---
title: "Default Requests"
description: "Store the client ID and attestation lifetime once so each attestation request only sends the instance key."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/client-attestation-service/default-requests
generated: 2026-10-01
---
# Default Requests

Every attestation request repeats the same client ID and lifetime. **Default requests** let you save them once on your Client Attestation Service, so each request only sends the instance public key.

**Note:**

Default requests are **optional**. Nothing on this page is required to issue attestations.

## What Changes

Without a default, a request carries `clientId`, `instancePublicKeyJwk` and, if you want a lifetime other than 24 hours, `expirationSeconds`. With both stored, the call becomes:

```json
{
  "instancePublicKeyJwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
    "y": "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE"
  }
}
```

Anything you *do* send in the call wins over the stored value.

**Note:**

`attestationValiditySeconds` on the service is not a fallback for direct calls to the attest endpoint. Such a call uses its own `expirationSeconds`, which is `86400` (24 hours) unless you send another value. A stored default is how you change that. The service setting applies when a Wallet2 service requests attestations for itself.

## Prerequisites

- A Client Attestation Service with its KMS attached. See [Setup](https://docs.walt.id/enterprise-stack/services/client-attestation-service/setup.md).
- A bearer token with the `update-default-requests` permission and the permission to request attestations. Both are needed to store a default.

## Step 1: Store a Default

The last part of the URL, `attest-client`, names the API call the default applies to: the one behind `POST /v1/{target}/client-attester-api/attest`.

**Option: CURL**

**Endpoint:** `PUT /v1/{target}/client-attester-api/default-requests/attest-client` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html)

##### Example Request

```bash
curl -X 'PUT' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/client-attester-api/default-requests/attest-client' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "clientId": "waltid.tenant1.wallet1",
  "expirationSeconds": 3600
}'
```

**Path Parameters**

- **orgID**: _String_ (required) - Organization host alias.
- **target**: _resourceIdentifier_ (required) - `{organizationID}.{tenantID}.{clientAttesterServiceID}`, for example `waltid.tenant1.client-attester1`.

**Header Parameters**

- **Authorization**: _String_ (required) - Bearer token. Format: `Bearer {yourToken}`.

**Body Parameters**

- A partial attestation request (`clientId`, `instancePublicKeyJwk`, `expirationSeconds`). Unknown or misspelled keys are rejected now, not when you request an attestation.

##### Example Response `200 OK`

The stored document is echoed back.

```json
{
  "clientId": "waltid.tenant1.wallet1",
  "expirationSeconds": 3600
}
```

**Response Codes**

- `200` - Default request stored.
- `400` - The document is not a valid partial body for this operation.
- `401` / `403` - Authentication or authorization failure.

## Step 2: Request an Attestation

Send only the instance key.

**Option: CURL**

**Endpoint:** `POST /v1/{target}/client-attester-api/attest` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html)

##### Example Request

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/client-attester-api/attest' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "instancePublicKeyJwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
    "y": "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE"
  }
}'
```

**Body Parameters**

- **instancePublicKeyJwk**: _Object_ (required) - The instance public key. Any other field you send overrides the stored value.

##### Example Response `200 OK`

```json
{
  "clientAttestationJwt": "eyJ...",
  "expiresAt": 1790682000
}
```

The attestation's `sub` is the stored `clientId`, and it is valid for the stored `expirationSeconds`.

**Response Codes**

- `200` - Attestation issued.
- `400` - The merged request is invalid, for example when neither the default nor the call provides `clientId`.
- `401` / `403` - Authentication or authorization failure.

## Good to Know

- **`clientId` is required.** Store it, or send it on every call.
- **Defaults are not guardrails.** A caller can send their own `clientId` or `expirationSeconds`.
- **Explicit values win.** A call with `"expirationSeconds": 60` gets a 60-second attestation.

## Read or Remove a Default

- List all stored defaults: `GET /v1/{target}/client-attester-api/default-requests` (needs `view-default-requests`).
- Read one: `GET …/default-requests/attest-client`. Returns `404` if none is stored.
- Remove one: `DELETE …/default-requests/attest-client`. Returns `204`, also when nothing was stored.

Full details and permissions: [Default Requests](https://docs.walt.id/enterprise-stack/administration/services/configuration/default-requests.md).