Default Requests

If you always look up the same kind of entity, such as PID providers, every trust lookup repeats the same expectedEntityType. Default requests let you save it once on your Trust Registry, so each lookup only sends the certificate.

Default requests are optional. Nothing on this page is required to resolve trust.

What Changes

Without a default, each lookup sends the certificate and the expected type. With the type stored, the call becomes:

{
  "certificatePemOrDer": "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA..."
}

A call that omits the type gets the stored one. That makes lookups stricter by default: a certificate that belongs to a different entity type is answered NOT_TRUSTED. Anything you do send in the call wins over the stored value.

Prerequisites

  • A Trust Registry with at least one loaded trust source. See Setup and Trust Source Management.
  • A bearer token with the update-default-requests permission and the permission to resolve. Both are needed to store a default.

Step 1: Store a Default

The last part of the URL, resolve-certificate, names the API call the default applies to: the one behind POST /v1/{target}/trust-registry-api/resolve/certificate.

CURL

Endpoint: PUT /v1/{target}/trust-registry-api/default-requests/resolve-certificate | API Reference

Example Request
curl -X 'PUT' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/default-requests/resolve-certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "expectedEntityType": "PID_PROVIDER"
}'

Path Parameters

  • orgID: String (required) - Organization host alias.
  • target: resourceIdentifier (required) - {organizationID}.{tenantID}.{trustRegistryServiceID}, for example myorg.tenant1.trust-registry.

Header Parameters

  • Authorization: String (required) - Bearer token. Format: Bearer {yourToken}.

Body Parameters

  • A partial resolve by certificate request. expectedEntityType and expectedServiceType must be valid values, and unknown or misspelled keys are rejected now, not when you resolve.
Example Response 200 OK

The stored document is echoed back.

{
  "expectedEntityType": "PID_PROVIDER"
}

Response Codes

  • 200 - Default request stored.
  • 400 - The document is not a valid partial body for this operation.
  • 401 / 403 - Authentication or authorization failure.

Step 2: Resolve

Send only the certificate.

CURL

Endpoint: POST /v1/{target}/trust-registry-api/resolve/certificate | API Reference

Example Request
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/resolve/certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "certificatePemOrDer": "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA..."
}'

Body Parameters

  • certificatePemOrDer: String (required) - The certificate to check. Any other field you send overrides the stored value.
Example Response 200 OK

The response is the same as for any lookup. See Trust Resolution. For a certificate registered to a wallet provider, the default above gives "decision": "NOT_TRUSTED". Sending "expectedEntityType": "WALLET_PROVIDER" in the call gives "decision": "TRUSTED".

Response Codes

  • 200 - Lookup answered (check decision).
  • 401 / 403 - Authentication or authorization failure.

Good to Know

  • Each lookup has its own default. resolve-certificate, resolve-certificate-chain, resolve-certificate-sha256 and resolve-provider-id are separate operations. Store one for each you use.
  • Defaults are not guardrails. A caller can send their own expectedEntityType.
  • Explicit values win. A call that sends its own type replaces the stored one.

Read or Remove a Default

  • List all stored defaults: GET /v1/{target}/trust-registry-api/default-requests (needs view-default-requests).
  • Read one: GET …/default-requests/resolve-certificate. Returns 404 if none is stored.
  • Remove one: DELETE …/default-requests/resolve-certificate. Returns 204, also when nothing was stored.

Full details and permissions: Default Requests.

Last updated on September 29, 2026
Wallet2 IntegrationTrust Registry Service