#Isolated Flow

Endpoint: POST /wallet/{walletId}/credentials/present/resolve-request | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/resolve-request \
  -H 'Content-Type: application/json' \
  -d '{
    "requestUrl": "openid4vp://authorize?client_id=x509_san_dns%3Averifier.example.org&request_uri=http%3A%2F%2Flocalhost%3A7004%2Fopenid4vc%2Frequest%2Fabc123"
  }'

Path Parameters

• walletId: String (required) - The wallet handling the presentation. See how to obtain it.

Body Parameters

• requestUrl: String (required) - The OID4VP authorization request URL.

#Example Response

{
  "authorizationRequest": {
    "nonce": "n-0S6_WzA2Mj",
    "client_id": "x509_san_dns:verifier.example.org",
    "response_uri": "http://localhost:7004/openid4vc/response",
    "dcql_query": {
      "credentials": [
        {
          "id": "identity_credential",
          "format": "dc+sd-jwt"
        }
      ]
    }
  },
  "nonce": "n-0S6_WzA2Mj",
  "clientId": "x509_san_dns:verifier.example.org",
  "responseUri": "http://localhost:7004/openid4vc/response",
  "hasRequestUri": true,
  "dcqlQuery": {
    "credentials": [
      {
        "id": "identity_credential",
        "format": "dc+sd-jwt"
      }
    ]
  }
}

Response Fields

• authorizationRequest: Object - The resolved authorization request. Pass it to Build the VP Token and Send the Response.
• nonce: String - The verifier's nonce, which the presentation must be bound to.
• clientId: String - The verifier's client identifier.
• responseUri: String - Where the presentation will be submitted.
• hasRequestUri: Boolean - Whether the request was fetched from a request_uri (vs supplied inline).
• dcqlQuery: Object - The verifier's DCQL query, ready to pass to Match from the Wallet Stores or Match Inline Credentials.

Endpoint: POST /wallet/{walletId}/credentials/present/match-credentials-from-store | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/match-credentials-from-store \
  -H 'Content-Type: application/json' \
  -d '{
    "dcqlQuery": {
      "credentials": [
        {
          "id": "identity_credential",
          "format": "dc+sd-jwt",
          "meta": { "vct_values": ["https://issuer.example.com/identity_credential"] },
          "claims": [
            { "path": ["given_name"] },
            { "path": ["family_name"] }
          ]
        }
      ]
    }
  }'

Path Parameters

• walletId: String (required) - The wallet whose stored credentials are matched.

Body Parameters

• dcqlQuery: Object (required) - The verifier's DCQL query returned by Resolve the Request.

#Example Response

{
  "matchedQueryIds": ["credential_1"],
  "matchCount": 2,
  "matchedCredentialIds": {
    "credential_1": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
  }
}

Response Fields

• matchedQueryIds: String - The DCQL credential-query IDs that were satisfied.
• matchCount: Number - Total number of matching credentials.
• matchedCredentialIds: Object - Map of DCQL query ID to wallet-assigned credential IDs. Use these IDs with Build the VP Token.

After the user consents, complete the manual presentation with Build the VP Token and Send the Response, or use the full-flow endpoint to match and submit in one call.

Endpoint: POST /wallet/{walletId}/credentials/present/match-credentials | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/match-credentials \
  -H 'Content-Type: application/json' \
  -d '{
    "dcqlQuery": { "credentials": [ { "id": "credential_1", "format": "dc+sd-jwt", "meta": { "vct_values": ["https://issuer.example.com/identity_credential"] }, "claims": [ { "path": ["given_name"] } ] } ] },
    "credentials": [
      { "id": "inline-1", "credential": { "type": "vc-sd_jwt", "format": "dc+sd-jwt", "signed": "eyJ...~WyJ...~", "credentialData": { "vct": "https://issuer.example.com/identity_credential", "given_name": "John" } } }
    ]
  }'

Body Parameters

• dcqlQuery: Object (required) - The DCQL query to match against.
• credentials: Array (required) - The credentials to match. Each entry has an id (your own label, echoed back in the result) and a credential: the credential in the wallet's own JSON representation — not a raw credential string. Its type field marks the format (vc-sd_jwt, vc-w3c_2, or mso_mdoc) and the rest of the object holds the credential data (as in the example above). The simplest way to get one in the right shape is to copy the credential object from a GET /wallet/{walletId}/credentials/{id} response.

#Example Response

Returns the same MatchCredentialsResult shape as Match from the wallet stores.

Endpoint: POST /wallet/{walletId}/credentials/present/build-vp-token | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/build-vp-token \
  -H 'Content-Type: application/json' \
  -d '{
    "authorizationRequest": {
      "nonce": "n-0S6_WzA2Mj",
      "client_id": "x509_san_dns:verifier.example.org",
      "response_uri": "http://localhost:7004/openid4vc/response",
      "dcql_query": {
        "credentials": [
          { "id": "identity_credential", "format": "dc+sd-jwt" }
        ]
      }
    },
    "selectedCredentialIds": {
      "identity_credential": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
    }
  }'

Path Parameters

• walletId: String (required) - The wallet holding the selected credentials.

Body Parameters

• authorizationRequest: Object (required) - The authorizationRequest returned by Resolve the Request.
• selectedCredentialIds: Object (required) - Map of DCQL query ID to wallet credential IDs selected by the user.
• key: Object (optional) - Inline key used to sign the VP token. Takes precedence over keyId.
• keyId: String (optional) - Key used to sign the VP token. Defaults to the wallet's default key.
• did: String (optional) - DID for holder binding. Defaults to the wallet's default DID.

#Example Response

{
  "vpToken": "{\"identity_credential\":\"eyJhbGciOiJFUzI1NiIs...\"}",
  "idToken": null
}

Response Fields

• vpToken: String - Serialized vp_token JSON string.
• idToken: String (optional) - Self-issued ID token for SIOPv2 flows, when one is required.

Endpoint: POST /wallet/{walletId}/credentials/present/send-response | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/send-response \
  -H 'Content-Type: application/json' \
  -d '{
    "authorizationRequest": {
      "nonce": "n-0S6_WzA2Mj",
      "client_id": "x509_san_dns:verifier.example.org",
      "response_uri": "http://localhost:7004/openid4vc/response"
    },
    "vpToken": "{\"identity_credential\":\"eyJhbGciOiJFUzI1NiIs...\"}",
    "idToken": null
  }'

Body Parameters

• authorizationRequest: Object (required) - The authorizationRequest returned by Resolve the Request.
• vpToken: String (required) - The vpToken returned by Build the VP Token.
• idToken: String (optional) - The idToken returned by Build the VP Token, when present.

#Example Response

Returns the same shape as the full presentation flow — transmission_success, verifier_response, and optionally redirect_to.

Endpoint: POST /wallet/{walletId}/credentials/present/isolated | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/present/isolated \
  -H 'Content-Type: application/json' \
  -d '{
    "requestUrl": "openid4vp://authorize?client_id=verifier2&request_uri=http%3A%2F%2Flocalhost%3A7003%2Fverification-session%2Fabc123%2Frequest",
    "credentials": [
      { "id": "inline-1", "credential": { "type": "vc-sd_jwt", "format": "dc+sd-jwt", "signed": "eyJ...~WyJ...~", "credentialData": { "vct": "https://issuer.example.com/identity_credential", "given_name": "John" } } }
    ],
    "keyId": "my-holder-key"
  }'

Body Parameters

• requestUrl: String (required) - The OID4VP authorization request URL.
• credentials: Array (required) - The credentials to present. Each entry has an id and a credential: the credential in the wallet's own JSON representation (the same shape as in Match Inline Credentials above), not a raw credential string. The simplest way to get one is to copy the credential object from a GET /wallet/{walletId}/credentials/{id} response.
• keyId: String (optional) - Key used to sign the presentation. Must be the holder key the inline credential is bound to. Defaults to the wallet's default key.
• did: String (optional) - DID for the presenter identity. Defaults to the wallet's default DID.

#Example Response

Returns the same shape as the full presentation flow — transmission_success, verifier_response, and optionally redirect_to.