generated by the client's code verifier. MUST be used with `code_challenge_method`", "type": "string" }, "code_challenge_method": { "description": "The method used to dervice the code challenge. MUST be `S256`", "enum": ["S256"], "type": "string" }, "issuer_state": { "description": "Issuer state as provided in the credential offer claim `grants.authorization_code.issuer_state`. Required if the offer contained `issuer_state`.", "type": "string" }, "connection": { "description": "Custom reference to the IDP that will be used for bridge interaction", "type": "string", "enum": ["connect_id", "select_id"] }, "account_claims": { "description": "Custom parameter to allow account based claims to be passed between bridge components. It is a comma separated list of claim names.", "type": "string" } }, "required": [ "client_id", "code_challenge", "code_challenge_method", "issuer_state", "redirect_uri", "response_type", "scope" ], "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "properties": { "request_uri": { "type": "string" } }, "type": "object" } } }, "description": "Redirect URI that can be used in the /authorize endpoint" }, "400": { "description": "The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestError" }, { "$ref": "#/components/schemas/InvalidScopeError" }, { "$ref": "#/components/schemas/InvalidClientError" }, { "$ref": "#/components/schemas/UnauthorizedClientError" }, { "$ref": "#/components/schemas/UnsupportedGrantTypeError" } ] } } } }, "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "security": [], "tags": ["Authorization Server"] } }, "/token": { "post": { "summary": "Token Endpoint", "description": "Token endpoint for OpenID for Verifiable Credential Issuance (OID4VCI). Exchanges either a Pre-Authorized Code or Authorization Code for an access token used to obtain verifiable credentials from the Credential Endpoint.\n\n## Flows\n\n| Grant Type | Required Parameters |\n|------------|---------------------|\n| `urn:ietf:params:oauth:grant-type:pre-authorized_code` | `pre-authorized_code`, `tx_code` (if required by the issuer) |\n| `authorization_code` | `code`, `redirect_uri`, `code_verifier` (PKCE) |\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 6)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-token-endpoint)\n- [RFC 6749 - The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)\n- [RFC 7636 - OAuth 2.0 Proof Key for Code Exchange (Section 4.5)](https://datatracker.ietf.org/doc/html/rfc7636#section-4.5)\n", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/TokenRequestModelDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TokenResponseModelDto" } } }, "description": "OK" }, "400": { "description": "Invalid request / grant / scope or unsupported grant type or invalid scope or authorization is pending", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestError" }, { "$ref": "#/components/schemas/InvalidGrantError" }, { "$ref": "#/components/schemas/InvalidScopeError" }, { "$ref": "#/components/schemas/InvalidClientError" }, { "$ref": "#/components/schemas/UnauthorizedClientError" }, { "$ref": "#/components/schemas/UnsupportedGrantTypeError" }, { "$ref": "#/components/schemas/AuthorizationPendingError" }, { "$ref": "#/components/schemas/SlowDownError" } ] } } } }, "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "security": [], "tags": ["Authorization Server"] } }, "/.well-known/jwt-vc-issuer": { "get": { "summary": "JWT VC Issuer Metadata", "description": "A well-known endpoint required to be published as a SD-JWT VC Issuer.\n\nReturned metadata is an object with `issuer` name and a JWKS that contains public key(s) used in signing issued credentials.\n\n## Purpose\n\nVerification of issued credentials.\n\n## Supported Standards\n\n- [SD-JWT VC - JWT VC Issuer Metadata](https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html).\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WellKnownJwtIssuerResponse" }, "example": { "issuer": "https://issuer.example.com", "jwks": { "keys": [ { "kty": "EC", "alg": "P-256", "kid": "kid", "x": "...", "y": "..." } ] } } } }, "description": "OK" } }, "security": [], "tags": ["Well-Known URIs"] } }, "/.well-known/oauth-authorization-server": { "get": { "summary": "Authorization Server Metadata", "description": "Authorization Server metadata as defined in [RFC8414 - OAuth 2.0 Authorization Server Metadata](https://datatracker.ietf.org/doc/html/rfc8414) and extended with additional fields and values in:\n\n- [RFC 9126 – OAuth 2.0 Pushed Authorization Requests (PAR)](https://datatracker.ietf.org/doc/rfc9126/)\n- [RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/rfc9449/)\n- [OAuth 2.0 JWT Secured Authorization Response Mode (JARM)](https://openid.net/specs/oauth-v2-jarm.html#name-authorization-server-metada)\n- [RFC 9396 - OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/rfc9396/)\n- [OpenID for Verifiable Credential Issuance (OpenID4VCI 1.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata)\n\nThe use of this endpoint is optional. It is relevant when the server acts and an Authorization Server. It does so when `authorization_servers` is omitted from Issuer Metadata or when `authorization_servers` contains an item that references the server. In that case, the Credential Issuer is also an Authorization Server and its metadata is retrieved from this endpoint.\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenidConfigResponse" } } }, "description": "OK" } }, "security": [], "tags": ["Well-Known URIs"] } }, "/.well-known/openid-configuration": { "get": { "summary": "OpenID Provider Configuration Metadata", "description": "This endpoint serves the same content as `/.well-known/oauth-authorization-server` and is here for interoperability reasons. The recommendation is\nto use `/.well-known/oauth-authorization-server` whenever possible.\n\n## Supported Standards\n\n- [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html)\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenidConfigResponse" } } }, "description": "OK" } }, "security": [], "tags": ["Well-Known URIs"] } }, "/.well-known/openid-credential-issuer": { "get": { "summary": "Credential Issuer Metadata", "description": "Returns the Credential Issuer Metadata document as defined in Section 12.2 of\nthe OpenID for Verifiable Credential Issuance (OID4VCI) specification.\n\nThis endpoint is mandatory for Credential Issuers and serves as the primary\ndiscovery mechanism for wallets and other clients interacting with the issuer.\n\nThe `credential_configurations_supported` object is populated from the available Credential Templates.\n\nEach configuration describes a credential that can be issued and provides\nthe information required to initiate and complete the issuance flow.\n\n## Supported Standard\n[OpenID for Verifiable Credential Issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata)\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WellKnownOpenidCredentialIssuerResponse" } } }, "description": "OK" } }, "security": [], "tags": ["Well-Known URIs"] } }, "/.well-known/appspecific/selectid.rp": { "get": { "summary": "SelectID Relying Party metadata", "description": "SelectID Relying Party metadata.\n\nAvailable for SelectID Authorizers to interact with the Wallet as a relying party.\n", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectIDRPConfigResponse" } } }, "description": "OK" } }, "security": [], "tags": ["Well-Known URIs"] } }, "/issuer/nonce": { "post": { "summary": "Get a nonce Endpoint", "description": "Get a nonce to be used in proof of possession during credential issuance.\n\nAs defined in section 7.0 of [OID4VCI](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-nonce-endpoint).\n\n## Note\n\nThis endpoint is only mounted in the SVX Wallet when enabled via the RUNTIME configuration - `issuer.issuance_policy.nonce_required`.\n\nWhen enabled, `nonce_endpoint` metadata will be added to the Credential Issuer Well-Known metadata (`/.well-known/openid-credential-issuer`).\nAs per the specification if the `nonce_endpoint` metadata is available, `nonce` MUST be used for the credential endpoint.\n\nWhen disabled, the SVX Wallet will return `HTTP 404 - Not Found` for calls to this endpoint.\n`nonce_endpoint` will not be available in the Credential Issuer Well-Known metadata.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 7.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-nonce-endpoint)\n", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "properties": { "c_nonce": { "type": "string" } } } } } } }, "security": [], "tags": ["OpenID 4 Verifiable Credential Issuance"] } }, "/issuer/credential": { "post": { "summary": "Credential Endpoint", "description": "Issues a Credential upon presentation of a valid Access Token. The Client can request issuance multiple times, enabling binding to multiple keys or DIDs.\n\nAll issued Credentials are cryptographically bound to an identifier that the End-User controls. Non-cryptographic binding is currently not supported.\n\n## Key Proof\n\nThe supported key `proof_type` values are `jwt` and `attestation` (when key attestation is configured via `key_attesters`).\n\n- `jwk` in `proof.header` will be assigned to `cnf.jwk` in the issued credential or to the `device_key_info` in the mso of the issued `mso_mdoc`\n- `kid` in `proof.header` will be assigned to the `credentialSubject.id` in the issued credential\n\nUsing the `kid` is the preferred method when using DIDs.\n\nCredential will be issued and signed by a key managed by the SVX Wallet. This can be configured to use external KMS (e.g: AWS KMS)\n\n## Batch Issuance support\n\nBatch issuance is supported as defined in [OpenID for Verifiable Credential Issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-batch-credential-issuance).\n\nMaximum number of credentials that can be issued in a single credential request can be configured via the runtime configuration `issuer.issuance_policy.max_batch_credential_issuance_size`.\n\nFor `key_attestation` proofs, a credential will be issued and bound to each key in the `attested_keys`. The maximum number of keys is the same as the maximum number of credentials that can be issued in a single credential request.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 7)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-endpoint)\n", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialResponse" } } }, "description": "OK" }, "400": { "description": "The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestError" }, { "$ref": "#/components/schemas/InvalidCredentialRequestError" }, { "$ref": "#/components/schemas/UnsupportedCredentialTemplateError" }, { "$ref": "#/components/schemas/UnsupportedCredentialFormatError" }, { "$ref": "#/components/schemas/InvalidProofError" }, { "$ref": "#/components/schemas/InvalidEncryptionParametersError" } ] } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessDeniedError" } } } }, "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "security": [], "tags": ["OpenID 4 Verifiable Credential Issuance"] } }, "/issuer/schemas": { "post": { "summary": "Create schema", "description": "**schema_json** must comply with the [specification](https://www.w3.org/TR/vc-json-schema/).\n\nSchema validity can be checked by using one of the web validators listed at the [JSON Schema tooling page](https://json-schema.org/tools?query=&sortBy=name&sortOrder=ascending&groupBy=toolingTypes&licenses=&languages=&drafts=&toolingTypes=validator).\n\n**schema_json.$id** is not expected in the payload. The API assigns its own internal value even if one is provided.\n\n---\n\nThere are additional restrictions for the `dc+sd-jwt` format. \n\nThere are registered JWT claims for this credential format ([SD-JWT VC spec](https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-16.html#section-2.2.2.2)).\n\nThey are used internally and cannot be included as claims or defined as claims in the **schema_json**\n\nThe following claims cannot be icluded in **schema_json.properties**:\n- `iss`\n- `nbf`\n- `exp`\n- `cnf`\n- `vct`\n- `vct#integrity`\n- `extends#integrity`\n- `schema_uri#integrity`\n- `sub`\n- `aud`\n- `jti`\n- `iat`\n- `_sd`\n- `_sd_alg`\n\n\n`status` is also a registered JWT claims. However currently SVX Wallet does not support status list for `dc+sd-jwt`.\nSo this claim can be included in a `dc+sd-jwt` credential schema for users to manually set an externally maintained Status List.\nBut `status` MUST always be shown and cannot be set as selectively disclosable.\n\nFor example, \n[Status List](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-status-list-20):\n```json\n \"status\": {\n \"status_list\": {\n \"idx\": 0,\n \"uri\": \"https://example.com/statuslists/1\"\n }\n }\n```\n\nThere are no restrictions for `jwt_vc_json` or `mso_mdoc` formats.\n\n---\n\nExample (`jwt_vc_json` format):\n\n```json\n{\n \"schema\": {\n \"name\": \"EmailCredential\",\n \"format\": \"jwt_vc_json\",\n \"schema_json\": {\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"description\": \"EmailCredential using JsonSchema\",\n \"type\": \"object\",\n \"properties\": {\n \"credentialSubject\": {\n \"type\": \"object\",\n \"properties\": {\n \"emailAddress\": {\n \"type\": \"string\",\n \"format\": \"email\"\n }\n },\n \"required\": [\"emailAddress\"]\n }\n }\n }\n }\n}\n```\n\n---\n\nExample (`dc+sd-jwt` format):\n\n```json\n{\n \"schema\": {\n \"name\": \"SelectiveDisclosableCredential\",\n \"format\": \"dc+sd-jwt\",\n \"schema_json\": {\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"type\": \"object\",\n \"properties\": {\n \"iss\": { \"type\": \"string\" },\n \"email\": { \"type\": \"string\" },\n \"is_over_18\": { \"type\": \"boolean\" }\n },\n \"required\": [\"iss\", \"email\", \"is_over_18\"]\n }\n }\n}\n```\n\n---\n\nExample (`mso_mdoc` format):\n\n```json\n{\n \"schema\": {\n \"name\": \"MobileDriverLicense\",\n \"format\": \"mso_mdoc\",\n \"schema_json\": {\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"type\": \"object\",\n \"properties\": {\n \"org.iso.18013.5.1\": {\n \"type\": \"object\",\n \"properties\": {\n \"email\": { \"type\": \"string\" },\n \"portrait\": {\n \"type\": \"string\",\n \"description\": \"jpeg as base64url encoded\",\n \"x-cbor-encoding\": \"bstr\"\n }\n }\n }\n },\n \"required\": [\"email\", \"portrait\"]\n }\n }\n}\n```\n", "operationId": "SchemasController_create", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateSchemaPayloadDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemaResponseDto" } } }, "description": "Schema successfully created" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Invalid request payload" } }, "tags": ["Schemas"] }, "get": { "summary": "List schemas", "description": "Returns a list of schemas available created and managed by the Wallet. The list can be filtered, sorted, and paginated by using the available query parameters.\n", "operationId": "SchemasController_findAll", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "search", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemasResponseDto" } } }, "description": "Schemas successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPaginationParamError" } } }, "description": "Invalid query params" } }, "tags": ["Schemas"] } }, "/issuer/schemas/{id}": { "get": { "summary": "Get schema", "description": "Returns schema information for a given schema id. The schema information includes the JSON schema definition and metadata such as supported credential formats. \n", "operationId": "SchemasController_findOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemaResponseDto" } } }, "description": "Schema successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "Schema could not be loaded" } }, "tags": ["Schemas"] }, "put": { "summary": "Update schema", "description": "Update schema information for a given schema id.\n\n**Note**: Updating a schema may have implications on existing credential templates linked to the schema and issued credentials based on those templates. Ensure to review the changes carefully before updating a schema.\n", "operationId": "SchemasController_update", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateSchemaPayloadDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemaResponseDto" } } }, "description": "Schema successfully updated" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "Invalid path param or payload" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemaNotFoundError" } } }, "description": "Schema not found" } }, "tags": ["Schemas"] }, "delete": { "summary": "Delete schema", "description": "Deletes a schema by its ID. Schemas that are linked to active credential templates or issued credentials cannot be deleted. Ensure to review the implications before deleting a schema.\n", "operationId": "SchemasController_deleteOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Schema deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SchemaNotFoundError" } } }, "description": "Schema not found" } }, "tags": ["Schemas"] } }, "/issuer/schemas/{id}/schema.json": { "get": { "summary": "Retrieve credential schema definition", "description": "Returns credential schema (**schema_json** attribute value) in a format described by the [specification](https://w3c-ccg.github.io/vc-json-schemas/v2/index.html).\n", "operationId": "SchemasController_findOneJSONScheme", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialJSONSchemaPayloadDto" } } }, "description": "Schema definition loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "Unsupported schema credential type" } }, "tags": ["Schemas"] } }, "/issuer/templates": { "post": { "summary": "Create credential template", "description": "Create a credential template by providing necessary information such as the linked schema, credential format, and other relevant metadata. The created template is then be used for issuing credentials.\n\n---\n\nRestriction for `dc+sd-jwt` format:\n\n- `status` is a registered JWT claims and MUST always be disclosed. `status` cannot be included in **config.disclosure_frame._sd**\n", "operationId": "CredentialTemplatesController_create", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCredentialTemplatePayloadDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateResponseDto" } } }, "description": "Credential template successfully created" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Invalid request payload" } }, "tags": ["Credential Templates"] }, "get": { "summary": "List credential templates", "description": "List credential templates created and managed by the Wallet. The list can be filtered, sorted, and paginated by using the available query parameters.\n", "operationId": "CredentialTemplatesController_findAll", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "format", "required": false, "schema": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"] } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplatesResponseDto" } } }, "description": "Credential templates successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPaginationParamError" } } }, "description": "Invalid query params" } }, "tags": ["Credential Templates"] } }, "/issuer/templates/{id}": { "get": { "summary": "Get credential template", "description": "Get credential template by ID The template contains necessary information for credential issuance such as the linked schema, credential format, and other relevant metadata.\n", "operationId": "CredentialTemplatesController_findOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateResponseDto" } } }, "description": "Credential template successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateNotFoundError" } } }, "description": "Credential template not found" } }, "tags": ["Credential Templates"] }, "put": { "summary": "Update credential template", "description": "Update credential template by providing necessary information such as the linked schema, credential format, and other relevant metadata. The updated template is then used for issuing credentials.\n", "operationId": "CredentialTemplatesController_update", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateCredentialTemplatePayloadDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateResponseDto" } } }, "description": "Credential template successfully updated" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "Invalid path param or payload" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateNotFoundError" } } }, "description": "Credential template not found" } }, "tags": ["Credential Templates"] }, "delete": { "summary": "Delete credential template", "description": "Delete credential template by ID. Deleted templates can no longer be used for credential issuance. Ensure to review the implications before deleting a credential template.\n", "operationId": "CredentialTemplatesController_deleteOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Credential template deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialTemplateNotFoundError" } } }, "description": "Credential template not found" } }, "tags": ["Credential Templates"] } }, "/issuer/status_list/{id}": { "get": { "summary": "Retrieve status list credential JWT", "description": "Returns a status list credential in JWT format. Typically used for revocation checking of issued credentials. The status list credential contains a bitstring representing the revocation status of credentials linked to the status list. The specific implementation of the status list credential may vary based on the supported standards and configurations of the issuer.\n\n## Supported Standards\n\n- [W3C VC Bitstring Status List v1.0](https://www.w3.org/TR/vc-bitstring-status-list/)\n", "operationId": "StatusListController_findOneJWT", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/jwt": { "schema": { "type": "string" } } }, "description": "Status list credential JWT" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/RevocationListNotFoundError" } ] } } }, "description": "Invalid path param or list not found" } }, "tags": ["Status Lists"] } }, "/issuer/offers": { "post": { "summary": "Create credential offer", "description": "Creates a credential offer. The credential offer object can be retrieved via the `uri` in the response.\n\n`claims` will be validated against the registered credentialTemplate.schema\n\nAn `authorization_code` or `urn:ietf:params:oauth:grant-type:authorized_code` grant MUST be provided. However, `issuer_state` and `pre-authorized_code` are optional. If not provided, Wallet will generate random values for them.\n\n`user_id` can only be used if Resource Hook is configured.\n`user_id` can only be used with Pre-authorized Code Grant.\n`user_id` will be sent to the external resource server via the resource hook.\n\nOne of `claims` OR `user_id` MUST be provided.\n\nCredential offers expire. Expiration is controlled by runtime configuration - `issuer.issuance_policy.credential_offer_expiry`.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 - Credential Offer Endpoint](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-offer-endpoint)\n", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialOfferRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialOfferResponse" } } }, "description": "OK" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidCredentialOfferPayload" }, { "$ref": "#/components/schemas/InvalidCredentialOfferClaims" } ] } } }, "description": "" } }, "tags": ["Credential Offers"] } }, "/issuer/offers/{id}": { "delete": { "summary": "Delete credential offer by ID", "description": "Delete credential offer by ID. Deleted credential offers can no longer be retrieved or used for credential issuance. Ensure to review the implications before deleting a credential offer.\n\n`id` path parameter refers to the `issuer_state` or `pre-authorized_code` of the credential offer.\n\nExpired credential offers can be deleted by using this endpoint.\n", "parameters": [ { "description": "ID of the credential offer to delete", "in": "path", "name": "id", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Credential offer deleted" } }, "tags": ["Credential Offers"] }, "get": { "summary": "Get credential offer by ID", "description": "Get credential offer by ID. The credential offer object contains necessary information for the wallet to proceed with credential issuance.\n\n`id` path parameter refers to the `issuer_state` or `pre-authorized_code` of the credential offer.\n\nExpired credential offers cannot be retrieved by using this endpoint.\n", "parameters": [ { "description": "ID of the credential offer to retrieve", "in": "path", "name": "id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialOfferDto" } } }, "description": "OK" } }, "security": [], "tags": ["Credential Offers"] } }, "/issuer/credentials": { "get": { "summary": "List issued credentials", "description": "Lists credentials that have been issued by this issuer instance. The list can be filtered, sorted, and paginated by using the available query parameters. Filtering by credential format is also supported to easily retrieve credentials of a specific format.\n", "operationId": "IssuerCredentialsController_findAll", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string", "enum": ["created_at"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "format", "required": false, "description": "Filter by credential format (Supported: `jwt_vc_json`, `dc+sd-jwt`, `mso_mdoc`)", "schema": { "type": "string", "enum": ["jwt_vc_json", "dc+sd-jwt", "mso_mdoc"] } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuerCredentialsResponseDto" } } }, "description": "Credentials successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPaginationParamError" } } }, "description": "Invalid query params" } }, "tags": ["Issuer Credentials"] }, "post": { "summary": "Issue ad-hoc credentials", "description": "Protected endpoint for ad-hoc issuance of signed credentials by authorised service accounts of the organisation.\n\nA credential of the provided `credential_configuration_id` will be issued for each key provided (JWK) in `binding_keys`.\nThe response follows the response of a successful issuance with the OID4VCI protocol.\nEach credential will be returned in an array of objects.\n\nIf `binding_keys` is not provided, a single credential without holder binding will be issued.\n\nExample:\n- `credentials: [ { credential: 'ejy0...' } ]`\n\n`jwt_vc_json` and `dc+sd-jwt` credentials will be returned as a base64url-encoded string of compact JWT.\n\n`mso_mdoc` credentials will be returned as a base64url-encoded representation of the CBOR-encoded IssuerSigned structure.\n\nProof of possesion of the `binding_keys` is not checked.\n\n## Supported Standards\n\n- jwt_vc_json: [W3C Verifiable Credentials Data Model 1.1](https://www.w3.org/TR/vc-data-model-1.1)\n- dc+sd-jwt: [SD-JWT-based Verifiable Digital Credentials](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc)\n- mso_mdoc: [ISO 18013-5 Mobile Driving License (mDL) v1.0](https://www.iso.org/standard/69084.html)\n", "operationId": "IssuerCredentials", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdhocCredentialIssuanceRequest" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialResponse" } } }, "description": "OK" }, "400": { "description": "The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestError" } ] } } } }, "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorError" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemporarilyUnavailableError" } } } } }, "tags": ["Issuer Credentials"] } }, "/issuer/credentials/verify": { "post": { "summary": "Verify credential", "description": "Verify a credential provided in the request body. This endpoint performs\nsignature, format and optional revocation/schema checks and returns a\nverification summary. Useful for issuer or operator tooling that needs\nto verify credentials without a Wallet context.\n", "operationId": "IssuerCredentialsController_verify", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "credential": { "type": "string", "description": "Encoded credential (compact JWT or base64url mso_mdoc)" }, "format": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"] } }, "required": ["credential"] } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialVerificationResponseDto" } } }, "description": "Credential verification complete" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestError" } } }, "description": "" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyCredentialError" } } }, "description": "" } }, "tags": ["Issuer Credentials"] } }, "/issuer/credentials/{id}": { "get": { "summary": "Get issued credential", "description": "Returns an issued credential if it exists by ID. The credential information includes the original credential content returned at the time of issuance and metadata such as the linked credential template, schema, and status list information if applicable. \n", "operationId": "IssuerCredentialsController_findOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuerCredentialResponseDto" } } }, "description": "Credential successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuerCredentialNotFoundError" } } }, "description": "Credential not found" } }, "tags": ["Issuer Credentials"] }, "delete": { "summary": "Delete issued credential", "description": "Deletes an issued credential record by ID. Deleted credentials can no longer be retrieved. Ensure to review the implications before deleting an issued credential, especially if it has been shared with holders or verifiers.\n", "operationId": "IssuerCredentialsController_remove", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Credential deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuerCredentialNotFoundError" } } }, "description": "Credential not found" } }, "tags": ["Issuer Credentials"] } }, "/issuer/credentials/{id}/status": { "patch": { "summary": "Update credential status list entry", "description": "Update credential status list entry for an issuer credential. This endpoint is used to update the revocation status of a credential by modifying the corresponding entry in the linked status list. The specific changes to the status list entry depend on the desired revocation status (e.g., revoked or active) and the implementation of the status list. Ensure to review the implications of changing a credential's revocation status, especially if it has been shared with holders or verifiers.\n\n## Supported Standards\n\n- [W3C VC Bitstring Status List v1.0](https://www.w3.org/TR/vc-bitstring-status-list/)\n", "operationId": "CredentialStatusController_update", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateCredentialStatusRequestDto" } } }, "required": true }, "responses": { "204": { "description": "Credential status list entry updated" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" }, { "$ref": "#/components/schemas/UnsupportedCredentialStatusListTypeError" }, { "$ref": "#/components/schemas/CredentialRevocationStatusValueInvalidError" } ] } } }, "description": "Invalid path param or payload" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialRevocationStatusNotFoundError" } } }, "description": "Credential status not found" } }, "tags": ["Issuer Credentials"] } }, "/verifier/templates": { "post": { "summary": "Create presentation template", "description": "Register a Presentation Template.\n\n`dcql_query` follows DCQL format when `type=dcql`.\n`input_descriptors` follows DIF Presentation Exchange format when `type=pex`.\n\nIf `type` is omitted, `dcql` is used by default.\n\n## Supported Standards\n\n- [DIF Presentation Exchange v2.1.1](https://identity.foundation/presentation-exchange/spec/v2.1.1/)\n- [OpenID4VP 1.0 (DCQL)](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)\n", "operationId": "PresentationTemplatesController_create", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePresentationTemplatePayloadDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateResponseDto" } } }, "description": "Presentation template successfully created" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestPayloadError" }, { "$ref": "#/components/schemas/InvalidPresentationTemplateInputDescriptorsError" }, { "$ref": "#/components/schemas/InvalidPresentationTemplateDcqlQueryError" } ] } } }, "description": "Invalid payload or presentation template content" } }, "tags": ["Presentation Templates"] }, "get": { "summary": "List presentation templates", "description": "List presentation templates managed by the Wallet. The list can be filtered, sorted, and paginated by using the available query parameters. Filtering by template type is also supported to easily retrieve templates of a specific format. \n", "operationId": "PresentationTemplatesController_findAll", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string", "enum": ["name", "created_at"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "search", "required": false, "schema": { "type": "string", "maxLength": 50 } }, { "in": "query", "name": "type", "required": false, "schema": { "$ref": "#/components/schemas/PresentationTemplateType" } }, { "in": "query", "name": "created_at_from", "required": false, "schema": { "type": "string", "format": "date" } }, { "in": "query", "name": "created_at_to", "required": false, "schema": { "type": "string", "format": "date" } }, { "in": "query", "name": "updated_at_from", "required": false, "schema": { "type": "string", "format": "date" } }, { "in": "query", "name": "updated_at_to", "required": false, "schema": { "type": "string", "format": "date" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedPresentationTemplatesResponseDto" } } }, "description": "Presentation templates successfully loaded" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPaginationParamError" }, { "$ref": "#/components/schemas/InvalidDateFilterValueError" } ] } } }, "description": "Invalid query params" } }, "tags": ["Presentation Templates"] } }, "/verifier/templates/{id}": { "get": { "summary": "Get presentation template", "description": "Get presentation template by ID. The template contains necessary information for presentation request generation such as the linked input descriptors or DCQL query and other relevant metadata.\n", "operationId": "PresentationTemplatesController_findOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateResponseDto" } } }, "description": "Presentation template successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateNotFoundError" } } }, "description": "Presentation template not found" } }, "tags": ["Presentation Templates"] }, "patch": { "summary": "Update presentation template", "description": "Update presentation template fields. `type` cannot be changed.\n\n`input_descriptors` updates are valid for `pex` templates, and `dcql_query` updates are valid for `dcql` templates.\n\n## Supported Standards\n\n- [DIF Presentation Exchange v2.1.1](https://identity.foundation/presentation-exchange/spec/v2.1.1/)\n- [OpenID4VP 1.0 (DCQL)](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)\n", "operationId": "PresentationTemplatesController_update", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdatePresentationTemplatePayloadDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateResponseDto" } } }, "description": "Presentation template successfully updated" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" }, { "$ref": "#/components/schemas/InvalidUpdateFieldForTypeError" }, { "$ref": "#/components/schemas/InvalidPresentationTemplateInputDescriptorsError" }, { "$ref": "#/components/schemas/InvalidPresentationTemplateDcqlQueryError" } ] } } }, "description": "Invalid path param or payload" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateNotFoundError" } } }, "description": "Presentation template not found" } }, "tags": ["Presentation Templates"] }, "delete": { "summary": "Delete presentation template", "description": "Delete presentation template by ID. Deleted templates can no longer be used for presentation request generation. Ensure to review the implications before deleting a presentation template.\n", "operationId": "PresentationTemplatesController_deleteOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Presentation template deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationTemplateNotFoundError" } } }, "description": "Presentation template not found" } }, "tags": ["Presentation Templates"] } }, "/verifier/requests": { "post": { "summary": "Create verifier presentation request", "description": "Create a verifier presentation request.\n\nThis endpoint creates and stores a presentation request that can later be listed,\nfetched, and correlated with received presentation responses.\n\nAll presentation requests expire. Expiration is controlled by runtime setting `verifier.request_policy.default_expiry` with a default value of 7 days.\n\n## Supported Standards\n\n- [OpenID4VP 1.0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-authorization-request)\n", "operationId": "VerifierRequestsController_create", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePresentationRequestPayloadDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestResponseDto" } } }, "description": "Presentation request successfully created" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Invalid request payload" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "tags": ["Verifier Requests"] }, "get": { "summary": "List verifier presentation requests", "description": "List verifier presentation requests managed by the Wallet. The list can be filtered, sorted, and paginated by using the available query parameters. Filtering by name is also supported to easily retrieve requests with a specific name or keyword.\n", "operationId": "VerifierRequestsController_findAll", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string", "enum": ["created_at", "updated_at"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "search", "required": false, "description": "Filter presentation requests by name.", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedPresentationRequestsResponseDto" } } }, "description": "Presentation requests successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPaginationParamError" } } }, "description": "Invalid query params" } }, "tags": ["Verifier Requests"] } }, "/verifier/requests/{id}": { "get": { "summary": "Get verifier presentation request", "description": "Get a verifier presentation request by ID. The presentation request object contains necessary information for the wallet to proceed with presentation submission as well as metadata such as the linked presentation template and stored presentation responses if any.\n", "operationId": "VerifierRequestsController_findOne", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestResponseDto" } } }, "description": "Presentation request successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestNotFoundError" } } }, "description": "Presentation request not found" } }, "tags": ["Verifier Requests"] }, "delete": { "summary": "Delete verifier presentation request", "description": "Delete a verifier presentation request by ID. Deleted presentation requests can no longer be retrieved, and new presentation responses cannot be submitted against them. Linked submission will be removed together with the deleted presentation request. Ensure to review the implications before deleting a presentation request.\n", "operationId": "VerifierRequestsController_remove", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Presentation request deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestNotFoundError" } } }, "description": "Presentation request not found" } }, "tags": ["Verifier Requests"] } }, "/verifier/requests/{id}/responses": { "get": { "summary": "List verifier presentation responses", "description": "List stored presentation responses for a verifier presentation request. The list can be filtered, sorted, and paginated by using the available query parameters. Sorting by `created_at` or `last_verified_at` is supported to easily retrieve responses based on their creation time or verification time if they have been verified by the Wallet.\n", "operationId": "VerifierRequestsController_findResponses", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string", "enum": ["created_at", "last_verified_at"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedPresentationResponsesResponseDto" } } }, "description": "Presentation responses successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/PresentationRequestNotFoundError" }, { "$ref": "#/components/schemas/PresentationResponseNotFoundError" } ] } } }, "description": "Presentation request or response not found" } }, "tags": ["Verifier Requests"] }, "post": { "summary": "Submit authorization response", "description": "Submit an authorization response to a previously created presentation request.\n\nThis endpoint is called by the wallet to submit a Verifiable Presentation in response to an authorization request.\n\nThe submission can be in one of two forms depending on the `response_mode` of the original presentation request:\n- `direct_post`: The `vp_token` and `presentation_submission` parameters are sent directly.\n- `direct_post.jwt`: The `response` parameter contains a JWE-encrypted authorization response.\n\nExactly one of `vp_token` or `response` must be provided. Providing both or neither results in an error.\n\nIf the original presentation request included a `verifier_redirect_uri`, it is returned in the response as `redirect_uri`.\n\n## Supported Standards\n\n- [OpenID4VP 1.0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-response)\n", "operationId": "OpenIdVPController_submitAuthorizationResponse", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitAuthorizationResponsePayloadDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitAuthorizationResponseResponseDto" } } }, "description": "Authorization response successfully submitted" }, "400": { "content": { "application/json": { "examples": { "invalid_request_both_provided": { "value": { "error": "invalid_request", "extra_info": {}, "message": "vp_token or response is required. Both MUST NOT be provided" } }, "invalid_request_expired": { "value": { "error": "invalid_request", "extra_info": {}, "message": "Presentation request has expired" } }, "invalid_request_already_submitted": { "value": { "error": "invalid_request", "extra_info": {}, "message": "Only one response can be submitted per request" } } }, "schema": { "$ref": "#/components/schemas/InvalidRequestError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "presentation_request_not_found": { "value": { "error": "not_found", "extra_info": {}, "message": "Presentation request not found" } } }, "schema": { "$ref": "#/components/schemas/PresentationRequestNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "security": [], "tags": ["OpenID 4 Verifiable Presentations"] } }, "/verifier/requests/{id}/responses/{responseId}": { "get": { "summary": "Get verifier presentation response", "description": "Get a stored presentation response for a verifier presentation request. The presentation response object contains the original submitted response information such as the Verifiable Presentation content and metadata such as the verification status and time if it has been verified by the Wallet.\n", "operationId": "VerifierRequestsController_findResponse", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "in": "path", "name": "responseId", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationResponseResponseDto" } } }, "description": "Presentation response successfully loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/PresentationRequestNotFoundError" }, { "$ref": "#/components/schemas/PresentationResponseNotFoundError" } ] } } }, "description": "Presentation request or response not found" } }, "tags": ["Verifier Requests"] }, "delete": { "summary": "Delete verifier presentation response", "description": "Delete a stored presentation response for a verifier presentation request. Deleted presentation responses can no longer be retrieved. Ensure to review the implications before deleting a presentation response, especially if it has been verified by the Wallet and shared with verifiers.\n", "operationId": "VerifierRequestsController_removeResponse", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "in": "path", "name": "responseId", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Presentation response deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/PresentationRequestNotFoundError" }, { "$ref": "#/components/schemas/PresentationResponseNotFoundError" } ] } } }, "description": "Presentation request or response not found" } }, "tags": ["Verifier Requests"] } }, "/verifier/requests/{id}/jwt": { "get": { "summary": "Get presentation request JWT", "description": "Retrieve the signed JWT representation of a presentation request.\n\nThis endpoint is typically called by the wallet after receiving an authorization request URI that contains a `request_uri` parameter pointing to this endpoint.\n\nThe response is the raw JWT string with content type `application/oauth-authz-req+jwt`.\n\n## Supported Standards\n\n- [OpenID4VP 1.0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-authorization-request)\n", "operationId": "OpenIdVPController_getPresentationRequestJwt", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/oauth-authz-req+jwt": { "schema": { "type": "string" } } }, "description": "Presentation request JWT successfully loaded" }, "404": { "content": { "application/json": { "examples": { "presentation_request_not_found": { "value": { "error": "not_found", "extra_info": {}, "message": "Presentation request not found" } } }, "schema": { "$ref": "#/components/schemas/PresentationRequestNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "security": [], "tags": ["OpenID 4 Verifiable Presentations"] } }, "/verify/sessions": { "post": { "summary": "Create an SVX Verify session", "description": "Create an SVX Verify session for a configured presentation template.\nThis server-side call initiates a hosted identity verification flow and returns a session identifier and a redirect URL.\nUse the returned `id` to poll session status or to fetch verified claims after the user completes the hosted flow.\n", "operationId": "SessionsController_createSession", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateSvxVerifySessionPayloadDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateSvxVerifySessionResponseDto" } } }, "description": "SVX Verify session created" }, "400": { "content": { "application/json": { "examples": { "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } }, "invalid_request": { "value": { "error": "invalid_request", "extra_info": {}, "message": "presentation_template_id=43345678-1234-4234-a234-123456789012 is not a whitelisted option" } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestPayloadError" }, { "$ref": "#/components/schemas/InvalidRequestError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "create_session_error": { "value": { "error": "create_session_error", "extra_info": {}, "message": "Failed to create identity session" } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/CreateSessionError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["SVX Verify"] }, "get": { "summary": "List SVX Verify sessions", "description": "List SVX Verify sessions with pagination and optional filters.\nEach session record contains current processing/submission status, metadata (created/updated timestamps), and a summary of any verified claims collected so far.\n", "operationId": "SessionsController_listSessions", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "order_by", "required": false, "schema": { "type": "string", "enum": ["created_at", "updated_at"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } }, { "in": "query", "name": "submission_status", "required": false, "schema": { "type": "string", "enum": ["verified", "pending", "failed"] } }, { "in": "query", "name": "created_at_from", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "in": "query", "name": "created_at_to", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "in": "query", "name": "updated_at_from", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "in": "query", "name": "updated_at_to", "required": false, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedSvxVerifySessionsResponseDto" } } }, "description": "SVX Verify sessions successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_pagination_param": { "value": { "error": "invalid_pagination_param", "extra_info": {}, "message": "Invalid pagination parameter(s). Check \"extra_info.details\" for more details." } }, "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPaginationParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "list_sessions_error": { "value": { "error": "list_sessions_error", "extra_info": {}, "message": "Failed to list identity sessions" } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/ListSessionsError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["SVX Verify"] } }, "/verify/sessions/{id}": { "get": { "summary": "Get an SVX Verify session", "description": "Retrieve an SVX Verify session by identifier. The response includes the session status, redirect URLs, lifecycle timestamps, and any verified claims produced by the hosted verification flow.\nSessions may expire; use the `id` returned by the create call to locate results after the user returns from the hosted experience.\n", "operationId": "SessionsController_getSession", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetSvxVerifySessionResponseDto" } } }, "description": "SVX Verify session loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": { "details": ["Validation failed (uuid is expected)"] }, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "session_not_found": { "value": { "error": "session_not_found", "extra_info": {}, "message": "Session not found" } } }, "schema": { "$ref": "#/components/schemas/SessionNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "get_session_error": { "value": { "error": "get_session_error", "extra_info": {}, "message": "Failed to get identity session" } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/GetSessionError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["SVX Verify"] } }, "/verify/verification/{id}/request": { "get": { "summary": "Get an SVX Verify presentation request JWT", "description": "Retrieve the raw signed JWT presentation request associated with an SVX Verify session.\nClients use this JWT when a raw authorization/request token is required by downstream components or wallets.\nDepending on configuration (`svx_verify.policy.presentation_request_multiple_loads_enabled`) the JWT may be single-use and readable only once.\n", "operationId": "VerificationController_getPresentationRequestToken", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/jwt": { "schema": { "type": "string" } } }, "description": "Presentation request JWT successfully loaded" }, "403": { "content": { "application/json": { "examples": { "forbidden": { "value": { "error": "forbidden", "extra_info": {}, "message": "Request data is allowed to only read once and it was already done" } } }, "schema": { "$ref": "#/components/schemas/ForbiddenError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "session_not_found": { "value": { "error": "session_not_found", "extra_info": {}, "message": "Session not found" } }, "presentation_request_not_found": { "value": { "error": "presentation_request_not_found", "extra_info": {}, "message": "Presentation request not found" } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/SessionNotFoundError" }, { "$ref": "#/components/schemas/SvxVerifyPresentationRequestNotFoundError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "security": [], "tags": ["SVX Verify"] } }, "/verify/verification/{id}/status": { "get": { "summary": "Get SVX Verify presentation status", "description": "Retrieve the current processing status for an SVX Verify session and brief verification result metadata.\nThis endpoint is intended to be polled from the browser during the hosted flow and therefore may require the session cookie established by the verification UI.\n", "operationId": "VerificationController_getPresentationStatus", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvxVerifyPresentationStatusResponseDto" } } }, "description": "Presentation status successfully loaded" }, "403": { "content": { "application/json": { "examples": { "forbidden": { "value": { "error": "forbidden", "extra_info": {}, "message": "Unauthorized session" } } }, "schema": { "$ref": "#/components/schemas/ForbiddenError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "session_not_found": { "value": { "error": "session_not_found", "extra_info": {}, "message": "Session not found" } }, "session_expired": { "value": { "error": "session_expired", "extra_info": {}, "message": "Session has expired" } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/SessionNotFoundError" }, { "$ref": "#/components/schemas/SessionExpiredError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "security": [], "tags": ["SVX Verify"] } }, "/verify/verification/{id}/accept_terms": { "post": { "summary": "Accept SVX Verify terms", "description": "Mark the verification session's terms and conditions as accepted for the current SVX Verify flow.\nIntended to be called from the hosted verification UI; this operation typically requires the session cookie established during the browser-based flow.\n", "operationId": "VerificationController_acceptTerms", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false } } }, "description": "Terms accepted" }, "403": { "content": { "application/json": { "examples": { "forbidden": { "value": { "error": "forbidden", "extra_info": {}, "message": "Unauthorized session" } } }, "schema": { "$ref": "#/components/schemas/ForbiddenError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "session_not_found": { "value": { "error": "session_not_found", "extra_info": {}, "message": "Session not found" } }, "session_expired": { "value": { "error": "session_expired", "extra_info": {}, "message": "Session has expired" } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/SessionNotFoundError" }, { "$ref": "#/components/schemas/SessionExpiredError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "security": [], "tags": ["SVX Verify"] } }, "/wallets": { "post": { "summary": "Register or find a Wallet", "description": "Register a new Wallet. When a Wallet exists with the given `external_reference`, the existing Wallet information is returned making the operation idempotent.\nIf `external_reference` is not used a new Wallet is always created.\n\nBased on the configuration of the component, a Wallet has a default key and DID assigned to it. This key and DID are used to register and authenticate the Wallet with the SVX API.\n", "operationId": "WalletsController_create", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateWalletPayloadDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WalletResponseDto" } } }, "description": "Existing Wallet successfully loaded" }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WalletResponseDto" } } }, "description": "New Wallet successfuly registered" }, "400": { "content": { "application/json": { "examples": { "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "register_wallet_error": { "value": { "error": "register_wallet_error", "extra_info": {}, "message": "Error occurred while registering a Wallet." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/RegisterWalletError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Wallet"] } }, "/wallets/{walletId}": { "delete": { "summary": "Delete Wallet by ID", "description": "Deleted Wallet by ID. All information stored inside the Wallet will be deleted as well.\n", "operationId": "WalletsController_deleteOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Wallet successfuly removed" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "delete_wallet_error": { "value": { "error": "delete_wallet_error", "extra_info": {}, "message": "Error occurred while deleting a Wallet." } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/DeleteWalletError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Wallet"] }, "get": { "summary": "Get Wallet by ID", "description": "Fetch Wallet information by ID.\n", "operationId": "WalletsController_getOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WalletResponseDto" } } }, "description": "Wallet information successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "load_wallet_error": { "value": { "error": "load_wallet_error", "extra_info": {}, "message": "Error occurred while loading Wallet information." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/LoadWalletError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Wallet"] } }, "/wallets/{walletId}/keys": { "post": { "summary": "Create a key for a Wallet", "description": "Create a new cryptographic key associated with the Wallet. Keys are created using the JOSE JWK standard using attribute strings listed in the [JOSE IANA registry](https://www.iana.org/assignments/jose/jose.xhtml).\n\nDepending on the configuration of the service only certain cryptographic keys are supported.\n", "operationId": "KeysController_create", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "key": { "properties": { "crv": { "type": "string" }, "kty": { "type": "string" } }, "required": ["kty", "crv"], "type": "object" } }, "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "properties": { "key": { "$ref": "#/components/schemas/JSONWebKeyPub" } }, "type": "object" } } }, "description": "New key successfully created" }, "400": { "content": { "application/json": { "examples": { "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Key could not be created" } }, "tags": ["Key Management"] } }, "/wallets/{walletId}/keys/{keyId}": { "delete": { "summary": "Delete a key from a Wallet", "description": "Delete a key from a Wallet.\n", "operationId": "KeysController_delete", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "keyId", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Key successfully removed" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Key Management"] }, "get": { "summary": "Get a key for a Wallet", "description": "Return the cryptographic key information for a key associated with a Wallet.\n\nThe information returned contains only header and public attributes of the key, i.e. not the private key information which is kept in the Wallet. Key information is returned in the JOSE JWK standard using attribute strings listed in the [JOSE IANA registry](https://www.iana.org/assignments/jose/jose.xhtml).\n", "operationId": "KeysController_get", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "keyId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "properties": { "key": { "$ref": "#/components/schemas/JSONWebKeyPub" } }, "type": "object" } } }, "description": "Key successfully loaded" }, "404": { "content": { "application/json": { "examples": { "key_not_found": { "value": { "error": "key_not_found", "extra_info": {}, "message": "Key was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/KeyNotFoundError" } ] } } }, "description": "Not found" } }, "tags": ["Key Management"] } }, "/wallets/{walletId}/keys/import": { "post": { "summary": "Import a key to a Wallet", "description": "Import an existing cryptographic key to a Wallet using the JOSE JWK notation.\n\nDepending on the configuration of the service only certain cryptographic keys are supported.\n", "operationId": "KeyController_Import", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "key": { "$ref": "#/components/schemas/JSONWebKey" } }, "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "properties": { "key": { "$ref": "#/components/schemas/JSONWebKeyPub" } }, "type": "object" } } }, "description": "Key has been imported" }, "400": { "content": { "application/json": { "examples": { "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } }, "key_not_supported": { "value": { "error": "key_not_supported", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/KeyNotSupportedError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "Key could not be imported" } }, "tags": ["Key Management"] } }, "/wallets/{walletId}/keys/{keyId}/sign": { "post": { "summary": "Sign data with a key from a wallet", "description": "Create a signature based on data provided using a cryptographic key associated with a Wallet.\n", "operationId": "KeyController_sign", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "keyId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "data": { "type": "string" } }, "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "properties": { "signature": { "type": "string" } }, "type": "object" } } }, "description": "Key has been created" }, "400": { "content": { "application/json": { "examples": { "invalid_request_payload": { "value": { "error": "invalid_request_payload", "extra_info": {}, "message": "Invalid request payload. Check \"extra_info.details\" for more details." } }, "key_signing_not_supported": { "value": { "error": "key_signing_not_supported", "extra_info": {}, "message": "The signing operation is not supported for the key. Check \"extra_info.details\" for more details." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidRequestPayloadError" }, { "$ref": "#/components/schemas/KeySigningNotSupportedError" } ] } } }, "description": "Data could not be signed" }, "404": { "content": { "application/json": { "examples": { "key_not_found": { "value": { "error": "key_not_found", "extra_info": {}, "message": "Key was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/KeyNotFoundError" } ] } } }, "description": "Not found" } }, "tags": ["Key Management"] } }, "/wallets/{walletId}/dids": { "post": { "summary": "Create a DID for a Wallet", "description": "Create a DID for a Wallet.\n", "operationId": "DidController_create", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "method": { "type": "string" }, "options": { "properties": { "codec": { "type": "string" }, "key": { "properties": { "crv": { "type": "string" }, "kty": { "type": "string" } }, "type": "object" }, "network": { "type": "string" } }, "type": "object" } }, "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "properties": { "did": { "$ref": "#/components/schemas/WalletDIDDto" } }, "type": "object" } } }, "description": "DID has been created" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateDidError" } } }, "description": "" } }, "tags": ["DID Management"] } }, "/wallets/{walletId}/dids/{id}": { "delete": { "summary": "Delete a DID from a Wallet", "description": "Delete a DID from a Wallet.\n", "operationId": "DidController_delete", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "id", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "DID has been successfully deleted" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteDidError" } } }, "description": "" } }, "tags": ["DID Management"] } }, "/wallets/{walletId}/receive": { "get": { "summary": "Get credential receive states", "description": "Get credential receive states.\n", "operationId": "ReceiveController_findAll", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "name": "order", "required": false, "in": "query", "description": "Issuance state response order. Default ordering: `DESC` (Supported: `ASC`, `DESC`)", "example": "DESC", "schema": { "enum": ["ASC", "DESC"], "type": "string" } }, { "name": "order_by", "required": false, "in": "query", "description": "Order Issuance state by an attribute, defaults to: `created_at` (Supported: `created_at`)", "example": "created_at", "schema": { "enum": ["created_at"], "type": "string" } }, { "name": "per_page", "required": false, "in": "query", "description": "Number of records per page", "example": 10, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "name": "page", "required": false, "in": "query", "description": "Page number (starting from 1)", "example": 1, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveStatesModelDto" } } }, "description": "Credential receive states successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_order_filter_value": { "value": { "error": "invalid_order_filter_value", "extra_info": {}, "message": "order filter value is invalid. Supported values: asc,desc." } }, "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } }, "invalid_per_page_filter_value": { "value": { "error": "invalid_per_page_filter_value", "extra_info": {}, "message": "per_page filter value is invalid. Must be a number between 1 and 100." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidOrderFilterValueError" }, { "$ref": "#/components/schemas/InvalidPerPageFilterValueError" } ] } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "load_credentials_error": { "value": { "error": "load_credentials_error", "extra_info": {}, "message": "Error occurred while loading Wallet credentials." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/LoadCredentialsError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential Issuance"] }, "post": { "summary": "Register credential offer", "description": "Credential offer is a JSON encoded object that the issuer uses to pass information to the wallet and initiate the issuance process.\nThis endpoint is used to validate, parse and extract the necessary information, leading to the next step in the process, getting an access token.\n\nFor more information on the structure of the credential offer object, see section 4.1 in OpenID4VCI 1.0.\n\nThe three supported methods for registering a credential offer are:\n- `credential_offer`: Pass the JSON object by value\n- `credential_offer_uri`: Pass the JSON object by reference. The service performs a GET request to retrieve the object.\n- `credential_offer_endpoint` - Credential Offer sent by the issuer to the wallet credential offer endpoint. It contains a single URI query parameter, either credential_offer or credential_offer_uri\n\nNote that the options above are mutually exclusive.\n\nAfter successfully registering the credential offer, a state is returned. This state is used as an identifier to link subsequent calls to receive endpoints.\n\n### Next Step\n\nTo continue the issuance process, call:\n\n```POST /wallets/{walletId}/receive/get_access_token```\n", "operationId": "ReceiveController_create", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveResponseModelDto" } } }, "description": "Successful registration of the credential offer." }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidCredentialOfferUrlError" } ] } } }, "description": "Bad Request - The request was invalid or cannot be otherwise served." } }, "tags": ["Verifiable Credential Issuance"] } }, "/wallets/{walletId}/receive/get_access_token": { "post": { "summary": "Get access token", "description": "The get access token endpoint ensures the wallet is able to retrieve a valid access token to go to the next step of actually getting the credential(s).\n\n## Wallet initiated issuance\n\nFor wallet initiated issuance, this endpoint is the entry point. Only Authorization Code Flow is supported.\n\nThe following parameters are required:\n- `credential_issuer`\n- `scope` (must be able to be looked up from the credential issuer metadata `credential_configurations_supported` property)\n- `redirect_uri`\n- `client_id`\n\n## Issuer initiated issuance via credential offer\n\nFor issuer initiated issuance, the issuer communicates a credential offer that is registered before acquiring an access token.\n\nTwo flows that are supported are:\n- Pre-Authorized Code Flow\n- Authorization Code Flow\n\n### Authorization Code Flow\n\nUses the `authorization_code` as defined in RFC6749 to issue access tokens.\n\nThis is usually a two-step process, that involves authentication on the front channel (through a browser window) to be performed by the client.\n\nIn step 1, a call to this endpoint returns the `authorization_url`. This URL is what needs to be opened in a browser window and will authenticate the end-user to the service.\nThis includes a redirect_uri responsible for receiving and storing the `authorization_code`.\n\nIn step 2, the service, exchanges the code for an access token by calling the Token Endpoint.\n\n### Pre-Authorized Code Flow\n\nThis flow is used when the issuer has already authenticated and authorized the end-user.\nThe issuer provides a Pre-Authorized Code in the credential offer which is used to exchange it for an access token in the Token Endpoint.\nThe Authorization Endpoint is not used in this flow.\n\nFor more information, see section 3.5 in OpenID4VCI 1.0.\n\n### Next Step\n\nTo continue the issuance process, call:\n\n```POST /wallets/{walletId}/receive/get_credential```\n", "operationId": "ReceiveController_getAccessToken", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveGetAccessTokenRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveGetAccessTokenResponseModelDto" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Verifiable Credential Issuance"] } }, "/wallets/{walletId}/receive/get_credential": { "post": { "summary": "Get verifiable credential", "description": "Get credential from the issuer and perform key binding. A valid access token is required in order to call this endpoint.\n\nSee section 7 in OpenID4VCI 1.0 for more information.\n\n### Key Binding\n\nKey binding is performed by providing either\n\n- `kid`: Public key is presented. Should be used when credential format is `dc+sd-jwt`.\n- `did`: DID is presented referencing one of the keys contained in the `verificationMethod` section of the DID document. Should be used when credential format is `jwt_vc_json`.\n\nOnly one of the `kid` or `did` parameters must be present during the request.\n\nBoth methods involve the wallet presenting key proof to the issuer to ensure control over cryptographic key material.\n\nSee section 7.2.1 in OpenID4VCI 1.0 for more information.\n\n### Not Supported Options\n\nNote that the following are not supported by the endpoint\n\n- `transaction_id`: Part of the deferred issuance flow, allows receiving a credential by referencing a `transaction_id`\n- Receiving encrypted credentials\n- legacy format header typ `vc+sd-jwt`\n", "operationId": "ReceiveController_getCredential", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveGetCredentialRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveGetCredentialResponseModelDto" } } }, "description": "New credential successfully added to the Wallet" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Verifiable Credential Issuance"] } }, "/wallets/{walletId}/receive/{state}": { "delete": { "summary": "Delete receive credential state", "description": "Delete state of a receive credential flow.\n", "operationId": "ReceiveController_deleteOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "state", "required": true, "schema": { "type": "string" } } ], "responses": { "500": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteReceiveStateError" }, "example": { "error": "delete_receive_state_error", "extra_info": {}, "message": "Error occurred while deleting receive credential state." } } } } }, "tags": ["Verifiable Credential Issuance"] }, "get": { "summary": "Get credential receive state", "description": "Get credential receive state.\n", "operationId": "ReceiveController_getInfo", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "state", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialReceiveStateModelDto" } } }, "description": "Credential receive state successfully loaded" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential Issuance"] } }, "/wallets/receive/callback": { "get": { "summary": "Handle holder receive callback", "description": "`authorization_code` redirect uri that was started via `/receive` endpoint.\n`state` and `code` come as a query parameters.\n`code` is exchanged for the `access_token` so client can call `POST /wallets/{walletId}/receive/get_credential` endpoint right away.\n", "parameters": [ { "description": "Error code", "in": "query", "name": "error", "required": false, "schema": { "type": "string" } }, { "description": "Error description", "in": "query", "name": "error_description", "required": false, "schema": { "type": "string" } }, { "description": "Error URI", "in": "query", "name": "error_uri", "required": false, "schema": { "type": "string" } }, { "description": "Authorization code", "in": "query", "name": "code", "required": false, "schema": { "type": "string" } }, { "description": "Authorization state", "in": "query", "name": "state", "required": false, "schema": { "type": "string" } }, { "description": "Access token issuer", "in": "query", "name": "iss", "required": false, "schema": { "type": "string" } } ], "operationId": "ReceiveController_callback", "responses": { "302": { "description": "Issuer response captured and processed - redirect back to the client Wallet" } }, "security": [], "tags": ["Verifiable Credential Issuance"] } }, "/wallets/{walletId}/send": { "get": { "summary": "Get presentation states", "description": "Get presentation states.\n", "operationId": "PresentationController_findAll", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "name": "order", "required": false, "in": "query", "description": "Presentation States response order. Default ordering: `DESC` (Supported: `ASC`, `DESC`)", "example": "DESC", "schema": { "enum": ["ASC", "DESC"], "type": "string" } }, { "name": "order_by", "required": false, "in": "query", "description": "Order Presentation States by an attribute, defaults to: `created_at` (Supported: `created_at`)", "example": "created_at", "schema": { "enum": ["created_at"], "type": "string" } }, { "name": "per_page", "required": false, "in": "query", "description": "Number of records per page", "example": 10, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "name": "page", "required": false, "in": "query", "description": "Page number (starting from 1)", "example": 1, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthorizationRequestsResponseDto" } } }, "description": "Presentation states successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_order_filter_value": { "value": { "error": "invalid_order_filter_value", "extra_info": {}, "message": "order filter value is invalid. Supported values: asc,desc." } }, "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } }, "invalid_per_page_filter_value": { "value": { "error": "invalid_per_page_filter_value", "extra_info": {}, "message": "per_page filter value is invalid. Must be a number between 1 and 100." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidOrderFilterValueError" }, { "$ref": "#/components/schemas/InvalidPerPageFilterValueError" } ] } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "load_credentials_error": { "value": { "error": "load_credentials_error", "extra_info": {}, "message": "Error occurred while loading Wallet credentials." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/LoadCredentialsError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Presentation"] }, "post": { "summary": "Register authorization request", "description": "Parse the authorization request URI and get the following information.\n\n- `client_id`: The Client ID of the verifier.\n- `client_metadata`: Verifier client metadata.\n- `nonce`: Nonce provided by the verifier to be returned in the response\n- `presentation_definition`: What credentials the verifier is requesting from the Wallet in PEX format.\n- `dcql_query`: What credentials the verifier is requesting from the wallet in DCQL format.\n- `redirect_uri`: The redirect URI of the verifier.\n- `response_mode`: How to return the response.\n- `response_type`: Which parameters to use to return the presentation to the verifier.\n- `response_uri`: Where to send the response.\n- `verifier_state`: State passed by the verifier to link request and response.\n- `meta.protocol_version`: Version of the protocol to be used. Supported values: `openid4vp-v1`. The default value is `openid4vp-v1`.\n\nThis information informs the Wallet how to process the request and respond to the verifier.\n\n## Request Parameters\n\nThe following sections describe in more detail the parameters, their default values and behaviour.\n\n### client_id (required)\n\nClient ID is a parameter identifying the Relying Party (RP) - the entity requesting and consuming a Verifiable Presentation. It is used by the Holder's Wallet to fetch and validate client metadata, and to establish trust before releasing Verifiable Presentations.\n\nClient ID consists of two parts:\n - prefix - to define the type of the identifier\n - identifer - identifier value\n\nSupported prefixes are: `redirect_uri`, `decentralized_identifier` and `x509_san_dns`.\n\n### client_metadata (required)\n\nClient metadata, also called verifier metadata in this case can be implemented using static configuration values, as well as employ Dynamic Discovery.\n\nThe static configuration is usually bound to an existing profile, for example.\n\n- [JWT VC Presentation Profile](https://identity.foundation/jwt-vc-presentation-profile/)\n- [HAIP](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-sd-jwt-vc-1_0-00.html)\n\nThey use specific, custom URL schemes such as `openid-vc` or `haip`. When these are used, values referred to in these profiles should be used as client metadata.\n\nEach network can define their own set of static configuration values for client metadata.\n\nThe use of fedarations or trust schemes is not yet supported.\n\nComponent does not support `authorization_signed_response_alg` configuration. If one is provided together with `response_mode = direct_post.jwt` - Presentation Request will not be parsed and registered.\n\n### nonce\n\nNonce to be returned in the response to prevent replay attacks.\n\n### presentation_definition (required)\n\nExpresses which credentials a verifier asks a wallet to present. The syntax to do this should conform to DIF Presentation Exchange specification.\nThe structure of the definition is validated by a JSON schema associated with the `presentation_definition` schema in the OpenAPI definition.\n\nIt is also possible to use `presentation_definition_uri`. In this case the wallet performs a GET request to the `presentation_definition_uri` and parses the response.\nThe response is stored in the `presentation_definition` attribute.\n\nNote that the service does not necessarily support all options defined in the Presentation Exchange specification.\n\nAPI expects `presentation_definition.input_descriptors[].format` to be defined. If it is missing, authorization request is not going to be registered.\n\n### response_mode\n\nHow the response is sent to the verifier. Possible values are\n\n- `direct_post`: In this mode, the Authorization Response is sent to the Verifier using an HTTPS POST request to an endpoint controlled by the Verifier. The Authorization Response parameters are encoded in the body using the application/x-www-form-urlencoded content type.\n\n- `direct_post.jwt`: In this mode, the Authorization Response is sent to the Verifier using an HTTPS POST request to an endpoint controlled by the Verifier. The Authorization Response is encoded as a JWE (JSON Web Encryption) and included in the body of the request, allowing for confidentiality and integrity protection. Unlike direct_post, this mode ensures that the entire Authorization Response is encrypted when transmitted to the Verifier.\n\nWhen using `direct_post` or `direct_post.jwt`, note that the `redirect_uri` must be returned after successfully posting the Authorization Response to the `response_uri`.\n\nNote that `fragment` is currently not supported.\n\n### response_uri\n\nIf the `response_mode` is `direct_post` this is the URI to send the response to.\n\n### verifier_state\n\nOpaque state that can be used to link the request and response. Is returned as the `state` parameter in the Authorization Response.\n\n## Use of JAR (RFC9101)\n\nJAR (RFC9101) is a JWT representation of the request. The JWT is signed with the verifier's private key.\nThere are two ways to do this.\n\n- `request`: The `request` parameter is the JWT representation of the request.\n- `request_uri`: The `request_uri` parameter is the URL of the request.\n\nIn most cases `request_uri` is used instead of `request` as it is more convenient, especially in situations when a QR code is used to represent the authorization request.\n\nThe JAR contains the necessary information and is fetched, verified and subsequently parsed. See the previous section for more details.\n\n## Examples\n\nBelow are some examples of valid authorization requests and how they are parsed.\n\n```\nopenid-vc://?request_uri=https://example.com/oidc/presentations/requests/c63aa3e9-dc7d-4753-9ac8-30bf7add6e4c/jwt&client_id=https://example.com/cb\n```\n\nThis is an example where JAR is used. First, the `request_uri` is used to fetch the request JWT. The JWT is validated and then parsed. The parsed request is stored in the `metadata.request` attribute.\nAll the required information, except for the `client_id` is fetched from the JWT, validated and stored.\n", "operationId": "PresentationController_create", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestSendRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthorizationRequestResponseDto" } } }, "description": "Successful registration of the presentation authorization request." }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPresentationRequestUrlError" } ] } } }, "description": "Bad Request - The request was invalid or cannot be otherwise served." } }, "tags": ["Verifiable Presentation"] } }, "/wallets/{walletId}/send/set_credentials": { "post": { "summary": "Set the credentials to be presented", "description": "Set the credentials to be presented as part of this presentation response.\n\nEach credential must be linked to an input descriptor from the credential definition. There is one important condition to present `mso_mdoc` credentials. `mso_mdoc` credential `doctype` attribute value must match `input_descriptors[].id` othwerwise submitting a presentation will fail. There are no such conditions for `jwt_vc_json` and `dc+sd-jwt` credential formats.\nFor credentials that support selective disclosure (`dc+sd-jwt`, `mso_mdoc`), there is the possibility to use the `claims_to_disclose` property.\nUse object notation to specify which claims to disclose. For example:\n\n```\n\"claims_to_disclose\": [\"given_name\", \"address.street_address\", \"address.locality\", \"nationalities[0]\"]\n```\n\n```\n\"claims_to_disclose\": [\"$['org.iso.18013.5.1']['birth_date']\", \"$['org.iso.18013.5.1']['given_name']\"]\n```\n\nIf a claim or a nested claim is not found in the credential or it doesn't support selective disclosure, it will be ignored.\n", "operationId": "SendController_setCredentials", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestSetCredentialsRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestSetCredentialsResponseModelDto" } } }, "description": "Successful registration of the credential offer." }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Verifiable Presentation"] } }, "/wallets/{walletId}/send/submit": { "post": { "summary": "Submit the presentation response to the verifier", "description": "Generate the presentation response to present the credentials to the verifier.\n\nBased on the `response_type`, the following parameters are included in the response:\n\nThe response always includes:\n- `vp_token`: A single JSON string or array of JSON strings representing the presentation.\n- `presentation_submission`: A JSON object containing the mapping between the requested credentials and where to find them in the returned VP token. This follows the DIF Presentation Exchange specification.\n\nOptionally, the following is also included:\n- `id_token`: A single JSON string that proves control of the wallet over key material.\n\nDepending on the `response_mode` option, the response can be sent to the verifier using an HTTPS POST request or an HTTP redirect.\n\nIn case of `response_mode=fragment` (default), the response is sent via the front channel by opening the `redirect_uri`, which is returned in the response to this request.\nThis `redirect_uri` includes all the response parameters. Note that this is currently not supported.\n\nIn case of `response_mode=direct_post` or `response_mode=post`, the response is submitted via an HTTPS POST request to the `response_uri`.\nIn this case, it is expected that a `redirect_uri` is returned in the response to this request.\nThis `redirect_uri` is also to be opened in the front channel, but is simply used to continue the verification process and not to transmit the response to the verifier.\n\nIn case of `response_mode=direct_post.jwt`, the response is submitted via an HTTPS POST request to the `response_uri` as a JWE.\nIn this case, it is expected that a `redirect_uri` is returned in the response to this request.\nThis `redirect_uri` is also to be opened in the front channel, but is simply used to continue the verification process and not to transmit the response to the verifier.\n\nThe status of this submission can be tracked via the `meta.submission_status` attribute. Note that in case of `response_mode=fragment`, the status is always `success`.\n", "operationId": "SendController_submit", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestSubmitRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresentationRequestSubmitResponseModelDto" } } }, "description": "Successful submission of presentation response" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidClaimsToDiscloseError" } } }, "description": "" } }, "tags": ["Verifiable Presentation"] } }, "/wallets/{walletId}/send/{state}": { "delete": { "summary": "Delete Verifiable Presentation State by ID", "description": "Delete state of a presentation flow\n", "operationId": "SendController_deleteOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "state", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Presentation State by ID successfuly removed" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "authorization_request_not_found": { "value": { "error": "authorization_request_not_found", "extra_info": {}, "message": "presentation state was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/AuthorizationRequestNotFoundError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "delete_presentation_state_error": { "value": { "error": "delete_presentation_state_error", "extra_info": {}, "message": "Error occurred while deleting a presentation State." } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/DeletePresentationStateError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Presentation"] }, "get": { "summary": "Get present credential state", "description": "Get present credential state.\n", "operationId": "SendController_findOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "state", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthorizationRequestResponseDto" } } }, "description": "Successful registration of the credential offer." }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Verifiable Presentation"] } }, "/wallets/{walletId}/credentials/import": { "post": { "summary": "Import credential", "description": "Import an existing credential from a known format into a Wallet.\n\nDepending on how key binding is performed, the import process associates the credential with the given `did` and/or `kid` if managed by the wallet:\n- `did`: The DID used for binding a DID to the credential.\n- `kid`: The key ID used for binding the key to the credential.\n\nIf the `did` or `kid` is not managed by the wallet, fields are ignored. They can later be updated with `PATCH /wallets/{walletId}/credentials/{credentialId}`.\n", "operationId": "CredentialsController_import", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialImportRequestModelDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialResponseDto" } } }, "description": "Credential imported" }, "400": { "content": { "application/json": { "examples": { "invalid_credential": { "value": { "error": "invalid_credential_data", "extra_info": {}, "message": "Could not import credential due to invalid credential data. Check \"extra_info.details\" for more details." } }, "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidCredentialDataError" } ] } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" } }, "tags": ["Verifiable Credential"] } }, "/wallets/{walletId}/credentials": { "get": { "summary": "Get credentials", "description": "Fetch a paginated list of credentials stored inside the Wallet.\n", "operationId": "CredentialsController_findAll", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "name": "order", "required": false, "in": "query", "description": "Issuance state response order. Default ordering: `DESC` (Supported: `ASC`, `DESC`)", "example": "DESC", "schema": { "enum": ["ASC", "DESC"], "type": "string" } }, { "name": "order_by", "required": false, "in": "query", "description": "Order Issuance state by an attribute, defaults to: `created_at` (Supported: `created_at`)", "example": "created_at", "schema": { "enum": ["created_at"], "type": "string" } }, { "name": "per_page", "required": false, "in": "query", "description": "Number of records per page", "example": 10, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "name": "page", "required": false, "in": "query", "description": "Page number (starting from 1)", "example": 1, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialsResponseDto" } } }, "description": "Wallet credentials successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_order_filter_value": { "value": { "error": "invalid_order_filter_value", "extra_info": {}, "message": "order filter value is invalid. Supported values: asc,desc." } }, "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } }, "invalid_per_page_filter_value": { "value": { "error": "invalid_per_page_filter_value", "extra_info": {}, "message": "per_page filter value is invalid. Must be a number between 1 and 100." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidOrderFilterValueError" }, { "$ref": "#/components/schemas/InvalidPerPageFilterValueError" } ] } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "$ref": "#/components/schemas/WalletNotFoundError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "load_credentials_error": { "value": { "error": "load_credentials_error", "extra_info": {}, "message": "Error occurred while loading Wallet credentials." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/LoadCredentialsError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential"] } }, "/wallets/{walletId}/credentials/{vcId}": { "delete": { "summary": "Delete credential by ID", "description": "Deletes credential by ID stored inside the Wallet\n", "operationId": "CredentialsController_remove", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "vcId", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Wallet credential by ID successfuly removed" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "credential_not_found": { "value": { "error": "credential_not_found", "extra_info": {}, "message": "Credential was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/CredentialNotFoundError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "delete_credential_error": { "value": { "error": "delete_credential_error", "extra_info": {}, "message": "Error occurred while deleting a Wallet credential." } }, "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/DeleteCredentialError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential"] }, "get": { "summary": "Get credential by ID", "description": "Fetch credential information by ID stored inside the Wallet\n", "operationId": "CredentialsController_findOne", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "vcId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialResponseDto" } } }, "description": "Wallet credential by ID successfully loaded" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "credential_not_found": { "value": { "error": "credential_not_found", "extra_info": {}, "message": "Credential was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/CredentialNotFoundError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "load_credential_error": { "value": { "error": "load_credential_error", "extra_info": {}, "message": "Error occurred while loading a Wallet credential." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/LoadCredentialError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential"] }, "patch": { "summary": "Patch credential by ID", "description": "Patches credential stored inside a Wallet.\n\nUsed to update `did` and `kid` fields in the meta data of the credential. Note that the `did` and `kid` need to reference an existing DID and Key Id.\nThis is used to associate an (existing) Key and/or DID controlled by the wallet with the credential to make it easier to reference that Key and/or DID when presenting credentials for example.\n", "operationId": "CredentialsController_patch", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "vcId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialPatchRequestModelDto" } } }, "required": true }, "responses": { "204": { "description": "Wallet credential successfully patched" }, "404": { "content": { "application/json": { "examples": { "credential_not_found": { "value": { "error": "credential_not_found", "extra_info": {}, "message": "Credential was not found." } }, "did_not_found": { "value": { "error": "did_not_found", "extra_info": {}, "message": "DID was not found." } }, "key_not_found": { "value": { "error": "key_not_found", "extra_info": {}, "message": "Key was not found." } }, "did_kid_association_not_found": { "value": { "error": "did_kid_association_not_found", "extra_info": {}, "message": "DID with associated Key was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/CredentialNotFoundError" }, { "$ref": "#/components/schemas/KeyNotFoundError" }, { "$ref": "#/components/schemas/DidNotFoundError" }, { "$ref": "#/components/schemas/DidKidAssociationNotFoundError" } ] } } }, "description": "Not found" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "patch_credential_error": { "value": { "error": "patch_credential_error", "extra_info": {}, "message": "Error occurred while patching a Wallet credential." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/PatchCredentialError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential"] } }, "/wallets/{walletId}/credentials/{vcId}/verify": { "get": { "summary": "Verify credential by ID", "description": "Verify a credential by ID stored inside the Wallet. The verification process checks the validity of the credential and returns a list of errors and warnings if any.\n\n**Checks performed:**\n\n- `format`.\n- `signature`.\n- `expiration` date is validated when the `expirationDate` attribute is present.\n- `issued at` date is validated when the `iat` attribute is present.\n- The `dc+sd-jwt` format also supports URL instead of DID as the value for the issuer attribute. URL will be used to construct .well-known endpoint to retrieve the public key.\n- Verifiable credential `schema` if present.\n- Verifiable credential `revocation` list status and its validity if present\n\n\n Credential schema and revocation status related checks are not considered critical and will be returned under `warnings` attribute. It is up for the client application to decide how these should be handled. All other failed checks will be served under `errors` attribute.\n\n\n **Verification options**\n\n You can optionally specify checks for the provided credential. If specified, only these checks will run. \n By default, `format`, `signature`, `expiration` checks are mandatory and can not be taken out from checks list. No further checks will be performed if credential is imposible to parse.\n \n ```\n GET wallets/{walletId}/credentials/{vcId}/verify?checks=format,signature,expiration,revocation_status\n ```\n\n `failed_to_verify_jwt` and `failed_to_verify_mso_mdoc` error might appear in both: errors and warnings list. \n In case of `dc+sd-jwt` it wraps any error that `@meeco/sd-jwt-vc` might throw. \n In case of `jwt_vc_json` it wraps any error that `did-jwt-vc` might throw. \n In case of `mso_mdoc` it wraps any error that `@owf/mdoc` might report.\n", "operationId": "CredentialsController_verify", "parameters": [ { "in": "path", "name": "walletId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "vcId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "checks", "required": false, "style": "form", "explode": false, "schema": { "type": "array", "items": { "type": "string", "enum": [ "format", "signature", "expiration", "schema", "revocation_status" ] } } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialVerificationResponseDto" } } }, "description": "Credential verification complete" }, "400": { "content": { "application/json": { "examples": { "invalid_path_param": { "value": { "error": "invalid_path_param", "extra_info": {}, "message": "Invalid path parameter(s). Check \"extra_info.details\" for more details." } } }, "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "" }, "404": { "content": { "application/json": { "examples": { "credential_not_found": { "value": { "error": "credential_not_found", "extra_info": {}, "message": "Credential was not found." } }, "wallet_not_found": { "value": { "error": "wallet_not_found", "extra_info": {}, "message": "Wallet was not found." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/WalletNotFoundError" }, { "$ref": "#/components/schemas/CredentialNotFoundError" } ] } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } }, "verify_credential_error": { "value": { "error": "verify_credential_error", "extra_info": {}, "message": "Error occurred while verifying a Wallet credential." } } }, "schema": { "oneOf": [ { "$ref": "#/components/schemas/VerifyCredentialError" }, { "$ref": "#/components/schemas/InternalServerError" } ] } } }, "description": "" } }, "tags": ["Verifiable Credential"] } }, "/admin/accounts": { "get": { "summary": "List admin accounts", "description": "Lists all registered admin accounts.\n", "operationId": "AdminAuthController_listAccounts", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListAdminAccountsResponseDto" } } }, "description": "Accounts list retrieved" } }, "tags": ["Admin Authentication"] } }, "/admin/accounts/{id}": { "delete": { "summary": "Delete admin account", "description": "Deletes a registered admin account and related passkeys.\n", "operationId": "AdminAuthController_deleteAccount", "parameters": [ { "name": "id", "required": true, "in": "path", "description": "ID of the admin account to delete", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteAdminAccountResponseDto" } } }, "description": "Account deleted" }, "404": { "description": "Account was not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "tags": ["Admin Authentication"] } }, "/admin/invitations": { "post": { "summary": "Create admin passkey invitation", "description": "Creates an invitation token that can be used exactly once to register the first admin passkey.\n", "operationId": "AdminAuthController_createInvitation", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAdminInvitationRequestDto" } } } }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAdminInvitationResponseDto" } } }, "description": "Admin passkey invitation created" } }, "tags": ["Admin Authentication"] }, "get": { "summary": "List admin invitations", "description": "Lists all pending, non-expired admin invitations.\n", "operationId": "AdminAuthController_listInvitations", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListAdminInvitationsResponseDto" } } }, "description": "Invitations list retrieved" } }, "tags": ["Admin Authentication"] } }, "/admin/invitations/{id}": { "delete": { "summary": "Delete admin invitation", "description": "Deletes a pending admin invitation.\n", "operationId": "AdminAuthController_deleteInvitation", "parameters": [ { "name": "id", "required": true, "in": "path", "description": "ID of the admin invitation to delete", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteAdminInvitationResponseDto" } } }, "description": "Invitation deleted" }, "404": { "description": "Invitation was not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "tags": ["Admin Authentication"] } }, "/admin/invitations/accept/options": { "post": { "summary": "Start admin passkey registration", "description": "Starts WebAuthn registration for a pending invitation and returns `PublicKeyCredentialCreationOptionsJSON`.\n\nUse the returned `options` with `navigator.credentials.create(...)`, then submit the resulting credential to\n`/admin/invitations/accept` together with `challenge_id`.\n", "operationId": "AdminAuthController_startInvitationRegistration", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StartAdminPasskeyRegistrationRequestDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StartAdminPasskeyRegistrationOptionsResponseDto" } } }, "description": "Registration options generated" }, "400": { "description": "Invitation is expired or invalid request data was provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "404": { "description": "Invitation was not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "409": { "description": "Invitation has already been used", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "security": [], "tags": ["Admin Authentication"] } }, "/admin/invitations/accept": { "post": { "summary": "Verify admin passkey registration", "description": "Verifies the WebAuthn registration response produced by `navigator.credentials.create(...)` and persists\nthe admin passkey.\n\n`challenge_id` must match the value returned by `/admin/invitations/accept/options`.\n", "operationId": "AdminAuthController_finishInvitationRegistration", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishAdminPasskeyRegistrationRequestDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishAdminPasskeyRegistrationResponseDto" } } }, "description": "Registration verified" }, "400": { "description": "Registration challenge is invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "401": { "description": "Registration verification failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "404": { "description": "Invitation was not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "409": { "description": "Invitation has already been used", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "security": [], "tags": ["Admin Authentication"] } }, "/admin/session/options": { "post": { "summary": "Start admin passkey authentication", "description": "Starts WebAuthn authentication and returns `PublicKeyCredentialRequestOptionsJSON`.\n\nUse the returned `options` with `navigator.credentials.get(...)`, then submit the resulting assertion to\n`/admin/session` together with `challenge_id`.\n", "operationId": "AdminAuthController_startAuthentication", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StartAdminPasskeyAuthenticationOptionsResponseDto" } } }, "description": "Authentication options generated" } }, "security": [], "tags": ["Admin Authentication"] } }, "/admin/session": { "post": { "summary": "Verify admin passkey authentication", "description": "Verifies the WebAuthn assertion produced by `navigator.credentials.get(...)`.\n\nOn success, returns an admin access token response and sets an HTTP-only refresh token cookie\n(`admin_refresh_token`) valid for 7 days.\n", "operationId": "AdminAuthController_finishAuthentication", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishAdminPasskeyAuthenticationRequestDto" } } }, "required": true }, "responses": { "200": { "headers": { "Set-Cookie": { "schema": { "type": "string" }, "description": "HTTP-only refresh token cookie (`admin_refresh_token`) scoped to `/admin/session/refresh`.\nThe cookie has a fixed 7-day expiry (non-sliding).\n" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishAdminPasskeyAuthenticationResponseDto" } } }, "description": "Authentication verified" }, "400": { "description": "Authentication challenge is invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "401": { "description": "Authentication verification failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } }, "404": { "description": "Passkey was not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "security": [], "tags": ["Admin Authentication"] } }, "/admin/session/refresh": { "post": { "summary": "Refresh admin access token", "description": "Issues a new admin access token using the HTTP-only `admin_refresh_token` cookie.\n\nOn success, the server rotates the refresh token value and returns it via `Set-Cookie` with the same\n`/admin/session/refresh` path and fixed 7-day expiry (non-sliding).\n", "operationId": "AdminAuthController_refreshAuthentication", "parameters": [], "responses": { "200": { "headers": { "Set-Cookie": { "schema": { "type": "string" }, "description": "Rotated HTTP-only refresh token cookie (`admin_refresh_token`) scoped to `/admin/session/refresh`.\nThe cookie maintains the original fixed 7-day expiry (non-sliding).\n" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishAdminPasskeyAuthenticationResponseDto" } } }, "description": "Access token refreshed" }, "401": { "description": "Refresh token cookie is missing, invalid, or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminPasskeyErrorResponseDto" } } } } }, "security": [], "tags": ["Admin Authentication"] } }, "/application/applications": { "post": { "summary": "Create application API token", "description": "Creates a new application API token with a unique name. Returns the client_id and client_secret once — the secret is not stored and cannot be retrieved again.\n", "operationId": "ApplicationController_createApplication", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateApplicationRequestDto" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateApplicationResponseDto" } } }, "description": "Application API token created" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Invalid request payload" } }, "tags": ["Application API Tokens"] }, "get": { "summary": "List application API tokens", "description": "Returns a paginated list of active application API tokens. Client secrets are not included.\n", "operationId": "ApplicationController_listApplications", "parameters": [ { "in": "query", "name": "order", "required": false, "schema": { "type": "string", "enum": ["ASC", "DESC"] } }, { "in": "query", "name": "per_page", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50 } }, { "in": "query", "name": "page", "required": false, "schema": { "type": "integer", "minimum": 1 } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListApplicationsResponseDto" } } }, "description": "Application API tokens loaded" } }, "tags": ["Application API Tokens"] } }, "/application/applications/{id}": { "delete": { "summary": "Delete application API token", "description": "Soft-deletes an application API token. The token will no longer be usable for authentication.\n", "operationId": "ApplicationController_deleteApplication", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Application API token deleted" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid path param" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApplicationApiTokenNotFoundError" } } }, "description": "Application API token not found" } }, "tags": ["Application API Tokens"] } }, "/application/token": { "post": { "summary": "Exchange client credentials for access token", "description": "Exchanges client credentials for a JWT access token using the OAuth2 Client Credentials grant (RFC 6749 §4.4). Accepts both `application/json` and `application/x-www-form-urlencoded`.\n\n## Supported Standards\n\n- [RFC 6749 - OAuth 2.0 Client Credentials Grant (Section 4.4)](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4)\n", "operationId": "ApplicationController_exchangeToken", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExchangeTokenRequestDto" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExchangeTokenRequestDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExchangeTokenResponseDto" } } }, "description": "Access token issued" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidRequestPayloadError" } } }, "description": "Invalid request payload" }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuth2InvalidClientError" } } }, "description": "Invalid client credentials" } }, "security": [], "tags": ["Application API Tokens"] } }, "/assets/images": { "post": { "summary": "Upload image asset", "description": "Upload an image asset for use in wallet and issuer display contexts.\n\nThe request must be sent as `multipart/form-data` with a `file` part.\n", "operationId": "AssetsController_createImage", "parameters": [], "requestBody": { "required": true, "content": { "multipart/form-data": { "schema": { "type": "object", "required": ["file"], "properties": { "file": { "type": "string", "format": "binary" } } } } } }, "responses": { "201": { "description": "Image asset uploaded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageAssetResponseDto" } } } }, "400": { "description": "Missing file, unsupported declared MIME type, invalid image bytes, or virus scan failure", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageAssetErrorResponse" } } } }, "413": { "description": "Image upload file exceeds the configured size limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageAssetErrorResponse" } } } } }, "tags": ["Assets"] } }, "/assets/images/{id}": { "get": { "summary": "Get image asset", "description": "Retrieve image asset bytes by ID.\n\nThe response content type depends on the stored image format.\n", "operationId": "AssetsController_getImage", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Image asset bytes", "content": { "image/png": { "schema": { "type": "string", "format": "binary" } }, "image/jpeg": { "schema": { "type": "string", "format": "binary" } }, "image/webp": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "description": "Invalid path param", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } } }, "404": { "description": "Image asset not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageAssetNotFoundError" } } } } }, "tags": ["Assets"] } }, "/bridge/authorize": { "get": { "summary": "Gets authorization url", "description": "Start bridge authorization and return the authorization URL for front-channel redirection.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance (OpenID4VCI 1.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)\n- [OpenID for Verifiable Presentations (OpenID4VP 1.0)](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)\n", "operationId": "BridgeController_authorize", "parameters": [ { "description": "Request URI", "in": "query", "name": "request_uri", "required": true, "schema": { "type": "string" } }, { "description": "Connection", "in": "query", "name": "connection", "required": true, "schema": { "type": "string" } }, { "description": "Client ID", "in": "query", "name": "client_id", "required": true, "schema": { "type": "string" } }, { "description": "Redirect URI", "in": "query", "name": "redirect_uri", "required": true, "schema": { "type": "string" } }, { "description": "Account claims. Comma separated list of claims.", "in": "query", "name": "account_claims", "required": true, "schema": { "type": "string" } }, { "description": "UI locales", "in": "query", "name": "ui_locales", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object", "properties": { "url": { "type": "string", "description": "Authorization URL to start the authentication process with the external identity provider." } } } } }, "description": "" } }, "tags": ["Bridge"] } }, "/bridge/authorize/receive/callback": { "get": { "summary": "Handle bridge receive callback", "description": "`authorization_code` redirect uri that was started via `/receive` endpoint.\n`state` and `code` come as a query parameters.\n`code` is exchanged for the `access_token` to be used in the credential issuence/presentation flow.\n\n## Supported Standards\n\n- [RFC 6749 - OAuth 2.0 Authorization Code Grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1)\n- [OpenID for Verifiable Credential Issuance (OpenID4VCI 1.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)\n", "parameters": [ { "description": "Error code", "in": "query", "name": "error", "required": false, "schema": { "type": "string" } }, { "description": "Error description", "in": "query", "name": "error_description", "required": false, "schema": { "type": "string" } }, { "description": "Error URI", "in": "query", "name": "error_uri", "required": false, "schema": { "type": "string" } }, { "description": "Authorization code", "in": "query", "name": "code", "required": false, "schema": { "type": "string" } }, { "description": "Authorization state", "in": "query", "name": "state", "required": false, "schema": { "type": "string" } }, { "description": "Access token issuer", "in": "query", "name": "iss", "required": false, "schema": { "type": "string" } } ], "operationId": "BridgeController_callback", "responses": { "302": { "description": "Redirects to `redirect_uri` if returned in the case of a successful presentation response submission.\nOtherwise redirects to `redirect_uri` originally provided in the /authorize endpoint.\n" } }, "tags": ["Bridge"] } }, "/version": { "get": { "summary": "Get deployed service version information", "description": "Endpoint to read deployed service version information.\n", "operationId": "AppController_getVersion", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VersionDto" } } }, "description": "" } }, "security": [], "tags": ["Monitoring"] } }, "/system/status": { "get": { "summary": "Get deployed service status information", "description": "Endpoint to read deployed service status information.\n", "operationId": "AppController_getSystemStatus", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StatusDto" } } }, "description": "" } }, "tags": ["Monitoring"] } }, "/system/settings": { "get": { "summary": "List Runtime settings", "description": "List Runtime namespace settings. Missing rows are returned as schema-defaulted documents with `configured: false`.\n", "operationId": "SettingsController_findAll", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingsResponseDto" } } }, "description": "Runtime settings loaded" } }, "tags": ["Settings"] } }, "/system/settings/effective": { "get": { "summary": "Get effective settings", "description": "Get the merged effective configuration with known Static/bootstrap secrets redacted.\n", "operationId": "SettingsController_getEffectiveConfig", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EffectiveConfigResponseDto" } } }, "description": "Effective settings loaded" } }, "tags": ["Settings"] } }, "/system/settings/{namespace}": { "get": { "summary": "Get Runtime setting", "description": "Get one Runtime namespace setting. Missing rows are returned as schema-defaulted documents with `configured: false`.\n", "operationId": "SettingsController_findOne", "parameters": [ { "in": "path", "name": "namespace", "required": true, "schema": { "type": "string", "enum": ["system", "issuer", "verifier", "bridge", "wallets"] } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingResponseDto" } } }, "description": "Runtime setting loaded" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPathParamError" } } }, "description": "Invalid namespace" } }, "tags": ["Settings"] }, "put": { "summary": "Replace Runtime setting", "description": "Replace one Runtime namespace document. First writes require `expected_revision: 0`; updates require the current revision.\n", "operationId": "SettingsController_update", "parameters": [ { "in": "path", "name": "namespace", "required": true, "schema": { "type": "string", "enum": ["system", "issuer", "verifier", "bridge", "wallets"] } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateSettingRequestDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingResponseDto" } } }, "description": "Runtime setting replaced" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "Invalid namespace, body, or Runtime document" }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingsRevisionConflictError" } } }, "description": "Runtime setting revision conflict" } }, "tags": ["Settings"] }, "delete": { "summary": "Reset Runtime setting", "description": "Reset one Runtime namespace to defaults. Requires `expected_revision`; missing namespace with `expected_revision: 0` is the only no-op reset.\n", "operationId": "SettingsController_reset", "parameters": [ { "in": "path", "name": "namespace", "required": true, "schema": { "type": "string", "enum": ["system", "issuer", "verifier", "bridge", "wallets"] } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetSettingRequestDto" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingResponseDto" } } }, "description": "Runtime setting reset to defaults" }, "400": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/InvalidPathParamError" }, { "$ref": "#/components/schemas/InvalidRequestPayloadError" } ] } } }, "description": "Invalid namespace or body" }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SettingsRevisionConflictError" } } }, "description": "Runtime setting revision conflict" } }, "tags": ["Settings"] } }, "/system/certificates": { "get": { "summary": "List certificates", "description": "Returns a list of imported certificates and metadata.\n\nCertificates are stored by type:\n- `managed`: bound to a managed signing key (`key_name` present), may contain a full `x5c` chain,\n and has `fingerprint256 = null`.\n- `trust_anchor`: imported without `key_name`, must contain exactly one certificate in `x5c`, and has\n a non-null `fingerprint256`.\n\nThe response includes certificate id, type, associated `key_name` (when bound), the stored `x5c`,\nand `fingerprint256` according to the certificate type rules above.\n", "operationId": "CertificatesController_listCertificates", "parameters": [], "responses": { "200": { "description": "Certificates list retrieved", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CertificatesResponseDto" } } } } }, "tags": ["Certificates"] } }, "/system/certificates/import": { "post": { "summary": "Import certificate", "description": "Import certificate material in `x5c` form (DER-encoded, base64-encoded items).\n\nBehavior depends on whether `key_name` is provided:\n- With `key_name`: imports a `managed` certificate for that managed signing key.\n - `x5c` must contain at least one certificate.\n - The first item (leaf certificate) public key must match the managed key.\n - The full provided chain is stored.\n - `fingerprint256` is stored as `null`.\n- Without `key_name`: imports a `trust_anchor` certificate.\n - `x5c` must contain exactly one certificate.\n - `fingerprint256` is computed and stored.\n\nNotes:\n- For `mso_mdoc` (mDL) credential issuance the credential key must have a valid DSC certificate; issuance\n will fail without it (see ISO 18013-5 for mDL DSC requirements).\n- When signing CSRs externally (for example with `openssl x509 -req`), explicitly provide extensions\n such as `subjectAltName`, `keyUsage`, and `extendedKeyUsage` so they are present in the issued certificate.\n", "operationId": "CertificatesController_importCertificate", "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportCertificateRequestDto" } } } }, "responses": { "201": { "description": "Certificate imported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CertificateResponseDto" } } } } }, "tags": ["Certificates"] } }, "/system/certificates/{certificate_id}": { "delete": { "summary": "Delete certificate", "description": "Delete an imported certificate by identifier.\n\nRemoval deletes either:\n- a `managed` key-bound certificate chain, or\n- a trust entry (`trust_anchor`).\n\nRemoving a credential signing certificate can break `mso_mdoc` issuance.\n", "operationId": "CertificatesController_deleteCertificate", "parameters": [ { "name": "certificate_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" }, "description": "Certificate ID" } ], "responses": { "204": { "description": "Certificate deleted" } }, "tags": ["Certificates"] } }, "/system/certificates/csrs": { "post": { "summary": "Create CSR", "description": "Create a Certificate Signing Request (CSR) for a named wallet key and return the CSR PEM.\n\nTypical flow: create CSR → sign the CSR with your CA (ensuring required extensions are present) →\nimport the signed chain using `/system/certificates/import` with `key_name`.\n\nNotes:\n- When using `openssl x509 -req` to sign a CSR, pass required extensions via `-extfile` so attributes such\n as `subjectAltName` and `keyUsage` are present in the issued certificate.\n- For credential signing keys used with `mso_mdoc`, ensure the issued certificate contains the DSC-related\n EKUs and usages required by ISO 18013-5.\n", "operationId": "CertificatesController_createCsr", "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCsrRequestDto" } } } }, "responses": { "201": { "description": "CSR created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrResponseDto" } } } } }, "tags": ["Certificates"] } }, "/system/metrics/wallets": { "get": { "summary": "Wallet metrics", "description": "Return aggregated wallet metrics for the deployment.\n\nOptional query parameters can constrain the aggregation window by wallet creation date.\n", "operationId": "SystemMetricsController_getWalletCounts", "parameters": [ { "description": "Counts only wallets created after the given date", "in": "query", "name": "start_date", "required": false, "schema": { "type": "string" } }, { "description": "Counts only wallets created before the given date", "in": "query", "name": "end_date", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WalletCountsResponseDto" } } }, "description": "Metrics successfully fetched" }, "400": { "content": { "application/json": { "examples": { "invalid_date_filter_value": { "value": { "error": "invalid_date_filter_value", "extra_info": {}, "message": "Invalid date filter value." } } }, "schema": { "$ref": "#/components/schemas/InvalidDateFilterValueError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "tags": ["System Metrics (Experimental)"] } }, "/system/metrics/svx_verify_sessions": { "get": { "summary": "SVX Verify session metrics", "description": ">\n**Experimental.** Returns aggregated counts for SVX Verify sessions,\noptionally filtered by creation date range.\n", "operationId": "SystemMetricsController_getSessionsCounts", "parameters": [ { "description": "Counts only sessions created after the given date", "in": "query", "name": "start_date", "required": false, "schema": { "type": "string" } }, { "description": "Counts only sessions created before the given date", "in": "query", "name": "end_date", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvxVerifySessionCountsResponseDto" } } }, "description": "Metrics successfully fetched" }, "400": { "content": { "application/json": { "examples": { "invalid_date_filter_value": { "value": { "error": "invalid_date_filter_value", "extra_info": {}, "message": "Invalid date filter value." } } }, "schema": { "$ref": "#/components/schemas/InvalidDateFilterValueError" } } }, "description": "" }, "500": { "content": { "application/json": { "examples": { "internal_server_error": { "value": { "error": "internal_server_error", "extra_info": {}, "message": "Internal server error." } } }, "schema": { "$ref": "#/components/schemas/InternalServerError" } } }, "description": "" } }, "tags": ["System Metrics (Experimental)"] } }, "/dashboard/config.json": { "get": { "summary": "Get dashboard configuration", "x-internal": true, "description": "Returns the dashboard configuration including authentication and identity provider settings.\n", "operationId": "DashboardController_getConfig", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object", "properties": { "auth_enabled": { "type": "boolean", "description": "Whether authentication is required for the dashboard" }, "client_id": { "type": "string", "description": "OIDC client identifier (present when auth_enabled is true)" }, "authority": { "type": "string", "format": "uri", "description": "OIDC authority URL (present when auth_enabled is true)" }, "redirect_uri": { "type": "string", "format": "uri", "description": "OIDC redirect URI (present when auth_enabled is true)" }, "post_logout_redirect_uri": { "type": "string", "format": "uri", "description": "OIDC post-logout redirect URI (present when auth_enabled is true)" }, "issuer_name": { "type": "string", "description": "Credential issuer name (present when configured)" } }, "required": ["auth_enabled"] } } }, "description": "dashboard configuration" } }, "security": [], "tags": ["Dashboard"] } } }, "components": { "securitySchemes": { "bearerAuth": { "bearerFormat": "JWT", "scheme": "bearer", "type": "http" }, "mutualTLS": { "type": "mutualTLS" } }, "schemas": { "RuntimeSettingModelDto": { "type": "object", "properties": { "namespace": { "type": "string", "enum": ["system", "issuer", "verifier", "bridge", "wallets"] }, "configured": { "type": "boolean", "description": "True when the namespace has a persisted row; derived from `revision != null`." }, "revision": { "type": "integer", "minimum": 1 }, "document": { "type": "object", "additionalProperties": true }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" } }, "required": [ "namespace", "configured", "revision", "document", "updated_at", "updated_by" ] }, "SettingResponseDto": { "type": "object", "properties": { "setting": { "$ref": "#/components/schemas/RuntimeSettingModelDto" } }, "required": ["setting"] }, "SettingsResponseDto": { "type": "object", "properties": { "settings": { "type": "array", "items": { "$ref": "#/components/schemas/RuntimeSettingModelDto" } } }, "required": ["settings"] }, "EffectiveConfigResponseDto": { "type": "object", "properties": { "values": { "type": "object", "additionalProperties": true, "description": "Merged effective configuration with known Static/bootstrap secrets redacted." } }, "required": ["values"] }, "UpdateSettingRequestDto": { "type": "object", "properties": { "document": { "type": "object", "additionalProperties": true }, "expected_revision": { "type": "integer", "minimum": 0 } }, "required": ["document", "expected_revision"] }, "ResetSettingRequestDto": { "type": "object", "properties": { "expected_revision": { "type": "integer", "minimum": 0 } }, "required": ["expected_revision"] }, "SettingsRevisionConflictError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["settings_revision_conflict"], "type": "string" }, "extra_info": { "description": "Object that contains namespace and revision conflict details", "type": "object", "properties": { "namespace": { "type": "string", "enum": ["system", "issuer", "verifier", "bridge", "wallets"] }, "expected_revision": { "type": "integer", "minimum": 0 }, "current_revision": { "type": "integer" } } }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "AdminPasskeyErrorResponseDto": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "extra_info": { "type": "object", "additionalProperties": true } }, "required": ["error", "message", "extra_info"] }, "AdminPasskeyInvitationResponseDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid" }, "secret_token": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" } }, "required": ["account_id", "secret_token", "expires_at"] }, "App": { "properties": { "component_name": { "type": "string" }, "current_api_version": { "type": "string" }, "git_commit": { "type": "string" }, "node": { "type": "string" }, "npm_config_user_agent": { "type": "string" }, "npm_lifecycle_event": { "type": "string" }, "npm_node_execpath": { "type": "string" } }, "required": [ "component_name", "current_api_version", "git_commit", "npm_config_user_agent", "node", "npm_lifecycle_event", "npm_node_execpath" ], "type": "object" }, "AppSignal": { "properties": { "active": { "type": "string" }, "env": { "type": "string" }, "name": { "type": "string" } }, "required": ["active", "name", "env"], "type": "object" }, "CreateAdminInvitationRequestDto": { "type": "object", "properties": { "display_name": { "type": "string", "maxLength": 255, "description": "Optional display name to associate with the invitation and resulting admin account.", "example": "Admin User" } } }, "CreateAdminInvitationResponseDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid", "description": "Identifier of the invitation/account record." }, "secret_token": { "type": "string", "description": "One-time invitation secret token to be used in registration endpoints." }, "expires_at": { "type": "string", "format": "date-time", "description": "Invitation expiration timestamp (ISO 8601 UTC)." } }, "required": ["account_id", "secret_token", "expires_at"] }, "DeleteAdminAccountResponseDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid", "description": "Identifier of the deleted admin account." }, "deleted": { "type": "boolean", "description": "Always `true` when deletion succeeds.", "example": true } }, "required": ["account_id", "deleted"] }, "DeleteAdminInvitationResponseDto": { "type": "object", "properties": { "invitation_id": { "type": "string", "format": "uuid", "description": "Identifier of the deleted invitation." }, "deleted": { "type": "boolean", "description": "Always `true` when deletion succeeds.", "example": true } }, "required": ["invitation_id", "deleted"] }, "FinishAdminPasskeyAuthenticationRequestDto": { "type": "object", "properties": { "challenge_id": { "type": "string", "description": "Challenge identifier returned by `/admin/session/options`." }, "response": { "type": "object", "additionalProperties": true, "description": "Serialized WebAuthn assertion from `navigator.credentials.get(...)`.\n\nExpected content typically includes:\n- `id` and `rawId`: Credential identifier values.\n- `type`: Usually `public-key`.\n- `response.clientDataJSON`: Base64URL-encoded client data.\n- `response.authenticatorData`: Base64URL-encoded authenticator data.\n- `response.signature`: Base64URL-encoded assertion signature.\n- `response.userHandle`: Optional user handle when provided by the authenticator.\n\nSend the JSON-safe object produced by your WebAuthn client helper/library.\n" } }, "required": ["challenge_id", "response"] }, "FinishAdminPasskeyAuthenticationResponseDto": { "type": "object", "properties": { "name": { "type": "string", "description": "Authenticated admin display name.", "example": "Admin User" }, "access_token": { "type": "string", "description": "Signed JWT access token." }, "token_type": { "type": "string", "description": "OAuth token type.", "example": "Bearer" }, "expires_in": { "type": "integer", "description": "Access token lifetime in seconds.", "example": 3600 } }, "required": ["name", "access_token", "token_type", "expires_in"] }, "FinishAdminPasskeyRegistrationRequestDto": { "type": "object", "properties": { "secret_token": { "type": "string", "description": "Invitation secret token returned by `/admin/invitations`." }, "challenge_id": { "type": "string", "description": "Challenge identifier returned by `/admin/invitations/accept/options`." }, "response": { "type": "object", "additionalProperties": true, "description": "Serialized WebAuthn registration credential from `navigator.credentials.create(...)`.\n\nExpected content typically includes:\n- `id` and `rawId`: Newly created credential identifier values.\n- `type`: Usually `public-key`.\n- `response.clientDataJSON`: Base64URL-encoded client data.\n- `response.attestationObject`: Base64URL-encoded attestation object.\n- `response.transports`: Optional list of authenticator transports.\n- `clientExtensionResults`: Optional extension output.\n\nSend the JSON-safe object produced by your WebAuthn client helper/library.\n" } }, "required": ["secret_token", "challenge_id", "response"] }, "FinishAdminPasskeyRegistrationResponseDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid", "description": "Identifier of the admin account." }, "passkey_id": { "type": "string", "format": "uuid", "description": "Identifier of the created passkey credential." }, "passkeys_count": { "type": "integer", "description": "Total number of passkeys currently registered for the account." } }, "required": ["account_id", "passkey_id", "passkeys_count"] }, "ListAdminAccountsResponseDto": { "type": "object", "properties": { "accounts": { "type": "array", "items": { "$ref": "#/components/schemas/AdminAccountDto" } } }, "required": ["accounts"] }, "ListAdminInvitationsResponseDto": { "type": "object", "properties": { "invitations": { "type": "array", "items": { "$ref": "#/components/schemas/AdminInvitationDto" } } }, "required": ["invitations"] }, "AdminInvitationDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid", "description": "Invitation/account identifier." }, "display_name": { "type": "string", "description": "Optional display name captured at invitation creation time." }, "expires_at": { "type": "string", "format": "date-time", "description": "Invitation expiration timestamp (ISO 8601 UTC)." }, "created_at": { "type": "string", "format": "date-time", "description": "Invitation creation timestamp (ISO 8601 UTC)." } }, "required": ["account_id", "display_name", "expires_at", "created_at"] }, "AdminAccountDto": { "type": "object", "properties": { "account_id": { "type": "string", "format": "uuid", "description": "Admin account identifier." }, "display_name": { "type": "string", "description": "Optional admin display name." }, "invitation_accepted_at": { "type": "string", "format": "date-time", "description": "Timestamp when invitation was accepted (ISO 8601 UTC)." }, "created_at": { "type": "string", "format": "date-time", "description": "Account creation timestamp (ISO 8601 UTC)." }, "updated_at": { "type": "string", "format": "date-time", "description": "Last account update timestamp (ISO 8601 UTC)." }, "passkeys_count": { "type": "integer", "description": "Number of registered passkeys for this account." } }, "required": [ "account_id", "display_name", "invitation_accepted_at", "created_at", "updated_at", "passkeys_count" ] }, "StartAdminPasskeyAuthenticationOptionsResponseDto": { "type": "object", "properties": { "challenge_id": { "type": "string", "format": "uuid", "description": "Challenge identifier required by `/admin/session`." }, "options": { "type": "object", "additionalProperties": true, "description": "WebAuthn `PublicKeyCredentialRequestOptionsJSON` payload to pass to `navigator.credentials.get({ publicKey: options })`.\n\nCommon fields:\n- `challenge`: Base64URL challenge generated by the server.\n- `rpId`: Relying Party ID to scope credential lookup.\n- `timeout`: Timeout in milliseconds.\n- `allowCredentials`: List of credential descriptors allowed for authentication.\n- `userVerification`: User verification requirement (`required`, `preferred`, or `discouraged`).\n- `extensions`: Optional WebAuthn extensions.\n" } }, "required": ["challenge_id", "options"] }, "StartAdminPasskeyRegistrationOptionsResponseDto": { "type": "object", "properties": { "challenge_id": { "type": "string", "format": "uuid", "description": "Challenge identifier required by `/admin/invitations/accept`." }, "options": { "type": "object", "additionalProperties": true, "description": "WebAuthn `PublicKeyCredentialCreationOptionsJSON` payload to pass to `navigator.credentials.create({ publicKey: options })`.\n\nCommon fields:\n- `challenge`: Base64URL challenge generated by the server.\n- `rp`: Relying Party metadata (`id`, `name`).\n- `user`: User handle and display metadata (`id`, `name`, `displayName`).\n- `pubKeyCredParams`: Supported public key algorithms.\n- `timeout`: Timeout in milliseconds.\n- `attestation`: Attestation conveyance preference.\n- `authenticatorSelection`: Authenticator requirements/preferences.\n- `excludeCredentials`: Credentials that must not be re-registered.\n" } }, "required": ["challenge_id", "options"] }, "StartAdminPasskeyRegistrationRequestDto": { "type": "object", "properties": { "secret_token": { "type": "string", "description": "Invitation secret token returned by `/admin/invitations`." } }, "required": ["secret_token"] }, "ClaimObject": { "type": "object", "additionalProperties": { "properties": { "display": { "type": "array", "items": { "$ref": "#/components/schemas/DisplayClaimObject" } }, "mandatory": { "type": "boolean" } } } }, "Component": { "properties": { "api_version": { "type": "string" }, "git_commit": { "type": "string" }, "name": { "type": "string" } }, "required": ["api_version", "name", "git_commit"], "type": "object" }, "CredentialJSONSchemaPayloadDto": { "type": "object", "properties": { "$id": { "type": "string" }, "$schema": { "type": "string", "enum": [ "http://json-schema.org/draft-07/schema#", "https://json-schema.org/draft/2019-09/schema", "https://json-schema.org/draft/2020-12/schema" ] }, "$comment": { "type": "string" }, "$defs": { "type": "object", "additionalProperties": true }, "name": { "type": "string" }, "description": { "type": "string" }, "title": { "type": "string" }, "type": { "type": "string" }, "properties": { "type": "object", "additionalProperties": true }, "required": { "type": "array", "items": { "type": "string" } }, "additionalProperties": { "type": "boolean" }, "examples": { "type": "array", "items": {} } }, "required": ["$schema", "type"], "additionalProperties": true }, "CreateSchemaDto": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 255 }, "format": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"], "example": "jwt_vc_json" }, "schema_json": { "$ref": "#/components/schemas/CredentialJSONSchemaPayloadDto" } }, "required": ["name", "format", "schema_json"] }, "CreateSchemaPayloadDto": { "type": "object", "properties": { "schema": { "$ref": "#/components/schemas/CreateSchemaDto" } }, "required": ["schema"] }, "SchemaResponseModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "format": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"], "example": "jwt_vc_json" }, "schema_json": { "type": "object", "additionalProperties": true }, "created_at": { "type": "string", "format": "date-time" } }, "required": ["id", "name", "format", "schema_json", "created_at"] }, "SchemaResponseDto": { "type": "object", "properties": { "schema": { "$ref": "#/components/schemas/SchemaResponseModelDto" } }, "required": ["schema"] }, "SchemasResponseDto": { "type": "object", "properties": { "schemas": { "type": "array", "items": { "$ref": "#/components/schemas/SchemaResponseModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["schemas", "meta"] }, "UpdateSchemaDto": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 255 }, "schema_json": { "$ref": "#/components/schemas/CredentialJSONSchemaPayloadDto" } } }, "UpdateSchemaPayloadDto": { "type": "object", "properties": { "schema": { "$ref": "#/components/schemas/UpdateSchemaDto" } }, "required": ["schema"] }, "CreateCredentialTemplateStyleDto": { "type": "object", "properties": { "text-color": { "type": "string", "example": "#FFF" }, "background": { "type": "string", "example": "linear-gradient(135deg," }, "image": { "type": "string", "format": "uri", "example": "https://example.com/image.png" }, "background-image": { "type": "string", "format": "uri", "example": "https://example.com/background-image.png" } }, "required": ["text-color", "background"] }, "CreateCredentialTemplateConfigDto": { "type": "object", "properties": { "vct": { "type": "string", "example": "urn:eu.europa.ec.eudi:pid:1" }, "valid_in": { "type": "integer" }, "valid_at": { "type": "string", "format": "date-time" }, "expires_in": { "type": "integer" }, "expires_at": { "type": "string", "format": "date-time" }, "issuer_credential_configurations_supported_name": { "type": "string", "example": "MyCustomCredentialConfigName" }, "disclosure_frame": { "type": "object", "additionalProperties": true }, "doctype": { "type": "string", "example": "org.iso.18013.5.1.mDL" }, "type": { "type": "array", "maxItems": 3, "items": { "type": "string" }, "example": ["UniversityDegreeCredential"] } } }, "CreateCredentialTemplateDto": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 128, "example": "Credential Template name" }, "schema_id": { "type": "string", "format": "uuid" }, "style": { "$ref": "#/components/schemas/CreateCredentialTemplateStyleDto" }, "config": { "$ref": "#/components/schemas/CreateCredentialTemplateConfigDto" } }, "required": ["name", "schema_id", "style"] }, "CreateCredentialTemplatePayloadDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/CreateCredentialTemplateDto" } }, "required": ["template"] }, "UpdateCredentialTemplateDto": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 128, "example": "Credential Template name" }, "style": { "$ref": "#/components/schemas/CreateCredentialTemplateStyleDto" }, "config": { "$ref": "#/components/schemas/CreateCredentialTemplateConfigDto" } }, "required": ["name", "style"] }, "UpdateCredentialTemplatePayloadDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/UpdateCredentialTemplateDto" } }, "required": ["template"] }, "CredentialTemplateSchemaDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "example": "9322c384-fd8e-4a13-80cd-1cbd1ef95ba8" }, "schema_url": { "type": "string", "format": "uri", "example": "https://example.com/schemas/9322c384-fd8e-4a13-80cd-1cbd1ef95ba8/schema.json" }, "name": { "type": "string" } }, "required": ["id", "schema_url", "name"] }, "CredentialTemplateStyleDto": { "type": "object", "properties": { "text-color": { "type": "string" }, "background": { "type": "string" }, "image": { "type": "string" }, "background-image": { "type": "string" } }, "required": ["text-color", "background", "image", "background-image"] }, "CredentialTemplateConfigDto": { "type": "object", "properties": { "vct": { "type": "string" }, "valid_in": { "type": "integer" }, "valid_at": { "type": "string", "format": "date-time" }, "expires_in": { "type": "integer" }, "expires_at": { "type": "string", "format": "date-time" }, "issuer_credential_configurations_supported_name": { "type": "string" }, "disclosure_frame": { "type": "object", "additionalProperties": true }, "doctype": { "type": "string" }, "type": { "type": "array", "items": { "type": "string" } } }, "required": [ "vct", "valid_in", "valid_at", "expires_in", "expires_at", "issuer_credential_configurations_supported_name", "disclosure_frame", "doctype", "type" ] }, "CredentialTemplateModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "example": "7dcfa413-bff0-4f62-a51a-ab9959623332" }, "name": { "type": "string", "example": "Credential Template name" }, "schema": { "$ref": "#/components/schemas/CredentialTemplateSchemaDto" }, "style": { "$ref": "#/components/schemas/CredentialTemplateStyleDto" }, "format": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"], "example": "dc+sd-jwt" }, "config": { "$ref": "#/components/schemas/CredentialTemplateConfigDto" }, "created_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "name", "schema", "style", "format", "config", "created_at" ] }, "CredentialTemplateResponseDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/CredentialTemplateModelDto" } }, "required": ["template"] }, "CredentialTemplatesResponseDto": { "type": "object", "properties": { "templates": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialTemplateModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["templates", "meta"] }, "StatusListType": { "type": "string", "enum": ["revocation", "suspension"] }, "RevocationStatusListValue": { "type": "string", "enum": ["0", "1"] }, "UpdateCredentialStatusRequestStatusDto": { "type": "object", "properties": { "type": { "$ref": "#/components/schemas/StatusListType" }, "status": { "$ref": "#/components/schemas/RevocationStatusListValue" } }, "required": ["type", "status"] }, "UpdateCredentialStatusRequestDto": { "type": "object", "properties": { "credential_status": { "$ref": "#/components/schemas/UpdateCredentialStatusRequestStatusDto" } }, "required": ["credential_status"] }, "UnsupportedCredentialStatusListTypeError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["unsupported_credential_status_list_type"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialRevocationStatusValueInvalidError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["credential_revocation_status_value_invalid"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialRevocationStatusNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["credential_revocation_status_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "RevocationListNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["revocation_list_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "PresentationTemplateType": { "type": "string", "enum": ["dcql", "pex"] }, "FilterNotPredicateDto": { "type": "object", "properties": { "enum": { "type": "array", "items": { "type": "string" } }, "const": { "description": "Any JSON value" } } }, "FilterItemsDto": { "type": "object", "properties": { "type": { "type": "string" } }, "required": ["type"] }, "FilterContainsDto": { "type": "object", "properties": { "type": { "type": "string" }, "const": { "description": "Any JSON value" } } }, "FilterDto": { "type": "object", "properties": { "type": { "type": "string" }, "const": { "description": "Any JSON value" }, "pattern": { "type": "string" }, "format": { "type": "string" }, "exclusiveMinimum": { "type": "number" }, "exclusiveMaximum": { "type": "number" }, "minimum": { "type": "number" }, "maximum": { "type": "number" }, "enum": { "type": "array", "items": { "type": "string" } }, "not": { "$ref": "#/components/schemas/FilterNotPredicateDto" }, "items": { "$ref": "#/components/schemas/FilterItemsDto" }, "contains": { "$ref": "#/components/schemas/FilterContainsDto" } }, "required": ["type"] }, "FieldsDto": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "string" } }, "name": { "type": "string" }, "purpose": { "type": "string" }, "filter": { "$ref": "#/components/schemas/FilterDto" }, "optional": { "type": "boolean" }, "intent_to_retain": { "type": "boolean" } }, "required": ["path"] }, "ConstraintsDto": { "type": "object", "properties": { "limit_disclosure": { "type": "string", "enum": ["required", "preferred"] }, "fields": { "type": "array", "items": { "$ref": "#/components/schemas/FieldsDto" } } } }, "InputDescriptorPayload": { "type": "object", "properties": { "id": { "type": "string" }, "format": { "type": "object", "additionalProperties": { "type": "object" } }, "name": { "type": "string" }, "purpose": { "type": "string" }, "constraints": { "$ref": "#/components/schemas/ConstraintsDto" }, "group": { "type": "array", "items": { "type": "string" } } }, "required": ["id", "constraints"] }, "DCQLClaimQueryDto": { "type": "object", "properties": { "id": { "type": "string" }, "namespace": { "type": "string" }, "claim_name": { "type": "string" }, "path": { "type": "array", "description": "JSONPath-like segments; each entry can be string, number, or null.", "items": {} }, "values": { "type": "array", "description": "Allowed value literals (string, number, boolean).", "items": {} }, "intent_to_retain": { "type": "boolean" } }, "required": ["path"] }, "DCQLCredentialQueryDto": { "type": "object", "properties": { "id": { "type": "string" }, "format": { "type": "string", "enum": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"] }, "multiple": { "type": "boolean" }, "meta": { "type": "object", "additionalProperties": true }, "trusted_authorities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "values": { "type": "array", "items": { "type": "string" } } }, "required": ["type", "values"] } }, "require_cryptographic_holder_binding": { "type": "boolean" }, "claims": { "type": "array", "items": { "$ref": "#/components/schemas/DCQLClaimQueryDto" } }, "claim_sets": { "type": "array", "items": { "type": "array", "items": { "type": "string" } } } }, "required": ["id", "format"] }, "DCQLCredentialSetQueryDto": { "type": "object", "properties": { "options": { "type": "array", "items": { "type": "array", "items": { "type": "string" } } }, "required": { "type": "boolean" } }, "required": ["options"] }, "DCQLQueryPayload": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "$ref": "#/components/schemas/DCQLCredentialQueryDto" } }, "credential_sets": { "type": "array", "items": { "$ref": "#/components/schemas/DCQLCredentialSetQueryDto" } } }, "required": ["credentials"] }, "CreatePresentationTemplateDto": { "type": "object", "properties": { "name": { "type": "string" }, "purpose": { "type": "string" }, "input_descriptors": { "type": "array", "items": { "$ref": "#/components/schemas/InputDescriptorPayload" } }, "dcql_query": { "$ref": "#/components/schemas/DCQLQueryPayload" }, "type": { "$ref": "#/components/schemas/PresentationTemplateType" } }, "required": ["name"] }, "CreatePresentationTemplatePayloadDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/CreatePresentationTemplateDto" } }, "required": ["template"] }, "UpdatePresentationTemplateDto": { "type": "object", "properties": { "name": { "type": "string" }, "purpose": { "type": "string" }, "input_descriptors": { "type": "array", "items": { "$ref": "#/components/schemas/InputDescriptorPayload" } }, "dcql_query": { "$ref": "#/components/schemas/DCQLQueryPayload" } } }, "UpdatePresentationTemplatePayloadDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/UpdatePresentationTemplateDto" } }, "required": ["template"] }, "PresentationTemplateModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "purpose": { "type": ["string", "null"] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "input_descriptors": { "oneOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/InputDescriptorPayload" } }, { "type": "null" } ] }, "type": { "$ref": "#/components/schemas/PresentationTemplateType" }, "dcql_query": { "anyOf": [ { "$ref": "#/components/schemas/DCQLQueryPayload" }, { "type": "null" } ] } }, "required": [ "id", "name", "purpose", "created_at", "updated_at", "input_descriptors", "type", "dcql_query" ] }, "PresentationTemplateResponseDto": { "type": "object", "properties": { "template": { "$ref": "#/components/schemas/PresentationTemplateModelDto" } }, "required": ["template"] }, "PaginatedPresentationTemplatesResponseDto": { "type": "object", "properties": { "templates": { "type": "array", "items": { "$ref": "#/components/schemas/PresentationTemplateModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["templates", "meta"] }, "PresentationTemplateNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["presentation_template_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidUpdateFieldForTypeError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_update_field_for_type"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPresentationTemplateInputDescriptorsError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_presentation_template_input_descriptors"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPresentationTemplateDcqlQueryError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_presentation_template_dcql_query"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPaginationParamError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_pagination_param"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "SchemaNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["schema_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialTemplateNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["credential_template_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CreateDidError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["create_did_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CreateWalletPayloadDto": { "properties": { "external_reference": { "example": "9b4cf584-4f82-4836-9b17-66482cd2b171", "type": "string" } }, "type": "object" }, "CredentialDefinition": { "properties": { "credentialSubject": { "additionalProperties": true, "description": "Object containing a list of name/value pairs, where each name identifies a claim offered in the Credential.", "type": "object" }, "type": { "description": "Array designating the types a certain Credential type supports, according to VC Data Model, Section 4.3.", "items": { "type": "string" }, "type": "array" } }, "required": ["type"], "type": "object" }, "CredentialImportRequestModelDto": { "properties": { "credential": { "description": "The encoded string representation of the credential to be imported.\n\nFor `jwt_vc_json` and `dc+sd-jwt` credential formats, the string is expected to be a compact JWT.\n\nFor `mso_mdoc` the expected string value is the base64url-encoded representation of the CBOR-encoded IssuerSigned structure, as defined in [ISO.18013-5]\nSupports the following docTypes:\n - org.iso.18013.5.mDL\n", "example": "LUpixVCWJk0eOt4CXQe1NXK....WZwmhmn9OQp6YxX0a2L", "type": "string" }, "format": { "description": "Credential format identifier. When not provided, credential will be assumed to be a compact JWT.", "enum": ["dc+sd-jwt", "jwt_vc_json", "vc+sd-jwt", "mso_mdoc"], "type": "string" }, "meta": { "description": "Additional information about the credential to be imported.", "properties": { "did": { "description": "A DID managed by the wallet used to perform credential key binding.", "example": "did:key:z6MkipmTzRNjTHKujEEAhG5JR5zHd578uUYNTnWaYMALRDUs", "type": "string" }, "kid": { "description": "An ID for a key managed by the wallet used to perform credential key binding.", "example": "lA5y6IC-aLCpHtf-NytvSbYGZWqAfbrgAoGn3F3l0NI", "type": "string" } } } }, "required": ["credential"], "type": "object" }, "CredentialNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["credential_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialOfferDto": { "properties": { "credential_issuer": { "example": "https://issuer.example.com", "type": "string" }, "credential_configuration_ids": { "description": "Credential configuration identifiers included in the offer.", "items": { "type": "string" }, "type": "array" }, "grants": { "$ref": "#/components/schemas/GrantDto" } }, "type": "object" }, "CredentialPatchRequestModelDto": { "properties": { "meta": { "description": "Additional information about the credential to be imported.", "properties": { "did": { "description": "A DID managed by the wallet used to perform credential key binding.", "example": "did:key:z6MkipmTzRNjTHKujEEAhG5JR5zHd578uUYNTnWaYMALRDUs", "type": "string" }, "kid": { "description": "An ID for a key managed by the wallet used to perform credential key binding.", "example": "lA5y6IC-aLCpHtf-NytvSbYGZWqAfbrgAoGn3F3l0NI", "type": "string" } } } } }, "CredentialReceiveGetAccessTokenRequestModelDto": { "properties": { "authorization_code": { "description": "code claimed via authorization code flow. It can to be exchanged for the access token.", "type": "string" }, "authorization_details": { "description": "Contains details about the credentials the Wallet wants to obtain.", "items": { "properties": { "type": { "enum": ["openid_credential"], "type": "string" }, "credential_configuration_id": { "type": "string" } }, "required": ["type", "credential_configuration_id"], "type": "object" }, "type": "array" }, "client_id": { "description": "Client identifier in OAuth 2.0", "type": "string" }, "client_secret": { "type": "string" }, "code_challenge": { "description": "Part of PKCE, used when calling the authorization endpoint.", "type": "string" }, "code_challenge_method": { "description": "Part of PKCE, used when calling the authorization endpoint.", "type": "string" }, "code_verifier": { "description": "Part of PKCE, used when calling the token endpoint, together with the authorization code", "type": "string" }, "credential_issuer": { "description": "The URL of the Credential Issuer from which the Wallet is requested to obtain one or more Credentials. The authorization server is determined based on the Credential Issuer Metadata.", "type": "string" }, "grant_type": { "description": "", "enum": [ "authorization_code", "urn:ietf:params:oauth:grant-type:pre-authorized_code" ], "type": "string" }, "issuer_state": { "description": "String value identifying a certain processing context at the Credential Issuer. This value is typically provided in the credential offer. When it is, the Wallet MUST send the value back to the Credential Issuer.", "type": "string" }, "protocol_version": { "description": "version of credential issuance protocol. Defaults to `openid4vci-v1`", "enum": ["openid4vci-v1"], "type": "string" }, "pre-authorized_code": { "description": "The code representing the authorization to obtain Credentials of a certain type. This parameter MUST be present if the grant_type is urn:ietf:params:oauth:grant-type:pre-authorized_code. Typically provided by the Credential Issuer in the credential offer.", "type": "string" }, "redirect_uri": { "description": "Only relevant when the grant_type is authorization_code.", "type": "string" }, "scope": { "description": "Request credentials using OAuth 2.0 scope parameter", "type": "string" }, "state": { "type": "string" }, "tx_code": { "description": "String value containing a Transaction Code. This value MUST be present if a tx_code object was present in the Credential Offer (including if the object was empty). This parameter MUST only be used if the grant_type is urn:ietf:params:oauth:grant-type:pre-authorized_code.", "type": "string" } }, "type": "object" }, "CredentialReceiveGetAccessTokenResponseModelDto": { "properties": { "access_token": { "type": "string" }, "authorization_url": { "description": "The URL to open in a browser in order to complete the authorization with the Authorization Server.", "type": "string" }, "credential_definition": { "oneOf": [ { "properties": { "vct": { "type": "string" } }, "type": "object" }, { "properties": { "type": { "items": { "type": "string" }, "type": "array" } }, "type": "object" } ] }, "client_id": { "description": "Client identifier in OAuth 2.0", "type": "string" }, "refresh_token": { "type": "string" }, "state": { "type": "string" } }, "type": "object" }, "CredentialReceiveGetCredentialRequestModelDto": { "properties": { "access_token": { "type": "string" }, "credential_definition": { "oneOf": [ { "properties": { "vct": { "type": "string" } }, "type": "object" }, { "properties": { "type": { "items": { "type": "string" }, "type": "array" } }, "type": "object" } ] }, "did": { "type": "string" }, "kid": { "type": "string" }, "state": { "type": "string" }, "transaction_id": { "description": "A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the Credential", "type": "string" } }, "type": "object" }, "CredentialReceiveGetCredentialResponseModelDto": { "properties": { "id": { "description": "Internal reference to the credential record that later has to be used with other credential related endpoints", "example": "8293745e-f600-4fc6-ba1d-7827125a23e0", "type": "string" }, "credential": { "description": "Contains issued Credential. MUST be present when transaction_id is not returned. MAY be a string or an object, depending on the Credential format. See Appendix E for the Credential format specific encoding requirements.", "type": "string" }, "credential_id": { "description": "Id under which the credential is stored in the wallet", "example": "urn:uuid:4b5c8b6f-9b8a-4c8b-8b6f-9b8a4c8b6f9b", "type": "string" }, "state": { "type": "string" }, "transaction_id": { "description": "A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the Credential", "type": "string" } }, "required": ["state"], "type": "object" }, "CredentialReceiveRequestModelDto": { "properties": { "credential_offer": { "$ref": "#/components/schemas/CredentialOfferDto" }, "credential_offer_uri": { "example": "https://example.com/credential_offer", "type": "string" }, "credential_offer_endpoint": { "example": "openid-credential-offer://credential_offer_uri=https://example.com/credential_offer", "type": "string" }, "protocol_version": { "description": "version of credential issuance protocol. Defaults to `openid4vci-v1`", "enum": ["openid4vci-v1"], "type": "string" } }, "type": "object" }, "CredentialReceiveResponseModelDto": { "properties": { "credential_offer": { "$ref": "#/components/schemas/CredentialOfferDto" }, "credential_offer_uri": { "example": "https://example.com/credential_offer", "type": "string" }, "credential_offer_endpoint": { "example": "openid-credential-offer://credential_offer_uri=https://example.com/credential_offer", "type": "string" }, "state": { "example": "e0d7bd1e-dce5-4366-989f-4647af68412a", "type": "string" }, "meta": { "$ref": "#/components/schemas/OpenIdVCIStateMeta" } }, "type": "object" }, "CredentialReceiveStatesModelDto": { "type": "object", "properties": { "states": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialReceiveStateModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["states", "meta"] }, "CredentialReceiveStateModelDto": { "properties": { "access_token": { "type": "string" }, "authorization_url": { "description": "The URL to open in a browser in order to complete the authorization with the Authorization Server.", "type": "string" }, "client_id": { "description": "Client identifier in OAuth 2.0", "type": "string" }, "credential_id": { "description": "Id under which the credential is stored in the wallet", "example": "urn:uuid:4b5c8b6f-9b8a-4c8b-8b6f-9b8a4c8b6f9b", "type": "string" }, "credential_ids": { "type": "array", "items": { "type": "string", "description": "Credential Ids that were issued using this receive state", "example": "urn:uuid:4b5c8b6f-9b8a-4c8b-8b6f-9b8a4c8b6f9b" } }, "proofs": { "type": "object", "properties": { "proof_type": { "type": "string", "example": "jwt" }, "jwt": { "description": "Array of Compact JWT of proof JWT used to issue the credential", "type": "array", "items": { "type": "string" } } } }, "credential_definition": { "oneOf": [ { "properties": { "vct": { "type": "string" } }, "type": "object" }, { "properties": { "type": { "items": { "type": "string" }, "type": "array" } }, "type": "object" } ] }, "credential_endpoint": { "description": "Credential Issuer credential endpoint called", "example": "https://example.uri/credentials", "type": "string" }, "credential_offer": { "$ref": "#/components/schemas/CredentialOfferDto" }, "credential_offer_uri": { "example": "https://example.com/credential_offer", "type": "string" }, "credential_offer_endpoint": { "example": "openid-credential-offer://credential_offer_uri=https://example.com/credential_offer", "type": "string" }, "did": { "type": "string" }, "format": { "enum": ["dc+sd-jwt", "vc+sd-jwt", "jwt_vc_json", "mso_mdoc"], "type": "string" }, "kid": { "type": "string" }, "refresh_token": { "type": "string" }, "response_type": { "description": "This value is always `code`", "enum": ["code"], "type": "string" }, "state": { "example": "e0d7bd1e-dce5-4366-989f-4647af68412a", "type": "string" }, "token_endpoint": { "description": "Credential Issuer or Authorization Server token endpoint called", "example": "https://example.uri/token", "type": "string" }, "transaction_id": { "description": "A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the Credential", "type": "string" }, "meta": { "$ref": "#/components/schemas/OpenIdVCIStateMeta" } }, "type": "object" }, "CredentialResponseDto": { "properties": { "credential": { "$ref": "#/components/schemas/CredentialResponseModelDto" } }, "required": ["credential"], "type": "object" }, "CredentialResponseModelDto": { "properties": { "created_at": { "description": "The date and time when the credential was added to a Wallet.", "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "credential": { "description": "The encoded string representation of the credential.", "example": "LUpixVCWJk0eOt4CXQe1NXK....WZwmhmn9OQp6YxX0a2L", "type": "string" }, "format": { "description": "Format of the credential.", "enum": ["dc+sd-jwt", "vc+sd-jwt", "jwt_vc_json", "mso_mdoc"], "type": "string" }, "id": { "description": "A unique identifier of the credential.", "example": "urn:uuid:df9a133c-0fca-4db1-8892-2f881aa44109", "type": "string" }, "meta": { "properties": { "claims": { "$ref": "#/components/schemas/ClaimObject", "description": "Object containing a list of name/value pairs. Each pair is a claim about the subject in the credential.\n\nSnapshot from Credential Issuer Metadata taken at the time of issuance.\nSee Appendix A.2.2 in OpenID for Verifiable Credential Issuance for more information.\n" }, "order": { "description": "Array designating the order that claims or credential_definition.credentialSubject attribute should be displayed.", "items": { "type": "string" }, "type": "array" }, "credential_definition": { "$ref": "#/components/schemas/CredentialDefinition", "description": "Object containing the detailed description of the credential type of the W3C VC Data Model.\n\nSnapshot from Credential Issuer Metadata taken at the time of issuance.\nSee Appendix A.1.1.2 in OpenID for Verifiable Credential Issuance for more information.\n" }, "did": { "description": "A DID managed by the wallet used to perform credential key binding.", "example": "did:key:z6MkipmTzRNjTHKujEEAhG5JR5zHd578uUYNTnWaYMALRDUs", "type": "string" }, "display": { "$ref": "#/components/schemas/CredentialDisplayObject", "description": "Array of objects, where each object contains information on how to display the credential.\n\nSnapshot from Credential Issuer Metadata taken at the time of issuance.\nSee section 11.2.3 in OpenID for Verifiable Credential Issuance for more information.\n" }, "issuer_display": { "$ref": "#/components/schemas/IssuerDisplayObject", "description": "Array of objects, where each object contains issuers name for a different locale.\n\nSnapshot from Credential Issuer Metadata taken at the time of issuance.\nSee section 11.2.3 in OpenID for Verifiable Credential Issuance for more information.\n" }, "kid": { "description": "An ID for a key managed by the wallet used to perform credential key binding.", "example": "lA5y6IC-aLCpHtf-NytvSbYGZWqAfbrgAoGn3F3l0NI", "type": "string" }, "vct": { "description": "The Credential type of the SD-JWT VC.\n\nSnapshot from Credential Issuer Metadata taken at the time of issuance.\nSee Appendix A.2.2 in OpenID for Verifiable Credential Issuance for more information.\n", "type": "string" }, "doctype": { "description": "The docType of the first document in the mso_mdoc", "type": "string" } }, "type": "object" } }, "required": ["id", "format", "credential", "meta", "created_at"], "type": "object" }, "CredentialVerificationCheckModelDto": { "properties": { "error": { "type": "string" }, "extra_info": { "type": "object" }, "message": { "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialVerificationResponseDto": { "properties": { "checks": { "type": "array", "items": { "type": "string", "enum": [ "format", "signature", "expiration", "nonce", "schema", "revocation_status" ] } }, "errors": { "items": { "$ref": "#/components/schemas/CredentialVerificationCheckModelDto" }, "type": "array" }, "id": { "type": "string" }, "warnings": { "items": { "$ref": "#/components/schemas/CredentialVerificationCheckModelDto" }, "type": "array" } }, "required": ["id", "checks", "warnings", "errors"], "type": "object" }, "CredentialsResponseDto": { "properties": { "credentials": { "items": { "$ref": "#/components/schemas/CredentialResponseModelDto" }, "type": "array" }, "meta": { "allOf": [ { "$ref": "#/components/schemas/Meta" } ], "example": { "order": "asc", "per_page": 20 } } }, "required": ["credentials", "meta"], "type": "object" }, "Database": { "properties": { "host": { "type": "string" }, "name": { "type": "string" }, "port": { "type": "string" }, "user": { "type": "string" } }, "required": ["host", "port", "name", "user"], "type": "object" }, "DcqlQuery": { "type": "object", "properties": { "credentials": { "description": "A non-empty array of Credential Queries that specify the requested Credentials.\n", "type": "array", "items": { "type": "object", "properties": { "id": { "description": "A string identifying the Credential in the response and, if provided, the constraints in credential_sets. The value MUST be a non-empty string consisting of alphanumeric, underscore (_), or hyphen (-) characters. Within the Authorization Request, the same id MUST NOT be present more than once.\n", "type": "string" }, "format": { "description": "A string that specifies the format of the requested Credential.", "type": "string" }, "claims": { "description": "A non-empty array of objects that specifies claims in the requested Credential. Verifiers MUST NOT point to the same claim more than once in a single query. Wallets SHOULD ignore such duplicate claim queries.\n", "type": "array", "items": { "type": "object", "properties": { "id": { "description": "REQUIRED if claim_sets is present in the Credential Query; OPTIONAL otherwise. A string identifying the particular claim. The value MUST be a non-empty string consisting of alphanumeric, underscore (_), or hyphen (-) characters. Within the particular claims array, the same id MUST NOT be present more than once.\n", "type": "string" }, "values": { "type": "array", "description": "Allowed value literals (string, number, boolean).", "items": {} }, "path": { "type": "array", "description": "JSONPath-like segments; each entry can be string, number, or null.", "items": {} }, "intent_to_retain": { "type": "boolean" } }, "required": ["path"] } }, "claim_sets": { "description": "A non-empty array containing arrays of identifiers for elements in claims that specifies which combinations of claims for the Credential are requested.\n", "type": "array", "items": { "type": "array", "items": { "type": "string" } } }, "meta": { "description": "An object defining additional properties requested by the Verifier that apply to the metadata and validity data of the Credential.\n\nIf empty, no specific constraints are placed on the metadata or validity of the requested Credential.\n", "type": "object", "properties": { "vct_values": { "description": "dc+sd-jwt specific - array of accepted vct values", "type": "array", "items": { "type": "string" } }, "doctype_value": { "description": "mso_mdoc specific - accepted value of doctype", "type": "string" }, "type_values": { "description": "jwt_vc_json specific - array of array accepted types. \n\ne.g: [[\"IDCredential\"]]\n", "type": "array", "items": { "type": "array", "items": { "type": "string" } } } } }, "trusted_authorities": { "description": "A non-empty array of objects that specifies expected authorities or trust frameworks that certify Issuers, that the Verifier will accept. Every Credential returned by the Wallet SHOULD match at least one of the conditions present in the corresponding trusted_authorities array if present\n", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "values": { "type": "array", "items": { "type": "string" } } } } }, "require_cryptographic_holder_binding": { "description": "A boolean which indicates whether the Verifier requires a Cryptographic Holder Binding proof. The default value is true, i.e., a Verifiable Presentation with Cryptographic Holder Binding is required. If set to false, the Verifier accepts a Credential without Cryptographic Holder Binding proof.\n", "type": "boolean" }, "multiple": { "description": "A boolean which indicates whether multiple Credentials can be returned for this Credential Query. If omitted, the default value is false.\n", "type": "boolean" } }, "required": ["id", "format", "meta"] } }, "credential_sets": { "description": "A non-empty array of Credential Set Queries that specifies additional constraints on which of the requested Credentials to return.\n", "type": "array", "items": { "type": "object", "properties": { "options": { "type": "array", "items": { "type": "array", "items": { "type": "string" } } }, "required": { "type": "boolean" } }, "required": ["options"] } } }, "required": ["credentials"] }, "DeleteCredentialError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["delete_credential_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DeleteDidError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["delete_did_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DeleteWalletError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["delete_wallet_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DidKidAssociationNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["did_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DidNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["did_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DisplayClaimObject": { "properties": { "locale": { "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z]{2})?(-[a-zA-Z]{2,3})?$", "type": "string" }, "name": { "type": "string" } }, "type": "object" }, "IssuerDisplayObject": { "type": "array", "items": { "type": "object", "properties": { "locale": { "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z]{2})?(-[a-zA-Z]{2,3})?$", "type": "string" }, "name": { "type": "string" } } } }, "CredentialDisplayObject": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "locale": { "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z]{2})?(-[a-zA-Z]{2,3})?$", "type": "string" }, "background_color": { "type": "string" }, "text_color": { "type": "string" }, "logo": { "properties": { "alt_text": { "type": "string" }, "uri": { "format": "uri", "type": "string" } }, "type": "object" } } } }, "GrantDto": { "properties": { "authorization_code": { "properties": { "issuer_state": { "type": "string" } }, "type": "object" }, "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "properties": { "pre-authorized_code": { "type": "string" }, "tx_code": { "type": "object", "properties": { "input_mode": { "type": "string", "enum": ["numeric", "text"] }, "length": { "type": "number" }, "description": { "type": "string" } } } }, "type": "object" } }, "type": "object" }, "HealthCheck": { "properties": { "database": { "type": "object" }, "disk": { "type": "object" }, "memory": { "type": "object" } }, "required": ["database", "memory", "disk"], "type": "object" }, "InputDescriptor": { "additionalProperties": false, "properties": { "constraints": { "additionalProperties": false, "properties": { "fields": { "items": { "properties": { "filter": { "additionalProperties": true, "description": "http://json-schema.org/draft-07/schema", "type": "object" }, "path": { "example": "[\"$.issuer\", \"$.vc.issuer\", \"$.iss\"]", "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "type": "array" }, "limit_disclosure": { "enum": ["required", "preferred"], "type": "string" } }, "type": "object" }, "format": { "additionalProperties": true, "description": "http://identity.foundation/claim-format-registry/schemas/presentation-definition-claim-format-designations.json", "type": "object" }, "group": { "items": { "type": "string" }, "type": "array" }, "id": { "type": "string" }, "name": { "type": "string" }, "purpose": { "type": "string" } }, "required": ["id", "constraints"], "type": "object" }, "InternalServerError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["internal_server_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidClaimsToDiscloseError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_claims_to_disclose_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidCredentialDataError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_credential_data"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidCredentialOfferUrlError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_credential_offer_url"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidDateFilterValueError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_date_filter_value"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidOrderFilterValueError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_order_filter_value"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPathParamError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_path_param"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPerPageFilterValueError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_per_page_filter_value"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidPresentationRequestUrlError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_presentation_request_url"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidRequestPayloadError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_request_payload"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "TrustedCertificateNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["trusted_certificate_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidTrustedCertificateFormatError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_trusted_certificate_format"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "FailedToLoadCertificateError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["failed_to_load_certificate"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CertificateAlreadyRegistered": { "properties": { "error": { "description": "Unique error identifier", "enum": ["certificate_already_registered"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "JSONWebKey": { "properties": { "crv": { "type": "string" }, "d": { "type": "string" }, "dp": { "type": "string" }, "dq": { "type": "string" }, "e": { "type": "string" }, "k": { "type": "string" }, "kid": { "type": "string" }, "kty": { "type": "string" }, "n": { "type": "string" }, "p": { "type": "string" }, "q": { "type": "string" }, "qi": { "type": "string" }, "x": { "type": "string" }, "y": { "type": "string" } }, "type": "object" }, "JSONWebKeyPub": { "properties": { "alg": { "type": "string" }, "crv": { "type": "string" }, "e": { "type": "string" }, "k": { "type": "string" }, "kid": { "type": "string" }, "kty": { "type": "string" }, "n": { "type": "string" }, "x": { "type": "string" }, "y": { "type": "string" } }, "type": "object" }, "KeyNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["key_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "KeyNotSupportedError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["key_not_supported"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "KeySigningNotSupportedError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["key_signing_not_supported"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "LoadCredentialError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["load_credential_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "LoadCredentialsError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["load_credentials_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "LoadWalletError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["load_wallet_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "NotImplementedError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["not_implemented"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "PatchCredentialError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["patch_credential_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "PresentationDefinition": { "properties": { "id": { "type": "string" }, "input_descriptors": { "items": { "$ref": "#/components/schemas/InputDescriptor" }, "type": "array" }, "submission_requirements": { "items": { "$ref": "#/components/schemas/SubmissionRequirement" }, "type": "array" } }, "required": ["id", "input_descriptors"], "type": "object" }, "PresentationRequestSendRequestModelDto": { "properties": { "authorization_request_uri": { "example": "openid-vc://?request_uri=https://example.com/oidc/presentations/requests/c63aa3e9-dc7d-4753-9ac8-30bf7add6e4c/jwt", "type": "string" }, "protocol_version": { "description": "Specification draft version presentation request uses. If not specified openid4vp-v1 is used.", "type": "string", "enum": ["openid4vp-v1"] } }, "type": "object", "required": ["authorization_request_uri"] }, "AuthorizationRequestsResponseDto": { "type": "object", "properties": { "presentation_states": { "type": "array", "items": { "$ref": "#/components/schemas/AuthorizationRequestResponseDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["presentation_states", "meta"] }, "AuthorizationRequestMetaResponseDto": { "properties": { "submission_status": { "enum": ["pending", "failed", "success"], "type": "string" }, "last_submitted_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "created_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "updated_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" } }, "type": "object" }, "AuthorizationRequestMetaWithRequestResponseDto": { "properties": { "request": { "description": "JWT respresentation of the request following RFC9101 (JAR)", "example": "lsdkjflkdsj..", "type": "string" }, "submission_status": { "enum": ["pending", "failed", "success"], "type": "string" }, "last_submitted_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "created_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "updated_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" } }, "type": "object" }, "AuthorizationRequestResponseDto": { "properties": { "authorization_request_uri": { "example": "openid-vc://?request_uri=https://example.com/oidc/presentations/requests/c63aa3e9-dc7d-4753-9ac8-30bf7add6e4c/jwt", "type": "string" }, "client_id": { "type": "string" }, "meta": { "$ref": "#/components/schemas/AuthorizationRequestMetaWithRequestResponseDto" }, "nonce": { "description": "Nonce provided by the verifier to be returned in the response", "type": "string" }, "selected_credentials": { "type": "array", "items": { "$ref": "#/components/schemas/AuthorizationRequestSelectedCredentialResponseDto" } }, "presentation_definition": { "oneOf": [ { "$ref": "#/components/schemas/PresentationDefinition" }, { "type": "null" } ] }, "dcql_query": { "oneOf": [ { "$ref": "#/components/schemas/DcqlQuery" }, { "type": "null" } ] }, "redirect_uri": { "type": "string" }, "response_mode": { "description": "Parameter to ask the Wallet to send the response to the verifier. Possible values are 'direct_post'", "enum": ["post", "direct_post"], "type": "string" }, "response_type": { "description": "Response type of the request. Possible values are `vp_token`, `id_token`", "enum": ["id_token", "vp_token", "vp_token id_token"], "type": "string" }, "response_uri": { "description": "Response uri of the request. Only relevant if response type is `direct_post`", "type": "string" }, "state": { "example": "e0d7bd1e-dce5-4366-989f-4647af68412a", "type": "string" }, "verifier_state": { "description": "State provided by the verifier to be returned in the response", "type": "string" } }, "type": "object" }, "AuthorizationRequestSelectedCredentialPayloadDto": { "description": "input_descriptor_id OR credential_query_id MUST be present", "properties": { "input_descriptor_id": { "type": "string" }, "credential_query_id": { "type": "string" }, "credential": { "properties": { "claims_to_disclose": { "description": "List of claims to disclose when presenting the credential. When a claim is nested, use object notation.\n\nExamples: `given_name`, `address.street` or `nationality.country[0]`\n", "items": { "type": "string" }, "type": "array" }, "id": { "type": "string" }, "kid": { "description": "Key to use for signing the presentation of the credential. If no key is specified, the key linked to the credential is used. If no key is linked to the credential, no signature is added to the presentation.", "type": "string" } }, "required": ["id", "kid"], "type": "object" } }, "required": ["credential"], "type": "object" }, "PresentationRequestSetCredentialsRequestModelDto": { "properties": { "credentials": { "items": { "$ref": "#/components/schemas/AuthorizationRequestSelectedCredentialPayloadDto" }, "type": "array" }, "state": { "type": "string" } }, "required": ["state", "credentials"], "type": "object" }, "AuthorizationRequestSelectedCredentialResponseDto": { "type": "object", "properties": { "input_descriptor_id": { "type": "string" }, "credential_query_id": { "type": "string" }, "credential": { "type": "object", "properties": { "claims_to_disclose": { "description": "List of claims to disclose when presenting the credential. When a claim is nested, use object notation.\n\nExamples: `given_name`, `address.street` or `nationality.country[0]`\n", "items": { "type": "string" }, "type": "array" }, "id": { "type": "string" }, "kid": { "description": "Key to use for signing the presentation of the credential. If no key is specified, the key linked to the credential is used. If no key is linked to the credential, no signature is added to the presentation.", "type": "string" } } } } }, "PresentationRequestSetCredentialsResponseModelDto": { "properties": { "credentials": { "type": "array", "items": { "$ref": "#/components/schemas/AuthorizationRequestSelectedCredentialResponseDto" } }, "meta": { "$ref": "#/components/schemas/AuthorizationRequestMetaResponseDto" }, "presentation_definition": { "oneOf": [ { "$ref": "#/components/schemas/PresentationDefinition" }, { "type": "null" } ] }, "dcql_query": { "oneOf": [ { "$ref": "#/components/schemas/DcqlQuery" }, { "type": "null" } ] }, "state": { "type": "string" } }, "required": [ "state", "credentials", "presentation_definition", "dcql_query", "meta" ], "type": "object" }, "PresentationRequestSubmitRequestModelDto": { "properties": { "client_id": { "type": "string" }, "credentials": { "items": { "$ref": "#/components/schemas/AuthorizationRequestSelectedCredentialPayloadDto" }, "type": "array" }, "nonce": { "description": "Nonce provided by the verifier to be returned in the response", "type": "string" }, "presentation_definition": { "$ref": "#/components/schemas/PresentationDefinition" }, "dcql_query": { "$ref": "#/components/schemas/DcqlQuery" }, "redirect_uri": { "type": "string" }, "response_mode": { "description": "Parameter to ask the Wallet to send the response to the verifier. Possible values are 'direct_post', 'post'.", "enum": ["direct_post", "post"], "type": "string" }, "response_type": { "description": "Response type of the request. Possible values are `vp_token`, `id_token`", "enum": ["vp_token", "vp_token id_token", "id_token"], "type": "string" }, "response_uri": { "description": "Response uri of the request. Only relevant if response type is `direct_post`", "type": "string" }, "state": { "type": "string" }, "verifier_state": { "description": "State provided by the verifier to be returned in the response", "type": "string" } }, "required": ["state"], "type": "object" }, "PresentationRequestSubmitResponseModelDto": { "properties": { "meta": { "$ref": "#/components/schemas/AuthorizationRequestMetaResponseDto" }, "redirect_uri": { "description": "Redirect URI to follow on the frontend.\n\nIn case of response_mode `fragment`, this contains the Authorization Response attributes and this is how they are passed to the verifier.\n\nIn case of response_mode `direct_post`, this is the URI that was returned after successfully posting the Authorization Response to the `response_uri` of the verifier.\n", "type": "string" }, "state": { "type": "string" } }, "type": "object" }, "Redis": { "properties": { "host": { "type": "string" }, "port": { "type": "string" }, "db": { "type": "string" }, "tlsEnabled": { "type": "boolean" } }, "required": ["host", "port", "db", "tlsEnabled"], "type": "object" }, "RegisterWalletError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["register_wallet_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "StatusDto": { "properties": { "app": { "$ref": "#/components/schemas/App" }, "appsignal": { "$ref": "#/components/schemas/AppSignal" }, "database": { "$ref": "#/components/schemas/Database" }, "redis": { "$ref": "#/components/schemas/Redis" }, "healthCheck": { "$ref": "#/components/schemas/HealthCheck" } }, "required": ["app", "appsignal", "database", "redis", "healthCheck"], "type": "object" }, "SubmissionRequirement": { "oneOf": [ { "additionalProperties": false, "properties": { "count": { "minimum": 1, "type": "integer" }, "from": { "type": "string" }, "name": { "type": "string" }, "rule": { "enum": ["pick"], "type": "string" } }, "required": ["rule", "from"] } ], "type": "object" }, "VerifyCredentialError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["verify_credential_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "VersionDto": { "properties": { "component": { "$ref": "#/components/schemas/Component" } }, "required": ["component"], "type": "object" }, "SvxVerifySessionCountsResponseDto": { "properties": { "svx_verify_session_metrics": { "$ref": "#/components/schemas/SvxVerifySessionCountsResponseModelDto" } }, "required": ["svx_verify_session_metrics"], "type": "object" }, "SvxVerifySessionCountsResponseModelDto": { "properties": { "sessions_created_total": { "type": "integer" }, "sessions_pending": { "type": "integer" }, "sessions_verified_total": { "type": "integer" }, "sessions_failed_total": { "type": "integer" } }, "required": [ "sessions_created_total", "sessions_pending", "sessions_verified_total", "sessions_failed_total" ], "type": "object" }, "WalletCountsResponseDto": { "properties": { "wallet_metrics": { "$ref": "#/components/schemas/WalletCountsResponseModelDto" } }, "required": ["wallet_metrics"], "type": "object" }, "WalletCountsResponseModelDto": { "properties": { "all_wallets": { "type": "number" }, "non_empty_wallets": { "type": "number" } }, "required": ["all_wallets", "non_empty_wallets"], "type": "object" }, "WalletDIDDto": { "properties": { "id": { "type": "string" }, "keys": { "items": { "properties": { "kid": { "type": "string" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "WalletNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["wallet_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "WalletResponseDto": { "properties": { "wallet": { "$ref": "#/components/schemas/WalletResponseModelDto" } }, "required": ["wallet"], "type": "object" }, "WalletResponseModelDto": { "properties": { "dids": { "items": { "$ref": "#/components/schemas/WalletDIDDto" }, "type": "array" }, "external_reference": { "example": "external-reference-param-value", "type": "string" }, "id": { "example": "da3be97a-1c30-498e-9a2f-12acd5e3962b", "type": "string" }, "keys": { "items": { "$ref": "#/components/schemas/JSONWebKeyPub" }, "type": "array" } }, "required": ["id", "external_reference", "keys", "dids"], "type": "object" }, "AuthorizationRequestNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["authorization_request_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DeleteReceiveStateError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["delete_presentation_state_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "DeletePresentationStateError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["delete_presentation_state_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CertificateSubjectDto": { "type": "object", "properties": { "common_name": { "type": "string" }, "country": { "type": "string" }, "state": { "type": "string" }, "locality": { "type": "string" }, "organization": { "type": "string" }, "organizational_unit": { "type": "string" } }, "required": ["common_name"] }, "CreateCsrRequestDto": { "type": "object", "properties": { "key_name": { "type": "string", "description": "Managed signing key identifier", "enum": [ "AccessTokenKey", "CredentialKey", "PresentationRequestKey", "AdminSigningKey" ] }, "subject": { "$ref": "#/components/schemas/CertificateSubjectDto" }, "issuer_alternative_name_url": { "type": "array", "items": { "type": "string" } } }, "required": ["key_name", "subject"] }, "ImportCertificateRequestDto": { "type": "object", "properties": { "x5c": { "type": "array", "minItems": 1, "description": "Certificate chain in DER base64 format.\n- With `key_name`, provide at least the leaf certificate (full chain is accepted and stored).\n- Without `key_name`, exactly one certificate is required.\n", "items": { "type": "string" } }, "key_name": { "type": "string", "description": "Optional managed signing key name. When present, imports as `managed`." } }, "required": ["x5c"] }, "CsrResponseDto": { "type": "object", "properties": { "csr": { "type": "object", "properties": { "key_name": { "type": "string" }, "csr_pem": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" } }, "required": ["key_name", "csr_pem", "created_at"] } }, "required": ["csr"] }, "CertificateModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": ["trust_anchor", "managed"] }, "key_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "x5c": { "type": "array", "minItems": 1, "items": { "type": "string" } }, "fingerprint256": { "description": "Present for `trust_anchor`; `null` for `managed`.", "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "created_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "type", "key_name", "x5c", "fingerprint256", "created_at" ] }, "CertificateResponseDto": { "type": "object", "properties": { "certificate": { "$ref": "#/components/schemas/CertificateModelDto" } }, "required": ["certificate"] }, "CertificatesResponseDto": { "type": "object", "properties": { "certificates": { "type": "array", "items": { "$ref": "#/components/schemas/CertificateModelDto" } } }, "required": ["certificates"] }, "Meta": { "type": "object", "properties": { "order_by": { "type": "string", "example": "name" }, "order": { "type": "string", "example": "ASC", "enum": ["ASC", "DESC"] }, "order_from_params": { "type": "boolean", "example": true }, "per_page": { "type": "number", "example": 10 }, "per_page_from_params": { "type": "boolean", "example": true }, "records_count": { "type": "number", "example": 100 }, "page": { "type": "number", "example": 1 }, "page_count": { "type": "number", "example": 10 } }, "required": [ "order_by", "order", "order_from_params", "per_page", "per_page_from_params", "records_count", "page", "page_count" ] }, "OpenIdVCIStateMeta": { "type": "object", "properties": { "created_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" }, "updated_at": { "example": "2024-01-09T12:00:00Z", "format": "date-time", "type": "string" } } }, "VerificationCheckResponseDto": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "extra_info": { "type": "object", "additionalProperties": true } }, "required": ["error", "message", "extra_info"] }, "CredentialVerificationResultDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "checks": { "type": "array", "items": { "type": "string" } }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } } }, "required": ["id", "checks", "warnings", "errors"] }, "PresentationVerificationResultDto": { "type": "object", "properties": { "checks": { "type": "array", "items": { "type": "string", "enum": ["format", "signature", "expiration", "nonce"] } }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "credentials": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialVerificationResultDto" } } }, "required": ["checks", "warnings", "errors", "credentials"] }, "IdTokenVerificationResultResponseDto": { "type": "object", "properties": { "checks": { "type": "array", "items": { "type": "string", "enum": ["format", "signature", "expiration", "nonce"] } }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } } }, "required": ["checks", "warnings", "errors"] }, "PresentationRequestResponseVerificationResultResponseDto": { "type": "object", "properties": { "checks": { "type": "array", "items": { "type": "string", "enum": ["format", "pex_constraints", "dcql_query"] } }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationCheckResponseDto" } }, "id_token": { "$ref": "#/components/schemas/IdTokenVerificationResultResponseDto" }, "vp_token": { "type": "array", "items": { "$ref": "#/components/schemas/PresentationVerificationResultDto" } } }, "required": ["checks", "warnings", "errors", "id_token", "vp_token"] }, "PresentationRequestModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "description": "Display name of the presentation request.", "example": "Employee ID check" }, "presentation_definition": { "oneOf": [ { "$ref": "#/components/schemas/PresentationDefinition" }, { "type": "null" } ] }, "dcql_query": { "oneOf": [ { "$ref": "#/components/schemas/DCQLQueryPayload" }, { "type": "null" } ] }, "status": { "type": "string", "enum": ["pending", "failed", "completed"] }, "response_type": { "type": "string", "enum": ["vp_token", "vp_token id_token"] }, "response_mode": { "type": "string", "enum": ["direct_post", "direct_post.jwt", "dc_api", "dc_api.jwt"] }, "state": { "type": ["string", "null"] }, "nonce": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "verifier_redirect_uri": { "type": ["string", "null"], "format": "uri" }, "expected_origins": { "type": ["array", "null"], "items": { "type": "string" } }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "name", "presentation_definition", "dcql_query", "status", "response_type", "response_mode", "state", "nonce", "expires_at", "verifier_redirect_uri", "expected_origins", "created_at", "updated_at" ] }, "PresentationRequestResponseDto": { "type": "object", "properties": { "presentation_request": { "$ref": "#/components/schemas/PresentationRequestModelDto" } }, "required": ["presentation_request"] }, "PaginatedPresentationRequestsResponseDto": { "type": "object", "properties": { "presentation_requests": { "type": "array", "items": { "$ref": "#/components/schemas/PresentationRequestModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["presentation_requests", "meta"] }, "PresentationResponseModelDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "presentation_request_id": { "type": ["string", "null"], "format": "uuid" }, "vp_token": { "type": ["string", "null"] }, "presentation_submission": { "type": ["object", "null"], "additionalProperties": true }, "verification_result": { "$ref": "#/components/schemas/PresentationRequestResponseVerificationResultResponseDto" }, "last_verified_at": { "type": "string", "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "presentation_request_id", "vp_token", "presentation_submission", "verification_result", "last_verified_at", "created_at" ] }, "PresentationResponseResponseDto": { "type": "object", "properties": { "presentation_response": { "$ref": "#/components/schemas/PresentationResponseModelDto" } }, "required": ["presentation_response"] }, "PaginatedPresentationResponsesResponseDto": { "type": "object", "properties": { "presentation_responses": { "type": "array", "items": { "$ref": "#/components/schemas/PresentationResponseModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["presentation_responses", "meta"] }, "CreatePresentationRequestPayloadDto": { "type": "object", "properties": { "name": { "description": "Optional custom name for the presentation request. If omitted, the presentation template name is used.", "type": "string", "example": "Employee ID check" }, "presentation_template_id": { "description": "Identifier of the presentation template to use for the request.", "type": "string", "example": "my-presentation-template" }, "response_mode": { "description": "Determines how the wallet submits the authorization response.", "type": "string", "enum": ["direct_post", "direct_post.jwt", "dc_api", "dc_api.jwt"] }, "verifier_redirect_uri": { "description": "URI to redirect to after the wallet submits the authorization response.", "type": "string", "example": "https://verifier.example.com/callback" }, "expected_origins": { "description": "List of expected origins for the Digital Credentials API response. At least one origin must be provided when specified.", "type": "array", "items": { "type": "string", "maxLength": 255 }, "minItems": 1, "example": ["https://verifier.example.com"] } }, "required": ["presentation_template_id"] }, "CreatePresentationRequestResponseDto": { "type": "object", "properties": { "id": { "description": "Unique identifier of the created presentation request.", "type": "string", "format": "uuid", "example": "c63aa3e9-dc7d-4753-9ac8-30bf7add6e4c" }, "authorization_uri": { "description": "The authorization URI for the wallet to initiate the presentation flow.", "type": "string", "example": "openid4vp://authorize?client_id=...&request_uri=https://example.com/verifier/requests/c63aa3e9/jwt" }, "jwt": { "description": "The signed JWT representation of the presentation request.", "type": "string" } }, "required": ["id", "authorization_uri", "jwt"] }, "SubmitAuthorizationResponsePayloadDto": { "type": "object", "description": "Exactly one of `vp_token` or `response` must be provided.\nUse `vp_token` with `direct_post` response mode.\nUse `response` (JWE) with `direct_post.jwt` response mode.\n", "properties": { "vp_token": { "description": "The Verifiable Presentation token. Required when `response_mode` is `direct_post`.", "type": "string" }, "response": { "description": "The JWE-encrypted authorization response. Required when `response_mode` is `direct_post.jwt`.", "type": "string" }, "presentation_submission": { "description": "JSON string containing the presentation submission mapping between requested credentials and the VP token.", "type": "string" }, "state": { "description": "Opaque state value from the original presentation request.", "type": "string" } } }, "SubmitAuthorizationResponseResponseDto": { "type": "object", "properties": { "redirect_uri": { "description": "The verifier redirect URI to follow after submission, if configured in the original presentation request.", "type": "string", "example": "https://verifier.example.com/callback?session=abc123" } } }, "PresentationRequestNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "PresentationResponseNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "InvalidRequestError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_request"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CreateSvxVerifySessionPayloadDto": { "properties": { "return_url": { "description": "URI to return to when the verification flow exits or is aborted.", "type": "string", "format": "uri", "example": "meeco://verify/return" }, "success_url": { "description": "URI to return to after a successful verification flow.", "type": "string", "format": "uri", "example": "meeco://verify/success" }, "presentation_template_id": { "description": "Whitelisted presentation template identifier to use for this session.", "type": "string", "format": "uuid", "example": "43345678-1234-4234-a234-123456789012" } }, "required": ["return_url", "success_url", "presentation_template_id"], "type": "object" }, "CreateSvxVerifySessionResponseDto": { "properties": { "id": { "description": "Created session identifier.", "type": "string", "format": "uuid", "example": "7dcfa413-bff0-4f62-a51a-ab9959623332" }, "url": { "description": "Verification URL for the browser-based verification flow.", "type": "string", "format": "uri", "example": "https://wallet.example.com/verify/verification/7dcfa413-bff0-4f62-a51a-ab9959623332" } }, "required": ["id", "url"], "type": "object" }, "GetSvxVerifySessionResponseDto": { "properties": { "session_id": { "description": "SVX Verify session identifier.", "type": "string", "format": "uuid", "example": "7dcfa413-bff0-4f62-a51a-ab9959623332" }, "status": { "description": "Current verification status for the session.", "type": "string", "enum": ["idle", "pending", "verified", "failed"] }, "verified_claims": { "description": "Claims verified from the presentation response, keyed by claim name.", "type": "object", "additionalProperties": true }, "error": { "description": "Error code recorded against the session when verification fails.", "type": ["string", "null"] }, "error_description": { "description": "Human-readable description of the recorded session error.", "type": ["string", "null"] } }, "required": ["session_id", "status", "verified_claims"], "type": "object" }, "SvxVerifySessionModelDto": { "properties": { "id": { "description": "SVX Verify session identifier.", "type": "string", "format": "uuid", "example": "7dcfa413-bff0-4f62-a51a-ab9959623332" }, "submission_status": { "description": "Current submission status recorded against the session.", "type": "string", "enum": ["verified", "pending", "failed"] }, "step": { "description": "Current step of the verification flow.", "type": "string", "enum": ["idle", "index", "share", "complete", "error", "aborted"] }, "presentation_template_id": { "description": "Presentation template identifier used for the session.", "type": "string", "format": "uuid" }, "created_at": { "description": "Timestamp the session was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "Timestamp the session was last updated.", "type": "string", "format": "date-time" }, "expires_at": { "description": "Timestamp the session expires.", "type": "string", "format": "date-time" }, "error_code": { "description": "Error code recorded against the session when verification fails.", "type": ["string", "null"] }, "error_description": { "description": "Human-readable description of the recorded session error.", "type": ["string", "null"] }, "verified_claims": { "description": "Claims verified from the presentation response, keyed by claim name.", "type": "object", "additionalProperties": true } }, "required": [ "id", "submission_status", "step", "presentation_template_id", "created_at", "updated_at", "expires_at", "error_code", "error_description", "verified_claims" ], "type": "object" }, "PaginatedSvxVerifySessionsResponseDto": { "type": "object", "properties": { "sessions": { "type": "array", "items": { "$ref": "#/components/schemas/SvxVerifySessionModelDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["sessions", "meta"] }, "SvxVerifyPresentationStatusResponseDto": { "properties": { "id": { "description": "SVX Verify session identifier.", "type": "string", "format": "uuid", "example": "7dcfa413-bff0-4f62-a51a-ab9959623332" }, "status": { "description": "Current state of the presentation request processing.", "type": "string", "enum": ["pending", "pending-loaded", "completed"] }, "error": { "description": "Error code returned while the request is still pending.", "type": ["string", "null"] }, "error_description": { "description": "Human-readable description for the current error, when present.", "type": ["string", "null"] } }, "required": ["id", "status", "error", "error_description"], "type": "object" }, "ForbiddenError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["forbidden"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "SessionNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["session_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "SessionExpiredError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["session_expired"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CreateSessionError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["create_session_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "GetSessionError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["get_session_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "ListSessionsError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["list_sessions_error"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "SvxVerifyPresentationRequestNotFoundError": { "properties": { "error": { "description": "Unique error identifier", "enum": ["presentation_request_not_found"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"], "type": "object" }, "CredentialOfferRequest": { "properties": { "claims": { "description": "Claims to be included in the issued verifiable credential", "properties": {}, "type": "object" }, "credential_configuration_ids": { "description": "Credential configuration identifiers to include in the offer.", "items": { "type": "string" }, "type": "array" }, "grants": { "properties": { "authorization_code": { "properties": { "issuer_state": { "type": "string" } }, "type": "object" }, "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "properties": { "pre-authorized_code": { "type": "string" }, "tx_code": { "type": "object", "description": "parameter to specify if tx_code will be required when using the pre-authorized_code to claim the credential offer.\n\nIf not provided, tx_code will not be required.\nIf empty object {} is set, tx_code will be required.\n", "properties": { "length": { "type": "number", "description": "specify the length of the tx_code.\nIn general tx_code will be sent separately of the credential offer and will require manual input, so a large value is not advised.\n" } } } }, "type": "object" } }, "type": "object" }, "user_id": { "description": "user_id sent to the external resource server via resource hook", "type": "string" } }, "type": "object", "required": ["credential_configuration_ids", "grants"] }, "CredentialOfferResponse": { "properties": { "credential_offer_uri": { "type": "string", "description": "credential offer URI\n" }, "tx_code": { "type": "string", "description": "randomly generated code that will be required when claiming the credential offer\n" } }, "type": "object" }, "InvalidCredentialOfferPayload": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_create_credential_offer_payload"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"] }, "InvalidCredentialOfferClaims": { "properties": { "error": { "description": "Unique error identifier", "enum": ["invalid_create_credential_offer_claims"], "type": "string" }, "extra_info": { "description": "Object that may contain more information about the error", "type": "object" }, "message": { "description": "User friendly error message", "type": "string" } }, "required": ["error", "message", "extra_info"] }, "IssuerCredentialResponseDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, "credential": { "type": "string", "description": "The issued credential. For `jwt_vc_json` and `dc+sd-jwt` formats this is a compact JWT string. For `mso_mdoc` it is a base64url-encoded CBOR-encoded IssuerSigned structure.", "example": "eyJhbGciOiJFUzI1NiJ9..." }, "format": { "type": "string", "enum": ["jwt_vc_json", "dc+sd-jwt", "mso_mdoc"], "example": "jwt_vc_json" }, "credential_configuration_id": { "type": "string", "example": "EmailCredential_jwt_vc_json" }, "holder_binding": { "oneOf": [ { "type": "object", "description": "JWK holder binding", "required": ["jwk"], "properties": { "jwk": { "type": "object", "description": "JSON Web Key representing the holder's public key", "additionalProperties": true } } }, { "type": "object", "description": "DID holder binding", "required": ["did"], "properties": { "did": { "type": "string", "example": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK" } } }, { "type": "null" } ] }, "created_at": { "type": "string", "format": "date-time", "example": "2026-03-03T00:00:00.000Z" } }, "required": [ "id", "credential", "format", "credential_configuration_id", "created_at" ] }, "IssuerCredentialsResponseDto": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "$ref": "#/components/schemas/IssuerCredentialResponseDto" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": ["credentials", "meta"] }, "PaginationMeta": { "type": "object", "properties": { "page": { "type": "integer", "example": 1 }, "per_page": { "type": "integer", "example": 10 }, "page_count": { "type": "integer", "example": 5 }, "records_count": { "type": "integer", "example": 42 }, "order": { "type": "string", "enum": ["ASC", "DESC"], "example": "DESC" }, "order_by": { "type": "string", "example": "created_at" }, "order_from_params": { "type": "boolean" }, "per_page_from_params": { "type": "boolean" } }, "required": [ "page", "per_page", "page_count", "records_count", "order", "order_by", "order_from_params", "per_page_from_params" ] }, "UpdateIssuerCredentialPayloadDto": { "type": "object", "description": "Reserved for future use. Payload for updating an issued credential (e.g. status list revocation).", "properties": { "issuer_credential": { "type": "object", "properties": { "status": { "type": "string", "description": "Credential status update (e.g. revocation)", "example": "revoked" } } } } }, "IssuerCredentialNotFoundError": { "type": "object", "properties": { "error": { "type": "string", "enum": ["issuer_credential_not_found"], "example": "issuer_credential_not_found" }, "message": { "type": "string", "example": "Issuer credential not found" } }, "required": ["error", "message"] }, "AttestationChallengeResponseModelDto": { "type": "object", "properties": { "attestation_challenge": { "type": "string" } }, "required": ["attestation_challenge"] }, "OAuthErrorResponse": { "type": "object", "required": ["error", "error_description"], "properties": { "error": { "type": "string", "description": "A machine-readable error code.", "examples": ["invalid_request"] }, "error_description": { "type": "string", "description": "A human-readable description of the error providing additional information about the error.", "examples": ["invalid pre-authorized_code"] }, "error_uri": { "type": "string", "format": "uri", "description": "A URI identifying a human-readable web page with information about the error.", "examples": ["https://example.com/errors/error_name"] } } }, "SlowDownError": { "allOf": [ { "$ref": "#/components/schemas/OAuthErrorResponse" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["slow_down"], "examples": ["slow_down"] }, "error_description": { "type": "string", "description": "A variant of authorization_pending error code, the authorization request is still pending and polling should continue, but the interval MUST be increased by 5 seconds for this and all subsequent requests.\n", "examples": [""] } } } ] }, "ServerErrorError": { "allOf": [ { "$ref": "#/components/schemas/OAuthErrorResponse" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["server_error"], "examples": ["server_error"] }, "error_description": { "type": "string", "description": "Server error.\n", "examples": ["Something went wrong..."] } } } ] }, "TemporarilyUnavailableError": { "allOf": [ { "$ref": "#/components/schemas/OAuthErrorResponse" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["temporarily_unavailable"], "examples": ["temporarily_unavailable"] }, "error_description": { "type": "string", "description": "The server is undergoing maintenance, or is otherwise unavailable.\n", "examples": [""] } } } ] }, "WellKnownJwtIssuerResponse": { "properties": { "issuer": { "type": "string" }, "jwks": { "properties": { "keys": { "items": { "type": "object", "description": "JSON Web Key representing the credential issuer's public key" }, "type": "array" } }, "type": "object" } }, "type": "object" }, "OpenidConfigResponse": { "properties": { "authorization_endpoint": { "type": "string" }, "authorization_response_iss_parameter_supported": { "type": "boolean" }, "authorization_signing_alg_values_supported": { "items": { "type": "string" }, "type": "array" }, "claim_types_supported": { "items": { "type": "string" }, "type": "array" }, "claims_supported": { "items": { "type": "string" }, "type": "array" }, "code_challenge_methods_supported": { "items": { "type": "string" }, "type": "array" }, "grant_types_supported": { "items": { "type": "string" }, "type": "array" }, "id_token_signing_alg_values_supported": { "items": { "type": "string" }, "type": "array" }, "issuer": { "type": "string" }, "jwks_uri": { "type": "string" }, "pushed_authorization_request_endpoint": { "type": "string" }, "request_object_signing_alg_values_supported": { "items": { "type": "string" }, "type": "array" }, "request_parameter_supported": { "type": "boolean" }, "request_uri_parameter_supported": { "type": "boolean" }, "response_modes_supported": { "items": { "type": "string" }, "type": "array" }, "response_types_supported": { "items": { "type": "string" }, "type": "array" }, "scopes_supported": { "items": { "type": "string" }, "type": "array" }, "subject_types_supported": { "items": { "type": "string" }, "type": "array" }, "token_endpoint": { "type": "string" }, "token_endpoint_auth_methods_supported": { "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "WellKnownOpenidCredentialIssuerResponse": { "properties": { "authorization_servers": { "items": { "description": "identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization", "type": "string" }, "type": "array" }, "batch_credential_issuance": { "properties": { "batch_size": { "type": "integer" } }, "type": "object" }, "credential_configurations_supported": { "items": { "$ref": "#/components/schemas/CredentialConfigurationsProperty" }, "type": "array" }, "credential_endpoint": { "type": "string" }, "credential_issuer": { "type": "string" }, "display": { "items": { "$ref": "#/components/schemas/DisplayName" }, "type": "array" }, "nonce_endpoint": { "type": "string", "description": "nonce_endpoint is only present if `issuer.issuance_policy.nonce_required` is configured to true.\n\nIf present the `nonce` must be used in the proof sent during credential issuance.\n" } }, "type": "object" }, "CredentialConfigurationsProperty": { "type": "object", "properties": { "credential_metadata": { "type": "object", "properties": { "claims": { "$ref": "#/components/schemas/CredentialConfigurationClaims" }, "display": { "items": { "$ref": "#/components/schemas/DisplayName" }, "type": "array" } } }, "credential_definition": { "description": "Object containing the detailed description of the Credential type. Specific for `jwt_vc_json`\n", "type": "object", "properties": { "type": { "type": "array", "items": { "type": "string" } } } }, "vct": { "type": "string", "description": "credential type identifier specific for `dc+sd-jwt`\n" }, "doctype": { "type": "string", "description": "document (credential type) identifier specific for `mso_mdoc`\n" }, "cryptographic_binding_methods_supported": { "items": { "type": "string", "examples": ["cose_key"] }, "type": "array" }, "credential_signing_alg_values_supported": { "items": { "type": "string" }, "type": "array", "description": "numeric alg values supported for COSE. Relevant for `mso_mdoc`\n" }, "format": { "type": "string", "examples": ["dc+sd-jwt", "jwt_vc_json", "mso_mdoc"] }, "proof_types_supported": { "properties": { "jwt": { "properties": { "proof_signing_alg_values_supported": { "items": { "type": "string", "examples": ["ES256", "EdDSA"] }, "type": "array" }, "key_attestations_required": { "type": "object", "example": {}, "description": "an object even empty signifies that key attestation is required.\n" } }, "type": "object" }, "attestation": { "type": "object", "properties": { "proof_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": ["ES256", "EdDSA"] } }, "key_attestations_required": { "type": "object", "example": {}, "description": "an object even empty signifies that key attestation is required.\n" } } } }, "type": "object" }, "scope": { "type": "string" } } }, "CredentialConfigurationClaims": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "array", "description": "JSONPath-like segments; each entry can be string, number, or null.", "items": {} }, "mandatory": { "type": "boolean" }, "display": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "locale": { "type": "string" } } } } }, "required": ["path"] } }, "DisplayName": { "properties": { "name": { "type": "string" }, "locale": { "type": "string" } }, "type": "object" }, "SelectIDRPConfigResponse": { "properties": { "issuer": { "type": "string" }, "redirect_uris": { "type": "array", "items": { "type": "string" } }, "client_name": { "type": "string" }, "client_uri": { "type": "string" }, "logo_uri": { "type": "string" }, "jwks_uri": { "type": "string" }, "resume_uri": { "type": "string" } } }, "InvalidClientError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_client"], "examples": ["invalid_client"] }, "error_description": { "type": "string", "description": "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).\n", "examples": [ "Token verification failed. Invalid client_id = '___'" ] } } } ] }, "UnauthorizedClientError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["unauthorized_client"], "examples": ["unauthorized_client"] }, "error_description": { "type": "string", "description": "The authenticated client is not authorized to use this authorization grant type.\n", "examples": [ "Grant type 'client_credentials ' not allowed for the client." ] } } } ] }, "UnsupportedGrantTypeError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["unsupported_grant_type"], "examples": ["unsupported_grant_type"] }, "error_description": { "type": "string", "description": "The authorization grant type is not supported by the authorization server.\n", "examples": ["unsupported grant_type requested"] } } } ] }, "InvalidScopeError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_scope"], "examples": ["invalid_scope"] }, "error_description": { "type": "string", "description": "The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner.\n", "examples": ["requested scope is not allowed"] } } } ] }, "InvalidGrantError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_grant"], "examples": ["invalid_grant"] }, "error_description": { "type": "string", "description": "The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.\n", "examples": ["invalid pre-authorized_code"] } } } ] }, "AuthorizationPendingError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["authorization_pending"], "examples": ["authorization_pending"] }, "error_description": { "type": "string", "description": "This error code is used if the Authorization Server is waiting for an End-User interaction or a downstream process to complete. The Wallet SHOULD repeat the access token request to the token endpoint (a process known as polling). Before each new request, the Wallet MUST wait at least the number of seconds specified by the interval claim of the Credential Offer (see Section 4.1.1) or the authorization response (see Section 5.2), or 5 seconds if none was provided, and respect any increase in the polling interval required by the \"slow_down\" error.\n", "examples": [""] } } } ] }, "InvalidCredentialRequestError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_credential_request"], "examples": ["invalid_credential_request"] }, "error_description": { "type": "string", "description": "The Credential Request is missing a required parameter, includes an unsupported parameter or parameter value, repeats the same parameter, or is otherwise malformed.\n", "examples": [""] } } } ] }, "UnsupportedCredentialTemplateError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["unsupported_credential_template"], "examples": ["unsupported_credential_template"] }, "error_description": { "type": "string", "description": "Requested credential template is not supported\n", "examples": [""] } } } ] }, "UnsupportedCredentialFormatError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["unsupported_credential_format"], "examples": ["unsupported_credential_format"] }, "error_description": { "type": "string", "description": "Requested Credential format is not supported.\n", "examples": [ "Requested Credential format 'mso_mdoc' is not supported" ] } } } ] }, "InvalidProofError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_proof"], "examples": ["invalid_proof"] }, "error_description": { "type": "string", "description": "The proof in the Credential Request is invalid. The proof field is not present or the provided key proof is invalid or not bound to a nonce provided by the Credential Issuer.\n", "examples": [""] } } } ] }, "InvalidEncryptionParametersError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_encryption_parameters"], "examples": ["invalid_encryption_parameters"] }, "error_description": { "type": "string", "description": "This error occurs when the encryption parameters in the Credential Request are either invalid or missing. In the latter case, it indicates that the Credential Issuer requires the Credential Response to be sent encrypted, but the Credential Request does not contain the necessary encryption parameters.\n", "examples": [""] } } } ] }, "AccessDeniedError": { "allOf": [ { "$ref": "#/components/schemas/Error" }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["access_denied"], "examples": ["access_denied"] }, "error_description": { "type": "string", "description": "The user or authorization server denied the request.\n", "examples": [""] } } } ] }, "Error": { "type": "object", "required": ["error", "error_description"], "properties": { "error": { "type": "string", "description": "A machine-readable error code.", "examples": ["invalid_request"] }, "error_description": { "type": "string", "description": "A human-readable description of the error providing additional information about the error.", "examples": ["invalid pre-authorized_code"] }, "error_uri": { "type": "string", "format": "uri", "description": "A URI identifying a human-readable web page with information about the error.", "examples": ["https://example.com/errors/error_name"] } } }, "TokenRequestModelDto": { "type": "object", "required": ["grant_type"], "properties": { "grant_type": { "type": "string", "description": "The type of grant being requested.", "enum": [ "urn:ietf:params:oauth:grant-type:pre-authorized_code", "authorization_code" ] }, "pre-authorized_code": { "type": "string", "description": "The pre-authorized code from the credential offer. Required when grant_type is `urn:ietf:params:oauth:grant-type:pre-authorized_code`." }, "tx_code": { "type": "string", "description": "Transaction code. Required if a `tx_code` object was present in the credential offer. The transaction code itself should be sent via a separate channel." }, "code": { "type": "string", "description": "Authorization code. Required when grant_type is `authorization_code`." }, "redirect_uri": { "type": "string", "description": "Required when grant_type is `authorization_code`." }, "code_verifier": { "type": "string", "description": "PKCE code verifier. Used with `authorization_code` grant type." }, "client_id": { "type": "string", "description": "Client identifier. Optional for pre-authorized code flow when client authentication is not required." }, "client_secret": { "type": "string", "description": "Client secret for `client_secret_post` authentication." }, "client_assertion": { "type": "string", "description": "Client assertion JWT for `private_key_jwt` authentication." }, "client_assertion_type": { "type": "string", "description": "Type of client assertion.", "enum": ["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"] } } }, "TokenResponseModelDto": { "type": "object", "required": ["access_token", "token_type", "expires_in"], "properties": { "access_token": { "type": "string", "description": "The access token issued by the authorization server." }, "token_type": { "type": "string", "description": "The type of the token issued.", "examples": ["DPoP", "Bearer"] }, "expires_in": { "type": "integer", "description": "The lifetime in seconds of the access token.", "examples": [3600] } } }, "AdhocCredentialIssuanceRequest": { "type": "object", "required": ["credential_configuration_id", "claims"], "properties": { "credential_configuration_id": { "type": "string", "description": "ID of the credential configuration to use for issuance.", "examples": ["EmailCredential_jwt_vc_json"] }, "claims": { "type": "object", "additionalProperties": true, "description": "Claims to include in the issued credential.", "example": { "first_name": "John", "family_name": "Doe" } }, "binding_keys": { "type": "array", "description": "Array of JSON Web Keys (JWK). One credential will be issued per key. If omitted, a single credential without holder binding is issued. Server enforces a maximum array size via `credential_issuer.max_batch_credential_issuance_size` (configured per deployment, minimum 2).\n", "minItems": 1, "items": { "type": "object", "additionalProperties": true, "description": "A JSON Web Key (RFC 7517).", "example": { "kty": "EC", "crv": "P-256", "x": "MKBidNIKdTTheDivDI4eK4GhCzI0FIaK7ZT+eTor3JQ", "y": "4cFgTSGUO7GLazVfVTwXhSUnWjTZARKsBd-zo9dTNqg" } } }, "signing_kid": { "type": "string", "description": "Optional key ID for the signing key to use. If omitted, the configured organisation wallet key is used." } } }, "CredentialRequest": { "type": "object", "required": ["credential_configuration_id", "proofs"], "properties": { "credential_configuration_id": { "type": "string", "description": "Identifier of the credential configuration to issue.", "examples": ["EmailCredential_jwt_vc_json"] }, "proofs": { "type": "object", "description": "Key proof(s) for holder binding. At least one of `jwt` or `attestation` must be provided. The server rejects requests where neither is present or where either array is empty.\n", "properties": { "jwt": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "Array of JWT key proofs." }, "attestation": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "Array of key attestation proofs." } } } } }, "CredentialResponse": { "type": "object", "required": ["credentials"], "properties": { "credentials": { "type": "array", "description": "Array of issued credentials. For `jwt_vc_json` and `dc+sd-jwt` formats, each credential is a compact JWT string. For `mso_mdoc`, it is a base64url-encoded CBOR-encoded IssuerSigned structure.\n", "items": { "type": "object", "required": ["credential"], "properties": { "credential": { "type": "string", "description": "The issued credential.", "examples": ["eyJhbGciOiJFUzI1NiJ9..."] } } } } } }, "ImageAssetDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "url": { "type": "string", "example": "/assets/images/8db3c474-3b65-4f35-9fd2-0d0a6e4d7182" }, "content_type": { "type": "string", "enum": ["image/png", "image/jpeg", "image/webp"] }, "size_bytes": { "type": "integer", "example": 12345 } }, "required": ["id", "url", "content_type", "size_bytes"] }, "ImageAssetResponseDto": { "type": "object", "properties": { "asset": { "$ref": "#/components/schemas/ImageAssetDto" } }, "required": ["asset"] }, "ImageAssetErrorResponse": { "type": "object", "properties": { "error": { "type": "string", "enum": [ "image_asset_file_required", "image_asset_file_too_large", "image_asset_unsupported_content_type", "image_asset_invalid_image_data", "image_asset_virus_scan_failed" ] }, "message": { "type": "string", "description": "User friendly error message" }, "extra_info": { "type": "object", "description": "Object that may contain more information about the error" } }, "required": ["error", "message", "extra_info"] }, "ImageAssetNotFoundError": { "type": "object", "properties": { "error": { "type": "string", "enum": ["image_asset_not_found"], "description": "Unique error identifier" }, "message": { "type": "string", "description": "User friendly error message" }, "extra_info": { "type": "object", "description": "Object that may contain more information about the error" } }, "required": ["error", "message", "extra_info"] }, "CreateApplicationRequestDto": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Unique display name for the application API token" } }, "required": ["name"] }, "CreateApplicationResponseDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "client_id": { "type": "string" }, "client_secret": { "type": "string", "description": "Plaintext secret — returned once and never stored" }, "created_at": { "type": "string", "format": "date-time" } }, "required": ["id", "name", "client_id", "client_secret", "created_at"] }, "ApplicationDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "client_id": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" } }, "required": ["id", "name", "client_id", "created_at"] }, "ListApplicationsResponseDto": { "type": "object", "properties": { "applications": { "type": "array", "items": { "$ref": "#/components/schemas/ApplicationDto" } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "required": ["applications", "meta"] }, "ExchangeTokenRequestDto": { "type": "object", "properties": { "grant_type": { "type": "string", "enum": ["client_credentials"] }, "client_id": { "type": "string" }, "client_secret": { "type": "string" } }, "required": ["grant_type", "client_id", "client_secret"] }, "ExchangeTokenResponseDto": { "type": "object", "properties": { "access_token": { "type": "string" }, "token_type": { "type": "string", "enum": ["Bearer"] }, "expires_in": { "type": "integer", "description": "Token lifetime in seconds" } }, "required": ["access_token", "token_type", "expires_in"] }, "ApplicationApiTokenNotFoundError": { "type": "object", "properties": { "error": { "type": "string", "enum": ["application_api_token_not_found"], "description": "Unique error identifier" }, "message": { "type": "string", "description": "User friendly error message" }, "extra_info": { "type": "object", "description": "Object that may contain more information about the error" } }, "required": ["error", "message", "extra_info"] }, "OAuth2InvalidClientError": { "type": "object", "properties": { "error": { "type": "string", "enum": ["invalid_client"], "description": "OAuth2 error code" } }, "required": ["error"] } } } }