Skip to main content

Receive DC API verification response

POST 
/v2/config/digital-wallet/openid/sdjwt/verification/history/:presentationExchangeId/receive

Receives an OpenID4VP Authorization Response that the W3C Digital Credentials API (DC API) delivered for a verification request.

The verifier frontend calls navigator.credentials.get() of the browser with the request in dcApiRequest. The browser sends the request to the wallet of the holder, and the wallet returns a credential response. The frontend forwards that response to this operation.

The server finds the verification record by presentationExchangeId, decrypts the response for dc_api.jwt, parses the VP Token (OpenID4VP 1.0 section 8.1), checks it against the DCQL query of the presentation definition, verifies the credentials and stores the result.

Use this operation only when the presentation definition sets responseMode to dc_api or dc_api.jwt, or uses the iso18013_7_annex_c version. For direct_post and direct_post.jwt the wallet posts the response to the verifier itself.

Request​

Path Parameters

    presentationExchangeId stringrequired

    Unique identifier of the verification exchange record: the presentationExchangeId property of the record.

    Example: 8e9c0a94-3b7d-4f2c-9d11-2f5a0b1c8d3e

Body

required

The body must hold response, vp_token, or both. The field names are case-sensitive and lowercase. The server refuses any other field. Do not send the presentation submission: the server derives it from the DCQL query and from the structure of vp_token.

For responseMode = dc_api.jwt, the server searches for the JWE in response and in vp_token, and it also unwraps a JSON string that holds one of these keys. For responseMode = dc_api, the server reads vp_token first and falls back to response. For iso18013_7_annex_c, send response with the base64url encoded response of the wallet.

    anyOf
    response stringrequired

    For responseMode = dc_api.jwt: JWE compact serialization (five base64url segments separated by .) that the wallet returned. The server decrypts it with the encryption key that it made for this verification record, and reads vp_token from the decrypted payload.

    For responseMode = dc_api (alternative form): a JSON-encoded string whose decoded form is {"vp_token": { ... }}.

    For iso18013_7_annex_c: the base64url encoded response of the wallet.

Responses​

The server processed the DC API response.

This body is not the verification history shape that the other verifier operations return. It is the stored verification record. The token properties use snake_case (vp_token_request, vp_token_response, and so on) and organisationId is the identifier of the digital wallet of the organisation. To read the record in the usual shape, call GET /v3/config/digital-wallet/openid/sdjwt/verification/history/{presentationExchangeId} after this call.

Response Headers
    Schema
      id uuid

      Identifier of the verification record. This value equals the presentationExchangeId.

      organisationId uuid

      Identifier of the digital wallet of the organisation.

      presentationDefinitionId uuidnullable

      Identifier of the presentation definition that this verification uses.

      vp_token_request_state stringnullable

      State value of the Authorization Request.

      vp_token_request stringnullable

      Full Authorization Request. This is a signed JWT, or a URI with the request parameters.

      vp_token_qr_code stringnullable

      Authorization Request URI for a QR code or a deep link. Empty for DC API response modes.

      vp_token_response string[]nullable

      Verifiable Presentation tokens that the wallet sent.

      presentationSubmission objectnullable

      Presentation Submission that the server derived from the DCQL query and the structure of the VP Token.

      property name* anynullable

      Presentation Submission that the server derived from the DCQL query and the structure of the VP Token.

      status string

      Possible values: [request_sent, request_received, presentation_acked]

      Lifecycle status of the verification exchange. The value is presentation_acked after a good DC API response.

      verified boolean

      Result of the verification of the Verifiable Presentation.

      holder objectnullable

      Metadata about the holder, for example the name from the client metadata.

      property name* anynullable

      Metadata about the holder, for example the name from the client metadata.

      presentation object[]nullable

      Decoded credentials that the holder presented.

      presentationValidity object[]nullable

      Validation result for each credential in the presentation.

      credentialExchangeId stringnullable

      Identifier of the credential issuance exchange that this verification started.

      transactionData objectnullable

      Transaction data that the holder approved.

      property name* anynullable

      Transaction data that the holder approved.

      transactionDataBase64 stringnullable

      Base64url encoding of the transaction data that the Authorization Request holds.

      nonce stringnullable

      Cryptographic nonce of the Authorization Request.

      responseType stringnullable

      Possible values: [vp_token, device_response]

      OAuth 2.0 response type of the Authorization Request.

      clientIdScheme stringnullable

      Possible values: [redirect_uri, did, verifier_attestation, x509_san_dns, x509_hash]

      Client ID scheme of the Authorization Request.

      responseMode stringnullable

      Possible values: [dc_api, dc_api.jwt]

      Response mode of the Authorization Request. This operation accepts only dc_api and dc_api.jwt, and no value for iso18013_7_annex_c.

      verifierAttestation stringnullable

      Verifier Attestation JWT that the server sent to the holder.

      directPostRedirectUri stringnullable

      URI that the wallet opens after it posts the Authorization Response. Not used for DC API response modes.

      requiresEncryption booleannullable

      true when the wallet must encrypt the Authorization Response as a JWE.

      version stringnullable

      Possible values: [version_01, iso18013_7_annex_c]

      OpenID4VP version that the presentation definition uses.

      files object[]nullable

      Files that the verification made, for example signed and unsigned PDF documents.

      dcApiRequest objectnullable

      Request object for the W3C Digital Credentials API, with one shape for Chrome and one for Safari.

      property name* anynullable

      Request object for the W3C Digital Credentials API, with one shape for Chrome and one for Safari.

      dcApiProtocol stringnullable

      Possible values: [openid4vp-v1-unsigned, openid4vp-v1-signed, org-iso-mdoc]

      Exchange protocol identifier for the W3C Digital Credentials API.

      presentationDefinitionSnapshot objectnullable

      Copy of the presentation definition at the time of the request.

      property name* anynullable

      Copy of the presentation definition at the time of the request.

      cryptographicKeyIdentifier stringnullable

      Key identifier of the key that signed the Authorization Request.

      cryptographicKeyFormat stringnullable

      Format of the key that signed the Authorization Request.

      signatureStamp booleannullable

      true when the signed PDF holds a visible signature stamp.

      signatureCoordinate integer[]nullable

      Possible values: >= 4, <= 4

      Page coordinates of the signature in the signed PDF, as [x1, y1, x2, y2] in points.

      dataAgreement objectnullable

      Data agreement that gives the terms for this verification exchange.

      property name* anynullable

      Data agreement that gives the terms for this verification exchange.

      createdAt number

      Unix timestamp in seconds when the server made this record.

      updatedAt number

      Unix timestamp in seconds when the server last changed this record.

    Loading...
    Last updated on