Setup
Create a Trust Registry Service instance for your organization.
Prerequisites
Ensure you have the trust-registry feature enabled via the _features.conf:
enabledFeatures = [
trust-registry
]
Create the Service
CURL
Endpoint: POST /v1/{target}/resource-api/services/create | API Reference
Example Request
curl -X 'POST' \
'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
-H 'accept: */*' \
-H 'Authorization: Bearer {yourToken}' \
-H 'Content-Type: application/json' \
-d '{
"type": "trust-registry",
"sourceAcceptancePolicy": "REQUIRE_VALID_SIGNATURE"
}'
Path Parameters
orgID: String - Your organization's Base URL prefix, e.g.myorg.enterprise-sandbox.waltid.dev.target: String - The target path for the new service:{organizationID}.{tenantID}.{serviceID}, e.g.myorg.tenant1.trust-registry.
Header Parameters
Authorization: String - Bearer token for your organization.
Body
type: String - Must betrust-registry.sourceAcceptancePolicy: String (optional) - Default admission policy for newly loaded sources. Defaults toREQUIRE_VALID_SIGNATURE. See Acceptance Policies.trustedSourceSignerCertificates: Array of strings (optional) - PEM or Base64-DER certificates or trust anchors authorized to sign XMLDSig TSL and compact-JWS LoTE sources. Configure them independently from the loaded artifact.validateSignaturesByDefault: Boolean (legacy, optional) - Compatibility setting for existing configurations. PrefersourceAcceptancePolicyfor new services.autoRefreshIntervalSeconds: Integer (optional) - Stored for compatibility, but no background refresh scheduler currently uses it. Refresh sources explicitly through the refresh endpoint.
Example Response
| Status | Description |
|---|---|
201 | Service created successfully |
400 | Invalid request |
401 | Invalid or missing authentication token |
To require independent signer trust by default, set sourceAcceptancePolicy to REQUIRE_AUTHENTICATED and configure trustedSourceSignerCertificates. A certificate embedded in XMLDSig or JWS x5c does not establish trust by itself.
Signer certificates are public certificates, not private keys. Keep the configured set limited to source signers or trust anchors that your organization has authorized.
Once the service is created, load trust sources into it. See Trust Source Management.
Last updated on July 27, 2026
