> For the complete documentation index, see [llms.txt](https://docs.meeco.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.meeco.me/openapi-docs/svx-wallet/open-id-4-verifiable-credential-issuance.md).

# Open ID 4 Verifiable Credential Issuance

## Get a nonce Endpoint

> Get a nonce to be used in proof of possession during credential issuance.\
> \
> As defined in section 7.0 of \[OID4VCI]\(<https://openid.net/specs/openid-4-verifiable-credential-issuance-1\\_0.html#name-nonce-endpoint).\\>
> \
> \## Note\
> \
> This endpoint is only mounted in the SVX Wallet when enabled via the RUNTIME configuration - \`issuer.issuance\_policy.nonce\_required\`.\
> \
> When enabled, \`nonce\_endpoint\` metadata will be added to the Credential Issuer Well-Known metadata (\`/.well-known/openid-credential-issuer\`).\
> As per the specification if the \`nonce\_endpoint\` metadata is available, \`nonce\` MUST be used for the credential endpoint.\
> \
> When disabled, the SVX Wallet will return \`HTTP 404 - Not Found\` for calls to this endpoint.\
> \`nonce\_endpoint\` will not be available in the Credential Issuer Well-Known metadata.\
> \
> \## Supported Standards\
> \
> \- \[OpenID for Verifiable Credential Issuance 1.0 (Section 7.0)]\(<https://openid.net/specs/openid-4-verifiable-credential-issuance-1\\_0.html#name-nonce-endpoint>)<br>

```json
{"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[],"paths":{"/issuer/nonce":{"post":{"summary":"Get a nonce Endpoint","description":"Get a nonce to be used in proof of possession during credential issuance.\n\nAs defined in section 7.0 of [OID4VCI](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-nonce-endpoint).\n\n## Note\n\nThis endpoint is only mounted in the SVX Wallet when enabled via the RUNTIME configuration - `issuer.issuance_policy.nonce_required`.\n\nWhen enabled, `nonce_endpoint` metadata will be added to the Credential Issuer Well-Known metadata (`/.well-known/openid-credential-issuer`).\nAs per the specification if the `nonce_endpoint` metadata is available, `nonce` MUST be used for the credential endpoint.\n\nWhen disabled, the SVX Wallet will return `HTTP 404 - Not Found` for calls to this endpoint.\n`nonce_endpoint` will not be available in the Credential Issuer Well-Known metadata.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 7.0)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-nonce-endpoint)\n","responses":{"200":{"description":"","content":{"application/json":{"schema":{"properties":{"c_nonce":{"type":"string"}}}}}}},"tags":["OpenID 4 Verifiable Credential Issuance"]}}}}
```

## Credential Endpoint

> Issues a Credential upon presentation of a valid Access Token. The Client can request issuance multiple times, enabling binding to multiple keys or DIDs.\
> \
> All issued Credentials are cryptographically bound to an identifier that the End-User controls. Non-cryptographic binding is currently not supported.\
> \
> \## Key Proof\
> \
> The supported key \`proof\_type\` values are \`jwt\` and \`attestation\` (when key attestation is configured via \`key\_attesters\`).\
> \
> \- \`jwk\` in \`proof.header\` will be assigned to \`cnf.jwk\` in the issued credential or to the \`device\_key\_info\` in the mso of the issued \`mso\_mdoc\`\
> \- \`kid\` in \`proof.header\` will be assigned to the \`credentialSubject.id\` in the issued credential\
> \
> Using the \`kid\` is the preferred method when using DIDs.\
> \
> Credential will be issued and signed by a key managed by the SVX Wallet. This can be configured to use external KMS (e.g: AWS KMS)\
> \
> \## Batch Issuance support\
> \
> Batch issuance is supported as defined in \[OpenID for Verifiable Credential Issuance]\(<https://openid.net/specs/openid-4-verifiable-credential-issuance-1\\_0.html#name-batch-credential-issuance).\\>
> \
> Maximum number of credentials that can be issued in a single credential request can be configured via the runtime configuration \`issuer.issuance\_policy.max\_batch\_credential\_issuance\_size\`.\
> \
> For \`key\_attestation\` proofs, a credential will be issued and bound to each key in the \`attested\_keys\`. The maximum number of keys is the same as the maximum number of credentials that can be issued in a single credential request.\
> \
> \## Supported Standards\
> \
> \- \[OpenID for Verifiable Credential Issuance 1.0 (Section 7)]\(<https://openid.net/specs/openid-4-verifiable-credential-issuance-1\\_0.html#name-credential-endpoint>)<br>

```json
{"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[],"paths":{"/issuer/credential":{"post":{"summary":"Credential Endpoint","description":"Issues a Credential upon presentation of a valid Access Token. The Client can request issuance multiple times, enabling binding to multiple keys or DIDs.\n\nAll issued Credentials are cryptographically bound to an identifier that the End-User controls. Non-cryptographic binding is currently not supported.\n\n## Key Proof\n\nThe supported key `proof_type` values are `jwt` and `attestation` (when key attestation is configured via `key_attesters`).\n\n- `jwk` in `proof.header` will be assigned to `cnf.jwk` in the issued credential or to the `device_key_info` in the mso of the issued `mso_mdoc`\n- `kid` in `proof.header` will be assigned to the `credentialSubject.id` in the issued credential\n\nUsing the `kid` is the preferred method when using DIDs.\n\nCredential will be issued and signed by a key managed by the SVX Wallet. This can be configured to use external KMS (e.g: AWS KMS)\n\n## Batch Issuance support\n\nBatch issuance is supported as defined in [OpenID for Verifiable Credential Issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-batch-credential-issuance).\n\nMaximum number of credentials that can be issued in a single credential request can be configured via the runtime configuration `issuer.issuance_policy.max_batch_credential_issuance_size`.\n\nFor `key_attestation` proofs, a credential will be issued and bound to each key in the `attested_keys`. The maximum number of keys is the same as the maximum number of credentials that can be issued in a single credential request.\n\n## Supported Standards\n\n- [OpenID for Verifiable Credential Issuance 1.0 (Section 7)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-endpoint)\n","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialResponse"}}},"description":"OK"},"400":{"description":"The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/InvalidRequestError"},{"$ref":"#/components/schemas/InvalidCredentialRequestError"},{"$ref":"#/components/schemas/UnsupportedCredentialTemplateError"},{"$ref":"#/components/schemas/UnsupportedCredentialFormatError"},{"$ref":"#/components/schemas/InvalidProofError"},{"$ref":"#/components/schemas/InvalidEncryptionParametersError"}]}}}},"403":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessDeniedError"}}}},"500":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServerErrorError"}}}},"503":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TemporarilyUnavailableError"}}}}},"tags":["OpenID 4 Verifiable Credential Issuance"]}}},"components":{"schemas":{"CredentialRequest":{"type":"object","required":["credential_configuration_id","proofs"],"properties":{"credential_configuration_id":{"type":"string","description":"Identifier of the credential configuration to issue."},"proofs":{"type":"object","description":"Key proof(s) for holder binding. At least one of `jwt` or `attestation` must be provided. The server rejects requests where neither is present or where either array is empty.\n","properties":{"jwt":{"type":"array","minItems":1,"items":{"type":"string"},"description":"Array of JWT key proofs."},"attestation":{"type":"array","minItems":1,"items":{"type":"string"},"description":"Array of key attestation proofs."}}}}},"CredentialResponse":{"type":"object","required":["credentials"],"properties":{"credentials":{"type":"array","description":"Array of issued credentials. For `jwt_vc_json` and `dc+sd-jwt` formats, each credential is a compact JWT string. For `mso_mdoc`, it is a base64url-encoded CBOR-encoded IssuerSigned structure.\n","items":{"type":"object","required":["credential"],"properties":{"credential":{"type":"string","description":"The issued credential."}}}}}},"InvalidRequestError":{"properties":{"error":{"description":"Unique error identifier","enum":["invalid_request"],"type":"string"},"extra_info":{"description":"Object that may contain more information about the error","type":"object"},"message":{"description":"User friendly error message","type":"string"}},"required":["error","message","extra_info"],"type":"object"},"InvalidCredentialRequestError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["invalid_credential_request"]},"error_description":{"type":"string","description":"The Credential Request is missing a required parameter, includes an unsupported parameter or parameter value, repeats the same parameter, or is otherwise malformed.\n"}}}]},"Error":{"type":"object","required":["error","error_description"],"properties":{"error":{"type":"string","description":"A machine-readable error code."},"error_description":{"type":"string","description":"A human-readable description of the error providing additional information about the error."},"error_uri":{"type":"string","format":"uri","description":"A URI identifying a human-readable web page with information about the error."}}},"UnsupportedCredentialTemplateError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["unsupported_credential_template"]},"error_description":{"type":"string","description":"Requested credential template is not supported\n"}}}]},"UnsupportedCredentialFormatError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["unsupported_credential_format"]},"error_description":{"type":"string","description":"Requested Credential format is not supported.\n"}}}]},"InvalidProofError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["invalid_proof"]},"error_description":{"type":"string","description":"The proof in the Credential Request is invalid. The proof field is not present or the provided key proof is invalid or not bound to a nonce provided by the Credential Issuer.\n"}}}]},"InvalidEncryptionParametersError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["invalid_encryption_parameters"]},"error_description":{"type":"string","description":"This error occurs when the encryption parameters in the Credential Request are either invalid or missing. In the latter case, it indicates that the Credential Issuer requires the Credential Response to be sent encrypted, but the Credential Request does not contain the necessary encryption parameters.\n"}}}]},"AccessDeniedError":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"error":{"type":"string","enum":["access_denied"]},"error_description":{"type":"string","description":"The user or authorization server denied the request.\n"}}}]},"ServerErrorError":{"allOf":[{"$ref":"#/components/schemas/OAuthErrorResponse"},{"type":"object","properties":{"error":{"type":"string","enum":["server_error"]},"error_description":{"type":"string","description":"Server error.\n"}}}]},"OAuthErrorResponse":{"type":"object","required":["error","error_description"],"properties":{"error":{"type":"string","description":"A machine-readable error code."},"error_description":{"type":"string","description":"A human-readable description of the error providing additional information about the error."},"error_uri":{"type":"string","format":"uri","description":"A URI identifying a human-readable web page with information about the error."}}},"TemporarilyUnavailableError":{"allOf":[{"$ref":"#/components/schemas/OAuthErrorResponse"},{"type":"object","properties":{"error":{"type":"string","enum":["temporarily_unavailable"]},"error_description":{"type":"string","description":"The server is undergoing maintenance, or is otherwise unavailable.\n"}}}]}}}}
```