#Isolated Flow

Endpoint: POST /wallet/{walletId}/credentials/receive/resolve-offer | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/resolve-offer \
  -H 'Content-Type: application/json' \
  -d '{
    "offerUrl": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A7005%2Fopenid4vci%2Fcredential-offer%3Fid%3D48f1dc54-134c-4e10-b889-17f3c0a595bf"
  }'

Path Parameters

• walletId: String (required) - The wallet handling the exchange. See how to obtain it.

Body Parameters

• Credential offer (required) — provide exactly one of:
  • offerUrl: String - The OID4VCI credential offer URL.
  • offerJson: Object - The credential offer as an inline JSON object.

#Example Response

{
  "credentialIssuer": "http://localhost:7005/openid4vci",
  "credentialConfigurationIds": ["identity_credential"],
  "grantType": "pre-authorized_code",
  "preAuthorizedCode": "SplxlOBeZQQYbYS6WxSbIA",
  "txCodeRequired": true,
  "credentialEndpoint": "http://localhost:7005/openid4vci/credential",
  "tokenEndpoint": "http://localhost:7005/openid4vci/token",
  "nonceEndpoint": "http://localhost:7005/openid4vci/nonce",
  "issuer": {
    "credentialIssuer": "http://localhost:7005/openid4vci",
    "display": {
      "name": "Example Issuer",
      "locale": "en-US",
      "logoUri": "https://issuer.example.com/logo.png",
      "logoAltText": "Example Issuer"
    }
  },
  "offeredCredentials": [
    {
      "configurationId": "identity_credential",
      "format": "dc+sd-jwt",
      "scope": null,
      "vct": "https://issuer.example.com/identity_credential",
      "doctype": null,
      "display": {
        "name": "Identity Credential",
        "locale": "en-US",
        "description": "Personal identity claims"
      },
      "claims": [
        {
          "path": ["given_name"],
          "mandatory": true,
          "displayName": "Given name"
        },
        {
          "path": ["family_name"],
          "mandatory": false,
          "displayName": "Family name"
        }
      ]
    }
  ],
  "transactionCode": {
    "inputMode": "numeric",
    "length": 6,
    "description": "Enter the PIN you received from the issuer"
  }
}

Response Fields

• credentialIssuer: String - Issuer identifier from the offer.
• credentialConfigurationIds: String - Flat list of credential configuration IDs listed in the offer.
• grantType: String - pre-authorized_code or authorization_code.
• preAuthorizedCode: String (optional) - The pre-authorized code from the credential offer, returned when the offer uses the pre-authorized code grant.
• txCodeRequired: Boolean - Whether the pre-authorized flow requires a transaction code (PIN).
• credentialEndpoint: String - The issuer's credential endpoint, from its metadata.
• tokenEndpoint: String (optional) - The token endpoint from the issuer's authorization-server metadata.
• nonceEndpoint: String (optional) - The issuer's nonce endpoint for c_nonce flows (OID4VCI 1.0).
• issuer: Object - Issuer metadata projection for consent UIs (credentialIssuer, optional localized display with name, locale, logoUri, logoAltText, and related branding fields when present).
• offeredCredentials: Object - Per-configuration offer details for the UI (not strings). Each entry includes:
  • configurationId / format — configuration id and credential format.
  • scope / vct / doctype — format-specific identifiers when present.
  • display — localized credential display (name, description, colors, logo, …).
  • claims — declared claim metadata (path, mandatory, displayName).
• transactionCode: Object (optional) - UI hints for collecting a transaction code when required (inputMode numeric or text, optional length, optional description). Distinct from the PIN value you send later as txCode.

Endpoint: POST /wallet/{walletId}/credentials/receive/request-token | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/request-token \
  -H 'Content-Type: application/json' \
  -d '{
    "tokenEndpoint": "http://localhost:7005/openid4vci/token",
    "preAuthorizedCode": "SplxlOBeZQQYbYS6WxSbIA",
    "credentialIssuer": "http://localhost:7005/openid4vci",
    "txCode": "123456"
  }'

Body Parameters

• tokenEndpoint: String (required) - The issuer's token endpoint.
• preAuthorizedCode: String (required) - The pre-authorized code from the credential offer.
• credentialIssuer: String (optional) - Credential issuer base URL. When supplied, the wallet resolves authorization-server metadata and can apply client-attestation headers if configured.
• txCode: String (optional) - Transaction code (PIN), if the offer requires one.
• clientId: String (optional) - See OAuth client identity. Defaults to eudiw-abca.
• redirectUri: String (optional) - Defaults to openid://.
• tokenRequestHeaders: Object (optional) - Additional headers to attach to the token request, such as OAuth-Client-Attestation and OAuth-Client-Attestation-PoP.
• anonymousPreAuthorizedCode: Boolean (optional) - Request an anonymous pre-authorized-code token exchange when the issuer supports it. Defaults to false.

#Example Response

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 300
}

Response Fields

• accessToken: String - Use it in the fetch-credential request.
• tokenType: String (optional) — OAuth token type; preserve it for subsequent credential requests.
• expiresIn: Number - Token lifetime in seconds.

Endpoint: POST {credentialIssuer}/nonce — the issuer's endpoint, not a wallet endpoint.

#Example Request

curl -X POST http://localhost:7005/openid4vci/nonce

#Example Response

{
  "c_nonce": "wKI4LT5Sadf6a0dyih5b0Ws"
}

Use the returned c_nonce as the nonce in Sign Proof.

Endpoint: POST /wallet/{walletId}/credentials/receive/sign-proof | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/sign-proof \
  -H 'Content-Type: application/json' \
  -d '{
    "issuerUrl": "http://localhost:7005/openid4vci",
    "nonce": "wKI4LT5Sadf6a0dyih5b0Ws",
    "credentialConfigurationId": "identity_credential"
  }'

Body Parameters

• issuerUrl: String (required) - The credential issuer URL, used as the proof audience.
• nonce: String (required) - The c_nonce from Get a Nonce (or from the token response, if the issuer returned one).
• credentialConfigurationId: String (required) - The credential configuration ID being requested.
• keyId: String (optional) - Key from the wallet's key store. Defaults to the wallet's default key.
• did: String (optional) - DID to use as the proof key ID. If omitted, the proof carries the JWK directly.
• key: Object (optional) - An inline key, supplied instead of keyId.

#Example Response

{
  "proofJwt": "eyJhbGciOiJFUzI1NiIsInR5cCI6Im9wZW5pZDR2Y2ktcHJvb2Yrand0In0..."
}

Endpoint: POST /wallet/{walletId}/credentials/receive/fetch-credential | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/fetch-credential \
  -H 'Content-Type: application/json' \
  -d '{
    "credentialEndpoint": "http://localhost:7005/openid4vci/credential",
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
    "credentialConfigurationId": "identity_credential",
    "proofJwt": "eyJhbGciOiJFUzI1NiIsInR5cCI6Im9wZW5pZDR2Y2ktcHJvb2Yrand0In0...",
    "storeInWallet": true
  }'

Body Parameters

• credentialEndpoint: String (required) - The issuer's credential endpoint.
• accessToken: String (required) - The access token from the token response.
• credentialConfigurationId: String (required) - The credential configuration ID to request.
• proofs: Object (optional) - The JWT proof collection for multiple holders. For one proof, supply the returned proofJwt instead; do not combine both fields.
• clientId: String (optional) - See OAuth client identity. Defaults to eudiw-abca.
• storeInWallet: Boolean (optional) - Store the fetched credential(s) in the wallet credential store. Defaults to false.

#Example Response

{
  "rawCredentials": [
    "eyJraWQiOiJkaWQ6a2V5Ono2TWtmcmlxMU1xTEJvUFdlY0dvRExqZ3VvMXNCOWJyajZ3VDNxWjVCeGtLcHVQNiJ9..."
  ]
}

Endpoint: POST /wallet/{walletId}/credentials/receive/authorization-url | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/authorization-url \
  -H 'Content-Type: application/json' \
  -d '{
    "offerUrl": "openid-credential-offer://?credential_offer_uri=...",
    "redirectUri": "https://wallet.example.org/callback",
    "usePkce": true
  }'

Body Parameters

• Credential offer (required) — provide exactly one of:
  • offerUrl: String - The OID4VCI credential offer URL.
  • offerJson: Object - The credential offer as an inline JSON object.
• useScope: Boolean (optional) — Defaults to false (authorization details). Set true to request the first offered configuration by its advertised scope.
• redirectUri: String (optional) - Redirect URI registered with the issuer. Defaults to openid://.
• usePkce: Boolean (optional) - Whether to use PKCE. Defaults to true.
• clientId: String (optional) - See OAuth client identity. Defaults to eudiw-abca.

#Example Response

{
  "authorizationUrl": "http://localhost:7005/openid4vci/authorize?response_type=code&client_id=eudiw-abca&state=abc123&code_challenge=...",
  "state": "abc123",
  "codeVerifier": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "credentialConfigurationId": "identity_credential",
  "credentialIssuerBaseUrl": "http://localhost:7005/openid4vci",
  "nonceEndpoint": "http://localhost:7005/openid4vci/nonce"
}

Response Fields

• authorizationUrl: String - Redirect the user here.
• state: String - Returned to your redirect URI; use it to correlate the response.
• codeVerifier: String - Store it — you'll need it to exchange the code (PKCE).
• credentialConfigurationId: String - The credential being requested.
• credentialIssuerBaseUrl: String - Credential issuer base URL. Pass this to Exchange Code.
• nonceEndpoint: String (optional) - The issuer's nonce endpoint for c_nonce flows (OID4VCI 1.0), when published. See Get a Nonce.

Endpoint: POST /wallet/{walletId}/credentials/receive/exchange-code | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/exchange-code \
  -H 'Content-Type: application/json' \
  -d '{
    "code": "SplxlOBeZQQYbYS6WxSbIA",
    "credentialIssuerBaseUrl": "http://localhost:7005/openid4vci",
    "codeVerifier": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
    "redirectUri": "https://wallet.example.org/callback"
  }'

Body Parameters

• code: String (required) - The authorization code returned to your redirect URI.
• credentialIssuerBaseUrl: String (required) - Credential issuer base URL returned by Generate Authorization URL. The wallet uses it to resolve authorization-server metadata, including the token endpoint.
• codeVerifier: String (optional) - The PKCE code verifier from the authorization-url step.
• redirectUri: String (optional) - The redirect URI used in the authorization request. Defaults to openid://.
• clientId: String (optional) - See OAuth client identity. Defaults to eudiw-abca.
• tokenRequestHeaders: Object (optional) - Additional headers to attach to the token request.

#Example Response

Returns the same shape as Request Token — an accessToken, optional expiresIn, and optional tokenType. Continue with Sign Proof and Fetch Credential.

Endpoint: POST /wallet/{walletId}/credentials/receive/deferred | API Reference

#Example Request

curl -X POST http://localhost:7006/wallet/{walletId}/credentials/receive/deferred \
  -H 'Content-Type: application/json' \
  -d '{
    "deferredCredentialEndpoint": "http://localhost:7005/openid4vci/credential_deferred",
    "transactionId": "8xFQ5j9Q8L-3PUdnl4RWxXgB7oNc3mK2pL9vR6tY1zA",
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
  }'

Body Parameters

• deferredCredentialEndpoint: String (required) - The deferred credential endpoint from the issuer metadata.
• transactionId: String (required) - The transaction ID returned when issuance was deferred.
• accessToken: String (required) - The access token from the original token response.
• holderBindings / proofRequired: Array / Boolean - Copy both from the original deferredCredential so stored credentials are matched to the original proof keys.
• credentialIdentifier: String (optional) - Copy the issuer-granted dataset identifier, when present.
• credentialIssuerBaseUrl / credentialConfigurationId: String - Preserve the original issuer and configuration for metadata, response validation, and Deferred Credential Request encryption.
• tokenType / dpopKeyId: String - Preserve the token type and, for DPoP, the original sender key independently of holder bindings.

#Example Response

{
  "credentialIds": ["550e8400-e29b-41d4-a716-446655440000"],
  "deferredTransactionIds": {}
}

For requests with explicit batch fields, a pending response contains pending.transactionId and pending.intervalSeconds, with empty credentialIds. Released requests retain the successful response shown above and report pending progress with HTTP 409. Wait that interval before another isolated poll. A failed local save returns storageOutcome with committed IDs and a retained handle; use wallet continuation instead of repeating the issuer request.