#Trust Resolution

Directly query trust status against the loaded trust sources. Use these endpoints to resolve whether a certificate, certificate fingerprint, or provider ID is trusted — for example, when debugging trust decisions, building custom integrations, or calling the Trust Registry from outside the standard Verifier2 flow.

All endpoints on this page require ES_TRUST_REGISTRY_RESOLVE.

#Resolve a Certificate Chain

Use chain resolution for credential verification. It validates a leaf-first presented chain against certificate trust anchors stored in the registry. The presented chain should include the signing certificate and required intermediates, but not the root where the credential profile prohibits it.

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{trustRegistryTarget}/trust-registry-api/resolve/certificate-chain' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "certificateChainPemOrDer": [
    "{leafCertificatePemOrBase64Der}",
    "{intermediateCertificatePemOrBase64Der}"
  ],
  "expectedEntityType": "PID_PROVIDER"
}'

A trusted response normally includes CERTIFICATE_PATH evidence. For compatibility with fingerprint-only sources and credentials that still present a registered root, the service can fall back to an exact certificate match and returns a warning instead of path evidence. NOT_TRUSTED means no valid path or eligible exact match remained after filtering.

#Resolve by Certificate

Check whether a certificate exactly matches an identity in an active trust source. Accepts PEM or base64-encoded DER format. Use certificate-chain resolution when the presented leaf must chain to a registry-owned anchor.

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{trustRegistryTarget}/trust-registry-api/resolve/certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "certificatePemOrDer": "MIIBkTCB+wIJAKHBfpEaYDcxMA0GCSqGSIb3DQEBCwUA...",
  "expectedEntityType": "PID_PROVIDER"
}'

{
  "decision": "TRUSTED",
  "sourceFreshness": "FRESH",
  "sourceAssurance": {
    "signatureStatus": "VALID",
    "signerTrust": "TRUSTED",
    "authenticityState": "AUTHENTICATED",
    "acceptancePolicy": "REQUIRE_AUTHENTICATED",
    "accepted": true
  },
  "matchedSource": {
    "sourceId": "eu-wallets",
    "sourceFamily": "LOTE",
    "displayName": "EU Wallet Providers",
    "sourceUrl": "https://trust.example.eu/wallet-providers.json",
    "territory": "EU",
    "issueDate": "2026-01-01T00:00:00Z",
    "nextUpdate": "2026-07-01T00:00:00Z",
    "assurance": {
      "signatureStatus": "VALID",
      "signerTrust": "TRUSTED",
      "authenticityState": "AUTHENTICATED",
      "acceptancePolicy": "REQUIRE_AUTHENTICATED",
      "accepted": true
    },
    "freshnessState": "FRESH"
  },
  "matchedEntity": {
    "entityId": "AT-WALLET-001",
    "sourceId": "eu-wallets",
    "entityType": "WALLET_PROVIDER",
    "legalName": "Demo Wallet Provider GmbH",
    "country": "AT"
  },
  "matchedService": {
    "serviceId": "wallet-service",
    "sourceId": "eu-wallets",
    "entityId": "AT-WALLET-001",
    "serviceType": "WALLET_INSTANCE_ATTESTATION",
    "status": "GRANTED",
    "statusStart": "2026-01-01T00:00:00Z"
  },
  "evidence": [
    {
      "type": "CERTIFICATE_MATCH",
      "value": "Identity: wallet-service-certificate",
      "metadata": {}
    },
    {
      "type": "STATUS",
      "value": "Service status: GRANTED",
      "metadata": {}
    }
  ],
  "warnings": []
}

#Resolve by Certificate SHA-256

Check trust using only the certificate's SHA-256 fingerprint. Faster than submitting the full certificate when the fingerprint is already available.

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{trustRegistryTarget}/trust-registry-api/resolve/certificate-sha256' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "certificateSha256Hex": "9f3df3b70633c3d23f5ef04d5d1e7f1d715b9683d8744cd38ec1a8114ec99f00",
  "expectedEntityType": "WALLET_PROVIDER"
}'

#Resolve by Provider ID

Check whether an entity is trusted by its provider identifier. Useful when the credential's iss field or a known entity ID is available but the raw certificate is not.

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{trustRegistryTarget}/trust-registry-api/resolve/provider-id' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "providerId": "AT-PID-001",
  "expectedEntityType": "PID_PROVIDER"
}'

#Response Reference

All resolution endpoints return a TrustDecision object with the following fields:

• decision: The trust resolution outcome. Possible values:

• sourceFreshness: Freshness state of the matched source. Values: FRESH, STALE, EXPIRED, UNKNOWN.
• sourceAssurance: Signature verification, signer trust, and source-admission result. See Trust Source Management.
• matchedSource (optional): The trust source that produced the match.
  • sourceId: Unique identifier of the source.
  • sourceFamily: TSL or LOTE.
  • format: Exact input role and syntax (ETSI_TS_119_612_TRUST_LIST_XML, ETSI_TS_119_612_LIST_OF_TRUST_LISTS_XML, ETSI_TS_119_602_JSON, or ETSI_TS_119_602_XML).
  • displayName: Human-readable name of the source.
  • sourceUrl (optional): URL the source was loaded from.
  • territory (optional): Territory or country code associated with the source.
  • issueDate (optional): ISO-8601 timestamp when the trust list was issued.
  • nextUpdate (optional): ISO-8601 timestamp when the trust list is due for update.
  • sequenceNumber (optional): Sequence number from the trust list, when present.
  • assurance: Source assurance recorded when this source was admitted.
  • freshnessState: Freshness state of this source. Values: FRESH, STALE, EXPIRED, UNKNOWN.
  • metadata: Map of additional key-value metadata. Empty by default.
• matchedEntity (optional): The entity whose identity matched.
  • entityId: The entity's identifier within the trust source.
  • sourceId: The source this entity belongs to.
  • entityType: The entity type. Values: PID_PROVIDER, WALLET_PROVIDER, ATTESTATION_PROVIDER, TRUST_SERVICE_PROVIDER, ACCESS_CERTIFICATE_PROVIDER, RELYING_PARTY_PROVIDER, OTHER.
  • legalName: Registered legal name of the entity.
  • tradeName (optional): Trading name of the entity.
  • registrationNumber (optional): Official registration number.
  • country (optional): ISO 3166-1 alpha-2 country code.
  • metadata: Map of additional key-value metadata. Empty by default.
• matchedService (optional): The specific trust service entry that matched.
  • serviceId: The service's identifier within the trust source.
  • sourceId: The source this service belongs to.
  • entityId: The entity this service belongs to.
  • serviceType: The service type URI as defined in the trust list.
  • status: Current trust status. Values: GRANTED, RECOGNIZED, ACCREDITED, SUPERVISED, DEPRECATED, SUSPENDED, REVOKED, WITHDRAWN, EXPIRED, UNKNOWN.
  • statusStart (optional): ISO-8601 timestamp when the current status became effective.
  • metadata: Map of additional key-value metadata. Empty by default.
• evidence (array): Additional trust evidence entries. Each item has type, value, and metadata.
• warnings (array): Non-fatal warnings, e.g. when a source is stale but a match was found.

#Endpoint Summary

#Troubleshooting Trust Decisions

• For NOT_TRUSTED, inspect evidence for certificate-path, entity-type, service-type, or service-status details.
• For STALE_SOURCE, refresh the matched source and verify its published nextUpdate value.
• For MULTIPLE_MATCHES, make identities unique across entities or add the appropriate entity and service filters.
• For PROCESSING_ERROR, validate the certificate encoding, chain order, and instant value.