Sign in
OpenID4VP Verification

Create an OpenID4VP presentation request (DCQL)

Create an OpenID4VP presentation request: the verifier (relying party) declares the credential type and the specific claims it wants disclosed, and the service returns a request object containing a DCQL (Digital Credentials Query Language) query, a single-use nonce, and a transaction id to bind the holder's presentation to this exact request. The holder wallet (or the demo present/response flow) presents an SD-JWT VC against this request; the returned uuid is the public capability the holder polls via GET /v1/presentations/{uuid} and answers via POST /v1/presentations/{uuid}/response. The nonce has a 300-second TTL and is consumed atomically on first verification (replay is rejected). Authenticated with the tenant API key (Bearer).

post/v1/presentations/request

Request body

requested_vctstring required

The Verifiable Credential Type (vct) the verifier requires the holder to present. Must match the vct of a credential schema the holder holds; it is embedded into the DCQL query's meta.vct_values so wallets filter to matching credentials.

requested_claimsstring[]

The list of claim names the verifier asks the holder to selectively disclose (each becomes a DCQL claim path). Only these claims are returned in disclosed_claims after a successful presentation; everything else stays hidden under selective disclosure. Defaults to an empty list (no specific claims requested).

audstring required

The verifier's audience identifier — its OpenID4VP client_id or web origin. It is bound into the request and must match the aud the holder signs into the Key-Binding JWT (KB-JWT) of the presentation; a mismatch fails the aud check. Also surfaced as the relying-party name on the public poll endpoint.

trusted_issstring

Optional. The issuer identifier (iss) the verifier is willing to trust for this presentation. When omitted or blank, it defaults to the tenant's own issuer identifier (tenant.issuer_iss). At verification time the presented credential's iss is checked against the tenant's trusted-issuer registry; an untrusted issuer fails verification.

Example request

{
  "requested_vct": "https://credentials.didit.me/vct/identity-card",
  "requested_claims": [
    "given_name",
    "family_name",
    "birth_date"
  ],
  "aud": "https://checkin.acme-air.com",
  "trusted_iss": "https://credentials.didit.me/issuers/acme-air"
}

Response

No response body

Changes