--- title: "Create a Credential Profile" description: "Learn how to create a credential profile for the walt.id Enterprise Issuer2 Service." stack: "Enterprise Stack (commercial) — version 0.21.0" stack_version: "0.21.0" stack_comparison: https://docs.walt.id/community-vs-enterprise.md canonical_url: https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-profiles/create-profile generated: 2026-07-20 --- # Create a Credential Profile This guide walks you through creating a credential profile, which defines the default configuration for issuing a specific type of credential. ## Prerequisites Before creating a profile, ensure you have: - **An Issuer2 service** — A running issuer service. See [Setup](https://docs.walt.id/enterprise-stack/services/issuer2-service/setup.md). - **A KMS key** — A key for signing credentials, in a [KMS Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) under the same tenant. - **An issuer identity** — Either a [DID](https://docs.walt.id/enterprise-stack/services/did-service/overview.md) or an [X.509 certificate](https://docs.walt.id/enterprise-stack/services/x509-service/overview.md) (choose per the format table below). The table below shows which issuer identification method (DID or X.509 certificate) is supported for each credential format: | Format | DIDs | X.509 Certificates | |--------|:----:|:------------------:| | JWT (W3C) | ✓ | ✓ | | SD-JWT (W3C) | ✓ | ✓ | | SD-JWT VC (IETF) | ✓ | ✓ | | ISO mDoc | – | ✓ | _✓ supported · – not available_ --- ## Create a Profile **Option: CURL** **Endpoint:** `POST /v2/{target}.{profileId}/issuer-service-api/credentials/profiles` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html) The new profile's own ID is the **last path segment** of the target (like service creation), i.e. `{target}.{profileId}` — here `waltid.tenant1.issuer1.profile-abc123`. ##### Example Request ```bash curl -X 'POST' \ 'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{target}.profile-abc123/issuer-service-api/credentials/profiles' \ -H 'accept: application/json' \ -H 'Authorization: Bearer {yourToken}' \ -H 'Content-Type: application/json' \ -d '{ "name": "University Degree Profile", "credentialConfigurationId": "UniversityDegree_jwt_vc_json", "issuerKeyId": "waltid.tenant1.kms1.key1", "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "w3cVersion": "W3CV2", "credentialData": { "@context": [ "https://www.w3.org/ns/credentials/v2", "https://www.w3.org/ns/credentials/examples/v2" ], "type": ["VerifiableCredential", "UniversityDegree"], "credentialSubject": { "degree": { "type": "BachelorDegree", "name": "Bachelor of Science and Arts" } } }, "mapping": { "id": "", "issuer": { "id": "" }, "credentialSubject": { "id": "" }, "validFrom": "", "validUntil": "" } }' ``` **Path Parameters** - **orgID**: _String_ (required) - Your organization ID, e.g. `test.enterprise-sandbox.waltid.dev`. - **target**: _String_ (required) - The issuer service path followed by the new profile's own ID as the final segment, `{organizationID}.{tenantID}.{issuerServiceID}.{profileId}`, e.g. `waltid.tenant1.issuer1.profile-abc123`. The `{profileId}` you choose here becomes the profile's ID. **Header Parameters** - **Authorization**: _String_ (required) - Bearer token for Enterprise Stack authentication. Format: `Bearer {token}`. **Body Parameters** - **name**: _String_ (required) - A human-readable name for the profile. - **credentialConfigurationId**: _String_ (required) - The credential configuration ID this profile issues. Must match a credential configuration declared on your issuer service. - **issuerKeyId**: _resourceIdentifier_ (required) - The key ID of a key stored in a [KMS service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) under the same tenant, e.g. `waltid.tenant1.kms1.key1`. - **credentialData**: _Object_ (required) - The credential data template. Structure depends on the credential format. - **issuerDid**: _String_ (optional) - The DID of the issuer. Not supported for mDocs. - **x5Chain**: _Array_ (optional) - X.509 certificate chain for signing (required for mDoc). The first certificate is the issuer's; provide the full chain if required. Each entry is a descriptor object `{ "type": "pem-encoded-x509-certificate-descriptor", "pemEncodedCertificate": "" }`. (A bare PEM string is also accepted for backwards compatibility, but the API always stores and returns the object form.) - **mapping**: _Object_ (optional) - Data mapping with [data functions](https://docs.walt.id/enterprise-stack/services/issuer2-service/data-functions.md) for dynamic value insertion at claim time. - **selectiveDisclosure**: _Object_ (optional) - Which SD-JWT claims a holder can selectively disclose, plus optional decoy configuration. Applies to SD-JWT VC and W3C SD-JWT credentials. - **idTokenClaimsMapping**: _Object_ (optional) - Maps claims from external IdP tokens to credential data fields using JSONPath. See [ID Token Claims Mapping](#id-token-claims-mapping). - **mDocNameSpacesDataMappingConfig**: _Object_ (optional) - Type conversion configuration for mDoc credentials. See [mDoc Data Mapping](#mdoc-data-mapping). - **credentialStatus**: _Object_ (optional) - Configuration for credential status (revocation/suspension). See [Credential Status](#credential-status). - **notifications**: _Object_ (optional) - Webhook notification settings. See [Notifications](https://docs.walt.id/enterprise-stack/services/issuer2-service/notifications.md). - **w3cVersion**: _String_ (optional) - W3C data model version of the issued credential. Either `W3CV11` for [VCDM v1.1](https://www.w3.org/TR/vc-data-model-1.1/) or `W3CV2` for [v2](https://www.w3.org/TR/vc-data-model/). **Note:** The `w3cVersion` parameter controls the format of the **issued credential**. When set to `W3CV2`, the service automatically applies the correct VCDM v2 `@context` (`https://www.w3.org/ns/credentials/v2`) and uses `validFrom`/`validUntil` in place of `issuanceDate`/`expirationDate`, regardless of what is provided in `credentialData`. --- ##### Example Response ```json { "profileId": "profile-abc123", "name": "University Degree Profile", "version": 1, "credentialConfigurationId": "UniversityDegree_jwt_vc_json", "issuerKeyId": "waltid.tenant1.kms1.key1", "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "...": "..." }, "mapping": { "...": "..." }, "w3cVersion": "W3CV2", "createdAt": 1704067200000, "updatedAt": 1704067200000 } ``` The service stores and echoes the full profile object; `credentialData` and `mapping` are elided above for brevity. Format-specific fields are included when set — `w3cVersion` for W3C, `selectiveDisclosure` for SD-JWT VC, `mDocNameSpacesDataMappingConfig` for mDoc. **Response Fields** - **profileId**: _String_ - The profile's own ID — the last path segment you chose, e.g. `profile-abc123`. To address the profile elsewhere (e.g. as an offer target), use the full path `{target}.{profileId}`. - **version**: _Integer_ - The profile version (starts at 1, increments on update). - **createdAt** / **updatedAt**: _Long_ - Unix timestamps (ms). **Response Codes** - `201` — Profile created successfully. - `400` — Invalid request body. - `401` — Invalid or missing authentication token. 🎉 You've created a credential profile. --- ## Advanced Configuration ### ID Token Claims Mapping When using the authorization code flow with an external IdP, you can map claims from the ID token to credential data fields: ```json { "idTokenClaimsMapping": { "$.family_name": "$.credentialSubject.familyName", "$.given_name": "$.credentialSubject.givenName", "$.email": "$.credentialSubject.email" } } ``` The keys are JSONPath expressions pointing to claims in the ID token, and the values are JSONPath expressions pointing to fields in the credential data. ### mDoc Data Mapping For mDoc/mDL credentials, you need to specify type conversions for CBOR encoding: ```json { "mDocNameSpacesDataMappingConfig": { "org.iso.18013.5.1": { "entriesConfigMap": { "birth_date": { "type": "string", "conversionType": "stringToFullDate" }, "issue_date": { "type": "string", "conversionType": "stringToFullDate" }, "expiry_date": { "type": "string", "conversionType": "stringToFullDate" }, "portrait": { "type": "string", "conversionType": "base64StringToByteString" } } } } } ``` **Available Conversion Types:** | Conversion Type | Description | |-----------------|-------------| | `stringToFullDate` | Converts ISO date string (e.g. `2024-01-15`) to CBOR full-date (tag 1004). | | `stringToTDate` | Converts ISO timestamp string to CBOR tdate (tag 0). | | `base64StringToByteString` | Converts standard base64-encoded string to CBOR byte string. | | `base64UrlStringToByteString` | Converts base64url-encoded string to CBOR byte string. | ### Credential Status Configure credential status for revocation/suspension support: ```json { "credentialStatus": { "statusCredentialConfig": "waltid.tenant1.credentialstatus.config1", "initialStatus": "0x0" } } ``` - **statusCredentialConfig**: _resourceIdentifier_ - Reference to a credential status configuration in the [Credential Status Service](https://docs.walt.id/enterprise-stack/services/credential-status-service/overview.md). - **initialStatus**: _String_ - Initial status value (e.g. `"0x0"` for valid). **Note:** Different credential formats support different status list types: - **W3C JWT/SD-JWT**: Bitstring Status List, StatusList2021 - **SD-JWT VC (IETF)**: Token Status List - **mDoc**: Token Status List **Note:** **Automatic rollover**: If the referenced credential status service has `autoRollover` enabled, new status lists are created automatically when capacity thresholds are reached. This is transparent to the issuer — you can keep using the same `statusCredentialConfig` reference. Learn more about [automatic rollover](https://docs.walt.id/enterprise-stack/services/credential-status-service/setup.md#capacity-configuration). --- ## Example Profiles ### SD-JWT VC Profile ```json { "name": "Identity Credential Profile", "credentialConfigurationId": "identity_credential_vc+sd-jwt", "issuerKeyId": "waltid.tenant1.kms1.key1", "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "given_name": "John", "family_name": "Doe", "birthdate": "1990-01-15" }, "selectiveDisclosure": { "fields": { "birthdate": { "sd": true } } }, "mapping": { "iat": "", "exp": "" } } ``` ### mDoc Profile with X.509 Certificate ```json { "name": "Photo ID Profile", "credentialConfigurationId": "org.iso.23220.photoid.1", "issuerKeyId": "waltid.tenant1.kms1.key1", "x5Chain": [ { "type": "pem-encoded-x509-certificate-descriptor", "pemEncodedCertificate": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n" } ], "credentialData": { "org.iso.23220.photoid.1": { "given_name_unicode": "John", "family_name_unicode": "Doe", "birth_date": "1990-01-15", "issuance_date": "2024-01-01", "expiry_date": "2029-01-01", "portrait": "base64-encoded-image-data" } }, "mDocNameSpacesDataMappingConfig": { "org.iso.23220.photoid.1": { "entriesConfigMap": { "birth_date": { "type": "string", "conversionType": "stringToFullDate" }, "issuance_date": { "type": "string", "conversionType": "stringToFullDate" }, "expiry_date": { "type": "string", "conversionType": "stringToFullDate" }, "portrait": { "type": "string", "conversionType": "base64StringToByteString" } } } } } ``` ### Profile with Notifications ```json { "name": "Notified Credential Profile", "credentialConfigurationId": "UniversityDegree_jwt_vc_json", "issuerKeyId": "waltid.tenant1.kms1.key1", "issuerDid": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp", "credentialData": { "...": "..." }, "notifications": { "webhook": { "url": "https://your-server.com/webhook/issuance", "bearerToken": "your-secret-token" } } } ``` --- ## Next Steps - [Manage Profiles](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-profiles/manage-profiles.md) – View, update, and delete profiles. - [Create Credential Offers](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-offers/overview.md) – Use your profile to create credential offers.