openapi: 3.1.0
info:
  title: Issuer Service API
  description: Generic swiyu Issuer Service service
servers:
- url: http://localhost:8080
  description: Generated server url
tags:
- name: Credential Metadata API
  description: "Provide metadata related to verifiable credentials, including credential\
    \ type metadata, JSON schemas, and Overlays Capture Architecture (OCA) data. (IF-110)"
- name: Issuer OID4VCI API
  description: "Public OpenID for Verifiable Credential Issuance (OID4VCI) API endpoints,\
    \ including issuing OAuth tokens for credential requests, issuing verifiable credentials,\
    \ and supporting deferred credential issuance (IF-111)"
- name: Actuator
  description: Monitor and interact
  externalDocs:
    description: Spring Boot Actuator Web API Documentation
    url: https://docs.spring.io/spring-boot/docs/current/actuator-api/html/
- name: Credential API
  description: "Exposes API endpoints for managing credential offers and their statuses.\
    \ Supports creating new credential offers, retrieving offer data and deeplinks,\
    \ and updating or querying the status of offers and issued verifiable credentials.\
    \ (IF-114)"
- name: Status List API
  description: Exposes API endpoints for managing status lists used in verifiable
    credential status tracking. Supports creating and initializing new status lists
    and retrieving status list information by ID. Ensures status list configuration
    is immutable after initialization. Manual status list updates can optionally persist
    a configuration override used for signing. (IF-113)
- name: Well-known endpoints API
  description: "Exposes OpenID .well-known endpoints for issuer configuration and\
    \ credential metadata as required by the OID4VCI specification. Provides endpoints\
    \ for OpenID Connect issuer configuration, OAuth authorization server information,\
    \ and issuer metadata describing supported verifiable credentials (IF-112)"
paths:
  /oid4vci/api/token:
    post:
      tags:
      - Issuer OID4VCI API
      summary: Submit form data
      operationId: oauthTokenEndpoint
      parameters:
      - name: DPoP
        in: header
        required: false
        schema:
          type: string
      requestBody:
        description: OAuth 2.0 access token request to be submitted
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/OauthAccessTokenRequest"
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthToken"
  /oid4vci/api/nonce:
    post:
      tags:
      - Issuer OID4VCI API
      summary: Provide a self-contained nonce in a publicly accessible endpoint.
      description: |
        Provide nonces for proof of possessions in a manner not requiring the service to save it.
        The nonce should be used only once. The nonce has a (very) limit lifetime.
        The response should not be cached.
        For more information see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-7.2">OID4VCI Nonce Endpoint specification</a></br>
        Also provides a DPoP nonce. For more details towards demonstrating proof of possession refer to <a href="https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid">RFC9449</a>
      operationId: createNonce
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/NonceResponse"
  /oid4vci/api/deferred_credential:
    post:
      tags:
      - Issuer OID4VCI API
      summary: Collect credential associated with the bearer token and the transaction
        id. This endpoint is used for deferred issuance.
      description: Issues a credential for a deferred transaction. Requires a valid
        bearer token and transaction details in the request body.
      operationId: createDeferredCredential
      parameters:
      - name: Authorization
        in: header
        description: Bearer token for authentication
        required: true
        schema:
          type: string
      - name: DPoP
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DeferredCredentialEndpointRequest"
          application/jwt:
            schema:
              type: string
              description: |
                An encoded JWT as described in RFC7519, with the claims as found in the unencrypted request
        required: true
      responses:
        "200":
          description: Credential issued successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CredentialEndpointResponse"
        "202":
          description: Credential issuance still pending — retry with the transaction_id
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DeferredCredentialPendingResponse"
        "400":
          description: Invalid request or validation error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                type: string
            application/jwt:
              schema:
                type: string
      security:
      - bearer-jwt: []
  /oid4vci/api/credential:
    post:
      tags:
      - Issuer OID4VCI API
      summary: Collect credential associated with the bearer token with the requested
        credential properties.
      description: Issues a credential for a given bearer token and credential request.
        Supports API versioning via SWIYU-API-Version header. Returns the issued credential
        in JSON or JWT format.
      operationId: createCredential
      parameters:
      - name: Authorization
        in: header
        description: "Bearer token for authentication. Format: 'Bearer ..."
        required: true
        schema:
          type: string
      - name: DPoP
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateCredentialRequest"
          application/jwt:
            schema:
              type: string
              description: |
                An encoded JWT as described in RFC7519, with the claims as found in the unencrypted request
        required: true
      responses:
        "200":
          description: Credential issued successfully.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CredentialEndpointResponse"
        "202":
          description: Successful deferred credential. The credential will be issued
            later
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DeferredCredentialPendingResponse"
        "400":
          description: Invalid request or validation error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
      security:
      - bearer-jwt: []
  /management/api/status-list:
    post:
      tags:
      - Status List API
      summary: Create and initialize a new status list.
      description: "Initialize and link a status list slot to to this service. This\
        \ process can be only done once per status list! Status List type, configuration\
        \ or length can not be changed after initialization!"
      operationId: createStatusList
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/StatusListCreate"
        required: true
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/StatusList"
  /management/api/status-list/{statusListId}:
    get:
      tags:
      - Status List API
      summary: Get the status information of a status list.
      operationId: getStatusListInformation
      parameters:
      - name: statusListId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/StatusList"
    post:
      tags:
      - Status List API
      summary: Update the status list registry entry manually.
      description: "Update the status list registry entry manually. Optionally accepts\
        \ configuration overrides to control key material selection for this update.\
        \ If provided, the override will be persisted on the status list and used\
        \ for subsequent publications. This endpoint can also be used in automatic\
        \ synchronization mode to update the configuration override."
      operationId: updateStatusListRegistryEntry
      parameters:
      - name: statusListId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/StatusListUpdate"
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/StatusList"
  /management/api/credentials:
    post:
      tags:
      - Credential API
      summary: Create a generic credential offer with the given content
      description: |
        Create a new credential offer, which can then be collected by the holder.
        The returned deep link has to be provided to the holder through another channel, for example as QR-Code.
        The credentialSubjectData can be a json object or a JWT, if the signer has been configured to perform data integrity checks.
        Returns both the ID used to interact with the offer and later issued VC, and the deep link to be provided to
      operationId: createCredential_1
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateCredentialOfferRequest"
        required: true
      responses:
        "200":
          description: Credential offer created
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/CredentialWithDeeplinkResponse"
        "400":
          description: |
            Bad request due to user content or internal call to external service like statuslist
          content:
            '*/*':
              schema:
                type: string
  /management/api/credentials/{credentialManagementId}:
    get:
      tags:
      - Credential API
      summary: "Get the offer data, if any is still cached"
      operationId: getCredentialInformation
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "200":
          description: Credential offer found
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/CredentialManagementDto"
    patch:
      tags:
      - Credential API
      summary: Update the status of an offer or the verifiable credential associated
        with the id. This is only for deferred flows. The status is set to ready for
        issuance
      operationId: updateCredentialForDeferredFlow
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              type: string
        required: true
      responses:
        "200":
          description: Credential status updated
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/UpdateStatusResponse"
        "400":
          description: Bad request due to user content or internal call to external
            service like statuslist
          content:
            '*/*':
              schema:
                type: string
  /management/api/credentials/{credentialManagementId}/status:
    get:
      tags:
      - Credential API
      summary: "Get the current status of an offer or the verifiable credential, if\
        \ already issued."
      operationId: getCredentialStatus
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/StatusResponse"
    patch:
      tags:
      - Credential API
      summary: Set the status of an offer or the verifiable credential associated
        with the id.
      operationId: updateCredentialStatus
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: credentialStatus
        in: query
        required: true
        schema:
          $ref: "#/components/schemas/UpdateCredentialStatusRequestType"
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/UpdateStatusResponse"
  /oid4vci/vct/{metadataKey}:
    get:
      tags:
      - Credential Metadata API
      operationId: getCredentialTypeMetadata
      parameters:
      - name: metadataKey
        in: path
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            application/json: {}
  /oid4vci/oca/{ocaKey}:
    get:
      tags:
      - Credential Metadata API
      operationId: getOverlaysCaptureArchitecture
      parameters:
      - name: ocaKey
        in: path
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            application/json: {}
  /oid4vci/json-schema/{schemaKey}:
    get:
      tags:
      - Credential Metadata API
      operationId: getJsonSchema
      parameters:
      - name: schemaKey
        in: path
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            application/schema+json:
              schema:
                type: string
  /management/api/credentials/{credentialManagementId}/offers/{offerId}:
    get:
      tags:
      - Credential API
      summary: "Get a specific offer data, if it is still cached"
      operationId: getCredentialOfferInformation
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: offerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "200":
          description: Credential offer found
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/CredentialInfoResponse"
  /management/api/credentials/{credentialManagementId}/offers/{offerId}/status:
    get:
      tags:
      - Credential API
      summary: Get the current status of a specific offer.
      operationId: getCredentialStatus_1
      parameters:
      - name: credentialManagementId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: offerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/StatusResponse"
  /actuator:
    get:
      tags:
      - Actuator
      summary: Actuator root web endpoint
      operationId: links
      responses:
        "200":
          description: OK
          content:
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
  /actuator/prometheus:
    get:
      tags:
      - Actuator
      summary: Actuator web endpoint 'prometheus'
      operationId: scrape
      parameters:
      - name: format
        in: query
        schema:
          type: string
          enum:
          - CONTENT_TYPE_004
          - CONTENT_TYPE_OPENMETRICS_100
          - CONTENT_TYPE_PROTOBUF
      - name: includedNames
        in: query
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            text/plain;version=0.0.4;charset=utf-8:
              schema:
                type: object
            application/openmetrics-text;version=1.0.0;charset=utf-8:
              schema:
                type: object
            application/vnd.google.protobuf;proto=io.prometheus.client.MetricFamily;encoding=delimited:
              schema:
                type: object
  /actuator/info:
    get:
      tags:
      - Actuator
      summary: Actuator web endpoint 'info'
      operationId: info
      responses:
        "200":
          description: OK
          content:
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/json:
              schema:
                type: object
  /actuator/health:
    get:
      tags:
      - Actuator
      summary: Actuator web endpoint 'health'
      operationId: health
      responses:
        "200":
          description: OK
          content:
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/json:
              schema:
                type: object
  /actuator/env:
    get:
      tags:
      - Actuator
      summary: Actuator web endpoint 'env'
      operationId: environment
      parameters:
      - name: pattern
        in: query
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/json:
              schema:
                type: object
  /actuator/env/{toMatch}:
    get:
      tags:
      - Actuator
      summary: Actuator web endpoint 'env-toMatch'
      operationId: environmentEntry
      parameters:
      - name: toMatch
        in: path
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/json:
              schema:
                type: object
        "404":
          description: Not Found
  /.well-known/openid-credential-issuer/{tenantId}:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadataByTenantId
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /.well-known/openid-credential-issuer/oid4vci/{tenantId}:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadataByTenantId_1
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /{tenantId}/.well-known/openid-credential-issuer:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadataByTenantId_2
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /oid4vci/{tenantId}/.well-known/openid-credential-issuer:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadataByTenantId_3
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /.well-known/openid-credential-issuer/oid4vci:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadata
      parameters:
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: Credential Issuer Metadata
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IssuerMetadata"
            application/jwt:
              schema:
                type: string
                description: Signed issuer metadata as JWT
  /oid4vci/.well-known/openid-credential-issuer:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadata_1
      parameters:
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: Credential Issuer Metadata
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IssuerMetadata"
            application/jwt:
              schema:
                type: string
                description: Signed issuer metadata as JWT
  /.well-known/openid-credential-issuer:
    get:
      tags:
      - Well-known endpoints API
      summary: Information about credentials which can be issued.
      operationId: getIssuerMetadata_2
      parameters:
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: Credential Issuer Metadata
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IssuerMetadata"
            application/jwt:
              schema:
                type: string
                description: Signed issuer metadata as JWT
  /oid4vci/{tenantId}/.well-known/oauth-authorization-server:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /{tenantId}/.well-known/oauth-authorization-server/oid4vci:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_1
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /oid4vci/{tenantId}/.well-known/openid-configuration:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_2
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /{tenantId}/.well-known/oauth-authorization-server:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_3
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /.well-known/oauth-authorization-server/{tenantId}:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_4
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /{tenantId}/.well-known/openid-configuration:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_5
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /.well-known/oauth-authorization-server/{tenantId}/oid4vci:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve tenant-specific OAuth 2.0 Authorization Server Metadata
      description: "Returns the Authorization Server configuration metadata for the\
        \ given tenant in accordance with RFC 8414. Depending on the 'Accept' header,\
        \ the response is provided either as an unsigned JSON document or as a signed\
        \ JWT. The metadata includes issuer information, endpoint URLs (e.g., token\
        \ endpoint), supported grant types and extensions required for OpenID for\
        \ Verifiable Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadataByTenantId_6
      parameters:
      - name: tenantId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
      responses:
        "200":
          description: OK
          content:
            '*/*':
              schema:
                type: object
  /.well-known/openid-configuration:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve OAuth 2.0 Authorization Server Metadata
      description: "Returns the configuration metadata of the Authorization Server\
        \ in accordance with RFC 8414. This includes URLs to endpoints (e.g., token\
        \ endpoint), supported grant types, as well as extensions for OpenID for Verifiable\
        \ Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadata
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthAuthorizationServerMetadata"
  /.well-known/oauth-authorization-server/oid4vci:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve OAuth 2.0 Authorization Server Metadata
      description: "Returns the configuration metadata of the Authorization Server\
        \ in accordance with RFC 8414. This includes URLs to endpoints (e.g., token\
        \ endpoint), supported grant types, as well as extensions for OpenID for Verifiable\
        \ Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadata_1
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthAuthorizationServerMetadata"
  /.well-known/oauth-authorization-server:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve OAuth 2.0 Authorization Server Metadata
      description: "Returns the configuration metadata of the Authorization Server\
        \ in accordance with RFC 8414. This includes URLs to endpoints (e.g., token\
        \ endpoint), supported grant types, as well as extensions for OpenID for Verifiable\
        \ Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadata_2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthAuthorizationServerMetadata"
  /oid4vci/.well-known/oauth-authorization-server:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve OAuth 2.0 Authorization Server Metadata
      description: "Returns the configuration metadata of the Authorization Server\
        \ in accordance with RFC 8414. This includes URLs to endpoints (e.g., token\
        \ endpoint), supported grant types, as well as extensions for OpenID for Verifiable\
        \ Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadata_3
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthAuthorizationServerMetadata"
  /oid4vci/.well-known/openid-configuration:
    get:
      tags:
      - Well-known endpoints API
      summary: Retrieve OAuth 2.0 Authorization Server Metadata
      description: "Returns the configuration metadata of the Authorization Server\
        \ in accordance with RFC 8414. This includes URLs to endpoints (e.g., token\
        \ endpoint), supported grant types, as well as extensions for OpenID for Verifiable\
        \ Credential Issuance (OID4VCI) and DPoP."
      operationId: getAuthorizationServerMetadata_4
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OAuthAuthorizationServerMetadata"
components:
  schemas:
    ApiError:
      type: object
      description: Error response object
      properties:
        error:
          type: string
        error_description:
          type: string
        detail:
          type: string
        trace_id:
          type: string
      required:
      - error
    BatchCredentialIssuance:
      type: object
      properties:
        batch_size:
          type: integer
          format: int32
          minimum: 10
      required:
      - batch_size
    ClientAgentInfoDto:
      type: object
      properties:
        remoteAddr:
          type: string
        user-agent:
          type: string
        accept-language:
          type: string
        accept-encoding:
          type: string
    ConfigurationOverride:
      type: object
      description: Override for configuration to be use for the created entity
      properties:
        issuer_did:
          type: string
          description: Override to be used in place of the ISSUER_ID
        verification_method:
          type: string
          description: "Override for the verification method that is looked up in\
            \ the did document during verification of the entity. Most often the full\
            \ did and a unique id after #"
        key_id:
          type: string
          description: ID of the key in the HSM
        key_pin:
          type: string
          description: "The pin which protects the key in the hsm, if any. Note that\
            \ this only the key pin, not hsm password or partition pin."
    CreateCredentialOfferRequest:
      type: object
      description: Initial credential creation request to start the offering process.
      properties:
        metadata_credential_supported_id:
          type: array
          description: ID linking the offer to the issuer metadata.
          items:
            type: string
          minItems: 1
        credential_subject_data:
          additionalProperties: true
          description: |2
                The user data to be written in the verifiable credential. Can be a json object or a JWT.
                credentialSubjectData": {"lastName": "Example","firstName": "Edward"}
                When using data integrity JWT the value are as claims inside the JWT.
                "credentialSubjectData": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsYXN0TmFtZSI6IkV4YW1wbGUiLCJmaXJzdE5hbWUiOiJFZHdhcmQiLCJkYXRlT2ZCaXJ0aCI6IjEuMS4xOTcwIn0.2VMjj1RpJ7jUjn1SJHDwwzqx3kygn88UxSsG5j1uXG8"
          example:
            lastName: Example
            firstName: Edward
        credential_metadata:
          $ref: "#/components/schemas/CredentialOfferMetadataDto"
          description: |
            Various metadata to be used for credential creation.
          example:
            deferred: false
        offer_validity_seconds:
          type: integer
          format: int32
          description: how long the offer should be usable in seconds. Example is
            1 Day.
          example: 86400
        deferred_offer_validity_seconds:
          type: integer
          format: int32
          description: how long the offer should be valid after it reached the deferred
            state in seconds. Example is 7 Days.
          example: 604800
        credential_valid_until:
          type: string
          format: date-time
          description: Setting for until when the VC shall be valid. XMLSchema dateTimeStamp
            https://www.w3.org/TR/xmlschema11-2/#dateTimeStamp
          example: 2010-01-01T19:23:24Z
        credential_valid_from:
          type: string
          format: date-time
          description: Setting for from when the VC shall be valid. XMLSchema dateTimeStamp
            https://www.w3.org/TR/xmlschema11-2/#dateTimeStamp
          example: 2010-01-01T18:23:24Z
        status_lists:
          type: array
          description: List of URIs of the status lists to be used with the credential.
            Status Lists must be initialized. Can provide multiple status lists to
            have multiple status sources.
          items:
            type: string
        configuration_override:
          $ref: "#/components/schemas/ConfigurationOverride"
          description: "Optional Parameter to override configured parameters, such\
            \ as the DID used or the HSM key used in singing the request object"
      required:
      - metadata_credential_supported_id
    CreateCredentialRequest:
      type: object
      description: Request to the Credential Endpoint as defined in OID4VCI 1.0 specification
      properties:
        credential_configuration_id:
          type: string
          description: |
            String that uniquely identifies one of the keys in the name/value pairs stored in
            the credential_configurations_supported Credential Issuer metadata.
            Only used if a credential_identifiers parameter was not returned from the Token Response as part of the authorization_details parameter.
            It MUST NOT be used otherwise.
          example: university_example_sd_jwt
          minLength: 1
        proofs:
          $ref: "#/components/schemas/ProofsDto"
          description: |
            Optional object providing 1+ proof of possessions of the cryptographic key material to
            which the issued Credential instances will be bound to
          example:
            jwt:
            - eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6IkVDIiwidXNlIjoic2lnIiwiY3J2IjoiUC0yNTYiLCJraWQiOiJUZXN0LUtleSIsIngiOiJrdHFJRFpoUjFmY2NlM3VGanpxdDdLRVlEdVdweFJoX3pqdkszanZsS2k4IiwieSI6Ik1UV2ZObTJ6dy1CbklqM2szbW0xZVB3Q3hqTm9DSEowdXN6V25MeHVDemsiLCJpYXQiOjE3NTMyNjkyNzZ9fQ.eyJhdWQiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvb2lkNHZjaSIsIm5vbmNlIjoiY2U5YzEzNzgtODc2Yi00OGUyLTg0ZmUtOGE0ZjUwZGFkZmJmIiwiaWF0IjoxNzUzMjY5Mjc2fQ.ck-6Oq6IAav1VdFOkq9Qh7tzrl52jJvFBU3aPcZ_20oE73Cf4izN0ECmmiJm_qUMvYJlykQFsX2sW43gFC6vCw
        credential_response_encryption:
          $ref: "#/components/schemas/CredentialResponseEncryption"
          description: |
            Optional object providing information how to encrypt the Credential Response, if present.
          example: |
            {
               "enc": "A128GCM",
               "jwk": {"kty":"EC", "alg": "ECDH-ES","crv":"P-256","kid":"transportEncKeyEC","x":"DTaouFJpyVkLvfhoOvuTDR6_nmTt7YTvEHsHzK0Ingk","y":"vOipfo61Sy64XpneRyR5g6NCGXLv_Q7f3-kEDMT-G9U"
            }
      required:
      - credential_configuration_id
    CredentialConfiguration:
      type: object
      properties:
        format:
          type: string
          pattern: "^[dv]c\\+sd-jwt$"
        vct:
          type: string
          description: |
            String designating the type of the Credential, as defined in sd-jwt-vc
        vct_metadata_uri:
          type: string
          description: |
            Allowing for an indirection if using urn:vct resolver
        vct_metadata_uri#integrity:
          type: string
          description: |
            Allowing for validating content received from vct_metadata_uri as defined in W3C SRI (Subresource Integrity)
        vct_version:
          type: string
          description: |
            The vct_version indicates the version of the vct. It is recommended to use semver-notation
        vct_subtype:
          type: string
          description: |
            An optional value that can describe an adaption of the vct.
            This value can then be used by verifiers who require the adoption of the vct standard.
        vct_subtype_version:
          type: string
          description: |
            The vct_subtype_version indicates the version of the vct_subtype. It is recommended to use semver-notation
        cryptographic_binding_methods_supported:
          type: array
          description: |2
                 A non-empty array of case sensitive strings that identify the representation of the cryptographic key material that the issued Credential is bound.
                 If missing, credential will be issued as unbound VC.
          items:
            type: string
            description: |2
                   A non-empty array of case sensitive strings that identify the representation of the cryptographic key material that the issued Credential is bound.
                   If missing, credential will be issued as unbound VC.
            pattern: ^jwk$
        credential_signing_alg_values_supported:
          type: array
          items:
            type: string
            pattern: ^ES256|Ed25519$
        proof_types_supported:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/SupportedProofType"
        display:
          type: array
          items:
            $ref: "#/components/schemas/MetadataCredentialDisplayInfo"
        credential_metadata:
          $ref: "#/components/schemas/CredentialConfigurationMetadata"
        protected_issuance_authorization_trust_statement:
          type: string
          description: Protected Issuance Authorization Trust Statement (piaTS) JWT
            proving issuance authorization for protected VC formats.
      required:
      - format
      - vct
    CredentialConfigurationMetadata:
      type: object
      description: |
        Object containing information relevant to the usage and display of issued Credentials.
        Credential Format-specific mechanisms can overwrite the information in this object to convey
        Credential metadata. Format-specific mechanisms, such as SD-JWT VC display metadata are always
        preferred by the Wallet over the information in this object, which serves as the default fallback.
      properties:
        display:
          type: array
          items:
            $ref: "#/components/schemas/MetadataCredentialDisplayInfo"
        claims:
          type: array
          items:
            $ref: "#/components/schemas/MetadataClaimDescriptor"
    CredentialEndpointResponse:
      type: object
      properties:
        credentials:
          type: array
          items:
            $ref: "#/components/schemas/CredentialObjectDto"
    CredentialInfoResponse:
      type: object
      properties:
        status:
          $ref: "#/components/schemas/CredentialStatusType"
        metadata_credential_supported_id:
          type: array
          items:
            type: string
        credential_metadata:
          $ref: "#/components/schemas/CredentialOfferMetadataDto"
        holder_jwks:
          type: array
          items:
            type: string
        key_attestations:
          type: array
          items:
            type: string
        client_agent_info:
          $ref: "#/components/schemas/ClientAgentInfoDto"
        offer_expiration_timestamp:
          type: integer
          format: int64
        deferred_offer_expiration_seconds:
          type: integer
          format: int32
        credential_valid_from:
          type: string
          format: date-time
        credential_valid_until:
          type: string
          format: date-time
        offer_deeplink:
          type: string
        vc_hash:
          type: array
          items:
            type: string
    CredentialManagementDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          $ref: "#/components/schemas/CredentialStatusType"
        renewal_request_count:
          type: integer
          format: int32
        renewal_response_count:
          type: integer
          format: int32
        credential_offers:
          type: array
          items:
            $ref: "#/components/schemas/CredentialInfoResponse"
        dpop_key:
          type: string
    CredentialObjectDto:
      type: object
      properties:
        credential:
          type: string
          description: |
            One sdjwt credential as string, if multiple credentials are issued each is wrapped in
            a separate CredentialObjectDto object.
    CredentialOfferMetadataDto:
      type: object
      properties:
        deferred:
          type: boolean
        vct_metadata_uri:
          type: string
          maxLength: 2147483647
          minLength: 1
        vct_metadata_uri#integrity:
          type: string
          maxLength: 2147483647
          minLength: 1
    CredentialResponseEncryption:
      type: object
      properties:
        jwk:
          type: object
          additionalProperties: {}
        enc:
          type: string
      required:
      - enc
      - jwk
    CredentialStatusType:
      type: string
      description: |2
            Status for the full lifecycle of a verifiable credential.
            OFFERED - an offer link has been created, and not yet redeemed by a holder.
            CANCELLED - the VC was revoked before being claimed.
            IN_PROGRESS - very short lived state, if the Holder has redeemed the one-time-code, but not yet gotten their credential. To allow a holder to retry fetching the vc set the state to offered.
            DEFERRED - the offer has been used and all necessary data from the wallet has been received but the credential is not yet issued. To use this state the credential metadata entry has to have deferred set to true.
            READY - Status set by the business issuer to continue the issuance of the credential for the deferred flow.
            ISSUED - the VC has been collected by the holder and is valid.
            SUSPENDED - the VC has been temporarily suspended. To unsuspend change state to issued.
            REVOKED - the VC has been revoked. This state is final and can not be changed.
            EXPIRED - the lifetime of the VC expired (not used yet)
      enum:
      - INIT
      - OFFERED
      - CANCELLED
      - IN_PROGRESS
      - DEFERRED
      - READY
      - ISSUED
      - SUSPENDED
      - REVOKED
      - REQUESTED
      - EXPIRED
      example: SUSPENDED
    CredentialWithDeeplinkResponse:
      type: object
      properties:
        management_id:
          type: string
          format: uuid
        offer_id:
          type: string
          format: uuid
        offer_deeplink:
          type: string
    DeferredCredentialEndpointRequest:
      type: object
      description: Request to the deferred credential endpoint.
      properties:
        transaction_id:
          type: string
          format: uuid
          description: Id received from the create credential request for the deferred
            flow.
        credential_response_encryption:
          $ref: "#/components/schemas/CredentialResponseEncryption"
          description: |
            Note that this object will be used for encrypting the response, regardless of what was sent in the initial Credential Request.
            If this parameter is missing, the credential_response_encryption sent in the credential request will be used.
      required:
      - transaction_id
    DeferredCredentialPendingResponse:
      type: object
      properties:
        transaction_id:
          type: string
          description: String identifying the Deferred Issuance transaction for subsequent
            polling.
        interval:
          type: integer
          format: int64
          description: Minimum number of seconds the Wallet MUST wait before polling
            again.
      required:
      - interval
      - transaction_id
    IssuerCredentialRequestEncryption:
      type: object
      properties:
        enc_values_supported:
          type: array
          description: List of supported JWE encryption algorithms
          items:
            type: string
            description: List of supported JWE encryption algorithms
            pattern: ^(A128GCM|A256GCM)$
          minItems: 1
        zip_values_supported:
          type: array
          description: If present must be a non-empty array of JWE compression algorithms
          items:
            type: string
            description: If present must be a non-empty array of JWE compression algorithms
        encryption_required:
          type: boolean
          description: Boolean value specifying whether the Credential Issuer requires
            the additional encryption on top of TLS
        jwks:
          type: object
          additionalProperties:
            type: object
            description: "A JSON Web Key Set that contains one or more public keys,\
              \ to be used by the Wallet as an input to a key agreement for encryption\
              \ of the Credential Request."
            example:
              keys:
              - kty: EC
                crv: P-256
                kid: ec91e148-974d-47f1-9891-4b89d8bad57c
                x: rm2YkWAJ2V84gS00DqeGR6MXHgW3FWISG45Vop0cWv4
                "y": ktSScp7s2fWSdq_7c6iOUI9AYFwQahXG60Nr9SL68mY
          description: "A JSON Web Key Set that contains one or more public keys,\
            \ to be used by the Wallet as an input to a key agreement for encryption\
            \ of the Credential Request."
          example:
            keys:
            - kty: EC
              crv: P-256
              kid: ec91e148-974d-47f1-9891-4b89d8bad57c
              x: rm2YkWAJ2V84gS00DqeGR6MXHgW3FWISG45Vop0cWv4
              "y": ktSScp7s2fWSdq_7c6iOUI9AYFwQahXG60Nr9SL68mY
      required:
      - enc_values_supported
      - encryption_required
    IssuerCredentialResponseEncryption:
      type: object
      properties:
        enc_values_supported:
          type: array
          description: List of supported JWE encryption algorithms
          items:
            type: string
            description: List of supported JWE encryption algorithms
            pattern: ^(A128GCM|A256GCM)$
          minItems: 1
        zip_values_supported:
          type: array
          description: If present must be a non-empty array of JWE compression algorithms
          items:
            type: string
            description: If present must be a non-empty array of JWE compression algorithms
        encryption_required:
          type: boolean
          description: Boolean value specifying whether the Credential Issuer requires
            the additional encryption on top of TLS
        alg_values_supported:
          type: array
          items:
            type: string
            pattern: ^ECDH-ES$
          minItems: 1
      required:
      - alg_values_supported
      - enc_values_supported
      - encryption_required
    IssuerMetadata:
      type: object
      description: |
        The OID4VCI Credential Issuer Metadata contains information on the Credential Issuer's technical capabilities,
        supported Credentials, and (internationalized) display information.
      properties:
        credential_issuer:
          type: string
          description: The Credential Issuer's identifier
        authorization_servers:
          type: array
          items:
            type: string
        credential_endpoint:
          type: string
          description: |
            Information for the holder where to get the credential.
          pattern: ^.+/credential$
        nonce_endpoint:
          type: string
          description: |
            Nonce for proof of possessions. Required for VCs to be bound to a holder.
          pattern: ^.+/nonce$
        deferred_credential_endpoint:
          type: string
        credential_configurations_supported:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/CredentialConfiguration"
        credential_request_encryption:
          $ref: "#/components/schemas/IssuerCredentialRequestEncryption"
        credential_response_encryption:
          $ref: "#/components/schemas/IssuerCredentialResponseEncryption"
        batch_credential_issuance:
          $ref: "#/components/schemas/BatchCredentialIssuance"
        display:
          type: array
          description: "Array of objects, where each object contains display properties\
            \ of a Credential Issuer for a certain language"
          items:
            $ref: "#/components/schemas/MetadataIssuerDisplayInfo"
        profile_version:
          type: string
        credential_issuer_identity_trust_statement:
          type: string
          description: Identity Trust Statement (idTS) JWT proving the issuer's identity
            within the Swiss Trust ecosystem.
      required:
      - credential_configurations_supported
      - credential_endpoint
      - credential_issuer
      - nonce_endpoint
    KeyAttestationRequirement:
      type: object
      properties:
        key_storage:
          type: array
          items:
            type: string
            enum:
            - iso_18045_high
            - iso_18045_enhanced-basic
      required:
      - key_storage
    Link:
      type: object
      properties:
        href:
          type: string
        templated:
          type: boolean
    MetadataClaimDescriptor:
      type: object
      description: |
        A claims description object as used in the Credential Issuer metadata is an object used to describe
        how a certain claim in the Credential is displayed to the End-User.
      properties:
        path:
          type: array
          items:
            type: object
          minItems: 1
        mandatory:
          type: boolean
        display:
          type: array
          items:
            $ref: "#/components/schemas/MetadataDisplayInfo"
          maxItems: 2147483647
          minItems: 1
      required:
      - path
    MetadataCredentialDisplayInfo:
      type: object
      properties:
        locale:
          type: string
          description: |
            String value that identifies the language of this object represented as a language tag taken
            from values defined in BCP47 [RFC5646]. There MUST be only one object for each language identifier.
          example: de-CH
        name:
          type: string
          minLength: 1
        logo:
          $ref: "#/components/schemas/MetadataLogo"
        description:
          type: string
        background_color:
          type: string
          description: |-
            String value of a background color of the Credential represented as numerical color values defined
            in CSS Color Module Level 3
        background_image:
          $ref: "#/components/schemas/MetadataImage"
        text_color:
          type: string
          deprecated: true
          description: |
            Not supported in swiss-profile-issuance 1.0. Wallets may choose ignored to ignore this value.
            String with information in which colour to display texts.
      required:
      - name
    MetadataDisplayInfo:
      type: object
      properties:
        locale:
          type: string
          description: |
            String value that identifies the language of this object represented as a language tag taken
            from values defined in BCP47 [RFC5646]. There MUST be only one object for each language identifier.
          example: de-CH
        name:
          type: string
          minLength: 1
      required:
      - name
    MetadataImage:
      type: object
      properties:
        uri:
          type: string
          description: |-
            String value that contains a data URL containing the logo of the Credential Issuer.
            The Wallet needs to determine the scheme, since the URI value could use the https: scheme, the data: scheme, etc.
          pattern: "^data:image/(png|jpeg);base64,.*$"
      required:
      - uri
    MetadataIssuerDisplayInfo:
      type: object
      properties:
        locale:
          type: string
          description: |
            String value that identifies the language of this object represented as a language tag taken
            from values defined in BCP47 [RFC5646]. There MUST be only one object for each language identifier.
          example: de-CH
        name:
          type: string
          minLength: 1
        logo:
          $ref: "#/components/schemas/MetadataLogo"
      required:
      - name
    MetadataLogo:
      type: object
      properties:
        uri:
          type: string
          description: |-
            String value that contains a data URL containing the logo of the Credential Issuer.
            The Wallet needs to determine the scheme, since the URI value could use the https: scheme, the data: scheme, etc.
          pattern: "^data:image/(png|jpeg);base64,.*$"
        alt_text:
          type: string
          description: String value of the alternative text for the logo image
      required:
      - uri
    NonceResponse:
      type: object
      properties:
        c_nonce:
          type: string
          description: String containing an unpredictable challenge to be used when
            creating a proof of possession of the key.
      required:
      - c_nonce
    OAuthAuthorizationServerMetadata:
      type: object
      properties:
        issuer:
          type: string
          description: The Issuer Identifier
        token_endpoint:
          type: string
          description: URL of the OAuth 2.0 Token Endpoint
        dpop_signing_alg_values_supported:
          type: array
          items:
            type: string
        profile_version:
          type: string
        pre-authorized_grant_anonymous_access_supported:
          type: boolean
      required:
      - issuer
      - token_endpoint
    OAuthToken:
      type: object
      properties:
        scope:
          type: string
        access_token:
          type: string
        refresh_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
          format: int64
      required:
      - access_token
    OauthAccessTokenRequest:
      type: object
      properties:
        grant_type:
          type: string
          default: urn:ietf:params:oauth:grant-type:pre-authorized_code
          description: The type of grant being requested. Must be 'urn:ietf:params:oauth:grant-type:pre-authorized_code'
            or 'refresh_token.
          minLength: 1
        pre-authorized_code:
          type: string
        refresh_token:
          type: string
      required:
      - grant_type
    ProofsDto:
      type: object
      properties:
        jwt:
          type: array
          description: |
            ProofsDto represents the proofs object in the OID4VCI Credential Request.
          example: jwt
          items:
            type: string
          minItems: 1
      required:
      - jwt
    StatusList:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: Id of the status list used by the business issuer.
        statusRegistryUrl:
          type: string
          description: URI of the status list used by registry.
        maxListEntries:
          type: integer
          format: int32
          description: How many status entries can be part of the status list. The
            memory size of the status list is depending on the type and the config
            of the status list.
          example: 100000
        remainingListEntries:
          type: integer
          format: int32
          description: How many status entries are not used in the  status list.
          example: 12
        config:
          type: object
          additionalProperties: {}
          description: |2
                 Additional config parameters, depending on the status list type. For Example
                 {"bits": 2}
                 for token status list with revocation & suspension
                 {"purpose": "suspension"}
                 for a bit string status list for suspension
          example:
            bits: 2
    StatusListCreate:
      type: object
      properties:
        type:
          type: string
          description: "[DEPRECATED] This parameter is deprecated and should not be\
            \ sent in future requests."
        maxLength:
          type: integer
          format: int32
          description: How many status entries can be part of the status list. The
            memory size of the status list is depending on the type and the config
            of the status list.
          example: 100000
          minimum: 1
        config:
          $ref: "#/components/schemas/StatusListCreateConfig"
          description: |2
                 Additional config parameters, depending on the status list type. For Example
                 {"bits": 2}
                 for token status list with revocation & suspension
                 {"purpose": "suspension"}
                 for a bit string status list for suspension
          example:
            bits: 2
        configuration_override:
          $ref: "#/components/schemas/ConfigurationOverride"
          description: "Optional Parameter to override configured parameters, such\
            \ as the DID used or the HSM key used in singing the request object"
      required:
      - config
      - maxLength
    StatusListCreateConfig:
      type: object
      properties:
        purpose:
          type: string
        bits:
          type: integer
          format: int32
          description: "The number of bits used per Referenced Token. More bits allow\
            \ additional states. 1 bit is only revocation, 2 bits is revocation and\
            \ suspension of a credential. Possible values are 1, 2, 4, 8."
          example: 2
      required:
      - bits
    StatusListUpdate:
      type: object
      description: Optional overrides for status list updates.
      properties:
        configuration_override:
          $ref: "#/components/schemas/ConfigurationOverride"
          description: "Optional Parameter to override configured parameters, such\
            \ as the DID used or the HSM key used in signing the status list"
    StatusResponse:
      type: object
      properties:
        status:
          $ref: "#/components/schemas/CredentialStatusType"
    SupportedProofType:
      type: object
      properties:
        proof_signing_alg_values_supported:
          type: array
          items:
            type: string
            pattern: ^ES256|Ed25519$
        key_attestations_required:
          $ref: "#/components/schemas/KeyAttestationRequirement"
    UpdateCredentialStatusRequestType:
      type: string
      description: |2
            Status for the full lifecycle of a verifiable credential.
            CANCELLED - the VC was revoked before being claimed.
            READY - Status set by the business issuer to continue the issuance of the credential for the deferred flow
            SUSPENDED - the VC has been temporarily suspended. To unsuspend change state to issued.
            REVOKED - the VC has been revoked. This state is final and can not be changed.
      enum:
      - CANCELLED
      - READY
      - ISSUED
      - SUSPENDED
      - REVOKED
      example: SUSPENDED
    UpdateStatusResponse:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          $ref: "#/components/schemas/CredentialStatusType"
        status_lists:
          type: array
          items:
            type: string
            format: uuid
    WebhookCallback:
      type: object
      description: Callback transmitting information about an event which occurred.
      properties:
        subject_id:
          type: string
          format: uuid
        event_type:
          type: string
          enum:
          - VC_STATUS_CHANGED
          - VC_DEFERRED
          - ISSUANCE_ERROR
        event:
          type: string
        event_description:
          type: string
        event_trigger:
          type: string
          enum:
          - CREDENTIAL_MANAGEMENT
          - CREDENTIAL_OFFER
        timestamp:
          type: string
          format: date-time
  securitySchemes:
    bearer-jwt:
      type: http
      scheme: bearer
      bearerFormat: JWT