---
title: "How to Verify an SD-JWT-based Verifiable Credential (IETF | SD-JWT VC) via OID4VP with walt.id"
description: "Verify SD-JWT IETF credentials via OID4VP with the walt.id Verifier API. For developers: cURL examples, policies, callbacks, and result retrieval."
stack: "Community Stack (open source) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/verifier/credential-verification/sd-jwt-vc-oid4vc
generated: 2026-07-08
---
# How to Verify an SD-JWT-based Verifiable Credential (IETF | SD-JWT VC) via OID4VP with walt.id

**TL;DR**

**What you:**

- Create verification requests for SD-JWT VC credentials via OID4VP
- Configure VC and VP policies for credential verification
- Implement custom presentation definitions with field constraints
- Retrieve and inspect verification results and presented credentials

**Relevant concepts:**

- [SD-JWT VC](https://docs.walt.id/concepts/digital-credentials/sd-jwt-vc.md) – Intro to the IETF standard for selective disclosure credentials
- [OpenID4VP](https://docs.walt.id/concepts/data-exchange-protocols/openid4vp.md) – Protocol for requesting and receiving verifiable presentations

Video: https://youtu.be/N6pZTs-Jr9M

This guide provides a comprehensive walkthrough for verifying a SD-JWT VC credentials based on
the [IETF standard](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/) using
the walt.id verifier API. The verification process will utilize the OID4VCI protocol, an extension of OpenID,
facilitating secure and standardized communication between identities.

**SD-JWT VC**: A digital equivalent of physical credentials such as a driver's license or university
degree. VCs are cryptographically secure, privacy-respecting, and instantly verifiable.

**OID4VCI**: A protocol specifying how parties can issue VCs and present these credentials in a way that's consistent
and secure across platforms ensuring interoperability.

## Preparing the Verification

First, determine the type of SD-JWT VC Credential to be verified. Although this guide focuses on an `identity_credential` — the default credential issued in the [SD-JWT VC issuance guide](https://docs.walt.id/community-stack/issuer/credential-issuance/sd-jwt-vc-oid4vc.md) — you can use any credential type compliant with the IETF standard.

The verification process will be as follows:

1. Specify the credential type(s) to request from a user and the verification policies to be applied to the credential(
   s).
2. Optionally provide a success and failure redirect URL, which the user will be redirected to after the verification
   process is completed.

After you have provided the required information:

1. The API generates
   a [Presentation Definition](https://identity.foundation/presentation-exchange/#presentation-definition).
2. API returns a URL which can passed to OIDC-compliant wallet to fulfill the request.

If you have provided a success or failure redirect URL, the user will be redirected to that URL. You can then access the
verification results by using the id of the verification session, which can be found in the URL generated by the API, as
well as in the query or path parameters of the redirect URL.

### Example Verification Request

In this example, we specify the credential we want to verify by supplying the type.

**Option: CURL**

```bash
curl -X 'POST' \
  'http://0.0.0.0:7003/openid4vc/verify' \
  -H 'accept: */*' \
  -H 'authorizeBaseUrl: openid4vp://authorize' \
  -H 'responseMode: direct_post' \
  -H 'successRedirectUri: https://example.com/success?id=$id' \
  -H 'errorRedirectUri: https://example.com/error?id=$id' \
  -H 'statusCallbackUri: https://example.com/verificationResult' \
  -H 'statusCallbackApiKey: myAPIKey' \
  -H 'stateId: myUniqueStateValue' \
  -H 'Content-Type: application/json' \
  -d '{
  "request_credentials": [
   { "vct": "https://issuer.demo.walt.id/draft13/identity_credential", "format": "vc+sd-jwt" }
  ]
}'
```

**Note:**

  The `vct` value is the Verifiable Credential Type identifier for the SD-JWT VC you want to request. It is a URL that uniquely identifies the credential type and resolves to its type metadata.  You can find the correct `vct` value for a credential in the credential that was issued — see the [SD-JWT VC issuance guide](https://docs.walt.id/community-stack/issuer/credential-issuance/sd-jwt-vc-oid4vc.md).

**Header Parameters**

- **authorizeBaseUrl** - is used to modify the start of the OID4VC request URL. The default value is `openid4vp://authorize` which 
  is fine for most use-cases. If you however are required to use the HAIP OID4VC profile, you need to update the value as follows: `haip://`

- **responseMode** - should be `direct_post` as the other options are not yet supported.
- **successRedirectUri** (optional) - is used to redirect the user if verification is successful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/success?id=$id` will be replaced with `/success?id=1234567890`
- **errorRedirectUri** (optional) - is used to redirect the user if verification is unsuccessful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/error?id=$id` will be replaced with `/error?id=1234567890`
- **statusCallbackUri** (optional) - URL that should be called when the presentation request has been fulfilled by a
  wallet. The request
  sent will be a `POST` including the whole presentation
  result. [See Verification Status Policies Response](#verification-status-policies-response)
- **statusCallbackApiKey** (optional) - If the endpoint you provide via `statusCallbackUri` is protected, you can use
  the `statusCallbackApiKey` to authenticate.
  The provided key will be appended as Authorization Header to the request.
- **stateId** (optional) - overwrite the unique `state` value which gets created for each verification request with your
  own.
- **openId4VPProfile** (optional) - Define profile for VP (Verifiable Presentation) request. The default is W3C
  OpenID4VP, which can optionally provided as `DEFAULT`.
  Apart from that, you can choose from the following options:
    - `HAIP`: For the OID4VC HAIP profile.
    - `EBSIV3`: For EBSI V3 compliant VP. Learn more [here](https://docs.walt.id/community-stack/verifier/ecosystems/ebsi/overview.md).
    - `ISO_18013_7_MDOC`: For mdoc Openid4VP.

**Body Parameters**

- **vp_policies** - Policies applied to the Verifiable Presentation. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md)
- **vc_policies** - Policies applied to all requested credentials. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
- **request_credentials** - An array of objects detailing the credentials to be requested from the user. Each object
  varies based on the type of credential being requested.
  <br/>
  <details><summary>Expand To Learn More</summary>

  Below are the possible credential types and their respective object structures:

  1. **SD-JWT VC Credential (IETF Standard)**
  - **vct**: Specifies the type of credential (e.g., https://issuer.com/identity_credential). This maps to
    the `vct`
    attribute in the SD-JWT VC credential.
  - **format**: Describes the format of the credential. For SD-JWT VC credentials, this would be
    vc+sd-jwt.: Describes the format of the credential. For SD-JWT VC credentials, this would be `vc+sd-jwt`.
     ```json
     { "vct": "test.com/identity_credential", "format": "vc+sd-jwt" }
     ```
  1. **W3C JWT Credential**
    - **type** Specifies the type of credential (e.g., `VerifiableID`, `VerifiableDiploma`). This maps to the `type`
      attribute in W3C credentials.
    - **format**: Describes the format of the credential. For W3C JWT credentials, this would
      be `jwt_vc_json`.
      ```json
      { "type": "ProofOfResidence", "format": "jwt_vc_json" }
      ```
  2. **mDL Credential (ISO/IEC 18013-5)**
    - **doc_type**: Specifies the type of credential (e.g., org.iso.18013.5.1.mDL). This maps to the doc_type
      attribute of
      the mdoc document.
    - **format**: Describes the format of the credential. For mDL credentials, this would be `mso_mdoc`.
      ```json
      { "doc_type": "org.iso.18013.5.1.mDL", "format": "mso_mdoc" }
      ```

  **Optional Parameters**
  <br />
  Next to describing the type and format of the credential, the objects also take an optional `policies` and `id`
  attribute

  - **policies**: An array of policies to apply to the specified credential. A list of all policies can be
    found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
  - **id**: Used to set a specific id for the
    generated [Presentation Definition](https://identity.foundation/presentation-exchange/spec/v1.0.0/#presentation-definition).
    If not set,
    the verifier API auto-assigns a generated one.

  **Full Examples**
    ```json
     {
      "vct": "ProofOfResidence",
      "format": "vc+sd-jwt",
      "policies": [
        "schema",
        {
          "policy": "webhook",
          "args": "https://example.org/abc/xyz"
        }
      ],
      "id": "test123"
     } 

    ```

</details>

### Example Verification Request 2 - Defining VC/VP Policies

**Error:**

Please note that if you are using the HAIP profile, you cannot specify custom policies at this point.

<br/>

In this example, we not only specify the types of credentials to verify, but also define the policies that should be
executed during verification:

- **VC policies (vc_policies)**: Applied to individual Verifiable Credentials (VCs).
- **VP policies (vp_policies)**: Applied to the Verifiable Presentation (VP) as a whole.
- **Default behavior**: The `signature` policy is applied by default to both VP and VC(s).
- **Policy catalog**: A list of available policies can be found
  [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).

How VC policies are applied:

- **Global scope**: Once defined, VC policies are applied globally to all requested credentials in the verification
  session.
- **Per-credential override**: A later section shows how to customize and apply specific policies to individual
  credentials when needed.

We specify policies in the verification request alongside the `request_credentials` parameter (previously explained),
using the `vc_policies` and `vp_policies` fields:

- **`vc_policies`** and **`vp_policies`** each contain a list of policies; either one or both can be provided.
- **Identical structure**: Both fields share the same structure.
- **Policy representation**:
  - As a **string** if the policy does not require arguments.
  - As an **object** if the policy requires arguments.

**Example Polices**

```json
[
  "signature",
  // policy without argument
  "expired",
  // policy without argument
  "not-before",
  // policy without argument
  {
    "policy": "webhook",
    "args": "https://example.org/abc/xyz"
  }
  // policy with argument
]
```

**Initiation Request**

**Option: CURL**

```bash
curl -X 'POST' \
  'http://0.0.0.0:7003/openid4vc/verify' \
  -H 'accept: */*' \
  -H 'authorizeBaseUrl: openid4vp://authorize' \
  -H 'responseMode: direct_post' \
  -H 'successRedirectUri: https://example.com/success?id=$id' \
  -H 'errorRedirectUri: https://example.com/error?id=$id' \
  -H 'statusCallbackUri: https://example.com/verificationResult' \
  -H 'statusCallbackApiKey: myAPIKey' \
  -H 'stateId: myUniqueStateValue' \
  -H 'Content-Type: application/json' \
  -d '{
      "vp_policies": ["signature", "expired", "not-before"],
      "vc_policies": ["signature", "expired", "not-before",
       {"policy": "webhook", "args": "https://example.org/abc/xyz"}],
      "request_credentials": [
       { "vct": "https://issuer.demo.walt.id/draft13/identity_credential", "format": "vc+sd-jwt" }
      ]
   }'
```

**Header Parameters**

- **authorizeBaseUrl** - is used to modify the start of the OID4VC request URL. If you are using the
  cross-device
  flow, where you will display the URL as a QR code, you can leave the value as `openid4vp://authorize` or if you don't
  know the wallet the user will be using to claim the credential. If you are using the same device flow, where you
  already
  know the user's wallet and want the user to be able to go directly to it, you can use the wallet URL path that is able
  to
  receive an OIDC request as a query parameter. Our wallet for example can receive OID4VC requests here
  `https://wallet.demo.walt.id/wallet-api/wallet/{wallet}/exchange/useOfferRequest`.

- **responseMode** - should be `direct_post` as the other options are not yet supported.
- **successRedirectUri** (optional) - is used to redirect the user if verification is successful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/success?id=$id` will be replaced with `/success?id=1234567890`
- **errorRedirectUri** (optional) - is used to redirect the user if verification is unsuccessful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/error?id=$id` will be replaced with `/error?id=1234567890`
- **statusCallbackUri** (optional) - URL that should be called when the presentation request has been fulfilled by a
  wallet. The request
  sent will be a `POST` including the whole presentation
  result. [See Verification Status Policies Response](#verification-status-policies-response)
- **statusCallbackApiKey** (optional) - If the endpoint you provide via `statusCallbackUri` is protected, you can use
  the `statusCallbackApiKey` to authenticate.
  The provided key will be appended as Authorization Header to the request.
- **stateId** (optional) - overwrite the unique `state` value which gets created for each verification request with your
  own.
- **openId4VPProfile** (optional) - Define profile for VP (Verifiable Presentation) request. The default is W3C
  OpenID4VP, which can optionally provided as `DEFAULT`.
  Apart from that, you can choose from the following options:
  - `HAIP`: For the OID4VC HAIP profile.
  - `EBSIV3`: For EBSI V3 compliant VP. Learn more [here](https://docs.walt.id/community-stack/verifier/ecosystems/ebsi/overview.md).
  - `ISO_18013_7_MDOC`: For mdoc Openid4VP.

**Body Parameters**

- **vp_policies** - Policies applied to the Verifiable Presentation. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md)
- **vc_policies** - Policies applied to all requested credentials. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
- **request_credentials** - An array of objects detailing the credentials to be requested from the user. Each object
  varies based on the type of credential being requested.
  <br/>
  <details><summary>Expand To Learn More</summary>

  Below are the possible credential types and their respective object structures:

  1. **SD-JWT VC Credential (IETF Standard)**
  - **vct**: Specifies the type of credential (e.g., https://issuer.com/identity_credential). This maps to
    the `vct`
    attribute in the SD-JWT VC credential.
  - **format**: Describes the format of the credential. For SD-JWT VC credentials, this would be
    vc+sd-jwt.: Describes the format of the credential. For SD-JWT VC credentials, this would be `vc+sd-jwt`.
     ```json
     { "vct": "test.com/identity_credential", "format": "vc+sd-jwt" }
     ```
  2. **W3C JWT Credential**
  - **type** Specifies the type of credential (e.g., `VerifiableID`, `VerifiableDiploma`). This maps to the `type`
    attribute in W3C credentials.
  - **format**: Describes the format of the credential. For W3C JWT credentials, this would
    be `jwt_vc_json`.
    ```json
    { "type": "ProofOfResidence", "format": "jwt_vc_json" }
    ```
  3. **mDL Credential (ISO/IEC 18013-5)**
  - **doc_type**: Specifies the type of credential (e.g., org.iso.18013.5.1.mDL). This maps to the doc_type
    attribute of
    the mdoc document.
  - **format**: Describes the format of the credential. For mDL credentials, this would be `mso_mdoc`.
    ```json
    { "doc_type": "org.iso.18013.5.1.mDL", "format": "mso_mdoc" }
    ```

  **Optional Parameters**
  <br />
  Next to describing the type and format of the credential, the objects also take an optional `policies` and `id`
  attribute

  - **policies**: An array of policies to apply to the specified credential. A list of all policies can be
    found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
  - **id**: Used to set a specific id for the
    generated [Presentation Definition](https://identity.foundation/presentation-exchange/spec/v1.0.0/#presentation-definition).
    If not set,
    the verifier API auto-assigns a generated one.

  **Full Examples**
    ```json
     {
      "vct": "ProofOfResidence",
      "format": "vc+sd-jwt",
      "policies": [
        "schema",
        {
          "policy": "webhook",
          "args": "https://example.org/abc/xyz"
        }
      ],
      "id": "test123"
     } 

    ```

</details>

Upon execution, the system generates a URL, which can be shared directly with users or displayed as a QR code.

### Example Verification Request 3: Applying Policies to Specific Credentials

**Error:**

Please note that if you are using the HAIP profile, you cannot specify custom policies at this point.

<br/>

In this example, which builds on the previous ones, we apply specific policies to a distinct credential in the
verification process.

To do this:

1. Specify the required credential type and format in the `request_credentials` array.
2. Add a `policies` array to the same credential object to define policies that apply **only** to that credential.
3. Choose supported policy names and optional arguments from the list of policies
   [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).

Here's how it looks in practice:

```json
{
  "vp_policies": [
    "signature",
    "expired"
  ],
  "vc_policies": [
    "signature",
    "expired"
  ],
  "request_credentials": [
    {
      "vct": "VerifiableId",
      "format": "vc+sd-jwt"
    },
    {
      "vct": "ProofOfResidence",
      "format": "vc+sd-jwt"
    },
    {
      "vct": "OpenBadgeCredential",
      "format": "vc+sd-jwt",
      "policies": [
        "signature",
        {
          "policy": "webhook",
          "args": "https://example.org/abc/xyz"
        }
      ]
    }
  ]
}
```

Key points from this example:

- **Per-credential policies**: The `OpenBadgeCredential` object in `request_credentials` is extended with a `policies`
  array so that additional checks apply only to this credential.
- **String vs. object policies**:
  - `"signature"` does not require arguments and is therefore provided as a **string**.
  - `"webhook"` requires an argument and is therefore provided as an **object** with a `policy` and `args` field.
- **Policy reference**: A list of different types of policies and their required arguments can be found
  [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
- **Global policies remain in effect**: The other requested credentials, `"VerifiableId"` and `"ProofOfResidence"`,
  do not define custom policies and are verified against the globally defined `vp_policies` and `vc_policies`.

**Initiation Request**

**Option: CURL**

```bash
curl -X 'POST' \
'http://0.0.0.0:7003/openid4vc/verify' \
-H 'accept: */*' \
-H 'authorizeBaseUrl: openid4vp://authorize' \
-H 'responseMode: direct_post' \
-H 'successRedirectUri: https://example.com/success?id=$id' \
-H 'errorRedirectUri: https://example.com/error?id=$id' \
-H 'statusCallbackUri: https://example.com/verificationResult' \
-H 'statusCallbackApiKey: myAPIKey' \
-H 'stateId: myUniqueStateValue' \
-H 'Content-Type: application/json' \
-d '{
  "vp_policies": [
    "signature",
    "expired"
  ],
  "vc_policies": [
    "signature",
    "expired"
  ],
  "request_credentials": [
    {
      "vct": "VerifiableId",
      "format": "vc+sd-jwt"
    },
    {
      "vct": "ProofOfResidence",
      "format": "vc+sd-jwt"
    },
    {
      "vct": "OpenBadgeCredential",
      "format": "vc+sd-jwt"
      "policies": [
        "signature",
        {
          "policy": "webhook",
          "args": "https://example.org/abc/xyz"
        }
      ]
    }
  ]
}'
```

**Header Parameters**

- **authorizeBaseUrl** - is used to modify the start of the OID4VC request URL. If you are using the
  cross-device
  flow, where you will display the URL as a QR code, you can leave the value as `openid4vp://authorize` or if you don't
  know the wallet the user will be using to claim the credential. If you are using the same device flow, where you
  already
  know the user's wallet and want the user to be able to go directly to it, you can use the wallet URL path that is able
  to
  receive an OIDC request as a query parameter. Our wallet for example can receive OID4VC requests here
  `https://wallet.demo.walt.id/wallet-api/wallet/{wallet}/exchange/useOfferRequest`.

- **responseMode** - should be `direct_post` as the other options are not yet supported.
- **successRedirectUri** (optional) - is used to redirect the user if verification is successful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/success?id=$id` will be replaced with `/success?id=1234567890`
- **errorRedirectUri** (optional) - is used to redirect the user if verification is unsuccessful. You can use the `$id`
  placeholder
  to get access to the id of verification session in your application in order to retrieve the verification results.
  E.g. `/error?id=$id` will be replaced with `/error?id=1234567890`
- **statusCallbackUri** (optional) - URL that should be called when the presentation request has been fulfilled by a
  wallet. The request
  sent will be a `POST` including the whole presentation
  result. [See Verification Status Policies Response](#verification-status-policies-response)
- **statusCallbackApiKey** (optional) - If the endpoint you provide via `statusCallbackUri` is protected, you can use
  the `statusCallbackApiKey` to authenticate.
  The provided key will be appended as Authorization Header to the request.
- **stateId** (optional) - overwrite the unique `state` value which gets created for each verification request with your
  own.
- **openId4VPProfile** (optional) - Define profile for VP (Verifiable Presentation) request. The default is W3C
  OpenID4VP, which can optionally provided as `DEFAULT`.
  Apart from that, you can choose from the following options:
  - `HAIP`: For the OID4VC HAIP profile.
  - `EBSIV3`: For EBSI V3 compliant VP. Learn more [here](https://docs.walt.id/community-stack/verifier/ecosystems/ebsi/overview.md).
  - `ISO_18013_7_MDOC`: For mdoc Openid4VP.

**Body Parameters**

- **vp_policies** - Policies applied to the Verifiable Presentation. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md)
- **vc_policies** - Policies applied to all requested credentials. A list of policies can be
  found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
- **request_credentials** - An array of objects detailing the credentials to be requested from the user. Each object
  varies based on the type of credential being requested.
  <br/>
  <details><summary>Expand To Learn More</summary>

  Below are the possible credential types and their respective object structures:

  1. **SD-JWT VC Credential (IETF Standard)**
  - **vct**: Specifies the type of credential (e.g., https://issuer.com/identity_credential). This maps to
    the `vct`
    attribute in the SD-JWT VC credential.
  - **format**: Describes the format of the credential. For SD-JWT VC credentials, this would be
    vc+sd-jwt.: Describes the format of the credential. For SD-JWT VC credentials, this would be `vc+sd-jwt`.
     ```json
     { "vct": "test.com/identity_credential", "format": "vc+sd-jwt" }
     ```
  2. **W3C JWT Credential**
  - **type** Specifies the type of credential (e.g., `VerifiableID`, `VerifiableDiploma`). This maps to the `type`
    attribute in W3C credentials.
  - **format**: Describes the format of the credential. For W3C JWT credentials, this would
    be `jwt_vc_json`.
    ```json
    { "type": "ProofOfResidence", "format": "jwt_vc_json" }
    ```
  3. **mDL Credential (ISO/IEC 18013-5)**
  - **doc_type**: Specifies the type of credential (e.g., org.iso.18013.5.1.mDL). This maps to the doc_type
    attribute of
    the mdoc document.
  - **format**: Describes the format of the credential. For mDL credentials, this would be `mso_mdoc`.
    ```json
    { "doc_type": "org.iso.18013.5.1.mDL", "format": "mso_mdoc" }
    ```

  **Optional Parameters**
  <br />
  Next to describing the type and format of the credential, the objects also take an optional `policies` and `id`
  attribute

  - **policies**: An array of policies to apply to the specified credential. A list of all policies can be
    found [here](https://docs.walt.id/community-stack/verifier/credential-verification/policies/overview.md).
  - **id**: Used to set a specific id for the
    generated [Presentation Definition](https://identity.foundation/presentation-exchange/spec/v1.0.0/#presentation-definition).
    If not set,
    the verifier API auto-assigns a generated one.

  **Full Examples**
    ```json
     {
      "vct": "ProofOfResidence",
      "format": "jwt_vc_json",
      "policies": [
        "schema",
        {
          "policy": "webhook",
          "args": "https://example.org/abc/xyz"
        }
      ],
      "id": "test123"
     } 

    ```

</details>

Upon execution, the system generates a URL, which can be shared directly with users or displayed as a QR code.

### Example Verification Request 4: Implementing a Custom Presentation Definition

In this example, we explore how you can provide your own `input_descriptor` that will be merged with the autogenerated
presentation definition.

To implement a custom presentation definition:

1. Create a custom `input_descriptor` for the
   [presentation definition](https://identity.foundation/presentation-exchange/#presentation-definition).
2. Add this `input_descriptor` as part of an object in the `request_credentials` array so it can be merged with the
   auto-generated definition (see example below).

**Note:**

Important: Please also provide an id in the `input_descriptor` object.

**Example**

```json
{
  "vp_policies": [
    ...
  ],
  "vc_policies": [
    ...
  ],
  "request_credentials": [
    { "vct": "VerifiableId", "format": "vc+sd-jwt" },
    {
      "format": "vc+sd-jwt",
      "vct": "https://issuer.com/identity_credential",
      "input_descriptor": {
        "id": "234",
        "constraints": {
          "fields": [
            {
              "path": [
                "$.birthdate"
              ],
              "filter": {
                "type": "string",
                "pattern": ".*"
              }
            }
          ]
        }
      }
    }
  ]
}
```

On execution the verifier API will auto-generate the input descriptor for the `VerifiableId` credential that we specified via
the regular object and merge it with our custom input descriptor of the `identity_credential` to form the final presentation definition.

**Note:**

When using the `input_descriptor` make sure to also provide the `presentation-definition` policy in the
`vp_policies` array to ensure the constraints specified are checked during verification.

### Example Verification Request 5: Using Relational Constraints

The `presentation-definition` policy also implements the
[relational constraint feature](https://identity.foundation/presentation-exchange/#relational-constraint-feature).
These constraints let you define relations between issuer, holder and multiple credentials
within the `input_descriptor`.

#### subject_is_issuer

Use this constraint when you want to ensure that the credential was self issued by the presenter. The verification will only succeed if the issuer DID matches the credential subject.

```json
{
  "vp_policies": ["presentation-definition"],
  "request_credentials": [
    {
      "input_descriptor": {
        "id": "OpenBadgeCredential",
        "format": { "jwt_vc_json": { "alg": ["EdDSA"] } },
        "constraints": {
          "subject_is_issuer": "required",
          "fields": [
            {
              "path": ["$.vc.type"],
              "filter": { "type": "string", "pattern": "OpenBadgeCredential" }
            }
          ]
        }
      }
    }
  ]
}
```

#### is_holder

`is_holder` ensures the presenter actually holds the credential referenced by
the selected field(s). It checks that the credential was issued to the holder
who is submitting the presentation.

```json
{
  "vp_policies": ["presentation-definition"],
  "request_credentials": [
    {
      "input_descriptor": {
        "id": "OpenBadgeCredential",
        "format": { "jwt_vc_json": { "alg": ["EdDSA"] } },
        "constraints": {
          "is_holder": [
            { "field_id": ["achname"], "directive": "required" }
          ],
          "fields": [
            {
              "path": ["$.vc.type"],
              "filter": { "type": "string", "pattern": "OpenBadgeCredential" }
            },
            {
              "id": "achname",
              "path": ["$.vc.credentialSubject.achievement.name"]
            }
          ]
        }
      }
    }
  ]
}
```

#### same_subject

This constraint enforces that the fields referenced across several credentials
all relate to the same subject DID. Use it when multiple credentials must refer
to one entity.

```json
{
  "vp_policies": ["presentation-definition"],
  "request_credentials": [
    {
      "input_descriptor": {
        "id": "OpenBadgeCredential",
        "format": { "jwt_vc_json": { "alg": ["EdDSA"] } },
        "constraints": {
          "same_subject": [
            { "field_id": ["obc_achievement", "udc_degree"], "directive": "required" }
          ],
          "fields": [
            {
              "path": ["$.vc.type"],
              "filter": { "type": "string", "pattern": "OpenBadgeCredential" }
            },
            {
              "id": "obc_achievement",
              "path": ["$.vc.credentialSubject.achievement.name"]
            }
          ]
        }
      }
    },
    {
      "input_descriptor": {
        "id": "UniversityDegreeCredential",
        "format": { "jwt_vc_json": { "alg": ["EdDSA"] } },
        "constraints": {
          "fields": [
            {
              "path": ["$.vc.type"],
              "filter": { "type": "string", "pattern": "UniversityDegreeCredential" }
            },
            {
              "id": "udc_degree",
              "path": ["$.vc.credentialSubject.degree.name"]
            }
          ]
        }
      }
    }
  ]
}
```

## Presenting the Credential via walt.id Wallet

Using the URL returned by the verification request, we can fulfill the request using the
[hosted wallet](https://wallet.demo.walt.id) by walt.id. Either show the URL as QR code and scan it with a camera or provide
the URL as is in the
text field below the camera once you click on "Scan to receive or present credentials" in the web wallet credentials
overview page in the top right corner.

To fulfill the presentation request programmatically via the Wallet API, see the guide on
[how to present digital credentials via OID4VP](https://docs.walt.id/community-stack/wallet/credential-exchange/guides/present-digital-credentials-oid4vp.md).

## Retrieving the Verification Status

After the user presents the credential(s), you can retrieve the verification result using the `state` value from
the presentation request URL you shared with the user.

**Extracting the `state` value**

```
openid4vp://authorize?...&state=a07bdb17-7d87-4965-9296-1adefcaaddd9&...
```

**Option: CURL**

**Endpoint:** `GET /openid4vc/session/{state}` | [API Reference](https://verifier.demo.walt.id/swagger/index.html#/Verification/get_openid4vc_session__state_)

##### Example Request

```bash
curl -X 'GET' \
  'http://0.0.0.0:7003/openid4vc/session/{state}' \
  -H 'accept: application/json'
```

**Path Parameters**

- `state`: _String_ – The `state` value extracted from the presentation request URL.

---

##### Example Response

The response contains the status of the verification policies applied to the credential(s) presented by the user.

- **`verificationResult`** – `true` if all policies were successful, otherwise `false`.
- **`policyResults`** – Container with the results of the policies applied to each credential.
  - **`credential`** – Name of the credential that a given set of policy results refers to.
  - **`policies`** – Collection of individual policy evaluation results for the credential.
    - **`policy`** – Name of an individual policy.
    - **`is_success`** – Boolean result of the policy.

```json
{
  "id": "5ef9bdg5OvW4",
  "presentationDefinition": {
    "id": "8ZhlGXPnXaQx",
    "input_descriptors": [
      {
        "id": "https://issuer.demo.walt.id/draft13/identity_credential",
        "format": {
          "vc+sd-jwt": {}
        },
        "constraints": {
          "fields": [
            {
              "path": [
                "$.vct"
              ],
              "filter": {
                "type": "string",
                "pattern": "https://issuer.demo.walt.id/draft13/identity_credential"
              }
            }
          ],
          "limit_disclosure": "required"
        }
      }
    ]
  },
  "tokenResponse": {
    "vp_token": "eyJraWQiOiJkaWQ6a2V5Ono2TWtqb1JocTFqU05KZExpcnVTWHJGRnhhZ3FyenRaYVhIcUhHVVRLSmJjTnl3cCN6Nk1ram9SaHExalNOSmRMaXJ1U1hyRkZ4YWdxcnp0WmFYSHFIR1VUS0piY055d3AiLCJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJnaXZlbl9uYW1lIjoiSm9obiIsImZhbWlseV9uYW1lIjoiRG9lIiwiZW1haWwiOiJqb2huZG9lQGV4YW1wbGUuY29tIiwicGhvbmVfbnVtYmVyIjoiKzEtMjAyLTU1NS0wMTAxIiwiYWRkcmVzcyI6eyJzdHJlZXRfYWRkcmVzcyI6IjEyMyBNYWluIFN0IiwibG9jYWxpdHkiOiJBbnl0b3duIiwicmVnaW9uIjoiQW55c3RhdGUiLCJjb3VudHJ5IjoiVVMifSwiaXNfb3Zlcl8xOCI6dHJ1ZSwiaXNfb3Zlcl8yMSI6dHJ1ZSwiaXNfb3Zlcl82NSI6dHJ1ZSwiaWQiOiJ1cm46dXVpZDphMGZjM2VmMi1kZDI2LTQ1NTAtOWI0Ni01ZjY1OTM0ZDEzYjAiLCJpYXQiOjE3Nzc0NDIzMTAsIm5iZiI6MTc3NzQ0MjMxMCwiZXhwIjoxODA4OTc4MzEwLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDprZXk6ejZNa2pvUmhxMWpTTkpkTGlydVNYckZGeGFncXJ6dFphWEhxSEdVVEtKYmNOeXdwIiwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoib05kaHFwWlV5TnZRSHdOLS1IOWFxQmJuTnRPYWpSN056bVJzNl8wdWtqZyIsIngiOiJtZTdKbWE3S05hejNMM3N6OVNlRTdqbDkxYW1UbTktd1Y4dXBJcllJYVJRIiwieSI6ImxFQWVDNHRkcnl4MnBCUmJleHlQcE52ejdxSk9wWFBVS3ZKSnZoQkh6QUEifX0sInZjdCI6Imh0dHBzOi8vaXNzdWVyLmRlbW8ud2FsdC5pZC9kcmFmdDEzL2lkZW50aXR5X2NyZWRlbnRpYWwiLCJfc2QiOlsicjVYMDg4RGZYUWxsYlVSbHlmSnRwWVBXbldxWmgyeUgzX3NpUUw3T2JONCJdfQ.q5nb1t_ei5KyVJ-88h7clze-EAmKh8VFIKg-i51GZ0J0aiomLmtGibXs0Sf0yoG4u_PN2uHEwdEz7C64e0khBw~eyJraWQiOiJvTmRocXBaVXlOdlFId04tLUg5YXFCYm5OdE9halI3TnptUnM2XzB1a2pnIiwidHlwIjoia2Irand0IiwiYWxnIjoiRVMyNTYifQ.eyJpYXQiOjE3Nzc0NTA1MzYsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NzAwMy9vcGVuaWQ0dmMvdmVyaWZ5Iiwibm9uY2UiOiI5Y2UwMTZiYS01YzQxLTRiNjctOWVlMC04MzlhNzYyODVmOTgiLCJzZF9oYXNoIjoiNVNYWGN1TVpUM3RJSFRwRW1wTjV1NEFhX3FVZEgwWnBHdndLOGdhT0lIRSJ9.2BH7psl5N3LqFHlfBsFArHgVlOFvqdSNwrgTcNpCd_P_yUESbIrWGXu-CI840xmgFFkjISUz413W2IpaYre1-A",
    "presentation_submission": {
      "id": "8ZhlGXPnXaQx",
      "definition_id": "8ZhlGXPnXaQx",
      "descriptor_map": [
        {
          "id": "8ZhlGXPnXaQx",
          "format": "vc+sd-jwt",
          "path": "$"
        }
      ]
    },
    "state": "5ef9bdg5OvW4"
  },
  "verificationResult": true,
  "policyResults": {
    "results": [
      {
        "credential": "eyJraWQiOiJkaWQ6a2V5Ono2TWtqb1JocTFqU05KZExpcnVTWHJGRnhhZ3FyenRaYVhIcUhHVVRLSmJjTnl3cCN6Nk1ram9SaHExalNOSmRMaXJ1U1hyRkZ4YWdxcnp0WmFYSHFIR1VUS0piY055d3AiLCJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJnaXZlbl9uYW1lIjoiSm9obiIsImZhbWlseV9uYW1lIjoiRG9lIiwiZW1haWwiOiJqb2huZG9lQGV4YW1wbGUuY29tIiwicGhvbmVfbnVtYmVyIjoiKzEtMjAyLTU1NS0wMTAxIiwiYWRkcmVzcyI6eyJzdHJlZXRfYWRkcmVzcyI6IjEyMyBNYWluIFN0IiwibG9jYWxpdHkiOiJBbnl0b3duIiwicmVnaW9uIjoiQW55c3RhdGUiLCJjb3VudHJ5IjoiVVMifSwiaXNfb3Zlcl8xOCI6dHJ1ZSwiaXNfb3Zlcl8yMSI6dHJ1ZSwiaXNfb3Zlcl82NSI6dHJ1ZSwiaWQiOiJ1cm46dXVpZDphMGZjM2VmMi1kZDI2LTQ1NTAtOWI0Ni01ZjY1OTM0ZDEzYjAiLCJpYXQiOjE3Nzc0NDIzMTAsIm5iZiI6MTc3NzQ0MjMxMCwiZXhwIjoxODA4OTc4MzEwLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDprZXk6ejZNa2pvUmhxMWpTTkpkTGlydVNYckZGeGFncXJ6dFphWEhxSEdVVEtKYmNOeXdwIiwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoib05kaHFwWlV5TnZRSHdOLS1IOWFxQmJuTnRPYWpSN056bVJzNl8wdWtqZyIsIngiOiJtZTdKbWE3S05hejNMM3N6OVNlRTdqbDkxYW1UbTktd1Y4dXBJcllJYVJRIiwieSI6ImxFQWVDNHRkcnl4MnBCUmJleHlQcE52ejdxSk9wWFBVS3ZKSnZoQkh6QUEifX0sInZjdCI6Imh0dHBzOi8vaXNzdWVyLmRlbW8ud2FsdC5pZC9kcmFmdDEzL2lkZW50aXR5X2NyZWRlbnRpYWwiLCJfc2QiOlsicjVYMDg4RGZYUWxsYlVSbHlmSnRwWVBXbldxWmgyeUgzX3NpUUw3T2JONCJdfQ.q5nb1t_ei5KyVJ-88h7clze-EAmKh8VFIKg-i51GZ0J0aiomLmtGibXs0Sf0yoG4u_PN2uHEwdEz7C64e0khBw~eyJraWQiOiJvTmRocXBaVXlOdlFId04tLUg5YXFCYm5OdE9halI3TnptUnM2XzB1a2pnIiwidHlwIjoia2Irand0IiwiYWxnIjoiRVMyNTYifQ.eyJpYXQiOjE3Nzc0NTA1MzYsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NzAwMy9vcGVuaWQ0dmMvdmVyaWZ5Iiwibm9uY2UiOiI5Y2UwMTZiYS01YzQxLTRiNjctOWVlMC04MzlhNzYyODVmOTgiLCJzZF9oYXNoIjoiNVNYWGN1TVpUM3RJSFRwRW1wTjV1NEFhX3FVZEgwWnBHdndLOGdhT0lIRSJ9.2BH7psl5N3LqFHlfBsFArHgVlOFvqdSNwrgTcNpCd_P_yUESbIrWGXu-CI840xmgFFkjISUz413W2IpaYre1-A",
        "policyResults": [
          {
            "policy": "signature_sd-jwt-vc",
            "description": "Checks a SD-JWT-VC credential by verifying its cryptographic signature using the key referenced by the DID in `iss`.",
            "is_success": true,
            "result": {
              "given_name": "John",
              "family_name": "Doe",
              "email": "johndoe@example.com",
              "phone_number": "+1-202-555-0101",
              "address": {
                "street_address": "123 Main St",
                "locality": "Anytown",
                "region": "Anystate",
                "country": "US"
              },
              "is_over_18": true,
              "is_over_21": true,
              "is_over_65": true,
              "id": "urn:uuid:a0fc3ef2-dd26-4550-9b46-5f65934d13b0",
              "iat": 1777442310,
              "nbf": 1777442310,
              "exp": 1808978310,
              "_sd_alg": "sha-256",
              "iss": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp",
              "cnf": {
                "jwk": {
                  "kty": "EC",
                  "crv": "P-256",
                  "kid": "oNdhqpZUyNvQHwN--H9aqBbnNtOajR7NzmRs6_0ukjg",
                  "x": "me7Jma7KNaz3L3sz9SeE7jl91amTm9-wV8upIrYIaRQ",
                  "y": "lEAeC4tdryx2pBRbexyPpNvz7qJOpXPUKvJJvhBHzAA"
                }
              },
              "vct": "https://issuer.demo.walt.id/draft13/identity_credential",
              "_sd": [
                "r5X088DfXQllbURlyfJtpYPWnWqZh2yH3_siQL7ObN4"
              ]
            }
          }
        ]
      }
    ],
    "time": "PT0.028667167S",
    "policiesRun": 1
  }
}
```

## Inspecting Presented Credentials

After a successful presentation session (`verificationResult` is `true`), you can retrieve a decoded and formatted
view of all credentials presented by the holder.

You can choose between two view modes:

- **`simple`**: Recommended default view; provides a concise, human-friendly representation suitable for most use cases.
- **`verbose`**: Provides additional technical detail useful for debugging, auditing, and in-depth inspection.

### Identity Credential With Two Disclosable Claims

In the following we provide an example that involves the presentation of an IETF SD-JWT-VC Identity Credential
with two disclosable claims, namely, the `family_name` and `birthdate` properties.

**Option: Simple**

**Endpoint:** `GET /openid4vc/session/{id}/presented-credentials` | [API Reference](https://verifier.demo.walt.id/swagger/index.html#/Credential%20Verification/get_openid4vc_session__id__presented_credentials)

##### Example Request

```bash
curl -X 'GET' \
  'http://0.0.0.0:7003/openid4vc/session/{id}/presented-credentials' \
  -H 'accept: application/json'
```

**Path Parameters**

- `id`: _String_ – The identifier of the presentation session whose credentials should be retrieved.

**Query Parameters**

- `viewMode`: _String (optional)_ – Controls how detailed the response will be. Accepted values:
  - `simple` _(default)_ — Returns decoded `header` and `payload` for each credential. The go-to choice for most cases.
  - `verbose` — Returns the full compact JWT (`raw`), decoded headers, full and undisclosed payloads, and selective disclosure maps. Useful for debugging and auditing.

---

##### Example Response

```json
{
  "credentialsByFormat": {
    "vc+sd-jwt": [
      {
        "type": "sd_jwt_vc_view_simple",
        "vc": {
          "header": {
            "x5c": [
              "-----BEGIN CERTIFICATE-----\nMIIBeTCCAR8CFHrWgrGl5KdefSvRQhR+aoqdf48+MAoGCCqGSM49BAMCMBcxFTATBgNVBAMMDE1ET0MgUk9PVCBDQTAgFw0yNTA1MTQxNDA4MDlaGA8yMDc1MDUwMjE0MDgwOVowZTELMAkGA1UEBhMCQVQxDzANBgNVBAgMBlZpZW5uYTEPMA0GA1UEBwwGVmllbm5hMRAwDgYDVQQKDAd3YWx0LmlkMRAwDgYDVQQLDAd3YWx0LmlkMRAwDgYDVQQDDAd3YWx0LmlzMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEG0RINBiF+oQUD3d5DGnegQuXenI29JDaMGoMvioKRBN53d4UazakS2unu8BnsEtxutS2kqRhYBPYk9RAriU3gTAKBggqhkjOPQQDAgNIADBFAiAOMwM7hH7q9Di+mT6qCi4LvB+kH8OxMheIrZ2eRPxtDQIhALHzTxwvN8Udt0Z2Cpo8JBihqacfeXkIxVAO8XkxmXhB\n-----END CERTIFICATE-----"
            ],
            "kid": "9vuaJyUxRx4KmHyoZ9kjJxMs_mjpnnf-mPM9nPMG51A",
            "typ": "vc+sd-jwt",
            "alg": "ES256"
          },
          "payload": {
            "given_name": "John",
            "email": "johndoe@example.com",
            "phone_number": "+1-202-555-0101",
            "address": {
              "street_address": "123 Main St",
              "locality": "Anytown",
              "region": "Anystate",
              "country": "US"
            },
            "is_over_18": true,
            "is_over_21": true,
            "is_over_65": true,
            "id": "urn:uuid:f4411ed9-d3eb-4c5d-971a-ffb2872b616d",
            "iat": 1752648454,
            "nbf": 1752648454,
            "exp": 1784184454,
            "iss": "http://localhost:22222/draft13",
            "cnf": {
              "jwk": {
                "kty": "EC",
                "crv": "P-256",
                "kid": "pE7QRzzJ3utoKynTja7JyeAzcQefzZO24rEdWwkGtT0",
                "x": "oRIMe5XVIcJGDSW10r19w5jym8W-btkxChzecsuXUhc",
                "y": "XQrS0p2BJf_WXIcn-RAdFoX17DJsefpED3Ct4t4W-X0"
              }
            },
            "vct": "http://localhost:22222/identity_credential",
            "display": [],
            "family_name": "Doe",
            "birthdate": "1940-01-01"
          }
        },
        "keyBinding": {
          "header": {
            "kid": "pE7QRzzJ3utoKynTja7JyeAzcQefzZO24rEdWwkGtT0",
            "typ": "kb+jwt",
            "alg": "ES256"
          },
          "payload": {
            "iat": 1752648455,
            "aud": "http://localhost:22222/openid4vc/verify",
            "nonce": "196b37da-77d0-463f-897c-5a0c1c6d5623",
            "sd_hash": "iywnYcva2cWTVcclB1gECoI-x-y3IGz07snR_4QiWyE"
          }
        }
      }
    ]
  },
  "viewMode": "simple"
}
```

**Response Fields**

- `viewMode`: _String_ – Echoed request value (or the default if not specified).
- `credentialsByFormat`: _Object_ – A map where each key is a presentation format (`vc+sd-jwt`, `jwt_vc_json`, `mso_mdoc`) and the value is an array of decoded presented credentials. Each `sd_jwt_vc` entry in `simple` view contains:
  - `vc`: _Object_ – Decoded IETF SD-JWT-VC credential:
    - `header`: _Object_ – The JWT `header` section.
    - `payload`: _Object_ – The JWT `payload` with all disclosures substituted.
  - `keyBinding`: _Object_ – Decoded Key Binding JWT (if requested/provided):
    - `header`: _Object_ – The JWT `header` section.
    - `payload`: _Object_ – The JWT `payload` section.

**Option: Verbose**

**Endpoint:** `GET /openid4vc/session/{id}/presented-credentials` | [API Reference](https://verifier.demo.walt.id/swagger/index.html#/Credential%20Verification/get_openid4vc_session__id__presented_credentials)

##### Example Request

```bash
curl -X 'GET' \
  'http://0.0.0.0:7003/openid4vc/session/{id}/presented-credentials?viewMode=verbose' \
  -H 'accept: application/json'
```

**Path Parameters**

- `id`: _String_ – The identifier of the presentation session whose credentials should be retrieved.

**Query Parameters**

- `viewMode`: _String (optional)_ – Controls how detailed the response will be. Accepted values:
  - `simple` _(default)_ — Returns decoded `header` and `payload` for each credential. The go-to choice for most cases.
  - `verbose` — Returns the full compact JWT (`raw`), decoded headers, full and undisclosed payloads, and selective disclosure maps. Useful for debugging and auditing.

---

##### Example Response

```json
{
  "credentialsByFormat": {
    "vc+sd-jwt": [
      {
        "type": "sd_jwt_vc_view_verbose",
        "raw": "eyJ4NWMiOlsiLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlCZVRDQ0FSOENGSHJXZ3JHbDVLZGVmU3ZSUWhSK2FvcWRmNDgrTUFvR0NDcUdTTTQ5QkFNQ01CY3hGVEFUQmdOVkJBTU1ERTFFVDBNZ1VrOVBWQ0JEUVRBZ0Z3MHlOVEExTVRReE5EQTRNRGxhR0E4eU1EYzFNRFV3TWpFME1EZ3dPVm93WlRFTE1Ba0dBMVVFQmhNQ1FWUXhEekFOQmdOVkJBZ01CbFpwWlc1dVlURVBNQTBHQTFVRUJ3d0dWbWxsYm01aE1SQXdEZ1lEVlFRS0RBZDNZV3gwTG1sa01SQXdEZ1lEVlFRTERBZDNZV3gwTG1sa01SQXdEZ1lEVlFRRERBZDNZV3gwTG1sek1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUcwUklOQmlGK29RVUQzZDVER25lZ1F1WGVuSTI5SkRhTUdvTXZpb0tSQk41M2Q0VWF6YWtTMnVudThCbnNFdHh1dFMya3FSaFlCUFlrOVJBcmlVM2dUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQU9Nd003aEg3cTlEaSttVDZxQ2k0THZCK2tIOE94TWhlSXJaMmVSUHh0RFFJaEFMSHpUeHd2TjhVZHQwWjJDcG84SkJpaHFhY2ZlWGtJeFZBTzhYa3htWGhCXG4tLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIl0sImtpZCI6Ijl2dWFKeVV4Ung0S21IeW9aOWtqSnhNc19tanBubmYtbVBNOW5QTUc1MUEiLCJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJnaXZlbl9uYW1lIjoiSm9obiIsImVtYWlsIjoiam9obmRvZUBleGFtcGxlLmNvbSIsInBob25lX251bWJlciI6IisxLTIwMi01NTUtMDEwMSIsImFkZHJlc3MiOnsic3RyZWV0X2FkZHJlc3MiOiIxMjMgTWFpbiBTdCIsImxvY2FsaXR5IjoiQW55dG93biIsInJlZ2lvbiI6IkFueXN0YXRlIiwiY291bnRyeSI6IlVTIn0sImlzX292ZXJfMTgiOnRydWUsImlzX292ZXJfMjEiOnRydWUsImlzX292ZXJfNjUiOnRydWUsImlkIjoidXJuOnV1aWQ6ZjQ0MTFlZDktZDNlYi00YzVkLTk3MWEtZmZiMjg3MmI2MTZkIiwiaWF0IjoxNzUyNjQ4NDU0LCJuYmYiOjE3NTI2NDg0NTQsImV4cCI6MTc4NDE4NDQ1NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDoyMjIyMi9kcmFmdDEzIiwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2Iiwia2lkIjoicEU3UVJ6ekozdXRvS3luVGphN0p5ZUF6Y1FlZnpaTzI0ckVkV3drR3RUMCIsIngiOiJvUklNZTVYVkljSkdEU1cxMHIxOXc1anltOFctYnRreENoemVjc3VYVWhjIiwieSI6IlhRclMwcDJCSmZfV1hJY24tUkFkRm9YMTdESnNlZnBFRDNDdDR0NFctWDAifX0sInZjdCI6Imh0dHA6Ly9sb2NhbGhvc3Q6MjIyMjIvaWRlbnRpdHlfY3JlZGVudGlhbCIsImRpc3BsYXkiOltdLCJfc2QiOlsiV0NzTVZhMWxtUlBuRE1FSXVtSkg1UjJ3MDdLek5sRXlmLXFibS1sdlJlQSIsInZ5Q2trOG5rTlpjU05CcXpMeWhTekRwMUF1d25TOTExdWtyRmdtRlpQRkkiXX0.c2smAamo4kc6YxE5-SqF5ZIVIabdm5TZxHcESC3MjpoKaEF3ZL6HO8XeOid-0wD0XuPHscqjilmyiqFkk6yuaw~WyJjdFdidkpYeGJmbVRzMlJ3UFBXZ2d3IiwiZmFtaWx5X25hbWUiLCJEb2UiXQ~WyJ6cWRyTmZSUHp4WWl2YnZaZXZFaDF3IiwiYmlydGhkYXRlIiwiMTk0MC0wMS0wMSJd~eyJraWQiOiJwRTdRUnp6SjN1dG9LeW5UamE3SnllQXpjUWVmelpPMjRyRWRXd2tHdFQwIiwidHlwIjoia2Irand0IiwiYWxnIjoiRVMyNTYifQ.eyJpYXQiOjE3NTI2NDg0NTUsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6MjIyMjIvb3BlbmlkNHZjL3ZlcmlmeSIsIm5vbmNlIjoiMTk2YjM3ZGEtNzdkMC00NjNmLTg5N2MtNWEwYzFjNmQ1NjIzIiwic2RfaGFzaCI6Iml5d25ZY3ZhMmNXVFZjY2xCMWdFQ29JLXgteTNJR3owN3NuUl80UWlXeUUifQ.XOZ_Y5n8OVuVS7OqkJz6O26ppf767ryIt8sVxxpQKFqYgLEMRd--WsVepvs6JQWiccavm4iGwlAokbw1ESPl6Q",
        "vc": {
          "header": {
            "x5c": [
              "-----BEGIN CERTIFICATE-----\nMIIBeTCCAR8CFHrWgrGl5KdefSvRQhR+aoqdf48+MAoGCCqGSM49BAMCMBcxFTATBgNVBAMMDE1ET0MgUk9PVCBDQTAgFw0yNTA1MTQxNDA4MDlaGA8yMDc1MDUwMjE0MDgwOVowZTELMAkGA1UEBhMCQVQxDzANBgNVBAgMBlZpZW5uYTEPMA0GA1UEBwwGVmllbm5hMRAwDgYDVQQKDAd3YWx0LmlkMRAwDgYDVQQLDAd3YWx0LmlkMRAwDgYDVQQDDAd3YWx0LmlzMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEG0RINBiF+oQUD3d5DGnegQuXenI29JDaMGoMvioKRBN53d4UazakS2unu8BnsEtxutS2kqRhYBPYk9RAriU3gTAKBggqhkjOPQQDAgNIADBFAiAOMwM7hH7q9Di+mT6qCi4LvB+kH8OxMheIrZ2eRPxtDQIhALHzTxwvN8Udt0Z2Cpo8JBihqacfeXkIxVAO8XkxmXhB\n-----END CERTIFICATE-----"
            ],
            "kid": "9vuaJyUxRx4KmHyoZ9kjJxMs_mjpnnf-mPM9nPMG51A",
            "typ": "vc+sd-jwt",
            "alg": "ES256"
          },
          "fullPayload": {
            "given_name": "John",
            "email": "johndoe@example.com",
            "phone_number": "+1-202-555-0101",
            "address": {
              "street_address": "123 Main St",
              "locality": "Anytown",
              "region": "Anystate",
              "country": "US"
            },
            "is_over_18": true,
            "is_over_21": true,
            "is_over_65": true,
            "id": "urn:uuid:f4411ed9-d3eb-4c5d-971a-ffb2872b616d",
            "iat": 1752648454,
            "nbf": 1752648454,
            "exp": 1784184454,
            "iss": "http://localhost:22222/draft13",
            "cnf": {
              "jwk": {
                "kty": "EC",
                "crv": "P-256",
                "kid": "pE7QRzzJ3utoKynTja7JyeAzcQefzZO24rEdWwkGtT0",
                "x": "oRIMe5XVIcJGDSW10r19w5jym8W-btkxChzecsuXUhc",
                "y": "XQrS0p2BJf_WXIcn-RAdFoX17DJsefpED3Ct4t4W-X0"
              }
            },
            "vct": "http://localhost:22222/identity_credential",
            "display": [],
            "family_name": "Doe",
            "birthdate": "1940-01-01"
          },
          "undisclosedPayload": {
            "given_name": "John",
            "email": "johndoe@example.com",
            "phone_number": "+1-202-555-0101",
            "address": {
              "street_address": "123 Main St",
              "locality": "Anytown",
              "region": "Anystate",
              "country": "US"
            },
            "is_over_18": true,
            "is_over_21": true,
            "is_over_65": true,
            "id": "urn:uuid:f4411ed9-d3eb-4c5d-971a-ffb2872b616d",
            "iat": 1752648454,
            "nbf": 1752648454,
            "exp": 1784184454,
            "iss": "http://localhost:22222/draft13",
            "cnf": {
              "jwk": {
                "kty": "EC",
                "crv": "P-256",
                "kid": "pE7QRzzJ3utoKynTja7JyeAzcQefzZO24rEdWwkGtT0",
                "x": "oRIMe5XVIcJGDSW10r19w5jym8W-btkxChzecsuXUhc",
                "y": "XQrS0p2BJf_WXIcn-RAdFoX17DJsefpED3Ct4t4W-X0"
              }
            },
            "vct": "http://localhost:22222/identity_credential",
            "display": [],
            "_sd": [
              "WCsMVa1lmRPnDMEIumJH5R2w07KzNlEyf-qbm-lvReA",
              "vyCkk8nkNZcSNBqzLyhSzDp1AuwnS911ukrFgmFZPFI"
            ]
          },
          "disclosures": {
            "WCsMVa1lmRPnDMEIumJH5R2w07KzNlEyf-qbm-lvReA": {
              "disclosure": "WyJjdFdidkpYeGJmbVRzMlJ3UFBXZ2d3IiwiZmFtaWx5X25hbWUiLCJEb2UiXQ",
              "salt": "ctWbvJXxbfmTs2RwPPWggw",
              "key": "family_name",
              "value": "Doe"
            },
            "vyCkk8nkNZcSNBqzLyhSzDp1AuwnS911ukrFgmFZPFI": {
              "disclosure": "WyJ6cWRyTmZSUHp4WWl2YnZaZXZFaDF3IiwiYmlydGhkYXRlIiwiMTk0MC0wMS0wMSJd",
              "salt": "zqdrNfRPzxYivbvZevEh1w",
              "key": "birthdate",
              "value": "1940-01-01"
            }
          }
        },
        "keyBinding": {
          "header": {
            "kid": "pE7QRzzJ3utoKynTja7JyeAzcQefzZO24rEdWwkGtT0",
            "typ": "kb+jwt",
            "alg": "ES256"
          },
          "payload": {
            "iat": 1752648455,
            "aud": "http://localhost:22222/openid4vc/verify",
            "nonce": "196b37da-77d0-463f-897c-5a0c1c6d5623",
            "sd_hash": "iywnYcva2cWTVcclB1gECoI-x-y3IGz07snR_4QiWyE"
          }
        }
      }
    ]
  },
  "viewMode": "verbose"
}
```

**Response Fields**

- `viewMode`: _String_ – Echoed request value (or the default if not specified).
- `credentialsByFormat`: _Object_ – A map where each key is a presentation format (`vc+sd-jwt`, `jwt_vc_json`, `mso_mdoc`) and the value is an array of decoded presented credentials. Each `sd_jwt_vc` entry in `verbose` view contains:
  - `raw`: _String_ – The compact serialized IETF SD-JWT-VC.
  - `vc`: _Object_ – Verbosely decoded IETF SD-JWT-VC:
    - `header`: _Object_ – The JWT `header` section.
    - `fullPayload`: _Object_ – The JWT `payload` with all disclosures substituted.
    - `undisclosedPayload`: _Object_ – The JWT `payload` without any disclosures substituted.
    - `disclosures`: _Object_ – A map between selective disclosure (hashed) values and their decoded representation. Only present if disclosable claims were provided.
  - `keyBinding`: _Object_ – Decoded Key Binding JWT (if requested/provided):
    - `header`: _Object_ – The JWT `header` section.
    - `payload`: _Object_ – The JWT `payload` section.