---
title: "Default Requests"
description: "Store the entity type you always expect so each trust lookup only sends the certificate."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/trust-registry-service/default-requests
generated: 2026-10-01
---
# Default Requests

If you always look up the same kind of entity, such as PID providers, every trust lookup repeats the same `expectedEntityType`. **Default requests** let you save it once on your Trust Registry, so each lookup only sends the certificate.

**Note:**

Default requests are **optional**. Nothing on this page is required to resolve trust.

## What Changes

Without a default, each lookup sends the certificate and the expected type. With the type stored, the call becomes:

```json
{
  "certificatePemOrDer": "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA..."
}
```

A call that omits the type gets the stored one. That makes lookups stricter by default: a certificate that belongs to a different entity type is answered `NOT_TRUSTED`. Anything you *do* send in the call wins over the stored value.

## Prerequisites

- A Trust Registry with at least one loaded trust source. See [Setup](https://docs.walt.id/enterprise-stack/services/trust-registry-service/setup.md) and [Trust Source Management](https://docs.walt.id/enterprise-stack/services/trust-registry-service/trust-source-management.md).
- A bearer token with the `update-default-requests` permission and the permission to resolve. Both are needed to store a default.

## Step 1: Store a Default

The last part of the URL, `resolve-certificate`, names the API call the default applies to: the one behind `POST /v1/{target}/trust-registry-api/resolve/certificate`.

**Option: CURL**

**Endpoint:** `PUT /v1/{target}/trust-registry-api/default-requests/resolve-certificate` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html)

##### Example Request

```bash
curl -X 'PUT' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/default-requests/resolve-certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "expectedEntityType": "PID_PROVIDER"
}'
```

**Path Parameters**

- **orgID**: _String_ (required) - Organization host alias.
- **target**: _resourceIdentifier_ (required) - `{organizationID}.{tenantID}.{trustRegistryServiceID}`, for example `myorg.tenant1.trust-registry`.

**Header Parameters**

- **Authorization**: _String_ (required) - Bearer token. Format: `Bearer {yourToken}`.

**Body Parameters**

- A partial [resolve by certificate](https://docs.walt.id/enterprise-stack/services/trust-registry-service/trust-resolution.md#resolve-by-certificate) request. `expectedEntityType` and `expectedServiceType` must be valid values, and unknown or misspelled keys are rejected now, not when you resolve.

##### Example Response `200 OK`

The stored document is echoed back.

```json
{
  "expectedEntityType": "PID_PROVIDER"
}
```

**Response Codes**

- `200` - Default request stored.
- `400` - The document is not a valid partial body for this operation.
- `401` / `403` - Authentication or authorization failure.

## Step 2: Resolve

Send only the certificate.

**Option: CURL**

**Endpoint:** `POST /v1/{target}/trust-registry-api/resolve/certificate` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html)

##### Example Request

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/resolve/certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "certificatePemOrDer": "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA..."
}'
```

**Body Parameters**

- **certificatePemOrDer**: _String_ (required) - The certificate to check. Any other field you send overrides the stored value.

##### Example Response `200 OK`

The response is the same as for any lookup. See [Trust Resolution](https://docs.walt.id/enterprise-stack/services/trust-registry-service/trust-resolution.md#resolve-by-certificate). For a certificate registered to a wallet provider, the default above gives `"decision": "NOT_TRUSTED"`. Sending `"expectedEntityType": "WALLET_PROVIDER"` in the call gives `"decision": "TRUSTED"`.

**Response Codes**

- `200` - Lookup answered (check `decision`).
- `401` / `403` - Authentication or authorization failure.

## Good to Know

- **Each lookup has its own default.** `resolve-certificate`, `resolve-certificate-chain`, `resolve-certificate-sha256` and `resolve-provider-id` are separate operations. Store one for each you use.
- **Defaults are not guardrails.** A caller can send their own `expectedEntityType`.
- **Explicit values win.** A call that sends its own type replaces the stored one.

## Read or Remove a Default

- List all stored defaults: `GET /v1/{target}/trust-registry-api/default-requests` (needs `view-default-requests`).
- Read one: `GET …/default-requests/resolve-certificate`. Returns `404` if none is stored.
- Remove one: `DELETE …/default-requests/resolve-certificate`. Returns `204`, also when nothing was stored.

Full details and permissions: [Default Requests](https://docs.walt.id/enterprise-stack/administration/services/configuration/default-requests.md).