Open ID 4 Verifiable Credential Issuance

Get a nonce Endpoint

post

Get a nonce to be used in proof of possession during credential issuance.

As defined in section 7.0 of OID4VCI.

Note

This endpoint is only mounted in the SVX Wallet when enabled via the RUNTIME configuration - issuer.issuance_policy.nonce_required.

When enabled, nonce_endpoint metadata will be added to the Credential Issuer Well-Known metadata (/.well-known/openid-credential-issuer). As per the specification if the nonce_endpoint metadata is available, nonce MUST be used for the credential endpoint.

When disabled, the SVX Wallet will return HTTP 404 - Not Found for calls to this endpoint. nonce_endpoint will not be available in the Credential Issuer Well-Known metadata.

Supported Standards

• OpenID for Verifiable Credential Issuance 1.0 (Section 7.0)

Responses

200Success

application/json

c_noncestringOptional

post/issuer/nonce

HTTPcURLJavaScriptPython

POST /issuer/nonce HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Accept: */*

200Success

{
  "c_nonce": "text"
}

Credential Endpoint

post

Issues a Credential upon presentation of a valid Access Token. The Client can request issuance multiple times, enabling binding to multiple keys or DIDs.

All issued Credentials are cryptographically bound to an identifier that the End-User controls. Non-cryptographic binding is currently not supported.

Key Proof

The supported key proof_type values are jwt and attestation (when key attestation is configured via key_attesters).

• jwk in proof.header will be assigned to cnf.jwk in the issued credential or to the device_key_info in the mso of the issued mso_mdoc

• kid in proof.header will be assigned to the credentialSubject.id in the issued credential

Using the kid is the preferred method when using DIDs.

Credential will be issued and signed by a key managed by the SVX Wallet. This can be configured to use external KMS (e.g: AWS KMS)

Batch Issuance support

Batch issuance is supported as defined in OpenID for Verifiable Credential Issuance.

Maximum number of credentials that can be issued in a single credential request can be configured via the runtime configuration issuer.issuance_policy.max_batch_credential_issuance_size.

For key_attestation proofs, a credential will be issued and bound to each key in the attested_keys. The maximum number of keys is the same as the maximum number of credentials that can be issued in a single credential request.

Supported Standards

• OpenID for Verifiable Credential Issuance 1.0 (Section 7)

Body

application/json

credential_configuration_idstringRequired

Identifier of the credential configuration to issue.

Example: EmailCredential_jwt_vc_json

Responses

200

OK

application/json

400

The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.

application/json

403Error

application/json

500Error

application/json

503Error

application/json

post/issuer/credential

HTTPcURLJavaScriptPython

POST /issuer/credential HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/json
Accept: */*
Content-Length: 110

{
  "credential_configuration_id": "EmailCredential_jwt_vc_json",
  "proofs": {
    "jwt": [
      "text"
    ],
    "attestation": [
      "text"
    ]
  }
}

{
  "credentials": [
    {
      "credential": "eyJhbGciOiJFUzI1NiJ9..."
    }
  ]
}