openapi: 3.1.0
info:
title: Verifier API
description: Generic Verifier service
servers:
- url: https://astra-vz-verifier-service-d.apps.p-szb-ros-shrd-npr-01.cloud.admin.ch
description: Generated server url
tags:
- name: Verifier Management API
description: This API allows the creation of a verfication process and retrieval
of its status.It is used by the business verifier to manage verifications. (IF-100)
- name: Verfifier OID4VP API
description: "Handles OpenID for Verifiable Presentations (OID4VP) endpoints, enabling\
\ verifiers to retrieve request objects, receive verification presentations, and\
\ access OpenID client metadata as specified by the OID4VP protocol. This API\
\ is intended for wallets to fetch credentials in compliance with OpenID standards.\
\ (IF-101)"
- name: Actuator
description: Monitor and interact
externalDocs:
description: Spring Boot Actuator Web API Documentation
url: https://docs.spring.io/spring-boot/docs/current/actuator-api/html/
paths:
/oid4vp/api/request-object/{request_id}/response-data:
post:
tags:
- Verfifier OID4VP API
summary: Receive Verification Presentation (from e.g. Wallet)
description: "Handles various types of verification presentations including\
\ standard presentations, rejections, DCQL presentations, and encrypted DCQL\
\ presentations. The method automatically determines the request type based\
\ on the provided parameters."
externalDocs:
description: OpenId4VP response parameters
url: https://openid.net/specs/openid-4-verifiable-presentations-1_0-ID2.html#section-6.1
operationId: receiveVerificationPresentation
parameters:
- name: request_id
in: path
description: The unique identifier of the verification request
required: true
schema:
type: string
format: uuid
- name: SWIYU-API-Version
in: header
description: "Optional API version. Supported values: 1 - This supports OID4VP\
\ ID2 with DIF Presentation Exchange), 2 - This supports OID4VP 1.0"
required: false
schema:
type: string
enum:
- "1"
- "2"
requestBody:
content:
application/x-www-form-urlencoded:
schema:
$ref: "#/components/schemas/VerificationPresentationUnion"
description: The verification presentation request. Type is determined
automatically based on the provided parameters.
required: true
responses:
"400":
description: Bad Request. The request body is not valid
content:
application/json:
schema:
$ref: "#/components/schemas/ApiErrorDto"
"200":
description: Verification Presentation received and processed successfully
/management/api/verifications:
post:
tags:
- Verifier Management API
summary: Creates a new verification process with the given attributes
operationId: createVerification
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/CreateVerificationManagement"
required: true
responses:
"400":
description: Bad Request. The request body is not valid
content:
'*/*':
schema:
$ref: "#/components/schemas/ApiErrorDto"
"200":
description: Verification created
content:
'*/*':
schema:
$ref: "#/components/schemas/ManagementResponse"
/oid4vp/api/request-object/{request_id}:
get:
tags:
- Verfifier OID4VP API
summary: Get Request Object
description: Can return a RequestObjectDto as JSON Object or a SignedJWT String
depending on JAR (JWT secured authorization request) flag in verifier management
operationId: getRequestObject
parameters:
- name: request_id
in: path
required: true
schema:
type: string
format: uuid
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: Request object either as plaintext or signed JWT
content:
application/oauth-authz-req+jwt:
schema:
$ref: "#/components/schemas/RequestObject"
application/json:
schema:
$ref: "#/components/schemas/RequestObject"
"404":
description: Request Object not found
content:
application/oauth-authz-req+jwt:
schema:
$ref: "#/components/schemas/ApiErrorDto"
application/json:
schema:
$ref: "#/components/schemas/ApiErrorDto"
/oid4vp/api/openid-client-metadata.json:
get:
tags:
- Verfifier OID4VP API
summary: Get client metadata
description: "Metadata providing further information about the verifier, such\
\ as name and logo."
operationId: getOpenIdClientMetadata
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: Request object either as plaintext or signed JWT
content:
application/json:
examples:
Sample Client Metadata:
description: Sample Client Metadata
value:
client_id: did:example:12345
client_name#en: English name (all regions)
client_name#fr: French name (all regions)
client_name#de-DE: German name (region Germany)
client_name#de-CH: German name (region Switzerland)
client_name#de: German name (fallback)
client_name: Fallback name
client_logo: www.example.com/logo.png
client_logo#fr: www.example.com/logo_fr.png
/management/api/verifications/{verificationId}:
get:
tags:
- Verifier Management API
summary: Get verification by id
operationId: getVerification
parameters:
- name: verificationId
in: path
required: true
schema:
type: string
format: uuid
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: Verification found
content:
'*/*':
schema:
$ref: "#/components/schemas/ManagementResponse"
"404":
description: Verification not found or already expired
content:
'*/*':
schema:
$ref: "#/components/schemas/ApiErrorDto"
/actuator:
get:
tags:
- Actuator
summary: Actuator root web endpoint
operationId: links
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
application/json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
/actuator/prometheus:
get:
tags:
- Actuator
summary: Actuator web endpoint 'prometheus'
operationId: scrape
parameters:
- name: format
in: query
schema:
type: string
enum:
- CONTENT_TYPE_004
- CONTENT_TYPE_OPENMETRICS_100
- CONTENT_TYPE_PROTOBUF
- name: includedNames
in: query
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
text/plain;version=0.0.4;charset=utf-8:
schema:
type: object
application/openmetrics-text;version=1.0.0;charset=utf-8:
schema:
type: object
application/vnd.google.protobuf;proto=io.prometheus.client.MetricFamily;encoding=delimited:
schema:
type: object
/actuator/info:
get:
tags:
- Actuator
summary: Actuator web endpoint 'info'
operationId: info
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/health:
get:
tags:
- Actuator
summary: Actuator web endpoint 'health'
operationId: health
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/env:
get:
tags:
- Actuator
summary: Actuator web endpoint 'env'
operationId: environment
parameters:
- name: pattern
in: query
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/env/{toMatch}:
get:
tags:
- Actuator
summary: Actuator web endpoint 'env-toMatch'
operationId: environmentEntry
parameters:
- name: toMatch
in: path
required: true
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
"404":
description: Not Found
components:
schemas:
VerificationPresentationUnion:
type: object
description: Union DTO that contains all possible parameters from all verification
presentation types. Only the relevant fields should be populated based on
the request type.
properties:
vp_token:
description: "VP token that can be either a string for standard presentations\
\ or a JSON object for DCQL presentations. For standard/PE presentations:\
\ JWT token string. For DCQL presentations: Object containing credential\
\ query results where keys are query IDs and values are arrays of presentations."
example: |
Standard/PE: "eyJhbGci...QMA"
DCQL: {"my_credential": ["eyJhbGci...QMA", "eyJhbGci...QMA"]}
oneOf:
- type: string
- {}
presentation_submission:
type: string
description: The presentation submission as defined in DIF presentation
submission (used for Standard and PE presentations)
example:
id: a30e3b91-fb77-4d22-95fa-871689c322e2
definition_id: 32f54163-7166-48f1-93d8-ff217bdb0653
error:
type: string
description: Error code for rejection (used for REJECTION)
enum:
- invalid_scope
- invalid_request
- invalid_client
- vp_formats_not_supported
- invalid_presentation_definition_uri
- invalid_presentation_definition_reference
- client_rejected
- access_denied
example: client_rejected
error_description:
type: string
description: Error description for rejection (used for REJECTION)
example: The owner has declined the verification request.
response:
type: string
description: Encrypted response JWE string (used for DCQLE)
example: eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldFIn0...
ApiErrorDto:
type: object
properties:
error:
type: string
error_description:
type: string
detail:
type: string
Constraint:
type: object
properties:
id:
type: string
description: (Optional) unique string with no conflict with another id in
the Presentation Definition
name:
type: string
description: (Optional) If present human-friendly name which describes the
target field
purpose:
type: string
description: (Optional) Purpose for which the data is requested
format:
type: object
additionalProperties:
$ref: "#/components/schemas/FormatAlgorithm"
description: (Optional) If present object with one or more properties matching
the registered Claim Format
fields:
type: array
description: Selection which properties are requested of the holder
example:
- path:
- $.vct
filter:
type: string
const: test-sdjwt
- path:
- $.dateOfBirth
items:
$ref: "#/components/schemas/Field"
minItems: 1
required:
- fields
DcqlClaimDto:
type: object
description: Represents an individual claim object within the 'claims' array
of a Credential Query according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.3
properties:
id:
type: string
description: "REQUIRED if claim_sets is present in the Credential Query;\
\ OPTIONAL otherwise. A string identifying the particular claim. The value\
\ MUST be a non-empty string consisting of alphanumeric, underscore (_),\
\ or hyphen (-) characters. Within the particular claims array, the same\
\ id MUST NOT be present more than once."
pattern: "^[a-zA-Z0-9_-]+$"
path:
type: array
description: "The path to the claim within the credential. According to\
\ OpenID for Verifiable Presentations 1.0, Section 6.3, property 'path'.https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#claims_path_pointer"
items: {}
minItems: 1
values:
type: array
description: "OPTIONAL. A non-empty array of strings, integers or boolean\
\ values that specifies the expected values of the claim. If the values\
\ property is present, the Wallet SHOULD return the claim only if the\
\ type and value of the claim both match exactly for at least one of the\
\ elements in the array. Details of the processing rules are defined in\
\ Section 6.4.1."
items: {}
required:
- path
DcqlCredentialDto:
type: object
description: Represents a Credential Query within a DCQL query according to
https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.1
properties:
id:
type: string
description: "A string identifying the Credential in the response and, if\
\ provided, the constraints in credential_sets. The value MUST be a non-empty\
\ string consisting of alphanumeric, underscore (_) or hyphen (-) characters.\
\ Within the Authorization Request, the same id MUST NOT be present more\
\ than once. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6.1, property 'id'."
minLength: 1
pattern: "^[a-zA-Z0-9_-]+$"
format:
type: string
description: "A string that specifies the format of the requested Credential.\
\ Valid Credential Format Identifier values are defined in Appendix B.\
\ According to OpenID for Verifiable Presentations 1.0, Section 6.1, property\
\ 'format'."
minLength: 1
multiple:
type: boolean
default: false
description: "A boolean which indicates whether multiple Credentials can\
\ be returned for this Credential Query. If omitted, the default value\
\ is false. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6.1, property 'multiple'."
meta:
$ref: "#/components/schemas/DcqlCredentialMetaDto"
description: "An object defining additional properties requested by the\
\ Verifier that apply to the metadata and validity data of the Credential.\
\ The properties of this object are defined per Credential Format. According\
\ to OpenID for Verifiable Presentations 1.0, Section 6.1, property 'meta'."
claims:
type: array
description: "An optional non-empty array of Claims Query objects, specifying\
\ individual claims. According to OpenID for Verifiable Presentations\
\ 1.0, Section 6.1, property 'claims'."
items:
$ref: "#/components/schemas/DcqlClaimDto"
maxItems: 2147483647
minItems: 1
claim_sets:
type: array
description: "An optional non-empty array containing arrays of identifiers\
\ for elements in claims that specifies which combinations of claims for\
\ the Credential are requested. According to OpenID for Verifiable Presentations\
\ 1.0, Section 6.1, property 'claim_sets'."
items:
type: array
items:
type: string
maxItems: 2147483647
minItems: 1
require_cryptographic_holder_binding:
type: boolean
description: "A boolean indicating if cryptographic holder binding is required.\
\ If true, the Wallet MUST return a Verifiable Presentation of a Verifiable\
\ Credential. If false, a Verifiable Credential without Holder Binding\
\ MAY be returned. If omitted, the default is to require cryptographic\
\ holder binding. According to OpenID for Verifiable Presentations 1.0,\
\ Section 6.1, property 'require_cryptographic_holder_binding'. Also referenced\
\ in Appendix B.1. See Section 6.1 and Appendix B.1."
trusted_authorities:
type: array
description: "An optional non-empty array of Trusted Authorities Query objects.\
\ According to OpenID for Verifiable Presentations 1.0, Section 6.1, property\
\ 'trusted_authorities'."
items:
$ref: "#/components/schemas/DcqlTrustedAuthoritiesDto"
required:
- format
- id
- meta
DcqlCredentialMetaDto:
type: object
description: Represents metadata parameters within a Credential Query according
to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.1
properties:
type_values:
type: array
description: "For W3C Verifiable Credentials: A non-empty array of arrays\
\ of strings that specifies allowed values for the 'type' of the requested\
\ Verifiable Credential. According to OpenID for Verifiable Presentations\
\ 1.0, Appendix B.1.1, property 'type_values'."
items:
type: array
items:
type: string
maxItems: 2147483647
minItems: 1
vct_values:
type: array
description: "For IETF SD-JWT VC: A non-empty array of strings that specifies\
\ allowed values for the type of the requested Verifiable Credential.\
\ According to OpenID for Verifiable Presentations 1.0, Appendix B.3.5,\
\ property 'vct_values'."
items:
type: string
maxItems: 2147483647
minItems: 1
doctype_value:
type: string
description: "For ISO mdoc: A string that specifies an allowed value for\
\ the 'doctype' of the requested Verifiable Credential. It MUST be a valid\
\ doctype identifier. According to OpenID for Verifiable Presentations\
\ 1.0, Appendix B.2.3, property 'doctype_value'."
DcqlCredentialSetDto:
type: object
description: Represents a Credential Set Query within a DCQL query according
to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.2
properties:
options:
type: array
description: "A non-empty array, where each value in the array is a list\
\ of Credential Query identifiers representing one set of Credentials\
\ that satisfies the use case. According to OpenID for Verifiable Presentations\
\ 1.0, 6.2 Credential Set Query, property 'options'."
items:
type: array
items:
type: string
minItems: 1
required:
type: boolean
default: true
description: "A boolean indicating if this credential set is required. (default\
\ is true)According to OpenID for Verifiable Presentations 1.0, 6.2. Credential\
\ Set Query, property 'required'."
required:
- options
DcqlQueryDto:
type: object
description: Represents the Digital Credentials Query Language (DCQL) query
according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6
**⚠️ Not yet implemented**
example:
credentials:
- id: identity_credential_dcql
format: dc+sd-jwt
meta:
vct_values:
- https://credentials.example.com/identity_credential
claims:
- path:
- given_name
- path:
- family_name
- path:
- address
- street_address
require_cryptographic_holder_binding: true
- id: university_degree_dcql
format: dc+sd-jwt
meta:
vct_values:
- https://credentials.example.com/university_degree
claims:
- path:
- degree_name
- path:
- graduation_year
credential_sets:
- options:
- - identity_credential_dcql
- - university_degree_dcql
required: true
properties:
credentials:
type: array
description: "A non-empty array of Credential Queries that specify the requested\
\ Credentials. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6, property 'credentials'."
items:
$ref: "#/components/schemas/DcqlCredentialDto"
minItems: 1
credential_sets:
type: array
description: "An optional non-empty array of Credential Set Queries that\
\ specifies additional constraints on which of the requested Credentials\
\ to return. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6, property 'credential_sets'."
items:
$ref: "#/components/schemas/DcqlCredentialSetDto"
required:
- credentials
x-implementation-status:
status: not-implemented
DcqlTrustedAuthoritiesDto:
type: object
description: Trusted Authorities Query according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.1.1
properties:
type:
type: string
description: "A string uniquely identifying the type of information about\
\ the issuer trust framework. According to OpenID for Verifiable Presentations\
\ 1.0, Section 6.1.1, property 'type'."
minLength: 1
values:
type: array
description: "A non-empty array of strings, where each string (value) contains\
\ information specific to the used Trusted Authorities Query type that\
\ allows the identification of an issuer, a trust framework, or a federation\
\ that an issuer belongs to. According to OpenID for Verifiable Presentations\
\ 1.0, Section 6.1.1, property 'values'."
items:
type: string
minItems: 1
required:
- type
- values
Field:
type: object
properties:
path:
type: array
description: (Mandatory) Array of one or more JSONPath string expressions
items:
type: string
minItems: 1
id:
type: string
description: (Optional) If present value MUST be a string that is unique
name:
type: string
description: (Optional) If present human-friendly name which describes the
target field
purpose:
type: string
description: (Optional) If present describes purpose for which the field
is requested
filter:
$ref: "#/components/schemas/Filter"
description: (Optional) If present object with one or more properties matching
the registered Claim Format
required:
- path
Filter:
type: object
properties:
type:
type: string
default: string
description: (Optional) If present value MUST be 'string'
example: string
pattern: string
const:
type: string
description: (Optional) If present value MUST be a string / no pattern
example: vct-as-in-issuer-metadata
FormatAlgorithm:
type: object
properties:
sd-jwt_alg_values:
type: array
description: (Required) algorithms string from the SDJWT family
items:
type: string
minItems: 1
kb-jwt_alg_values:
type: array
description: (Required) algorithms defining the keybinding algorithm for
SDJWT family
items:
type: string
minItems: 1
required:
- kb-jwt_alg_values
- sd-jwt_alg_values
InputDescriptor:
type: object
properties:
id:
type: string
description: (Mandatory) unique string with no conflict with another id
in the Presentation Definition
example: 11111111-1111-1111-1111-111111111111
minLength: 1
name:
type: string
description: (Optional) If present human-friendly name which describes the
target field
example: Example Data Request
purpose:
type: string
description: (Optional) Purpose for which the data is requested
example: We collect this data to test our verifier
format:
type: object
additionalProperties:
$ref: "#/components/schemas/FormatAlgorithm"
description: (Optional) If present object with one or more properties matching
the registered Claim Format
example:
vc+sd-jwt:
sd-jwt_alg_values:
- ES256
kb-jwt_alg_values:
- ES256
constraints:
$ref: "#/components/schemas/Constraint"
required:
- constraints
- id
ManagementResponse:
type: object
properties:
id:
type: string
format: uuid
request_nonce:
type: string
state:
$ref: "#/components/schemas/VerificationStatus"
presentation_definition:
$ref: "#/components/schemas/PresentationDefinition"
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
wallet_response:
$ref: "#/components/schemas/ResponseData"
verification_url:
type: string
verification_deeplink:
type: string
PresentationDefinition:
type: object
properties:
id:
type: string
description: "A unique ID for the desired context. Can be any String, but\
\ using a UUID is recommended."
example: 00000000-0000-0000-0000-000000000000
name:
type: string
description: (Optional) If present human-friendly string intended to constitute
a distinctive designation of the Presentation Definition
example: Test Verification
purpose:
type: string
description: (Optional) Purpose for which the presentation definition is
requested and used for
example: We want to test a new Verifier
format:
type: object
additionalProperties:
$ref: "#/components/schemas/FormatAlgorithm"
description: (Optional) If present object with one or more properties matching
the registered Claim Format.
example:
vc+sd-jwt:
sd-jwt_alg_values:
- ES256
kb-jwt_alg_values:
- ES256
input_descriptors:
type: array
description: Input Descriptors are objects used to describe the information
a Verifier requires of a Holder
items:
$ref: "#/components/schemas/InputDescriptor"
required:
- input_descriptors
ResponseData:
type: object
properties:
error_code:
$ref: "#/components/schemas/VerificationErrorResponseCode"
error_description:
type: string
credential_subject_data:
type: object
additionalProperties: {}
VerificationErrorResponseCode:
type: string
description: |
| Value | Description |
|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| credential_invalid | The credential presented during validation was deemed invalid.
This is a general purpose code if none of the other codes apply. |
| jwt_expired | During the verification process an expired jwt was used. |
| jwt_premature | During the verification process a not yet valid jwt was used. |
| missing_nonce | During the verification process a nonce was missing. |
| invalid_format | The data send in the verification process used an invalid format. |
| credential_expired | The credential presented during validation was expired. |
| unsupported_format | The credential presented during validation was in an unsupported format. |
| credential_revoked | The credential presented during validation was revoked. |
| credential_suspended | The credential presented during validation was suspended. |
| credential_missing_data | The credential presented during validation does not contain the required fields. |
| unresolvable_status_list | The credential presented during validation contains a status list which cannot be reached during validation. |
| public_key_of_issuer_unresolvable | The credential presented during validation was issued by an entity that does not provide the public key at the time of verification. |
| issuer_not_accepted | The credential presented during validation was issued by an entity that is not in the list of allowed issuers. |
| malformed_credential | The credential presented during validation isnt valid according to the format specification in question |
| holder_binding_mismatch | The holder has provided invalid proof that the credential is under their control. |
| client_rejected | The holder rejected the verification request. |
| issuer_not_accepted | The issuer of the vc was not in the allow-list given in the verificaiton request. |
| authorization_request_missing_error_param | During the verification process a required parameter (eg.: vp_token, presentation) was not provided in the request. |
| authorization_request_object_not_found | The requested verification process cannot be found. |
| verification_process_closed | The requested verification process is already closed. |
| invalid_presentation_definition | The provided credential presentation was invalid. |
| presentation_submission_constraint_violated | The presentation submission provided violated at least one constraint defined in the presentation definition |
| invalid_presentation_submission | The presentation submission couldn't be deserialized and is therefore invalid |
| invalid_scope | Requested scope value is invalid, unknown or malformed |
| invalid_request | Various issues with the request |
| invalid_client | client_metadata parameter exists, but the Wallet recognizes Client Identifier and knows metadata associated with it, Verifier's pre-registered metadata has been found based on the Client Identifier, but client_metadata parameter is also present |
| vp_formats_not_supported | The Wallet doesn't support any of the formats requested by the Verifier |
| invalid_presentation_definition_uri | Presentation Definition URI can't be reached |
| invalid_presentation_definition_reference | Presentation Definition URI can be reached, but the presentation_definition cannot be found there |
enum:
- credential_invalid
- jwt_expired
- invalid_format
- credential_expired
- missing_nonce
- unsupported_format
- credential_revoked
- credential_suspended
- holder_binding_mismatch
- credential_missing_data
- unresolvable_status_list
- public_key_of_issuer_unresolvable
- client_rejected
- issuer_not_accepted
- authorization_request_object_not_found
- authorization_request_missing_error_param
- verification_process_closed
- invalid_presentation_definition
- malformed_credential
- presentation_submission_constraint_violated
- invalid_presentation_submission
- invalid_scope
- invalid_request
- invalid_client
- vp_formats_not_supported
- invalid_presentation_definition_uri
- invalid_presentation_definition_reference
- jwt_premature
- invalid_token_status_list
VerificationStatus:
type: string
enum:
- PENDING
- SUCCESS
- FAILED
ConfigurationOverrideDto:
type: object
description: Override for Verifier configuration to be use for this one verification
properties:
external_url:
type: string
description: "Override for the EXTERNAL_URL - the url the wallet should\
\ call, to fetch the request object and send the verification response\
\ to."
example: https://www.example.com/verifier
verifier_did:
type: string
description: Override to be used in clientId instead of environment variable
VERIFIER_DID
example: did:webvh:mySCID12345213:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:00000000-0000-0000-0000-000000000000
verification_method:
type: string
description: "Override for DID_VERIFICATION_METHOD, the id of the public\
\ key in the did document. Most often the full did and a unique id after\
\ #"
example: did:webvh:mySCID12345213:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:00000000-0000-0000-0000-000000000000#myVerificationMethod-xx
key_id:
type: string
description: ID of the key in the HSM
example: myOverrideHSMKeyId01
key_pin:
type: string
description: "The pin which protects the key in the hsm, if any. Note that\
\ this only the key pin, not hsm password or partition pin."
example: 11111
CreateVerificationManagement:
type: object
properties:
accepted_issuer_dids:
type: array
description: |
List of dids from issuers whose credentials are accepted for this verification.
Will be evaluated before trust anchor.
If not specified and no trust anchor specified all dids are trusted.
example:
- did:example:12345
items:
type: string
trust_anchors:
type: array
description: |
List of trust anchor dids from the trust registry.
This is an alternative to specifying accepted issuer dids,
if these dids have a trust statement.
All dids trusted by the trust anchor are accepted.
If not specified, trust statements will not be used for this verification.
items:
$ref: "#/components/schemas/TrustAnchor"
jwt_secured_authorization_request:
type: boolean
description: Toggle whether the request-object is available as plain object
oras jwt object signed by the verifier as additional security measure
response_mode:
$ref: "#/components/schemas/ResponseModeType"
description: |-
Requested Response Mode from the wallet to the verifier.
- direct_post - the wallet sends a clear text response
- direct_post.jwt - the wallet sends an encrypted response
presentation_definition:
$ref: "#/components/schemas/PresentationDefinition"
description: Presentation definition according to https://identity.foundation/presentation-exchange/#presentation-definition
configuration_override:
$ref: "#/components/schemas/ConfigurationOverrideDto"
description: "Optional Parameter to override configured parameters, such\
\ as the DID used or the HSM key used in singing the request object"
example: {}
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
ResponseModeType:
type: string
description: Supported response_mode as defined in OID4VP
enum:
- direct_post
- direct_post.jwt
TrustAnchor:
type: object
properties:
did:
type: string
example: did:example:12345
minLength: 1
trust_registry_uri:
type: string
description: |
URI of the trust registry to be used for finding the trust anchor.
For the example value the trust anchor would be searched at
https://trust-reg.trust-infra.swiyu-int.admin.ch/api/v1/truststatements/{trust_anchor_did}
example: https://trust-reg.trust-infra.swiyu-int.admin.ch
minLength: 1
required:
- did
- trust_registry_uri
JWKSet:
type: object
properties:
keys:
type: array
items:
$ref: "#/components/schemas/JsonWebKey"
JsonWebKey:
type: object
properties:
kty:
type: string
kid:
type: string
use:
type: string
alg:
type: string
"n":
type: string
e:
type: string
crv:
type: string
x:
type: string
"y":
type: string
OpenIdClientMetadataVpFormat:
type: object
properties:
jwt_vp:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormatAlg"
required:
- jwt_vp
OpenIdClientMetadataVpFormatAlg:
type: object
properties:
alg:
type: array
items:
type: string
minItems: 1
required:
- alg
OpenIdClientMetadataVpFormatSdJwt:
type: object
properties:
sd-jwt_alg_values:
type: array
items:
type: string
kb-jwt_alg_values:
type: array
items:
type: string
OpenIdClientMetadataVpFormatsSupported:
type: object
properties:
dc+sd-jwt:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormatSdJwt"
OpenidClientMetadataDto:
type: object
description: |-
Verifier metadata values.
Additional Verifier metadata parameters MAY be defined and used, as described in [RFC7591].
The Wallet MUST ignore any unrecognized parameters.
properties:
additionalProperties:
type: object
additionalProperties: {}
writeOnly: true
client_id:
type: string
minLength: 1
vp_formats:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormat"
deprecated: true
jwks:
$ref: "#/components/schemas/JWKSet"
description: |
One or more public keys, such as those used by the Wallet as an input to a key agreement
that may be used for encryption of the Authorization Response, or where the Wallet will
require the public key of the Verifier to generate a Verifiable Presentation.
Public keys included in this parameter MUST NOT be used to verify the signature of signed Authorization Requests
encrypted_response_enc_values_supported:
type: array
description: |-
If present, should be non-empty array of JWE algorithms as in RFC7516.
When a response_mode requiring encryption of the Response (such as direct_post.jwt) is specified,
one of the specified algorithms is to be used.
items:
type: string
vp_formats_supported:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormatsSupported"
description: |
An object containing a list of name/value pairs, where the name is a Credential Format Identifier and the
value defines format-specific parameters that a Verifier supports.
required:
- client_id
- vp_formats
RequestObject:
type: object
description: |
OID4VP Request Object sent to the Wallet as response after receiving an Authorization Request.
Contains either a Presentation Exchange (PE) presentation_definition or a DCQL query (dcql_query), depending on the verification request format.
- If the verification was initiated using the older PE format, the presentation_definition field is used.
- If the verification was initiated using the new DCQL format, the dcql_query field is used.
properties:
client_id:
type: string
client_id_scheme:
type: string
response_type:
type: string
response_mode:
$ref: "#/components/schemas/ResponseModeType"
description: |
If "direct_post", expect the response to be sent via an HTTPS connection to response_uri.
If "direct_post.jwt" expects the response to also be encrypted.
response_uri:
type: string
nonce:
type: string
version:
type: string
presentation_definition:
$ref: "#/components/schemas/PresentationDefinition"
description: |
Presentation definition according to https://identity.foundation/presentation-exchange/#presentation-definition.
This field is only used for requests initiated with the older Presentation Exchange (PE) format.
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
description: |
DCQL query object as an Authorization Request parameter.
This field is used for requests initiated with the DCQL format and contains the Digital Credentials Query Language (DCQL) query.
client_metadata:
$ref: "#/components/schemas/OpenidClientMetadataDto"
description: "A JSON object containing the Verifier metadata values providing\
\ further information about the verifier, such as name and logo. It is\
\ UTF-8 encoded. It MUST NOT be present if client_metadata_uri parameter\
\ is present."
example: |-
{
"client_id": "did:example:12345",
"client_name#en": "English name (all regions)",
"client_name#fr": "French name (all regions)",
"client_name#de-DE": "German name (region Germany)",
"client_name#de-CH": "German name (region Switzerland)",
"client_name#de": "German name (fallback)",
"client_name": "Fallback name",
"client_logo": "www.example.com/logo.png",
"client_logo#fr": "www.example.com/logo_fr.png",
"vp_formats": {
"jwt_vp": {
"alg": [
"ES256"
],
}
}
}
state:
type: string
Link:
type: object
properties:
href:
type: string
templated:
type: boolean
WebhookCallback:
description: Callback transmitting that verification can now be fetched.
properties:
verification_id:
type: string
format: uuid
timestamp:
type: string
format: date-time