Setup

Create a Trust Registry Service instance for your organization.

Prerequisites

Ensure you have the trust-registry feature enabled via the _features.conf:

enabledFeatures = [
    trust-registry
]

Create the Service

CURL

Endpoint: POST /v1/{target}/resource-api/services/create | API Reference

Example Request
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "trust-registry",
  "sourceAcceptancePolicy": "REQUIRE_VALID_SIGNATURE"
}'

Path Parameters

  • orgID: String - Your organization's Base URL prefix, e.g. myorg.enterprise-sandbox.waltid.dev.
  • target: String - The target path for the new service: {organizationID}.{tenantID}.{serviceID}, e.g. myorg.tenant1.trust-registry.

Header Parameters

  • Authorization: String - Bearer token for your organization.

Body

  • type: String - Must be trust-registry.
  • sourceAcceptancePolicy: String (optional) - Default admission policy for newly loaded sources. Defaults to REQUIRE_VALID_SIGNATURE. See Acceptance Policies.
  • trustedSourceSignerCertificates: Array of strings (optional) - PEM or Base64-DER certificates or trust anchors authorized to sign XMLDSig TSL and compact-JWS LoTE sources. Configure them independently from the loaded artifact.
  • validateSignaturesByDefault: Boolean (legacy, optional) - Compatibility setting for existing configurations. Prefer sourceAcceptancePolicy for new services.
  • autoRefreshIntervalSeconds: Integer (optional) - Stored for compatibility, but no background refresh scheduler currently uses it. Refresh sources explicitly through the refresh endpoint.

Example Response
StatusDescription
201Service created successfully
400Invalid request
401Invalid or missing authentication token

To require independent signer trust by default, set sourceAcceptancePolicy to REQUIRE_AUTHENTICATED and configure trustedSourceSignerCertificates. A certificate embedded in XMLDSig or JWS x5c does not establish trust by itself.

Signer certificates are public certificates, not private keys. Keep the configured set limited to source signers or trust anchors that your organization has authorized.

Once the service is created, load trust sources into it. See Trust Source Management.

Last updated on July 27, 2026