---
title: "Submit a vp_token for verification"
method: POST
path: "/v1/presentations/{uuid}/response"
tags: ["OpenID4VP Verification"]
---

# Submit a vp_token for verification

`POST /v1/presentations/{uuid}/response`

Submit a holder's presentation (the SD-JWT VC verifiable presentation, including the Key-Binding JWT) against a presentation request and verify it. The service consumes the request's single-use nonce, verifies the issuer signature (resolving the key by `kid`), the holder key binding, the `aud` and `nonce` bindings, the algorithm allow-list, expiry, and revocation via the Token Status List, then checks the credential's issuer against the tenant's trusted-issuer registry. A presentation request is single-use: a second response (replay) is rejected with 422. Authenticated with the tenant API key.

## Path parameters

- `uuid` string, uuid, required

## Request body

- object
  - `vp_token` string, required — The OpenID4VP verifiable presentation token: the SD-JWT VC with its selected disclosures and the appended Key-Binding JWT (KB-JWT). The KB-JWT must be signed by the holder key bound in the credential's `cnf` claim and carry the request's `aud` and `nonce`.

## Response `200`

Verification succeeded (verdict `verified`). Returns the verification result with the disclosed claims and the per-check booleans.

- object
  - `uuid` string, uuid — Unique identifier of the verification result record.
  - `verdict` 'verified' | 'failed' — Outcome of verification; `verified` on a 200 response.
  - `disclosed_claims` object — Map of claim name to value for the claims the holder disclosed. Reserved SD-JWT registered claims (iss, vct, iat, exp, cnf, status, _sd, _sd_alg) are excluded.
  - `checks` object — Per-check boolean results of verification (all true on a verified result).
    - `signature` boolean — The issuer's signature over the SD-JWT is valid (issuer key resolved by `kid`, supporting rotation).
    - `key_binding` boolean — The KB-JWT is present and signed by the holder key bound in the credential's `cnf` claim (holder possession proof).
    - `aud` boolean — The KB-JWT audience matches the request's verifier audience (`aud`).
    - `nonce` boolean — The KB-JWT nonce matches the request's single-use nonce, which had not been consumed or expired (anti-replay).
    - `alg_allowlist` boolean — Every algorithm in the presentation is on the ES256 allow-list.
    - `not_expired` boolean — The credential's `exp` is in the future.
    - `not_revoked` boolean — The credential is not revoked or suspended per its Token Status List.
  - `error` string — Empty string on a verified result.

## Other responses

- `422` — Verification failed (verdict `failed`), or the request was already used (replay). Returns the failed result; `checks` is an empty object and `error` carries the failing reason. On replay, the body is a minimal failure shape with `error` set to the replay message.

## Changes

- **2026-06-30** `1ee4908e9af4` — 1 breaking, 1 info
  - request body became required
  - added the non-success response with the status `422`

[Change history](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/changes/v1/presentations/:uuid/response/post.md)

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/2eeb13158ffa/schema)