#Trust Source Management

Each trust source is identified by a unique sourceId. Loading a source validates its format, applies the selected acceptance policy, and atomically activates the normalized entities, services, and certificate identities.

Supported inputs are:

• ETSI TS 119 612 national TSL XML;
• ETSI TS 119 612 EU List of Trusted Lists (LoTL) XML;
• ETSI TS 119 602 V1.1.1 annex A.1 JSON;
• ETSI TS 119 602 V1.1.1 annex A.2.1 XML;
• normative TS 119 602 JSON in a supported compact-JWS envelope.

Other JSON/XML shapes are rejected.

#Load from URL

Endpoint: POST /v1/{target}/trust-registry-api/sources/load

curl -X POST \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/sources/load' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
    "sourceId": "austria-tsl",
    "url": "https://www.signatur.rtr.at/vertrauensliste.xml",
    "acceptancePolicy": "REQUIRE_VALID_SIGNATURE"
  }'

Other public sources useful for interoperability testing are:

The EU LoTL contains OtherTSLPointer entries. A successful load reports them in pointersLoaded, but does not fetch the referenced national TSLs. Load every national TSL required by your verification policy as a separate source.

#Load from Content

Provide one of url or content. This example reads a complete ETSI TS 119 602 annex A.1 JSON document from disk:

jq -n --rawfile content wallet-providers.json \
  '{sourceId: "wallet-providers", content: $content, acceptancePolicy: "ALLOW_UNSIGNED"}' |
curl -X POST \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/sources/load' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  --data-binary @-

ALLOW_UNSIGNED is explicit in this example because the inline document has no signature. Use authenticated sources for production trust decisions.

#Request Fields

• sourceId: Unique source identifier.
• url: Remote source URL. Mutually exclusive with content.
• content: TSL/LoTL XML, LoTE JSON/XML, or compact JWS. Mutually exclusive with url.
• sourceUrl: Optional origin retained for refresh when loading inline content.
• acceptancePolicy: Optional per-load policy; the service default is used when omitted.
• trustedSignerCertificates: Optional PEM or Base64-DER signer certificates/trust anchors. These are configured independently of certificates embedded in a source.

#Acceptance Policies

The service default is REQUIRE_VALID_SIGNATURE. For the strongest source admission, use REQUIRE_AUTHENTICATED and configure the authorized signer certificate or its trust anchor independently.

#Load Signed LoTE JSON

Signed LoTE JSON uses compact JWS with an embedded, normative TS 119 602 JSON payload. The supported envelope requires ES256, ES384, or ES512 and a protected x5c header. Detached payloads, b64=false, and unsupported critical headers are rejected.

curl -X POST \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/sources/load' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
    "sourceId": "signed-wallet-providers",
    "content": "{compactJws}",
    "acceptancePolicy": "REQUIRE_AUTHENTICATED",
    "trustedSignerCertificates": ["{sourceSignerCertificatePemOrBase64Der}"]
  }'

#Load Result

{
  "sourceId": "austria-tsl",
  "success": true,
  "entitiesLoaded": 9,
  "servicesLoaded": 42,
  "identitiesLoaded": 42,
  "pointersLoaded": 0,
  "assurance": {
    "signatureStatus": "VALID",
    "signerTrust": "NOT_EVALUATED",
    "authenticityState": "INTEGRITY_VERIFIED",
    "acceptancePolicy": "REQUIRE_VALID_SIGNATURE",
    "accepted": true
  }
}

Always check success. A failed load includes errorCode and error; it does not replace an already active source.

#List and Monitor Sources

curl \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/sources' \
  -H 'Authorization: Bearer {yourToken}'

Each TrustSource includes:

• sourceFamily: TSL or LOTE;
• format: the exact TrustListFormat value;
• issue date, next update, sequence number, and freshnessState;
• assurance: signature, signer trust, acceptance policy, and admission state;
• source-specific metadata such as the LoTL pointerCount.

Use GET /v1/{target}/trust-registry-api/sources/health for source freshness and normalized record counts.

#Refresh a Source

curl -X POST \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/sources/{sourceId}/refresh' \
  -H 'Authorization: Bearer {yourToken}'

Refresh reuses the source URL, acceptance policy, and signer certificates stored at the successful load. If fetching, validation, or parsing fails, the previous active snapshot remains available.

#List Trusted Entities

curl \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/trust-registry-api/entities?sourceFamily=TSL&entityType=TRUST_SERVICE_PROVIDER&country=AT&onlyCurrentlyTrusted=true' \
  -H 'Authorization: Bearer {yourToken}'

sourceFamily accepts TSL or LOTE. Entity and service results are normalized from the validated source document.

#Endpoint Summary