openapi: 3.1.0
info:
title: Verifier API
description: Generic Verifier service
servers:
- url: http://localhost:8080
description: Generated server url
tags:
- name: Verifier Management API
description: This API allows the creation of a verfication process and retrieval
of its status.It is used by the business verifier to manage verifications. (IF-100)
- name: Verfifier OID4VP API
description: "Handles OpenID for Verifiable Presentations (OID4VP) endpoints, enabling\
\ verifiers to retrieve request objects, receive verification presentations, and\
\ access OpenID client metadata as specified by the OID4VP protocol. This API\
\ is intended for wallets to fetch credentials in compliance with OpenID standards.\
\ (IF-101)"
- name: Actuator
description: Monitor and interact
externalDocs:
description: Spring Boot Actuator Web API Documentation
url: https://docs.spring.io/spring-boot/docs/current/actuator-api/html/
paths:
/oid4vp/api/request-object/{request_id}/response-data:
post:
tags:
- Verfifier OID4VP API
summary: Receive Verification Presentation (from e.g. Wallet)
description: "Handles various types of verification presentations including\
\ standard presentations, rejections, DCQL presentations, and encrypted DCQL\
\ presentations. The method automatically determines the request type based\
\ on the provided parameters."
externalDocs:
description: OpenId4VP response parameters
url: https://openid.net/specs/openid-4-verifiable-presentations-1_0-ID2.html#section-6.1
operationId: receiveVerificationPresentation
parameters:
- name: request_id
in: path
description: The unique identifier of the verification request
required: true
schema:
type: string
format: uuid
- name: SWIYU-API-Version
in: header
description: "Optional API version. Supported values: 2 (DEFAULT) - This supports\
\ OID4VP 1.0"
required: false
schema:
type: string
enum:
- "2"
requestBody:
content:
application/x-www-form-urlencoded:
schema:
$ref: "#/components/schemas/VerificationPresentationUnion"
description: The verification presentation request. Type is determined
automatically based on the provided parameters.
required: true
responses:
"400":
description: Bad Request. The request body is not valid
content:
application/json:
schema:
$ref: "#/components/schemas/ApiErrorDto"
"200":
description: Verification Presentation received and processed successfully
content:
application/json:
schema:
type: object
/management/api/verifications:
post:
tags:
- Verifier Management API
summary: Creates a new verification process with the given attributes
operationId: createVerification
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/CreateVerificationManagement"
required: true
responses:
"400":
description: Bad Request. The request body is not valid
content:
'*/*':
schema:
$ref: "#/components/schemas/ApiErrorDto"
"200":
description: Verification created
content:
'*/*':
schema:
$ref: "#/components/schemas/ManagementResponse"
/oid4vp/api/request-object/{request_id}:
get:
tags:
- Verfifier OID4VP API
summary: Get Request Object
description: Can return a RequestObjectDto as JSON Object or a SignedJWT String
depending on JAR (JWT secured authorization request) flag in verifier management
operationId: getRequestObject
parameters:
- name: request_id
in: path
required: true
schema:
type: string
format: uuid
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: |-
Request object either as plaintext or signed JWT.
The 'application/oauth-authz-req+jwt' representation is a compact serialized JWS (optionally nested JWE) representing the Request Object claims. As this is a JWT and not a JSON object, its structural requirements cannot be expressed as a JSON Schema and are documented here instead:
- The JOSE header MUST require the 'profile_version' parameter to indicate the Swiss Profile version.
- The JWT Claims Set corresponds to the [RequestObject](#/components/schemas/RequestObject) schema documented for the 'application/json' representation below, with 'request' and 'request_uri' claims strictly prohibited.
The 'application/json' representation is kept for documentation purposes only, mirroring the JWT Claims Set of the 'application/oauth-authz-req+jwt' representation; it is not actually returned when JAR (JWT-secured Authorization Request) is enabled.
content:
application/oauth-authz-req+jwt:
schema:
type: string
format: jwt
application/json:
schema:
$ref: "#/components/schemas/RequestObject"
"404":
description: Request Object not found
content:
application/oauth-authz-req+jwt:
schema:
$ref: "#/components/schemas/ApiErrorDto"
application/json:
schema:
$ref: "#/components/schemas/ApiErrorDto"
/oid4vp/api/openid-client-metadata.json:
get:
tags:
- Verfifier OID4VP API
summary: Get client metadata
description: "Metadata providing further information about the verifier, such\
\ as name and logo."
operationId: getOpenIdClientMetadata
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: Request object either as plaintext or signed JWT
content:
application/json:
schema:
$ref: "#/components/schemas/OpenidClientMetadataDto"
examples:
Sample Client Metadata:
description: Sample Client Metadata
value:
client_name#en: English name (all regions)
client_name#fr: French name (all regions)
client_name#de-DE: German name (region Germany)
client_name#de-CH: German name (region Switzerland)
client_name#de: German name (fallback)
client_name: Fallback name
client_logo: www.example.com/logo.png
client_logo#fr: www.example.com/logo_fr.png
/management/api/verifications/{verificationId}:
get:
tags:
- Verifier Management API
summary: Get verification by id
operationId: getVerification
parameters:
- name: verificationId
in: path
required: true
schema:
type: string
format: uuid
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: Verification found
content:
'*/*':
schema:
$ref: "#/components/schemas/ManagementResponse"
"404":
description: Verification not found or already expired
content:
'*/*':
schema:
$ref: "#/components/schemas/ApiErrorDto"
/actuator:
get:
tags:
- Actuator
summary: Actuator root web endpoint
operationId: links
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
application/json:
schema:
type: object
additionalProperties:
type: object
additionalProperties:
$ref: "#/components/schemas/Link"
/actuator/prometheus:
get:
tags:
- Actuator
summary: Actuator web endpoint 'prometheus'
operationId: scrape
parameters:
- name: format
in: query
schema:
type: string
enum:
- CONTENT_TYPE_004
- CONTENT_TYPE_OPENMETRICS_100
- CONTENT_TYPE_PROTOBUF
- name: includedNames
in: query
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
text/plain;version=0.0.4;charset=utf-8:
schema:
type: object
application/openmetrics-text;version=1.0.0;charset=utf-8:
schema:
type: object
application/vnd.google.protobuf;proto=io.prometheus.client.MetricFamily;encoding=delimited:
schema:
type: object
/actuator/info:
get:
tags:
- Actuator
summary: Actuator web endpoint 'info'
operationId: info
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/health:
get:
tags:
- Actuator
summary: Actuator web endpoint 'health'
operationId: health
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/env:
get:
tags:
- Actuator
summary: Actuator web endpoint 'env'
operationId: environment
parameters:
- name: pattern
in: query
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
/actuator/env/{toMatch}:
get:
tags:
- Actuator
summary: Actuator web endpoint 'env-toMatch'
operationId: environmentEntry
parameters:
- name: toMatch
in: path
required: true
schema:
type: string
responses:
"400":
description: Bad Request
content:
'*/*':
schema:
type: object
"200":
description: OK
content:
application/vnd.spring-boot.actuator.v3+json:
schema:
type: object
application/vnd.spring-boot.actuator.v2+json:
schema:
type: object
application/json:
schema:
type: object
"404":
description: Not Found
components:
schemas:
VerificationPresentationUnion:
type: object
description: Union DTO that contains all possible parameters from all verification
presentation types. Only the relevant fields should be populated based on
the request type.
properties:
vp_token:
description: "VP token that can be either a string for standard presentations\
\ or a JSON object for DCQL presentations. For standard/PE presentations:\
\ JWT token string. For DCQL presentations: Object containing credential\
\ query results where keys are query IDs and values are arrays of presentations."
example: |-
Standard/PE: "eyJhbGci...QMA"
DCQL: {"my_credential": ["eyJhbGci...QMA", "eyJhbGci...QMA"]}
oneOf:
- type: string
- {}
error:
type: string
description: Error code for rejection (used for REJECTION)
enum:
- invalid_scope
- invalid_request
- invalid_client
- vp_formats_not_supported
- invalid_presentation_definition_uri
- invalid_presentation_definition_reference
- client_rejected
- access_denied
example: client_rejected
error_description:
type: string
description: Error description for rejection (used for REJECTION)
example: The owner has declined the verification request.
response:
type: string
description: Encrypted response JWE string (used for DCQLE)
example: eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldFIn0...
state:
type: string
description: |
The OAuth State is an opaque value used by the client to maintain state between the request and callback.
If provided in the request object the state string MUST be returned in the response.
ApiErrorDto:
type: object
properties:
error:
type: string
error_description:
type: string
detail:
type: string
DcqlClaimDto:
type: object
description: Represents an individual claim object within the 'claims' array
of a Credential Query according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.3
properties:
id:
type: string
description: "REQUIRED if claim_sets is present in the Credential Query;\
\ OPTIONAL otherwise. A string identifying the particular claim. The value\
\ MUST be a non-empty string consisting of alphanumeric, underscore (_),\
\ or hyphen (-) characters. Within the particular claims array, the same\
\ id MUST NOT be present more than once."
pattern: "^[a-zA-Z0-9_-]+$"
path:
type: array
description: "The path to the claim within the credential. According to\
\ OpenID for Verifiable Presentations 1.0, Section 6.3, property 'path'.https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#claims_path_pointer"
items: {}
minItems: 1
values:
type:
- array
- "null"
description: "OPTIONAL. A non-empty array of strings, integers or boolean\
\ values that specifies the expected values of the claim. If the values\
\ property is present, the Wallet SHOULD return the claim only if the\
\ type and value of the claim both match exactly for at least one of the\
\ elements in the array. Details of the processing rules are defined in\
\ Section 6.4.1."
items: {}
maxItems: 2147483647
minItems: 1
required:
- path
DcqlCredentialDto:
type: object
description: Represents a Credential Query within a DCQL query according to
https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.1
properties:
id:
type: string
description: "A string identifying the Credential in the response and, if\
\ provided, the constraints in credential_sets. The value MUST be a non-empty\
\ string consisting of alphanumeric, underscore (_) or hyphen (-) characters.\
\ Within the Authorization Request, the same id MUST NOT be present more\
\ than once. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6.1, property 'id'."
minLength: 1
pattern: "^[a-zA-Z0-9_-]+$"
format:
type: string
description: "A string that specifies the format of the requested Credential.\
\ Valid Credential Format Identifier values are defined in Appendix B.\
\ According to OpenID for Verifiable Presentations 1.0, Section 6.1, property\
\ 'format'."
minLength: 1
meta:
$ref: "#/components/schemas/DcqlCredentialMetaDto"
description: "[NOT FULLY IMPLEMENTED] An object defining additional properties\
\ requested by the Verifier that apply to the metadata and validity data\
\ of the Credential. Parts of this object are not fully supported by this\
\ implementation; please consult the documentation. The properties of\
\ this object are defined per Credential Format. According to OpenID for\
\ Verifiable Presentations 1.0, Section 6.1, property 'meta'."
claims:
type: array
description: "An optional non-empty array of Claims Query objects, specifying\
\ individual claims. According to OpenID for Verifiable Presentations\
\ 1.0, Section 6.1, property 'claims'."
items:
$ref: "#/components/schemas/DcqlClaimDto"
maxItems: 2147483647
minItems: 1
require_cryptographic_holder_binding:
type: boolean
description: "A boolean indicating if cryptographic holder binding is required.\
\ If true, the Wallet MUST return a Verifiable Presentation of a Verifiable\
\ Credential. If false, a Verifiable Credential without Holder Binding\
\ MAY be returned. If omitted, the default is to require cryptographic\
\ holder binding. According to OpenID for Verifiable Presentations 1.0,\
\ Section 6.1, property 'require_cryptographic_holder_binding'. Also referenced\
\ in Appendix B.1. See Section 6.1 and Appendix B.1."
required:
- format
- id
- meta
DcqlCredentialMetaDto:
type: object
description: Represents metadata parameters within a Credential Query according
to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.1
properties:
type_values:
type: array
description: "For W3C Verifiable Credentials: A non-empty array of arrays\
\ of strings that specifies allowed values for the 'type' of the requested\
\ Verifiable Credential. According to OpenID for Verifiable Presentations\
\ 1.0, Appendix B.1.1, property 'type_values'."
items:
type: array
items:
type: string
maxItems: 2147483647
minItems: 1
vct_values:
type: array
description: "For IETF SD-JWT VC: A non-empty array of strings that specifies\
\ allowed values for the type of the requested Verifiable Credential.\
\ According to OpenID for Verifiable Presentations 1.0, Appendix B.3.5,\
\ property 'vct_values'."
items:
type: string
maxItems: 2147483647
minItems: 1
doctype_value:
type: string
description: "For ISO mdoc: A string that specifies an allowed value for\
\ the 'doctype' of the requested Verifiable Credential. It MUST be a valid\
\ doctype identifier. According to OpenID for Verifiable Presentations\
\ 1.0, Appendix B.2.3, property 'doctype_value'."
DcqlCredentialSetDto:
type: object
description: Represents a Credential Set Query within a DCQL query according
to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.2
properties:
options:
type: array
description: "A non-empty array, where each value in the array is a list\
\ of Credential Query identifiers representing one set of Credentials\
\ that satisfies the use case. According to OpenID for Verifiable Presentations\
\ 1.0, 6.2 Credential Set Query, property 'options'."
items:
type: array
items:
type: string
minItems: 1
required:
type: boolean
default: true
description: "A boolean indicating if this credential set is required. (default\
\ is true)According to OpenID for Verifiable Presentations 1.0, 6.2. Credential\
\ Set Query, property 'required'."
required:
- options
DcqlQueryDto:
type: object
description: Represents the Digital Credentials Query Language (DCQL) query
according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6
**⚠️ Not yet implemented**
example:
credentials:
- id: identity_credential_dcql
format: dc+sd-jwt
meta:
vct_values:
- https://credentials.example.com/identity_credential
claims:
- path:
- given_name
- path:
- family_name
- path:
- address
- street_address
require_cryptographic_holder_binding: true
- id: university_degree_dcql
format: dc+sd-jwt
meta:
vct_values:
- https://credentials.example.com/university_degree
claims:
- path:
- degree_name
- path:
- graduation_year
credential_sets:
- options:
- - identity_credential_dcql
- - university_degree_dcql
required: true
properties:
credentials:
type: array
description: "A non-empty array of Credential Queries that specify the requested\
\ Credentials. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6, property 'credentials'."
items:
$ref: "#/components/schemas/DcqlCredentialDto"
minItems: 1
credential_sets:
type: array
description: "An optional non-empty array of Credential Set Queries that\
\ specifies additional constraints on which of the requested Credentials\
\ to return. According to OpenID for Verifiable Presentations 1.0, Section\
\ 6, property 'credential_sets'."
items:
$ref: "#/components/schemas/DcqlCredentialSetDto"
required:
- credentials
x-implementation-status:
status: not-implemented
ManagementResponse:
type: object
properties:
id:
type: string
format: uuid
request_nonce:
type: string
state:
$ref: "#/components/schemas/VerificationStatus"
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
wallet_response:
$ref: "#/components/schemas/ResponseData"
verification_url:
type: string
verification_deeplink:
type: string
ResponseData:
type: object
properties:
error_code:
$ref: "#/components/schemas/VerificationErrorResponseCode"
error_description:
type: string
credential_subject_data:
type: object
additionalProperties: {}
VerificationErrorResponseCode:
type: string
description: |
| Value | Description |
|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| credential_invalid | The credential presented during validation was deemed invalid.
This is a general purpose code if none of the other codes apply. |
| jwt_expired | During the verification process an expired jwt was used. |
| jwt_premature | During the verification process a not yet valid jwt was used. |
| missing_nonce | During the verification process a nonce was missing. |
| invalid_format | The data send in the verification process used an invalid format. |
| credential_expired | The credential presented during validation was expired. |
| unsupported_format | The credential presented during validation was in an unsupported format. |
| credential_revoked | The credential presented during validation was revoked. |
| credential_suspended | The credential presented during validation was suspended. |
| credential_missing_data | The credential presented during validation does not contain the required fields. |
| unresolvable_status_list | The credential presented during validation contains a status list which cannot be reached during validation. |
| public_key_of_issuer_unresolvable | The credential presented during validation was issued by an entity that does not provide the public key at the time of verification. |
| issuer_not_accepted | The credential presented during validation was issued by an entity that is not in the list of allowed issuers. |
| malformed_credential | The credential presented during validation isnt valid according to the format specification in question |
| holder_binding_mismatch | The holder has provided invalid proof that the credential is under their control. |
| client_rejected | The holder rejected the verification request. |
| issuer_not_accepted | The issuer of the vc was not in the allow-list given in the verification request. |
| authorization_request_missing_error_param | During the verification process a required parameter (eg.: vp_token, presentation) was not provided in the request. |
| authorization_request_object_not_found | The requested verification process cannot be found. |
| verification_process_closed | The requested verification process is already closed. |
| invalid_presentation_definition | The provided credential presentation was invalid. |
| presentation_submission_constraint_violated | The presentation submission provided violated at least one constraint defined in the presentation definition |
| invalid_presentation_submission | The presentation submission couldn't be deserialized and is therefore invalid |
| invalid_scope | Requested scope value is invalid, unknown or malformed |
| invalid_request | Various issues with the request |
| invalid_client | client_metadata parameter exists, but the Wallet recognizes Client Identifier and knows metadata associated with it, Verifier's pre-registered metadata has been found based on the Client Identifier, but client_metadata parameter is also present |
| vp_formats_not_supported | The Wallet doesn't support any of the formats requested by the Verifier |
| invalid_presentation_definition_uri | Presentation Definition URI can't be reached |
| invalid_presentation_definition_reference | Presentation Definition URI can be reached, but the presentation_definition cannot be found there |
enum:
- credential_invalid
- jwt_expired
- invalid_format
- credential_expired
- missing_nonce
- unsupported_format
- credential_revoked
- credential_suspended
- holder_binding_mismatch
- credential_missing_data
- unresolvable_status_list
- public_key_of_issuer_unresolvable
- client_rejected
- issuer_not_accepted
- authorization_request_object_not_found
- authorization_request_missing_error_param
- invalid_presentation_definition
- malformed_credential
- presentation_submission_constraint_violated
- invalid_presentation_submission
- invalid_scope
- invalid_request
- invalid_client
- vp_formats_not_supported
- invalid_presentation_definition_uri
- invalid_presentation_definition_reference
- jwt_premature
- invalid_token_status_list
VerificationStatus:
type: string
enum:
- PENDING
- SUCCESS
- FAILED
ConfigurationOverrideDto:
type: object
description: Override for Verifier configuration to be use for this one verification
properties:
external_url:
type:
- string
- "null"
description: "Override for the EXTERNAL_URL - the url the wallet should\
\ call, to fetch the request object and send the verification response\
\ to."
example: https://www.example.com/verifier
pattern: ^https://.*
verifier_did:
type:
- string
- "null"
description: Override to be used in clientId instead of environment variable
VERIFIER_DID
example: did:webvh:mySCID12345213:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:00000000-0000-0000-0000-000000000000
verification_method:
type:
- string
- "null"
description: "Override for DID_VERIFICATION_METHOD, the id of the public\
\ key in the did document. Most often the full did and a unique id after\
\ #"
example: did:webvh:mySCID12345213:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:00000000-0000-0000-0000-000000000000#myVerificationMethod-xx
key_id:
type:
- string
- "null"
description: ID of the key in the HSM
example: myOverrideHSMKeyId01
key_pin:
type:
- string
- "null"
description: "The pin which protects the key in the hsm, if any. Note that\
\ this only the key pin, not hsm password or partition pin."
example: "11111"
client_metadata:
type:
- object
- "null"
additionalProperties:
type: string
description: |
Optional overrides for individual fields of the client_metadata embedded in the signed
authorization request JWT. Keys follow the OID4VP client_metadata naming conventions,
including locale-tagged variants (e.g. "client_name#en", "client_name#de-CH",
"logo_uri"). Values present here take precedence over the values read
from the configured client-metadata-file.
example:
client_name: My Client Name
client_name#en: My Client Name
client_name#de-CH: Mein Kundenname
logo_uri: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQAABjE+ibYAAAAASUVORK5CYII="
CreateVerificationManagement:
type: object
properties:
accepted_issuer_dids:
type:
- array
- "null"
description: |
List of dids from issuers whose credentials are accepted for this verification.
Will be evaluated before trust anchor.
If not specified and no trust anchor specified all dids are trusted.
example:
- did:example:12345
items:
type: string
trust_anchors:
type:
- array
- "null"
description: |
List of trust anchor dids from the trust registry.
This is an alternative to specifying accepted issuer dids,
if these dids have a trust statement.
All dids trusted by the trust anchor are accepted.
If not specified, trust statements will not be used for this verification.
items:
$ref: "#/components/schemas/TrustAnchor"
jwt_secured_authorization_request:
type: boolean
description: Toggle whether the request-object is available as plain object
oras jwt object signed by the verifier as additional security measure
response_mode:
$ref: "#/components/schemas/ResponseModeType"
description: |-
Requested Response Mode from the wallet to the verifier.
- direct_post - the wallet sends a clear text response
- direct_post.jwt - the wallet sends an encrypted response
configuration_override:
$ref: "#/components/schemas/ConfigurationOverrideDto"
description: "Optional Parameter to override configured parameters, such\
\ as the DID used or the HSM key used in singing the request object"
example: {}
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
verification_purpose:
$ref: "#/components/schemas/VerificationPurpose"
description: "Optional transparency metadata for registration at the TMS.\
\ When present, the verifier registers the DCQL query and injects the\
\ resulting vqPS into subsequent Authorization Requests."
required:
- dcql_query
ResponseModeType:
type: string
description: Supported response_mode as defined in OID4VP
enum:
- direct_post
- direct_post.jwt
TrustAnchor:
type: object
properties:
did:
type: string
example: did:example:12345
minLength: 1
trust_registry_uri:
type: string
description: |
URI of the trust registry to be used for finding the trust anchor.
For the example value the trust anchor would be searched at
https://trust-reg.trust-infra.swiyu-int.admin.ch/api/v1/truststatements/{trust_anchor_did}
example: https://trust-reg.trust-infra.swiyu-int.admin.ch
minLength: 1
pattern: ^https://.*
required:
- did
- trust_registry_uri
VerificationPurpose:
type: object
properties:
scope:
type: string
description: "Unique scope identifier for this specific query, e.g. 'com.example.age_verification'"
example: com.example.age_verification
minLength: 1
purpose_name:
type: object
additionalProperties:
type: string
description: Localized purpose names (max 50 chars per value). Key is language
tag (e.g. 'de-ch'). Must contain a 'default' key with a non-blank value.
example:
default: Age Verification
de-ch: Altersverifikation
minProperties: 1
purpose_description:
type: object
additionalProperties:
type: string
description: Localized purpose descriptions (max 500 chars per value). Key
is language tag (e.g. 'de-ch'). Must contain a 'default' key with a non-blank
value.
example:
default: Age Verification required for xyz
minProperties: 1
required:
- purpose_description
- purpose_name
- scope
JWKSet:
type: object
properties:
keys:
type: array
items:
$ref: "#/components/schemas/JsonWebKey"
JsonWebKey:
type: object
properties:
kty:
type: string
kid:
type: string
use:
type: string
alg:
type: string
"n":
type: string
e:
type: string
crv:
type: string
x:
type: string
"y":
type: string
OpenIdClientMetadataVpFormatSdJwt:
type: object
properties:
sd-jwt_alg_values:
type:
- array
- "null"
items:
type: string
kb-jwt_alg_values:
type:
- array
- "null"
items:
type: string
OpenIdClientMetadataVpFormatsSupported:
type: object
properties:
dc+sd-jwt:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormatSdJwt"
OpenidClientMetadataDto:
type: object
description: |-
Verifier metadata values.
Additional Verifier metadata parameters MAY be defined and used, as described in [RFC7591].
The Wallet MUST ignore any unrecognized parameters.
properties:
jwks:
$ref: "#/components/schemas/JWKSet"
description: |
One or more public keys, such as those used by the Wallet as an input to a key agreement
that may be used for encryption of the Authorization Response, or where the Wallet will
require the public key of the Verifier to generate a Verifiable Presentation.
Public keys included in this parameter MUST NOT be used to verify the signature of signed Authorization Requests
encrypted_response_enc_values_supported:
type: array
description: |-
If present, should be non-empty array of JWE algorithms as in RFC7516.
When a response_mode requiring encryption of the Response (such as direct_post.jwt) is specified,
one of the specified algorithms is to be used.
items:
type: string
vp_formats_supported:
$ref: "#/components/schemas/OpenIdClientMetadataVpFormatsSupported"
description: |
An object containing a list of name/value pairs, where the name is a Credential Format Identifier and the
value defines format-specific parameters that a Verifier supports.
additionalProperties:
type: object
additionalProperties: {}
required:
- encrypted_response_enc_values_supported
- jwks
- vp_formats_supported
RequestObject:
type: object
description: |
OID4VP Request Object sent to the Wallet as response after receiving an Authorization Request.
Contains either a Presentation Exchange (PE) presentation_definition or a DCQL query (dcql_query), depending on the verification request format.
- If the verification was initiated using the older PE format, the presentation_definition field is used.
- If the verification was initiated using the new DCQL format, the dcql_query field is used.
properties:
client_id:
type: string
response_type:
type: string
response_mode:
$ref: "#/components/schemas/ResponseModeType"
description: |
If "direct_post", expect the response to be sent via an HTTPS connection to response_uri.
If "direct_post.jwt" expects the response to also be encrypted.
response_uri:
type: string
nonce:
type: string
version:
type: string
dcql_query:
$ref: "#/components/schemas/DcqlQueryDto"
description: |
DCQL query object as an Authorization Request parameter.
This field is used for requests initiated with the DCQL format and contains the Digital Credentials Query Language (DCQL) query.
Mutually exclusive with the {@code scope} parameter: only one of the two may be present.
scope:
type: string
description: |
OAuth2 scope value identifying the DCQL query registered in the vqPS.
MUST be present when a vqPS is injected into verifier_info.
Mutually exclusive with dcql_query.
client_metadata:
$ref: "#/components/schemas/OpenidClientMetadataDto"
description: "A JSON object containing the Verifier metadata values providing\
\ further information about the verifier, such as name and logo. It is\
\ UTF-8 encoded. It MUST NOT be present if client_metadata_uri parameter\
\ is present."
example: |-
{
"client_name#en": "English name (all regions)",
"client_name#fr": "French name (all regions)",
"client_name#de-DE": "German name (region Germany)",
"client_name#de-CH": "German name (region Switzerland)",
"client_name#de": "German name (fallback)",
"client_name": "Fallback name",
"client_logo": "www.example.com/logo.png",
"client_logo#fr": "www.example.com/logo_fr.png",
"vp_formats": {
"jwt_vp": {
"alg": [
"ES256"
],
}
}
}
state:
type: string
description: |
An opaque value used by the client to maintain
state between the request and callback. The authorization
server includes this value when redirecting the user-agent back
to the client.
aud:
type: string
description: |
Audience ("aud") JWT claim identifying the intended recipient of this Request Object.
As the verifier cannot identify the wallet the Static Discovery metadata is used.
MUST be "https://self-issued.me/v2"
profile_version:
type: string
description: JWT header parameter indicating the Swiss Profile version used
to produce this Request Object.
encrypted_response_enc_values_supported:
type: array
description: JWE 'enc' algorithms accepted by the Verifier for an encrypted
Authorization Response.
items:
type: string
verifier_info:
type: array
description: Trust Protocol 2.0 trust statements embedded as JWT objects.
items:
$ref: "#/components/schemas/VerifierInfoEntryDto"
required:
- encrypted_response_enc_values_supported
- profile_version
VerifierInfoEntryDto:
type: object
properties:
format:
type: string
data:
type: string
Link:
type: object
properties:
href:
type: string
templated:
type: boolean
WebhookCallback:
description: Callback transmitting that verification can now be fetched.
properties:
verification_id:
type: string
format: uuid
timestamp:
type: string
format: date-time