--- title: "OCI Vault" description: "OCI Vault (Oracle Cloud Infrastructure Vault) is a service that allows you to store and manage sensitive information such as keys, passwords, and certificates. It provides a secure and centralized location to store and…" stack: "Community Stack (open source) — version 0.21.0" stack_version: "0.21.0" stack_comparison: https://docs.walt.id/community-vs-enterprise.md canonical_url: https://docs.walt.id/community-stack/issuer/key-management/oci-vault generated: 2026-07-20 --- # OCI Vault OCI Vault (Oracle Cloud Infrastructure Vault) is a service that allows you to store and manage sensitive information such as keys, passwords, and certificates. It provides a secure and centralized location to store and manage sensitive information, and it provides access controls to ensure that only authorized users and applications can access the information. The walt.id Wallet API provides an interface to interact with OCI Vault (Oracle Cloud Infrastructure Vault) to store and manage keys . ## OCI Vault (Oracle Cloud Infrastructure Vault) Configuration On the Oracle Cloud Infrastructure (OCI) console, you can create a vault and manage the keys in the vault. ### Create a OCI Vault To create a vault, you can follow the steps below: 1. Go to the OCI console and navigate to the Vault service. 2. Click on the `Create Vault` button. 3. Enter the details for the vault, such as the compartment and name. 4. Click on the `Create` button to create the vault. 5. Once the vault is created, you can manage the keys in the vault. ![Create Vault](https://docs.walt.id/img/concepts/oci-vault/oci-kms-create-vault.png) ## Get OCI Vault Details To get the details of the vault, you can follow the steps below: 1. Go to the OCI console and navigate to the Vault service. 2. Click on the vault to view the details of the vault. 3. You can view the details of the vault, such as the OCID, management endpoint, and crypto endpoint. 4. You can use this information to configure the wallet to use OCI Vault. ![Vault Details](https://docs.walt.id/img/concepts/oci-vault/oci-kms-endpoints.png) ## Get tenancy OCID To get the tenancy OCID, you can follow the steps below: 1. Go to the OCI console and click on the user profile. 2. Click on the `Tenancy:{name-of-tenancy}` to view the details of the tenancy. 3. You can view the details of the tenancy, such as the OCID. 4. You can use this OCID to configure the wallet to use OCI Vault. ![Tenancy OCID](https://docs.walt.id/img/concepts/oci-vault/oci-kms-tenancy-ocid.png) ## Get user OCID To get the user OCID, you can follow the steps below: 1. Go to the OCI console and click on the user profile -> My profile. 2. You can view the details of the user, such as the OCID. 3. You can use this OCID to configure the wallet to use OCI Vault. ![User OCID](https://docs.walt.id/img/concepts/oci-vault/oci-kms-user-ocid.png) ## Add Vault user To use the vault api you need to add a user and provide him with the necessary permissions to access the vault. Once added you can generate a private key for the user and use it to authenticate the wallet to the vault. You can find more information on how to add a user and generate a fingerprint + private key [here](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) ## Instance Principal Authentication To use oci sdk method you need to configure the vault for instance principal authentication. This is done by adding the instance principal to the vault and providing the necessary permissions. You can find more information on how to configure instance principal authentication [here](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm) ## Key Creation Below you find an example call to create a key in OCI Vault and associate it with a wallet managed by the Wallet API. The only thing that is important to note for the creation, that our system is only compatible with the following Key types offered by the OCI Vault: - RSA & ECDSA Oracle KMS key types [full list](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/dedicated_kms_pkcs_key_types.htm). **Option: OCI SDK** **Endpoint: ** `/onboard/issuer` | [API Reference](https://wallet.demo.walt.id/swagger/index.html#/Keys/post_wallet_api_wallet__wallet__keys_generate) **Example Request** ```bash curl -X 'POST' \ 'https://wallet.demo.walt.id/wallet-api/wallet/f01f8f55-d098-4c53-b47b-c97552829b39/keys/generate' \ -H 'accept: */*' \ -H 'Content-Type: application/json' \ -d '{ "backend": "oci", "config": { "vaultId": "ocid1.vault.oc1.eu-frankfurt-1.entbf645aabf2.abtheljshkb6dsuldqf324kitneb63vkz3dfd74dtqvkd5j2l2cxwyvmefeq", "compartmentId": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa" }, "keyType": "secp256r1" }' ``` **Body** ```json { "backend": "oci", "config": { "vaultId": "ocid1.vault.oc1.eu-frankfurt-1.entbf645aabf2.abtheljshkb6dsuldqf324kitneb63vkz3dfd74dtqvkd5j2l2cxwyvmefeq", "compartmentId": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa" }, "keyType": "secp256r1" } ``` **Body Parameters** - `backend`: _String_ - The location where the key is stored. In our case `oci` as we want to store it in oracle's vault. - `config` - `vaultId`: _String_ - the OCID of the vault where the key should be stored. - `compartmentId`: _String_ - the OCID of the compartment where the key should be stored. - `keyType`: _String_ - the algorithm used to generate the key. For Vault only RSA and secp256r1 is possible. --- **Example Response** The API will respond with the ID of the key. This ID is the internal reference and can be used in operations such as DID create or key delete. ``` Kki22j4lUwo1gtDfdvdCgOE0hhKcNHgIZSzSxU0CugE ``` **Option: OCI REST API** **Endpoint: ** `/onboard/issuer` | [API Reference](https://wallet.demo.walt.id/swagger/index.html#/Keys/post_wallet_api_wallet__wallet__keys_generate) **Example Request** ```bash curl -X 'POST' \ 'https://wallet.demo.walt.id/wallet-api/wallet/f01f8f55-d098-4c53-b47b-c97552829b39/keys/generate' \ -H 'accept: */*' \ -H 'Content-Type: application/json' \ -d '{ "backend": "oci-rest-api", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----" }, "keyType": "secp256r1" }' ``` **Body** ```json { "backend": "oci-rest-api", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----" }, "keyType": "secp256r1" } ``` **Body Parameters** - `backend`: _String_ - The location where the key is stored. In our case `oci-rest-api` as we want to store it in oracle's vault. - `config` - `tenancyOcid`: _String_ - The OCID of the tenancy. - `compartmentOcid`: _String_ - The OCID of the compartment. - `userOcid`: _String_ - The OCID of the user. - `fingerprint`: _String_ - The fingerprint of the user's public key. - `managementEndpoint`: _URL_ - The management endpoint of the vault. - `cryptoEndpoint`: _URL_ - The crypto endpoint of the vault. - `signingKeyPem`: _String_ - The private key of the user. - `keyType`: _String_ - the algorithm used to generate the key. For Vault only RSA and secp256r1 is possible. --- **Example Response** The API will respond with the ID of the key. This ID is the internal reference and can be used in operations such as DID create or key delete. ``` Kki22j4lUwo1gtDfdvdCgOE0hhKcNHgIZSzSxU0CugE ``` ### Creation via Issuer API **Option: OCI SDK** **Endpoint: ** `/onboard/issuer` | [API Reference](https://issuer.demo.walt.id/swagger/index.html#/Issuer%20onboarding/post_onboard_issuer) **Example Request** ```bash curl -X 'POST' \ 'https://issuer.demo.walt.id/onboard/issuer' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "key": { "backend": "oci", "keyType": "secp256r1", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "userOcid": "ocid1.user.oc1..aaaaaaaaxjkkfjqxdqk7ldfjrxjmacmbi7sci73rbfiwpioehikavpbtqx5q", "fingerprint": "bb:d4:4b:0c:c8:3a:49:15:7f:87:55:d5:2b:7e:dd:bc", "managementEndpoint": "entaftlvaaemy-management.kms.eu-frankfurt-1.oraclecloud.com", "cryptoEndpoint": "entaftlvaaemy-crypto.kms.eu-frankfurt-1.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- " } }, "did": { "method": "jwk" } }' ``` **Body** ```json { "key": { "backend": "oci", "keyType": "secp256r1", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "userOcid": "ocid1.user.oc1..aaaaaaaaxjkkfjqxdqk7ldfjrxjmacmbi7sci73rbfiwpioehikavpbtqx5q", "fingerprint": "bb:d4:4b:0c:c8:3a:49:15:7f:87:55:d5:2b:7e:dd:bc", "managementEndpoint": "entaftlvaaemy-management.kms.eu-frankfurt-1.oraclecloud.com", "cryptoEndpoint": "entaftlvaaemy-crypto.kms.eu-frankfurt-1.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- " } }, "did": { "method": "jwk" } } ``` **Body Parameters** - `key` - `backend`: _String_ - Specifies the storage type of key. It can be `jwk` (manged by you), `TSE` (managed by Hashicorp) or `oci` (managed by Oracle) - `keyType`: _String_ - the algorithm used to generate the key. For Vault only secp256r1 is possible. - `did`: - `method`: _String_ - Specifies the DID method. It can be key, jwk, web, cheqd. --- **Example Response** The onboard/issuer endpoint will return an object containing both the generated key in JWK format and the related DID. ```json { "issuerKey": { "type": "oci", "config": { "vaultId": "ocid1.vault.oc1.eu-frankfurt-1.entbf645aabf2.abtheljshkb6dsuldqf324kitneb63vkz3dfd74dtqvkd5j2l2cxwyvmefeq", "compartmentId": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa" }, "id": "ocid1.key.oc1.eu-frankfurt-1.enta2fneaadmk.abtheljrlj5snthwkx7ycdmknuftght527dkyjsoz72dcogklixrsdyolo5a", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"tT1DAZdtp7vUPphTxoilmr6dfZPKcPfwL8G_Ri3K0_E\",\"y\":\"JabPubkHQPK0G7O8eL3bKg75hX4Wkojb_AOepX8xdAs\"}", "_keyType": "secp256r1" }, "issuerDid": "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwieCI6InRUMURBWmR0cDd2VVBwaFR4b2lsbXI2ZGZaUEtjUGZ3TDhHX1JpM0swX0UiLCJ5IjoiSmFiUHVia0hRUEswRzdPOGVMM2JLZzc1aFg0V2tvamJfQU9lcFg4eGRBcyJ9" } ``` **Properties** - `type`: _String_ - the type of key can be either "oci" when using OCI Vault or "jwk" when providing the key in full as JWK. - `config`: _Object_ - the configuration object containing the necessary information to access the OCI Vault. - `id`: _String_ - the ID of the key in the OCI Vault. - `_publicKey` (optional): _Array_ - The public key can be fetched by the issuer API or directly provided, saving resources and reducing network requests. - `_keyType` (optional): _String_ - The key type can be fetched by the issuer API or directly provided, saving resources and reducing network requests. **Option: OCI REST API** **Endpoint: ** `/onboard/issuer` | [API Reference](https://issuer.demo.walt.id/swagger/index.html#/Issuer%20onboarding/post_onboard_issuer) **Example Request** ```bash curl -X 'POST' \ 'https://issuer.demo.walt.id/onboard/issuer' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "issuanceKeyConfig": { "type": "oci-rest-api", "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----", "algorithm": "secp256r1" }, "issuerDidConfig": { "method": "jwk" } }' ``` **Body** ```json { "issuanceKeyConfig": { "type": "oci-rest-api", "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----", "algorithm": "secp256r1" }, "issuerDidConfig": { "method": "key" } } ``` **Body Parameters** - `issuanceKeyConfig` - `type`: _String_ - Specifies the storage type of key. It can be `jwk` (manged by you), `TSE` (managed by Hashicorp) or `oci` (managed by Oracle) - `algorithm`: _String_ - the algorithm used to generate the key. For Vault only secp256r1 is possible. - `issuerDidConfig`: - `method`: _String_ - Specifies the DID method. It can be key, jwk, web, cheqd. --- **Example Response** The onboard/issuer endpoint will return an object containing both the generated key in JWK format and the related DID. ```json { "issuanceKey": { "type": "oci-rest-api", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----" }, "id": "ocid1.key.oc1.eu-frankfurt-1.enta2fneaadmk.abtheljrlj5snthwkx7ycdmknuftght527dkyjsoz72dcogklixrsdyolo5a", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"tT1DAZdtp7vUPphTxoilmr6dfZPKcPfwL8G_Ri3K0_E\",\"y\":\"JabPubkHQPK0G7O8eL3bKg75hX4Wkojb_AOepX8xdAs\"}", "_keyType": "secp256r1" }, "issuerDid": "did:jwk:eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwieCI6InRUMURBWmR0cDd2VVBwaFR4b2lsbXI2ZGZaUEtjUGZ3TDhHX1JpM0swX0UiLCJ5IjoiSmFiUHVia0hRUEswRzdPOGVMM2JLZzc1aFg0V2tvamJfQU9lcFg4eGRBcyJ9" } ``` **Properties** - `type`: _String_ - the type of key can be either "oci" when using OCI Vault or "jwk" when providing the key in full as JWK. - `config`: _Object_ - the configuration object containing the necessary information to access the OCI Vault. - `id`: _String_ - the ID of the key in the OCI Vault. - `_publicKey` (optional): _Array_ - The public key can be fetched by the issuer API or directly provided, saving resources and reducing network requests. - `_keyType` (optional): _String_ - The key type can be fetched by the issuer API or directly provided, saving resources and reducing network requests. ## Key Usage Once you have successfully created a key that is one of the supported types listed above, you can use it in sign and issue operations offered by the issuer API. If you've already had a look at our `/sign`, `/issue`, `/batchIssue` endpoints, you have seen that they all follow a similar request body structure, where the key that should be used for signing credentials is provided via the `issuerKey` property. Now instead of providing the key as JWK, we provide a reference to a key stored in Vault with the required parameters and access credentials. Below you can see an example of `issuerKey` object referencing a key stored in Vault. **Option: Example IssuerKey Object** ```json { "type": "oci-rest-api", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "compartmentOcid": "ocid1.tenancy.oc1..aaaaaaaaxxxxxx", "userOcid": "ocid1.user.oc1..aaaaaaaaxxxxxx", "fingerprint": "d4:4b:0c:c8:3a:49:15:7f:87", "managementEndpoint": "vault-management.region.oraclecloud.com", "cryptoEndpoint": "vault-crypto.region.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY-----" }, "id": "ocid1.key.oc1.eu-frankfurt-1.entaftlvaaemy.abtheljtkwxupytaepjrgvgbhoufoonh2kbevc3cenjetbpeabhgcxyzcmwq", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"r1FURkMEYWiYL_IKi1bG0Ar-N36Z5bvocBcEKtkGF_s\",\"y\":\"0QP3QWwVXfpZf_i-T9qOaSMfd3_or7t6JtbJr9YkvPY\"}", "_keyType": "secp256r1" } ``` **Properties** - `type`: _String_ - the type of key can be either "oci" when using OCI Vault or "jwk" when providing the key in full as JWK. - `config`: _Object_ - the configuration object containing the necessary information to access the OCI Vault. - `id`: _String_ - the ID of the key in the OCI Vault. - `_publicKey` (optional): _Array_ - The public key can be fetched by the issuer API or directly provided, saving resources and reducing network requests. - `_keyType` (optional): _String_ - The key type can be fetched by the issuer API or directly provided, saving resources and reducing network requests. ## Example Issuance Request Below you can see example issuance request to [`jwt/issue`](https://issuer.demo.walt.id/swagger/index.html#/Credential%20Issuance/post_openid4vc_jwt_issue) using a key created in the Vault Transit Secret Engine to sign the credential. **Option: OCI SDK** [Api Reference](https://issuer.demo.walt.id/swagger/index.html#/Credential%20Issuance/post_openid4vc_jwt_issue) ```bash curl -X 'POST' \ 'https://issuer.demo.walt.id/openid4vc/jwt/issue' \ -H 'accept: text/plain' \ -H 'Content-Type: application/json' \ -d '{ "issuerKey": { "type": "oci", "config": { "vaultId": "ocid1.vault.oc1.eu-frankfurt-1.entbf645aabf2.abtheljshkb6dsuldqf324kitneb63vkz3dfd74dtqvkd5j2l2cxwyvmefeq", "compartmentId": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa" }, "id": "ocid1.key.oc1.eu-frankfurt-1.entaftlvaaemy.abtheljtkwxupytaepjrgvgbhoufoonh2kbevc3cenjetbpeabhgcxyzcmwq", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"r1FURkMEYWiYL_IKi1bG0Ar-N36Z5bvocBcEKtkGF_s\",\"y\":\"0QP3QWwVXfpZf_i-T9qOaSMfd3_or7t6JtbJr9YkvPY\"}", "_keyType": "secp256r1" }, "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "@context": [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ], "id": "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)", "type": [ "VerifiableCredential", "OpenBadgeCredential" ], "name": "JFF x vc-edu PlugFest 3 Interoperability", ... }, "mapping": { "id": "", ... }, "standardVersion": "DRAFT13" }' ``` **Body** As you can see for the property `issuanceKey` we only provided the required parameters of the OCI Key Reference Object described above and left out `_publicKey` and `_keyType` ```json { "issuanceKey": { "type": "oci", "config": { "vaultId": "ocid1.vault.oc1.eu-frankfurt-1.entbf645aabf2.abtheljshkb6dsuldqf324kitneb63vkz3dfd74dtqvkd5j2l2cxwyvmefeq", "compartmentId": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa" }, "id": "ocid1.key.oc1.eu-frankfurt-1.entaftlvaaemy.abtheljtkwxupytaepjrgvgbhoufoonh2kbevc3cenjetbpeabhgcxyzcmwq", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"r1FURkMEYWiYL_IKi1bG0Ar-N36Z5bvocBcEKtkGF_s\",\"y\":\"0QP3QWwVXfpZf_i-T9qOaSMfd3_or7t6JtbJr9YkvPY\"}", "_keyType": "secp256r1" }, "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "@context": [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ], "id": "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)", "type": [ "VerifiableCredential", "OpenBadgeCredential" ], "name": "JFF x vc-edu PlugFest 3 Interoperability", ... }, "mapping": { "id": "", ... }, "standardVersion": "DRAFT13" } ``` **Option: OCI REST API** [Api Reference](https://issuer.demo.walt.id/swagger/index.html#/Credential%20Issuance/post_openid4vc_jwt_issue) ```bash curl -X 'POST' \ 'https://issuer.demo.walt.id/openid4vc/jwt/issue' \ -H 'accept: text/plain' \ -H 'statusCallbackUri: https://example.com/$id' \ -H 'Content-Type: application/json' \ -d '{ "issuanceKey": { "type": "oci-rest-api", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "compartmentOcid": "ocid1.compartment.oc1..aaaaaaaaxjkkfjqxdqk7ldfjrxjmacmbi7sci73rbfiwpioehikavpbtqx5q", "userOcid": "ocid1.user.oc1..aaaaaaaaxjkkfjqxdqk7ldfjrxjmacmbi7sci73rbfiwpioehikavpbtqx5q", "fingerprint": "bb:d4:4b:0c:c8:3a:49:15:7f:87:55:d5:2b:7e:dd:bc", "cryptoEndpoint": "ens7pgl2aaam2-crypto.kms.eu-frankfurt-1.oraclecloud.com", "managementEndpoint": "ens7pgl2aaam2-management.kms.eu-frankfurt-1.oraclecloud.com", "signingKeyPem": "privateKey" }, "id": "ocid1.key.oc1.eu-frankfurt-1.entaftlvaaemy.abtheljtkwxupytaepjrgvgbhoufoonh2kbevc3cenjetbpeabhgcxyzcmwq", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"r1FURkMEYWiYL_IKi1bG0Ar-N36Z5bvocBcEKtkGF_s\",\"y\":\"0QP3QWwVXfpZf_i-T9qOaSMfd3_or7t6JtbJr9YkvPY\"}", "_keyType": "secp256r1" }, "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "@context": [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ], "id": "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)", "type": [ "VerifiableCredential", "OpenBadgeCredential" ], "name": "JFF x vc-edu PlugFest 3 Interoperability", ... }, "mapping": { "id": "", ... }, "standardVersion": "DRAFT13" }' ``` **Header Parameters** - `statusCallbackUri`: _URL_ - Receive updates on the created issuance process, e.g. when a credential was successfully claimed. The parameter expects a URL which can accept a JSON POST request. The URL can also hold a `$id`, which will be replaced by the issuance session id. For example: `https://myurl.com/$id`, `https://myurl.com` or `https://myurl.com/test/$id`

Expand To Learn More
**Body** The data send to the provided URL will contain a JSON body: - `id` : _String_ - the issuance session id - `type`: _String_ - the event type - `data`: _JsonObject_ - the data for the event **Event Types** Possible events (event types) and their data are: - `resolved_credential_offer` with the credential offer as JSON (in our Web Wallet: called when the issuance offer is entered into the wallet, but not processing / accepted yet) - `requested_token` with the issuance request for the token as json object (called for the token required to receive the credentials) Credential issuance (called for every credential that's issued (= requested from wallet)) - `jwt_issue` with `jwt` being the issued jwt - `sdjwt_issue` with `sdjwt` being the issued sdjwt - `batch_jwt_issue` with `jwt` being the issued jwt - `batch_sdjwt_issue` with `sdjwt` being the issued sdjwt - `generated_mdoc` with `mdoc` being the CBOR (HEX) of the signed mdoc To allow for secure business logic flows, if a callback URL is set, and it cannot be reached, the issuance will not commence further (after that point). If no callback URL is set, the issuance logic does not change in any way.
**Body** As you can see for the property `issuerKey` we only provided the required parameters of the OCI Key Reference Object described above and left out `_publicKey` and `_keyType` ```json { "issuerKey": { "type": "oci", "config": { "tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaiijfupfvsqwqwgupzdy5yclfzcccmie4ktp2wlgslftv5j7xpk6q", "compartmentOcid": "ocid1.compartment.oc1..aaaaaaaawirugoz35riiybcxsvf7bmelqsxo3sajaav5w3i2vqowcwqrllxa", "userOcid": "ocid1.user.oc1..aaaaaaaaxjkkfjqxdqk7ldfjrxjmacmbi7sci73rbfiwpioehikavpbtqx5q", "fingerprint": "bb:d4:4b:0c:c8:3a:49:15:7f:87:55:d5:2b:7e:dd:bc", "managementEndpoint": "entaftlvaaemy-management.kms.eu-frankfurt-1.oraclecloud.com", "cryptoEndpoint": "entaftlvaaemy-crypto.kms.eu-frankfurt-1.oraclecloud.com", "signingKeyPem": "-----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- " }, "id": "ocid1.key.oc1.eu-frankfurt-1.entaftlvaaemy.abtheljtkwxupytaepjrgvgbhoufoonh2kbevc3cenjetbpeabhgcxyzcmwq", "_publicKey": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"r1FURkMEYWiYL_IKi1bG0Ar-N36Z5bvocBcEKtkGF_s\",\"y\":\"0QP3QWwVXfpZf_i-T9qOaSMfd3_or7t6JtbJr9YkvPY\"}", "_keyType": "secp256r1" }, "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "@context": [ "https://www.w3.org/2018/credentials/v1", "https://purl.imsglobal.org/spec/ob/v3p0/context.json" ], "id": "urn:uuid:THIS WILL BE REPLACED WITH DYNAMIC DATA FUNCTION (see below)", "type": [ "VerifiableCredential", "OpenBadgeCredential" ], "name": "JFF x vc-edu PlugFest 3 Interoperability", ... }, "mapping": { "id": "", ... }, "standardVersion": "DRAFT13" } ```