Skip to main content

Issue deferred credential

PUT 
/v2/config/digital-wallet/openid/sdjwt/credential/history/:credentialExchangeId

Updates a credential exchange record. Used to issue a credential via the OID4VCI Deferred Credential Endpoint by providing the credential claims for a pending issuance.

Request​

Path Parameters

    credentialExchangeId stringrequired

    Unique identifier of the credential exchange record tracking a single OID4VCI credential issuance lifecycle.

Body

required

Credential claims for the pending deferred issuance. The credential field is mandatory and must not be an empty object. The issuer refuses any other field in the body.

    anyOf
    credential objectrequired

    Credential object for the OID4VCI Deferred Credential Endpoint. Use credentialSubject.credentialSubject for W3C VC (JWT) format, or claims for IETF SD-JWT VC and ISO 18013-5 mDoc/mDL formats. Add id to name the entry of credentialDefinitions that the claims fill.

    credentialSubject object
    property name* any
    claims object
    property name* any
    property name* any

    Credential object for the OID4VCI Deferred Credential Endpoint. Use credentialSubject.credentialSubject for W3C VC (JWT) format, or claims for IETF SD-JWT VC and ISO 18013-5 mDoc/mDL formats. Add id to name the entry of credentialDefinitions that the claims fill.

Responses​

Credential history updated successfully

Response Headers
    Schema
      credentialHistory object

      Updated credential exchange record. The credential is now available at the OID4VCI Deferred Credential Endpoint. The issuer keeps the stored values of credentialOffer, did, jti, preAuthorisedCode, authorisationCode and userPin, and does not refresh them on this operation.

      id string

      Identifier of the credential exchange record. This field holds the same value as CredentialExchangeId.

      CredentialExchangeId string

      Unique identifier for the credential exchange record, tracking the full lifecycle of a single OID4VCI credential issuance.

      credentialExchangeId string

      Camel-case alias of CredentialExchangeId. The server sets both fields to the same value. Use this field in new integrations.

      organisationId string

      Identifier of the organisation that issues the credential.

      openIdOrganisationId string

      Identifier of the OpenID wallet deployment that processes this exchange.

      dataAgreementId string

      Identifier of the data agreement that governs this issuance. The field is empty when the issuance uses a credential definition instead of a data agreement.

      dataAttributeValues object[]required

      Attribute values supplied for a data agreement based issuance. The field is null when the issuance uses a credential definition.

    • Array [
      • name string

      Name of the data attribute, as defined in the data agreement.

      value string

      Value of the data attribute for this holder.

      limitedDisclosure boolean

      When true, the issuer makes this attribute selectively disclosable.

    • ]
      • isAccessed boolean

      Indicates whether the holder opened the credential offer.

      isTokenAccessed boolean

      Indicates whether the holder called the OID4VCI Token Endpoint for this exchange.

      issuanceMode string

      Possible values: [``, InTime, Deferred]

      Issuance mode used for this exchange. InTime means the credential was issued immediately via the OID4VCI Credential Endpoint. Deferred means the credential is pending via the Deferred Credential Endpoint.

      isPreAuthorised boolean

      When true, the issuance used the OID4VCI Pre-Authorized Code Flow. When false, the Authorization Code Flow was used.

      credentialOffer string

      The OID4VCI Credential Offer URI sent to the holder to start the issuance flow.

      credentialOfferEndpoint string

      Credential offer endpoint of the holder wallet. The issuer sends the Credential Offer to this URL for issuer-initiated issuance.

      credentialStatus string

      Possible values: [``, pending, ready]

      Processing status of the credential. pending means the credential is being prepared. ready means it is available for the holder to retrieve.

      status string

      Possible values: [``, offer_sent, offer_received, token_issued, credential_issued, credential_acked, credential_accepted, credential_deleted, issuance_denied]

      Lifecycle status of the credential exchange in the OID4VCI protocol flow: offer_sent (Credential Offer sent to holder), offer_received (holder scanned or received the offer), token_issued (issuer released an access token), credential_issued (credential issued via Credential Endpoint), credential_acked (holder acknowledged receipt), credential_accepted (holder accepted credential), credential_deleted (holder deleted credential), issuance_denied (issuer denied issuance).

      issuerState string

      Value of the OID4VCI issuer_state parameter. The issuer uses it to bind the Authorization Request to this exchange.

      authorisationRequestState string

      State value of the OAuth 2.0 Authorization Request that the wallet sent.

      authorisationCodeState string

      State value that the issuer returns together with the authorisation code.

      authorisationCode string

      OAuth 2.0 authorisation code issued for the Authorization Code Flow.

      preAuthorisedCode string

      Pre-authorised code issued for the OID4VCI Pre-Authorized Code Flow.

      acceptanceToken string

      Acceptance token that the holder uses to poll the OID4VCI Deferred Credential Endpoint.

      codeChallenge string

      PKCE code challenge that the wallet sent in the Authorization Request, as defined in RFC 7636.

      codeChallengeMethod string

      PKCE code challenge method, for example S256.

      redirectUri string

      Redirect URI that the wallet registered for the Authorization Code Flow.

      clientId string

      Client identifier of the holder's wallet, typically a DID or URL. Provided during the OID4VCI Token Request.

      did string

      Decentralized Identifier of the issuer that signs the credential.

      userPin string

      Transaction code (tx_code) for the Pre-Authorized Code Flow.

      createdAt integer

      Unix timestamp (in seconds) when this exchange record was created.

      updatedAt integer

      Unix timestamp (in seconds) when this exchange record was last modified.

      issuanceDate integer

      Unix timestamp (in seconds) when the issuer signed the credential of this record: the last re-issuance, else the first issuance. A record without a credential yet shows its last update. The list operation sorts on this field.

      limitedDisclosure boolean

      When true, the issuer makes the data agreement attributes selectively disclosable in the issued credential.

      credential objectrequired

      The credential payload being issued. Contains type and credentialSubject for W3C VC (JWT) format, or vct/doctype and claims for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.

      property name* any

      The credential payload being issued. Contains type and credentialSubject for W3C VC (JWT) format, or vct/doctype and claims for IETF SD-JWT VC / ISO 18013-5 mDoc/mDL formats.

      disclosureMapping objectrequired

      Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting.

      property name* any

      Selective disclosure mapping for IETF SD-JWT VC credentials. Each entry maps a claim path to its disclosure setting.

      credentialLabel string

      Label of the credential definition or data agreement that this issuance uses.

      credentialDefinitionId string

      Identifier of the credential definition that this issuance uses.

      credentialDefinitionUri string

      URL of an external credential definition that this issuance uses.

      presentationDefinitionId string

      Identifier of a presentation definition required for dynamic credential requests.

      presentationExchangeId string

      Identifier of the presentation exchange session linked to a dynamic credential request.

      holder objectrequired

      Metadata about the credential holder obtained during the OID4VCI exchange. The issuer returns only the name field. The default value before the holder starts the flow is Unknown.

      name string

      Identifier of the holder, typically a DID or display name resolved from wallet client metadata.

      credentialFormat string

      Possible values: [``, vc+sd-jwt, vp+sd-jwt, dc+sd-jwt, jwt_vc_json, jwt_vc, mso_mdoc]

      Credential format used for this issuance. jwt_vc_json is W3C VC (JWT). dc+sd-jwt is IETF SD-JWT VC. mso_mdoc is ISO 18013-5 mDoc/mDL. Records created by earlier releases can also hold the legacy values vc+sd-jwt, vp+sd-jwt and jwt_vc.

      supportRevocation boolean

      Indicates whether revocation is enabled for the issued credential.

      revocationStatus string

      Possible values: [``, Operational, Revoked]

      Current revocation status: Operational (valid) or Revoked (permanently invalidated). The field is empty when the credential definition does not support revocation.

      clientAssertion string

      OAuth 2.0 client assertion JWT provided by the holder's wallet for client authentication.

      clientAssertionType string

      Type of the client assertion token, for example urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

      clientAssertionVerified boolean

      Indicates whether the holder's client assertion JWT was verified.

      walletUnitAttestation string

      Wallet Unit Attestation (WUA) credential presented by the holder, certifying the wallet instance is genuine.

      walletUnitAttestationPoP string

      Proof of Possession for the Wallet Unit Attestation.

      walletUnitAttestationVerified boolean

      Indicates whether the Wallet Unit Attestation was verified.

      walletUnitValidity object[]required

      Array of wallet unit validity records containing attestation and proof of possession verification status.

    • Array [
      • attestation object

      Wallet unit attestation verification status.

      isExpired boolean

      Indicates whether the attestation has expired.

      isRevoked boolean

      Indicates whether the attestation has been revoked.

      isVerified boolean

      Indicates whether the attestation was verified.

      proofOfPossession object

      Proof of possession verification status.

      isExpired boolean

      Indicates whether the proof of possession has expired.

      isVerified boolean

      Indicates whether the proof of possession was verified.

      validatedAt integer

      Unix timestamp (in seconds) when the wallet unit validity was validated.

    • ]
      • credentialToken string

      The signed credential token (JWT, SD-JWT, or mDoc) issued to the holder.

      cnf objectrequired

      Confirmation claim (cnf) containing the holder's public key JWK for key binding.

      property name* any

      Confirmation claim (cnf) containing the holder's public key JWK for key binding.

      jti string

      JWT Token Identifier (jti), unique identifier for the issued credential token.

      proof string

      Proof JWT provided by the holder in the OID4VCI Credential Request, demonstrating key possession.

      proofType string

      Type of the proof provided in the Credential Request (e.g. jwt).

      proofVerified boolean

      Indicates whether the issuer verified the holder's proof of key possession.

      decodedWalletUnitAttestation objectrequired

      Decoded payload of the holder's Wallet Unit Attestation credential.

      property name* any

      Decoded payload of the holder's Wallet Unit Attestation credential.

      keyAttestationResult object

      Result of the check of the key attestation that the holder sent, when there was one.

      property name* any

      Result of the check of the key attestation that the holder sent, when there was one.

      keyAttestationId string

      Identifier of the key attestation that the holder sent, when there was one.

      batchCredentials object[]

      The credentials of a batch issuance, one entry for each credential. The issuer leaves the field out when the record has no batch.

    • Array [
      • credentialToken string

      The signed credential.

      cnf object

      Confirmation claim with the holder key of this credential.

      property name* any

      Confirmation claim with the holder key of this credential.

      jti string

      Unique identifier of this credential.

      credentialRevocationStatusListId string

      Identifier of the status list that holds the status of this credential.

      credentialRevocationStatusListIndex integer

      Index of this credential in its status list.

      revocationStatus string

      Possible values: [Operational, Revoked]

      Revocation status of this credential. Change it with batchIndex in the update credential revocation status operation.

      keyAttestationId string

      Identifier of the key attestation of this credential.

      notificationId string

      Identifier that the wallet sends to the OID4VCI Notification Endpoint for this credential.

      validFrom string

      Start of the validity of this credential.

      validUntil string

      End of the validity of this credential.

      archived boolean

      true for a credential of an earlier batch that a re-issuance replaced. The issuer leaves the field out when it is false.

    • ]
      • issuedAt integer

      Unix timestamp (in seconds) of the first issuance. 0 when it is not known.

      refreshCount integer

      Number of re-issuances of the credential of this record.

      lastRefreshedAt integer

      Unix timestamp (in seconds) of the last re-issuance. 0 when there is none.

      issuanceDeniedReason string

      Human-readable reason why the issuer denied the credential issuance request.

      expiredCredentialTokens string[]

      Array of previously issued credential tokens that have expired.

      expiredCredentials object[]

      Array of decoded expired credential payloads.

      transactionData object

      Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.

      property name* any

      Transaction data bound to this issuance, as defined in the OpenID4VP transaction data extension. This is the only field that the issuer leaves out when it has no value.

      credentialResponseEncryption objectrequired

      Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is null when the wallet asks for a plain response.

      alg string

      JWE key management algorithm, for example ECDH-ES.

      enc string

      JWE content encryption algorithm, for example A128GCM.

      jwk object

      Public JSON Web Key that the issuer uses to encrypt the Credential Response.

      property name* any

      Public JSON Web Key that the issuer uses to encrypt the Credential Response.

      property name* any

      Encryption parameters that the wallet requests for the OID4VCI Credential Response. The field is null when the wallet asks for a plain response.

      issuerTrustServiceProvider objectrequired

      Trust service provider record of the issuer, resolved from the trust list.

      property name* any

      Trust service provider record of the issuer, resolved from the trust list.

      holderTrustServiceProvider objectrequired

      Trust service provider record of the holder, resolved from the trust list.

      property name* any

      Trust service provider record of the holder, resolved from the trust list.

      individualId string

      Identifier of the individual recipient the credential offer was sent to.

      mapperId string

      Mapper identifier linking the credential offer to an external individual record.

      credentialResponseInterval integer

      Minimum polling interval (in seconds) for the OID4VCI Deferred Credential Endpoint.

      signatureStamp boolean

      When true, the issuer adds a visible signature stamp to the issued document.

      signatureCoordinate integer[]

      Possible values: >= 4, <= 4

      Position of the signature stamp on the document page, given as four pixel coordinates.

      cryptographicKeyIdentifier string

      Identifier of the key that signs the credential. The issuer leaves the field out when it has no value.

      cryptographicKeyFormat string

      Format of the signing key: x509 or did:key. The issuer leaves the field out when it has no value.

      credentialDefinitionSnapshot object

      Copy of the credential definition at the time of the issuance. The issuance uses this copy, so a later change of the credential definition does not change this exchange.

      property name* any

      Copy of the credential definition at the time of the issuance. The issuance uses this copy, so a later change of the credential definition does not change this exchange.

      oidcProviderId string

      Identifier of the external OpenID provider of the credential definition, when it has one.

      isWalletInitiated boolean

      true when a wallet started this issuance with a pushed authorisation request.

      reusedCredentialOfferId string

      Identifier of the reused credential offer that made this record, when the credential definition sets supportCredentialOfferReuse. Empty in other cases.

      userId string

      Identifier of the user that started this issuance, when known.

    Loading...
    Last updated on