--- title: "Verifying Mobile Driver's Licenses (mDL, ISO/IEC 18013-5) via OID4VP" description: "Learn how to request and verify ISO/IEC 18013-5 mobile driver's licenses via OID4VP using the walt.id Enterprise Stack Verifier2 API." stack: "Enterprise Stack (commercial) — version 0.21.0" stack_version: "0.21.0" stack_comparison: https://docs.walt.id/community-vs-enterprise.md canonical_url: https://docs.walt.id/enterprise-stack/services/verifier2-service/credential-verification/mdl-oid4vp generated: 2026-07-08 --- # Verifying Mobile Driver's Licenses (mDL, ISO/IEC 18013-5) via OID4VP This guide shows you how to verify ISO/IEC 18013-5 mobile driver's licenses (mDL) using the walt.id Enterprise Stack Verifier2 API and the OID4VP protocol. The verification process sends a credential request to a holder's wallet, receives the signed presentation, and validates it against your policies. [**mDL (Mobile Driver's License)**](https://docs.walt.id/concepts/digital-credentials/mdoc-mdl-iso.md): A digital representation of a driver's license based on the [ISO/IEC 18013-5 standard](https://www.iso.org/standard/69084.html), stored securely on digital ID wallet. [**OID4VP**](https://docs.walt.id/concepts/data-exchange-protocols/openid4vp.md): A protocol specifying how parties can present digital credentials in a way that's consistent and secure across platforms ensuring interoperability. ## Prerequisites Before you begin, ensure you have: - **Enterprise Verifier2 Service setup** — Follow the [Setup](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md) guide - **Valid authentication token** — Required for all API calls to the Enterprise Stack - **A test wallet with credentials** — Use the [walt.id Wallet](https://docs.walt.id/enterprise-stack/services/wallet-service/overview.md) for testing, or any OID4VP-compatible wallet **Note:** **Enterprise Architecture:** The Enterprise Verifier2 Service runs as a dedicated microservice within your organization's infrastructure. All requests are scoped to `{organizationID}.{tenantID}.{verifierServiceID}` for multi-tenancy isolation. **Error:** **mDL Verification Requirement:** Verifying mDL credentials requires a `clientId` to be configured during [verifier2 service setup](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters). If you created your service without setting a `clientId`, you'll need to recreate it with one before mDL verification will work. --- ## Example 1: Basic Verification This example requests a mobile driver's license (mDL) and verifies its cryptographic signature using the default signature policy. **Option: CURL** **Endpoint:** `POST /v1/{target}/verifier2-service-api/verification-session/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20|%20Verifier2%20Service%20-%20Verification%20Sessions/post_v1__target__verifier2_service_api_verification_session_create) ##### Example Request ```bash curl -X 'POST' \ 'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/verifier2-service-api/verification-session/create' \ -H 'accept: application/json' \ -H 'Authorization: Bearer {yourToken}' \ -H 'Content-Type: application/json' \ -d '{ "flow_type": "cross_device", "core_flow": { "dcql_query": { "credentials": [ { "id": "credential_1", "format": "mso_mdoc", "meta": { "doctype_value": "org.iso.18013.5.1.mDL" }, "claims": [ { "path": [ "org.iso.18013.5.1", "family_name" ] }, { "path": [ "org.iso.18013.5.1", "given_name" ] }, { "path": [ "org.iso.18013.5.1", "birth_date" ] } ] } ] }, "policies": { "vc_policies": [ { "policy": "signature" } ] } } }' ``` **Path Parameters** - **orgID**: _String_ (required) - Your organization ID (e.g., `test` for `test.enterprise-sandbox.waltid.dev`) - **target**: _String_ (required) - The verifier service target path (e.g., `waltid.verifier1`) **Header Parameters** - **Authorization**: _String_ (required) - Bearer token for Enterprise Stack authentication. Format: `Bearer {token}`. Obtain from your Enterprise Stack authentication flow. **Body Parameters** - **flow_type**: _String_ (required) - Specifies how the credential request will be delivered to the holder's wallet. Options: - `"cross_device"` — User scans a QR code on a different device (e.g. desktop browser → phone wallet) - `"same_device"` — User clicks a deep link on the same device (e.g. phone browser → wallet app on same phone) - `"dc_api"` — Browser/OS-native Digital Credentials API (Chrome, Safari, iOS/Android native) over OpenID4VP 1.0 (Annex D). - `"dc_api-annex-c"` — Browser/OS-native Digital Credentials API (Chrome, Safari, iOS/Android native) over 18013-7 (Annex C). - **core_flow**: _Object_ (required) - Defines what credentials to request and which policies to apply. Contains: - **dcql_query**: _Object_ (required) - Specifies the credential type, format, and claims to request using the [DCQL query language](https://docs.walt.id/concepts/data-exchange-protocols/dcql.md). You can also use the DCQL builder [here](https://dcql.walt.id/). - **credentials**: _Array_ - List of credential queries. Each credential query contains: - **id**: _String_ - Unique identifier for this credential in the request (used in policy results) - **format**: _String_ - Credential format. For mDL, use `"mso_mdoc"` (mobile security object document). - **meta.doctype_value**: _String_ - The ISO mDL document type. For mobile driver's licenses, use `"org.iso.18013.5.1.mDL"`. - **claims**: _Array_ (optional) - Specific claims to request from the credential. Each claim has a `path` array with namespace and claim name (e.g. `["org.iso.18013.5.1", "family_name"]`). If omitted, all claims that are non-selectively disclosable are provided by the wallet. - **policies**: _Object_ (optional) - Validation rules applied to the received credential. Defaults to signature verification only if omitted. - **vc_policies**: _Array_ - Policies applied to individual credentials. Each policy has a `policy` field specifying the policy name. Available policies: `signature`, `expired`, `not-before`, `revoked-status-list`, `schema`, and more. See [Policies](https://docs.walt.id/enterprise-stack/services/verifier2-service/policies/overview.md) for the complete list. - **vp_policies**: _Array_ (optional) - Policies applied to the entire presentation (not shown in this example) - **signedRequest**: _Boolean_ (optional) - Whether to sign the authorization request JWT. Required for HAIP profile compliance and DC API Annex C (ISO 18013-7) flows. Defaults to `false`. See [Signed Requests](#signed-requests) to learn more. - **encryptedResponse**: _Boolean_ (optional) - Whether the wallet should encrypt the VP token response. Defaults to `false`. See [Encrypted Responses](#encrypted-responses) to learn more. - **key**: _Object_ (optional) - Signing key for this verification session. Overrides the service-wide default `key` configured during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters). Must be a serialized key in the format `{"type":"jwk","jwk":{...}}`. Required when `signedRequest: true` or `encryptedResponse: true` and no service-wide default is configured. See [Signed Requests](#signed-requests) and [Encrypted Responses](#encrypted-responses) for when this is needed. - **x5c**: _Array of Strings_ (optional) - X.509 certificate chain for this verification session. Overrides the service-wide default `x5c` configured during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters). Must be an ordered chain in DER-encoded, Base64-encoded format where the first certificate corresponds to the `key`. Required for X.509-based client authentication (`x509_san_dns:` or `x509_hash:` as `clientId`) and signed Annex C requests. See [Signed Requests](#signed-requests) to learn more. - **verifier_info**: _Object_ (optional) - An array of attestations about the Verifier relevant to the Credential Request. Each object is a JSON object with the following fields: - **format**: _String_ - The format of the attestation. Currently only `"jwt"` is supported. - **data**: _String_ - The attestation data in JWT format. - **credentialIds**: _Array_ (optional) - Specifies which credentials in your DCQL query this attestation applies to. References the `id` fields from your `credentials` array in the DCQL query. If omitted, the attestation applies to all requested credentials. - **expirationDuration**: _String_ (optional) - ISO-8601 duration specifying how long the verification session remains valid. Defaults to 10 minutes (`PT10M`). Example: `"PT1H"` for 1 hour, `"PT30M"` for 30 minutes. - **expirationDate**: _String_ (optional) - ISO-8601 datetime specifying the exact time when the session expires. Takes precedence over `expirationDuration` if both are set. Example: `"2026-05-21T15:00:00Z"`. Session expires if left unused (no presentation pushed). Once a presentation is received, the session is no longer eligible for expiry. - **openid**: _Object_ (optional) - OpenID4VP-specific extensions - **transactionData**: _Array_ (optional) - Bind the credential presentation to a specific transaction (e.g., payment authorization, account access). Each entry references credential IDs and includes transaction details. See [Transaction Data Authorization](#transaction-data-authorization) for full documentation. - **url_config**: _Object_ (optional) - URL configuration for this session. Only applies to `cross_device` and `same_device` flows (not `dc_api`). - **url_prefix**: _String_ (optional) - The publicly accessible base URL where the wallet will fetch the authorization request and post its response. - The service constructs: Request URI: `{urlPrefix}/{target}/verifier2-service-api/{sessionId}/request` and Response URI: `{urlPrefix}/{target}/verifier2-service-api/{sessionId}/response` - **Must be reachable by the wallet** (use ngrok or public URL for local development) - **url_host**: _String_ (optional) - The base URL used to construct the authorization request link. Can be set as a service-wide default during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters) and overridden per-session here. - For standard OID4VP flows, use `"openid4vp://authorize"` (default) - For custom authorization endpoints (e.g. conformance testing), provide a full HTTPS URL - **redirects**: _Object_ (optional) - Success and error redirect URLs (only for `cross_device` and `same_device` flows) - **successRedirectUri**: _String_ - URL to redirect the user after successful verification - **errorRedirectUri**: _String_ - URL to redirect the user if verification fails **Note:** **Service-Level Defaults:** The `key`, `x5c`, and `url_host` parameters can be configured as service-wide defaults during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters). Request-level parameters provided here override these defaults for that specific session only. --- ##### Example Response The response contains the session ID and authorization URLs to present to the user. ```json { "sessionId": "b68503d9-432c-49e7-97f8-5a1a7029c13a", "bootstrapAuthorizationRequestUrl": "openid4vp://authorize?client_id=did%3Ajwk%3AeyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0&request_uri=https%3A%2F%2Fwaltid.testing-0-20-0.enterprise.test.waltid.cloud%2Fv1%2Fwaltid.tenant1.verifier3%2Fverifier2-service-api%2Fb68503d9-432c-49e7-97f8-5a1a7029c13a%2Frequest", "fullAuthorizationRequestUrl": "openid4vp://authorize?response_type=vp_token&client_id=did%3Ajwk%3AeyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0&state=57ce75d0-c42b-4779-988f-65ca3a07a060&response_mode=direct_post&nonce=01ebdfac-948b-4e49-b2a6-b959a039d860&response_uri=https%3A%2F%2Fwaltid.testing-0-20-0.enterprise.test.waltid.cloud%2Fv1%2Fwaltid.tenant1.verifier3%2Fverifier2-service-api%2Fb68503d9-432c-49e7-97f8-5a1a7029c13a%2Fresponse&dcql_query=%7B%22credentials%22%3A%5B%7B%22id%22%3A%22credential_1%22%2C%22format%22%3A%22mso_mdoc%22%2C%22meta%22%3A%7B%22doctype_value%22%3A%22org.iso.18013.5.1.mDL%22%7D%2C%22claims%22%3A%5B%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22family_name%22%5D%7D%2C%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22given_name%22%5D%7D%2C%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22birth_date%22%5D%7D%5D%7D%5D%7D&client_metadata=%7B%22vp_formats_supported%22%3A%7B%22mso_mdoc%22%3A%7B%22issuerauth_alg_values%22%3A%5B-7%2C-9%2C-50%5D%2C%22deviceauth_alg_values%22%3A%5B-7%2C-9%2C-50%2C-65537%5D%7D%7D%2C%22client_name%22%3A%22Verifier%22%7D", "creationTarget": "waltid.tenant1.verifier3.b68503d9-432c-49e7-97f8-5a1a7029c13a" } ``` - **sessionId**: _String_ - The unique ID of this verification session. Use this to query the session status. - **bootstrapAuthorizationRequestUrl**: _String_ - Shortened URL using `request_uri` by reference. **Use this for QR codes** to minimize QR code density. - **fullAuthorizationRequestUrl**: _String_ - Complete URL with all parameters embedded. Use this if the wallet doesn't support `request_uri` (rare). - **creationTarget**: _String_ - The full resource path including the session ID. Use this as the `{creationTarget}` path parameter when querying session info. ## Presenting the Request to the User After creating the session, you need to present the authorization request to the user based on the flow type you chose. ### Cross-Device Flow (QR Code) 1. **Generate a QR code** from the `bootstrapAuthorizationRequestUrl` 2. **Display the QR code** to the user on your web page or application 3. **User scans the QR code** with their wallet app 4. **Wallet presents the credential** and posts the response to your verifier 5. **Monitor the session status** by polling the session endpoint or using SSE/callbacks (see below) ### Same-Device Flow (Deep Link) 1. **Redirect the user** to the `bootstrapAuthorizationRequestUrl` 2. **User's wallet app opens** automatically (via deep link) 3. **Wallet presents the credential** and posts the response to your verifier 4. **User is redirected** to your `successRedirectUri` or `errorRedirectUri` 5. **Query the session status** to retrieve the verification results --- ## Checking Verification Results You can query the verification session to check if the user has presented their credential and whether validation succeeded. **Option: CURL** **Endpoint:** `GET /v1/{target}/verifier2-service-api/verification-session/{sessionId}/info` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20|%20Verifier2%20Service%20-%20Verification%20Sessions/get_v1__target__verifier2_service_api_verification_session__sessionId__info) ##### Example Request ```bash curl -X 'GET' \ 'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/verifier2-service-api/verification-session/{sessionId}/info' \ -H 'accept: application/json' \ -H 'Authorization: Bearer {yourToken}' ``` **Path Parameters** - **orgID**: _String_ (required) - Your organization ID (e.g., `test` for `test.enterprise-sandbox.waltid.dev`) - **target**: _String_ (required) - The verifier service target path (e.g., `waltid.verifier1`) - **sessionId**: _String_ (required) - The unique ID of the verification session returned when you created the session. Use this to query the current status and results. **Header Parameters** - **Authorization**: _String_ (required) - Bearer token for Enterprise Stack authentication. Format: `Bearer {token}`. --- ##### Example Response The response contains the complete session information including setup, status, policy results, and presented credentials. ```json { "_id": "waltid.tenant1.verifier3.b68503d9-432c-49e7-97f8-5a1a7029c13a", "session": { "id": "b68503d9-432c-49e7-97f8-5a1a7029c13a", "setup": { "flow_type": "cross_device", "core_flow": { "dcql_query": { "credentials": [ { "id": "credential_1", "format": "mso_mdoc", "multiple": false, "meta": { "doctype_value": "org.iso.18013.5.1.mDL", "format": "mso_mdoc" }, "require_cryptographic_holder_binding": true, "claims": [ { "path": [ "org.iso.18013.5.1", "family_name" ] }, { "path": [ "org.iso.18013.5.1", "given_name" ] }, { "path": [ "org.iso.18013.5.1", "birth_date" ] } ] } ] }, "signed_request": false, "encrypted_response": false, "policies": { "vc_policies": [ { "policy": "signature", "id": "signature" } ] } }, "url_config": {} }, "creationDate": "2026-05-20T12:53:33.892550815Z", "expirationDate": "2026-05-20T13:03:52.467486314Z", "retentionDate": "2036-05-20T12:53:33.892550815Z", "status": "SUCCESSFUL", "attempted": true, "reattemptable": true, "bootstrapAuthorizationRequest": { "response_type": "vp_token", "client_id": "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0", "request_uri": "https://waltid.testing-0-20-0.enterprise.test.waltid.cloud/v1/waltid.tenant1.verifier3/verifier2-service-api/b68503d9-432c-49e7-97f8-5a1a7029c13a/request" }, "bootstrapAuthorizationRequestUrl": "openid4vp://authorize?client_id=did%3Ajwk%3AeyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0&request_uri=https%3A%2F%2Fwaltid.testing-0-20-0.enterprise.test.waltid.cloud%2Fv1%2Fwaltid.tenant1.verifier3%2Fverifier2-service-api%2Fb68503d9-432c-49e7-97f8-5a1a7029c13a%2Frequest", "authorizationRequest": { "response_type": "vp_token", "client_id": "did:jwk:eyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0", "state": "57ce75d0-c42b-4779-988f-65ca3a07a060", "response_mode": "direct_post", "nonce": "01ebdfac-948b-4e49-b2a6-b959a039d860", "response_uri": "https://waltid.testing-0-20-0.enterprise.test.waltid.cloud/v1/waltid.tenant1.verifier3/verifier2-service-api/b68503d9-432c-49e7-97f8-5a1a7029c13a/response", "dcql_query": { "credentials": [ { "id": "credential_1", "format": "mso_mdoc", "multiple": false, "meta": { "doctype_value": "org.iso.18013.5.1.mDL", "format": "mso_mdoc" }, "require_cryptographic_holder_binding": true, "claims": [ { "path": [ "org.iso.18013.5.1", "family_name" ] }, { "path": [ "org.iso.18013.5.1", "given_name" ] }, { "path": [ "org.iso.18013.5.1", "birth_date" ] } ] } ] }, "client_metadata": { "vp_formats_supported": { "mso_mdoc": { "issuerauth_alg_values": [ -7, -9, -50 ], "deviceauth_alg_values": [ -7, -9, -50, -65537 ] } }, "client_name": "Verifier" } }, "authorizationRequestUrl": "openid4vp://authorize?response_type=vp_token&client_id=did%3Ajwk%3AeyJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiU05JZ1ItTHZzSEUtNkhUUGxYYUpQVDVubHRZMFpqZlA0VkpTWEwzQ2ZkMCIsIngiOiJIVWM1ZHY1eFREV3VMVmZQcFdvVXBWTjZ1QTNJNzBsVzVnNEhoMG5VaDQ0In0&state=57ce75d0-c42b-4779-988f-65ca3a07a060&response_mode=direct_post&nonce=01ebdfac-948b-4e49-b2a6-b959a039d860&response_uri=https%3A%2F%2Fwaltid.testing-0-20-0.enterprise.test.waltid.cloud%2Fv1%2Fwaltid.tenant1.verifier3%2Fverifier2-service-api%2Fb68503d9-432c-49e7-97f8-5a1a7029c13a%2Fresponse&dcql_query=%7B%22credentials%22%3A%5B%7B%22id%22%3A%22credential_1%22%2C%22format%22%3A%22mso_mdoc%22%2C%22meta%22%3A%7B%22doctype_value%22%3A%22org.iso.18013.5.1.mDL%22%7D%2C%22claims%22%3A%5B%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22family_name%22%5D%7D%2C%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22given_name%22%5D%7D%2C%7B%22path%22%3A%5B%22org.iso.18013.5.1%22%2C%22birth_date%22%5D%7D%5D%7D%5D%7D&client_metadata=%7B%22vp_formats_supported%22%3A%7B%22mso_mdoc%22%3A%7B%22issuerauth_alg_values%22%3A%5B-7%2C-9%2C-50%5D%2C%22deviceauth_alg_values%22%3A%5B-7%2C-9%2C-50%2C-65537%5D%7D%7D%2C%22client_name%22%3A%22Verifier%22%7D", "requestMode": "REQUEST_URI", "policies": { "vp_policies": { "jwt_vc_json": [ "jwt_vc_json/audience-check", "jwt_vc_json/nonce-check", "jwt_vc_json/envelope_signature" ], "dc+sd-jwt": [ "dc+sd-jwt/audience-check", "dc+sd-jwt/kb-jwt_signature", "dc+sd-jwt/nonce-check", "dc+sd-jwt/sd_hash-check" ], "mso_mdoc": [ "mso_mdoc/device-auth", "mso_mdoc/device_key_auth", "mso_mdoc/issuer_auth", "mso_mdoc/issuer_signed_integrity", "mso_mdoc/mso" ] }, "vc_policies": [ { "policy": "signature", "id": "signature" } ] }, "policy_results": { "vp_policies": { "credential_1": { "mso_mdoc/device-auth": { "policy_executed": { "policy": "mso_mdoc/device-auth", "id": "mso_mdoc/device-auth", "description": "Verify device authentication" }, "success": true, "results": { "device_public_jwk": { "kty": "EC", "crv": "P-256", "x": "m4r2Sf0jYK3OXLPrdrwC2OSSkwCBUVNJH-kpIlzmBzo", "y": "Uqa4uWu4rgrm3Cj9wugwYIig5ZS9DkLKxKnGk8sYr1o" }, "device_auth_bytes_hex": "d8185868847444657669636541757468656e7469636174696f6e83f6f682714f70656e494434565048616e646f7665725820e85d5ae0c4a98f58e23408479ebe1b09b396e774e51ba9fd3848116113ee0e98756f72672e69736f2e31383031332e352e312e6d444cd81841a0" }, "errors": [], "execution_time": "PT0.078628917S" }, "mso_mdoc/device_key_auth": { "policy_executed": { "policy": "mso_mdoc/device_key_auth", "id": "mso_mdoc/device_key_auth", "description": "Verify holder-verified data" }, "success": true, "results": { "empty_device_signed_namespaces": true }, "errors": [], "execution_time": "PT0.003564846S" }, "mso_mdoc/issuer_auth": { "policy_executed": { "policy": "mso_mdoc/issuer_auth", "id": "mso_mdoc/issuer_auth", "description": "Verify issuer authentication" }, "success": true, "results": { "certificate_chain": [ "30820208308201ada00302010202140e8f24af5f78b7ab2db6de8a2f761c9ccb5c6986300a06082a8648ce3d0403023024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341301e170d3235303532393037313833395a170d3236303832393037313833395a3022310b30090603550406130255533113301106035504030c0a4578616d706c652044533059301306072a8648ce3d020106082a8648ce3d030107034200041962a974bde33e83c9e702a0480fa3c52da3829f9950313ab0841b781f3abc5d177c40c07f7aff155c895ee6150b2553f7914203fee6949988d7fc6e332819faa381be3081bb301f0603551d230418301680148c2311b1fa254de2b90ece8ca8e5a3e4dc74d414301d0603551d0e04160414ed2e3d2d27a0fded289df4f8e0555b2ffad22a7b300e0603551d0f0101ff04040302078030230603551d12041c301a861868747470733a2f2f696163612e6578616d706c652e636f6d30150603551d250101ff040b3009060728818c5d050102302d0603551d1f042630243022a020a01e861c68747470733a2f2f696163612e6578616d706c652e636f6d2f63726c300a06082a8648ce3d0403020349003046022100cb92abbe413c15d70561ad20c779edf851aa929fdd8ce5de574376842c2b6c44022100fdd9962cc2e224f5775339904b93141ed9fad75cf45652ff93760075a549e757" ], "signer_jwk": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" }, "signer_pem": "-----BEGIN CERTIFICATE-----\nMIICCDCCAa2gAwIBAgIUDo8kr194t6sttt6KL3YcnMtcaYYwCgYIKoZIzj0EAwIw\r\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjkw\r\nNzE4MzlaFw0yNjA4MjkwNzE4MzlaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApF\r\neGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGWKpdL3jPoPJ5wKg\r\nSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT95FCA/7mlJmI1/xu\r\nMygZ+qOBvjCBuzAfBgNVHSMEGDAWgBSMIxGx+iVN4rkOzoyo5aPk3HTUFDAdBgNV\r\nHQ4EFgQU7S49LSeg/e0onfT44FVbL/rSKnswDgYDVR0PAQH/BAQDAgeAMCMGA1Ud\r\nEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgco\r\ngYxdBQECMC0GA1UdHwQmMCQwIqAgoB6GHGh0dHBzOi8vaWFjYS5leGFtcGxlLmNv\r\nbS9jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAMuSq75BPBXXBWGtIMd57fhRqpKf3Yzl\r\n3ldDdoQsK2xEAiEA/dmWLMLiJPV3UzmQS5MUHtn611z0VlL/k3YAdaVJ51c=\n-----END CERTIFICATE-----" }, "errors": [], "execution_time": "PT0.078830219S" }, "mso_mdoc/issuer_signed_integrity": { "policy_executed": { "policy": "mso_mdoc/issuer_signed_integrity", "id": "mso_mdoc/issuer_signed_integrity", "description": "Verify issuer-verified data integrity" }, "success": true, "results": { "namespace": { "org.iso.18013.5.1": [ { "id": "family_name", "digest_id": 0, "value": "Doe", "value_type": "CborString", "random_hex": "e14217e08f91b89c3bbe3ee466778e98", "serialized_hex": "a4686469676573744944006672616e646f6d50e14217e08f91b89c3bbe3ee466778e9871656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756563446f65" }, { "id": "given_name", "digest_id": 1, "value": "John", "value_type": "CborString", "random_hex": "fbee28e15ccb9cdbca72ee8b5bf94ff2", "serialized_hex": "a4686469676573744944016672616e646f6d50fbee28e15ccb9cdbca72ee8b5bf94ff271656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565644a6f686e" }, { "id": "birth_date", "digest_id": 2, "value": "1986-03-22", "value_type": "CborString", "random_hex": "fd7b099a5883278e8b3351ec2089afbe", "serialized_hex": "a4686469676573744944026672616e646f6d50fd7b099a5883278e8b3351ec2089afbe71656c656d656e744964656e7469666965726a62697274685f646174656c656c656d656e7456616c75656a313938362d30332d3232" } ] }, "matching_digest": { "org.iso.18013.5.1": [ "family_name", "given_name", "birth_date" ] } }, "errors": [], "execution_time": "PT0.040422222S" }, "mso_mdoc/mso": { "policy_executed": { "policy": "mso_mdoc/mso", "id": "mso_mdoc/mso", "description": "Verify MSO" }, "success": true, "results": { "signed": "2026-05-20T12:31:10.361778536Z", "valid_from": "2027-05-20T12:31:10.361778836Z" }, "errors": [], "execution_time": "PT0.009410621S" } } }, "vc_policies": [ { "policy": { "policy": "signature", "id": "signature" }, "success": true, "result": { "verification_result": true, "signed_credential": "o2d2ZXJzaW9uYzEuMGlkb2N1bWVudHOBo2dkb2NUeXBldW9yZy5pc28uMTgwMTMuNS4xLm1ETGxpc3N1ZXJTaWduZWSiam5hbWVTcGFjZXOhcW9yZy5pc28uMTgwMTMuNS4xg9gYWFKkaGRpZ2VzdElEAGZyYW5kb21Q4UIX4I-RuJw7vj7kZneOmHFlbGVtZW50SWRlbnRpZmllcmtmYW1pbHlfbmFtZWxlbGVtZW50VmFsdWVjRG9l2BhYUqRoZGlnZXN0SUQBZnJhbmRvbVD77ijhXMuc28py7otb-U_ycWVsZW1lbnRJZGVudGlmaWVyamdpdmVuX25hbWVsZWxlbWVudFZhbHVlZEpvaG7YGFhYpGhkaWdlc3RJRAJmcmFuZG9tUP17CZpYgyeOizNR7CCJr75xZWxlbWVudElkZW50aWZpZXJqYmlydGhfZGF0ZWxlbGVtZW50VmFsdWVqMTk4Ni0wMy0yMmppc3N1ZXJBdXRohEOhASahGCFZAgwwggIIMIIBraADAgECAhQOjySvX3i3qy223oovdhycy1xphjAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI1MDUyOTA3MTgzOVoXDTI2MDgyOTA3MTgzOVowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM-g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB_ev8VXIle5hULJVP3kUID_uaUmYjX_G4zKBn6o4G-MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo-TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv-tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB_wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNJADBGAiEAy5KrvkE8FdcFYa0gx3nt-FGqkp_djOXeV0N2hCwrbEQCIQD92ZYswuIk9XdTOZBLkxQe2frXXPRWUv-TdgB1pUnnV1kC29gYWQLWpmd2ZXJzaW9uYzEuMG9kaWdlc3RBbGdvcml0aG1nU0hBLTI1Nmx2YWx1ZURpZ2VzdHOhcW9yZy5pc28uMTgwMTMuNS4xqwBYINkmb8SGjrc7AGjP6gkyvJ1pNbdZ6I-xwFA8f9PL2guiAVggg2tS4UeThS0khoqyZTViFHzWiuuRR1I4aUCEswwJ6tcCWCBhf1K133IForrOHf43caHLjpNTlAJVxHYT_SzmJ4eK1gNYINMP97ZPmf-QLX72eHRlgwN0evBd5GvLr-6cDYvT7L09BFggb0V8kEZVt9-_wzIBLAlhrytSmm7ajzC58n1yVf4uE7QFWCCBdiI7t2bTX4feg_2GwpgMysLgiravmc_awwdpD2Z0cQZYID7NylJKtQhbBuKye2pL1k5iFX6X38JHL-9AiGa0559RB1ggG_IJ-IWsyVPi4JWkVf2p2PVHkga6jjaA5gQA4SLQCb0IWCBA_JctXYaTi9Z1eH11APUEX4fVq0RlvySyY75Vx5bvaglYIFCx9IEHFGrffrbP97PsM-dwi8K5ZMqolCg-oGrF-mlwClggBo2e11n0snkAvTs49Yu5McIu_BQ4hYgQTiDXTTCkvsltZGV2aWNlS2V5SW5mb6FpZGV2aWNlS2V5pAECIAEhWCCbivZJ_SNgrc5cs-t2vALY5JKTAIFRU0kf6SkiXOYHOiJYIFKmuLlruK4K5two_cLoMGCIoOWUvQ5CysSpxpPLGK9aZ2RvY1R5cGV1b3JnLmlzby4xODAxMy41LjEubURMbHZhbGlkaXR5SW5mb6Nmc2lnbmVkwHgeMjAyNi0wNS0yMFQxMjozMToxMC4zNjE3Nzg1MzZaaXZhbGlkRnJvbcB4HjIwMjYtMDUtMjBUMTI6MzE6MTAuMzYxNzc4NzM2Wmp2YWxpZFVudGlswHgeMjAyNy0wNS0yMFQxMjozMToxMC4zNjE3Nzg4MzZaWEBpgFeAPp3GYOhzUo9aUpOyQfv6dQONcrJEVd6N_AvHOyoQyKDXrpYXST9Djj01iPAe5aR29TI7sWIkUiYwZxwBbGRldmljZVNpZ25lZKJqbmFtZVNwYWNlc9gYQaBqZGV2aWNlQXV0aKFvZGV2aWNlU2lnbmF0dXJlhEOhASag9lhALzj9UuVdvDr5rmcY8bFNCc6l6Fg3vJ6sKNbQI_9lCtYptsdvt1UlRwsdjjq9zCzEBHKk7_qiPWG2gqk7hFSV6WZzdGF0dXMA", "credential_signature": { "type": "signature-cose", "signerKey": { "type": "jwk", "jwk": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" } }, "x5cList": [ "MIICCDCCAa2gAwIBAgIUDo8kr194t6sttt6KL3YcnMtcaYYwCgYIKoZIzj0EAwIwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1MjkwNzE4MzlaFw0yNjA4MjkwNzE4MzlaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApFeGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT95FCA/7mlJmI1/xuMygZ+qOBvjCBuzAfBgNVHSMEGDAWgBSMIxGx+iVN4rkOzoyo5aPk3HTUFDAdBgNVHQ4EFgQU7S49LSeg/e0onfT44FVbL/rSKnswDgYDVR0PAQH/BAQDAgeAMCMGA1UdEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgcogYxdBQECMC0GA1UdHwQmMCQwIqAgoB6GHGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbS9jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAMuSq75BPBXXBWGtIMd57fhRqpKf3Yzl3ldDdoQsK2xEAiEA/dmWLMLiJPV3UzmQS5MUHtn611z0VlL/k3YAdaVJ51c=" ] }, "verified_data": { "docType": "org.iso.18013.5.1.mDL", "org.iso.18013.5.1": { "family_name": "Doe", "given_name": "John", "birth_date": "1986-03-22" } }, "successful_issuer_public_key": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" }, "successful_issuer_public_key_id": "pX99OZjL2iNqM7OMkE1r1rYyuAObvPntewcDHdc2bMM" } } ], "specific_vc_policies": {}, "overallSuccess": true }, "presentation_validation_results": { "credential_1": { "mso_mdoc/device-auth": { "policy_executed": { "policy": "mso_mdoc/device-auth", "id": "mso_mdoc/device-auth", "description": "Verify device authentication" }, "success": true, "results": { "device_public_jwk": { "kty": "EC", "crv": "P-256", "x": "m4r2Sf0jYK3OXLPrdrwC2OSSkwCBUVNJH-kpIlzmBzo", "y": "Uqa4uWu4rgrm3Cj9wugwYIig5ZS9DkLKxKnGk8sYr1o" }, "device_auth_bytes_hex": "d8185868847444657669636541757468656e7469636174696f6e83f6f682714f70656e494434565048616e646f7665725820e85d5ae0c4a98f58e23408479ebe1b09b396e774e51ba9fd3848116113ee0e98756f72672e69736f2e31383031332e352e312e6d444cd81841a0" }, "errors": [], "execution_time": "PT0.078628917S" }, "mso_mdoc/device_key_auth": { "policy_executed": { "policy": "mso_mdoc/device_key_auth", "id": "mso_mdoc/device_key_auth", "description": "Verify holder-verified data" }, "success": true, "results": { "empty_device_signed_namespaces": true }, "errors": [], "execution_time": "PT0.003564846S" }, "mso_mdoc/issuer_auth": { "policy_executed": { "policy": "mso_mdoc/issuer_auth", "id": "mso_mdoc/issuer_auth", "description": "Verify issuer authentication" }, "success": true, "results": { "certificate_chain": [ "30820208308201ada00302010202140e8f24af5f78b7ab2db6de8a2f761c9ccb5c6986300a06082a8648ce3d0403023024310b30090603550406130255533115301306035504030c0c4578616d706c652049414341301e170d3235303532393037313833395a170d3236303832393037313833395a3022310b30090603550406130255533113301106035504030c0a4578616d706c652044533059301306072a8648ce3d020106082a8648ce3d030107034200041962a974bde33e83c9e702a0480fa3c52da3829f9950313ab0841b781f3abc5d177c40c07f7aff155c895ee6150b2553f7914203fee6949988d7fc6e332819faa381be3081bb301f0603551d230418301680148c2311b1fa254de2b90ece8ca8e5a3e4dc74d414301d0603551d0e04160414ed2e3d2d27a0fded289df4f8e0555b2ffad22a7b300e0603551d0f0101ff04040302078030230603551d12041c301a861868747470733a2f2f696163612e6578616d706c652e636f6d30150603551d250101ff040b3009060728818c5d050102302d0603551d1f042630243022a020a01e861c68747470733a2f2f696163612e6578616d706c652e636f6d2f63726c300a06082a8648ce3d0403020349003046022100cb92abbe413c15d70561ad20c779edf851aa929fdd8ce5de574376842c2b6c44022100fdd9962cc2e224f5775339904b93141ed9fad75cf45652ff93760075a549e757" ], "signer_jwk": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" }, "signer_pem": "-----BEGIN CERTIFICATE-----\nMIICCDCCAa2gAwIBAgIUDo8kr194t6sttt6KL3YcnMtcaYYwCgYIKoZIzj0EAwIw\r\nJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1Mjkw\r\nNzE4MzlaFw0yNjA4MjkwNzE4MzlaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApF\r\neGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGWKpdL3jPoPJ5wKg\r\nSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT95FCA/7mlJmI1/xu\r\nMygZ+qOBvjCBuzAfBgNVHSMEGDAWgBSMIxGx+iVN4rkOzoyo5aPk3HTUFDAdBgNV\r\nHQ4EFgQU7S49LSeg/e0onfT44FVbL/rSKnswDgYDVR0PAQH/BAQDAgeAMCMGA1Ud\r\nEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgco\r\ngYxdBQECMC0GA1UdHwQmMCQwIqAgoB6GHGh0dHBzOi8vaWFjYS5leGFtcGxlLmNv\r\nbS9jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAMuSq75BPBXXBWGtIMd57fhRqpKf3Yzl\r\n3ldDdoQsK2xEAiEA/dmWLMLiJPV3UzmQS5MUHtn611z0VlL/k3YAdaVJ51c=\n-----END CERTIFICATE-----" }, "errors": [], "execution_time": "PT0.078830219S" }, "mso_mdoc/issuer_signed_integrity": { "policy_executed": { "policy": "mso_mdoc/issuer_signed_integrity", "id": "mso_mdoc/issuer_signed_integrity", "description": "Verify issuer-verified data integrity" }, "success": true, "results": { "namespace": { "org.iso.18013.5.1": [ { "id": "family_name", "digest_id": 0, "value": "Doe", "value_type": "CborString", "random_hex": "e14217e08f91b89c3bbe3ee466778e98", "serialized_hex": "a4686469676573744944006672616e646f6d50e14217e08f91b89c3bbe3ee466778e9871656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756563446f65" }, { "id": "given_name", "digest_id": 1, "value": "John", "value_type": "CborString", "random_hex": "fbee28e15ccb9cdbca72ee8b5bf94ff2", "serialized_hex": "a4686469676573744944016672616e646f6d50fbee28e15ccb9cdbca72ee8b5bf94ff271656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565644a6f686e" }, { "id": "birth_date", "digest_id": 2, "value": "1986-03-22", "value_type": "CborString", "random_hex": "fd7b099a5883278e8b3351ec2089afbe", "serialized_hex": "a4686469676573744944026672616e646f6d50fd7b099a5883278e8b3351ec2089afbe71656c656d656e744964656e7469666965726a62697274685f646174656c656c656d656e7456616c75656a313938362d30332d3232" } ] }, "matching_digest": { "org.iso.18013.5.1": [ "family_name", "given_name", "birth_date" ] } }, "errors": [], "execution_time": "PT0.040422222S" }, "mso_mdoc/mso": { "policy_executed": { "policy": "mso_mdoc/mso", "id": "mso_mdoc/mso", "description": "Verify MSO" }, "success": true, "results": { "signed": "2026-05-20T12:31:10.361778536Z", "valid_from": "2027-05-20T12:31:10.361778836Z" }, "errors": [], "execution_time": "PT0.009410621S" } } }, "presented_raw_data": { "vpToken": { "credential_1": [ "o2d2ZXJzaW9uYzEuMGlkb2N1bWVudHOBo2dkb2NUeXBldW9yZy5pc28uMTgwMTMuNS4xLm1ETGxpc3N1ZXJTaWduZWSiam5hbWVTcGFjZXOhcW9yZy5pc28uMTgwMTMuNS4xg9gYWFKkaGRpZ2VzdElEAGZyYW5kb21Q4UIX4I-RuJw7vj7kZneOmHFlbGVtZW50SWRlbnRpZmllcmtmYW1pbHlfbmFtZWxlbGVtZW50VmFsdWVjRG9l2BhYUqRoZGlnZXN0SUQBZnJhbmRvbVD77ijhXMuc28py7otb-U_ycWVsZW1lbnRJZGVudGlmaWVyamdpdmVuX25hbWVsZWxlbWVudFZhbHVlZEpvaG7YGFhYpGhkaWdlc3RJRAJmcmFuZG9tUP17CZpYgyeOizNR7CCJr75xZWxlbWVudElkZW50aWZpZXJqYmlydGhfZGF0ZWxlbGVtZW50VmFsdWVqMTk4Ni0wMy0yMmppc3N1ZXJBdXRohEOhASahGCFZAgwwggIIMIIBraADAgECAhQOjySvX3i3qy223oovdhycy1xphjAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI1MDUyOTA3MTgzOVoXDTI2MDgyOTA3MTgzOVowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM-g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB_ev8VXIle5hULJVP3kUID_uaUmYjX_G4zKBn6o4G-MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo-TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv-tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB_wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNJADBGAiEAy5KrvkE8FdcFYa0gx3nt-FGqkp_djOXeV0N2hCwrbEQCIQD92ZYswuIk9XdTOZBLkxQe2frXXPRWUv-TdgB1pUnnV1kC29gYWQLWpmd2ZXJzaW9uYzEuMG9kaWdlc3RBbGdvcml0aG1nU0hBLTI1Nmx2YWx1ZURpZ2VzdHOhcW9yZy5pc28uMTgwMTMuNS4xqwBYINkmb8SGjrc7AGjP6gkyvJ1pNbdZ6I-xwFA8f9PL2guiAVggg2tS4UeThS0khoqyZTViFHzWiuuRR1I4aUCEswwJ6tcCWCBhf1K133IForrOHf43caHLjpNTlAJVxHYT_SzmJ4eK1gNYINMP97ZPmf-QLX72eHRlgwN0evBd5GvLr-6cDYvT7L09BFggb0V8kEZVt9-_wzIBLAlhrytSmm7ajzC58n1yVf4uE7QFWCCBdiI7t2bTX4feg_2GwpgMysLgiravmc_awwdpD2Z0cQZYID7NylJKtQhbBuKye2pL1k5iFX6X38JHL-9AiGa0559RB1ggG_IJ-IWsyVPi4JWkVf2p2PVHkga6jjaA5gQA4SLQCb0IWCBA_JctXYaTi9Z1eH11APUEX4fVq0RlvySyY75Vx5bvaglYIFCx9IEHFGrffrbP97PsM-dwi8K5ZMqolCg-oGrF-mlwClggBo2e11n0snkAvTs49Yu5McIu_BQ4hYgQTiDXTTCkvsltZGV2aWNlS2V5SW5mb6FpZGV2aWNlS2V5pAECIAEhWCCbivZJ_SNgrc5cs-t2vALY5JKTAIFRU0kf6SkiXOYHOiJYIFKmuLlruK4K5two_cLoMGCIoOWUvQ5CysSpxpPLGK9aZ2RvY1R5cGV1b3JnLmlzby4xODAxMy41LjEubURMbHZhbGlkaXR5SW5mb6Nmc2lnbmVkwHgeMjAyNi0wNS0yMFQxMjozMToxMC4zNjE3Nzg1MzZaaXZhbGlkRnJvbcB4HjIwMjYtMDUtMjBUMTI6MzE6MTAuMzYxNzc4NzM2Wmp2YWxpZFVudGlswHgeMjAyNy0wNS0yMFQxMjozMToxMC4zNjE3Nzg4MzZaWEBpgFeAPp3GYOhzUo9aUpOyQfv6dQONcrJEVd6N_AvHOyoQyKDXrpYXST9Djj01iPAe5aR29TI7sWIkUiYwZxwBbGRldmljZVNpZ25lZKJqbmFtZVNwYWNlc9gYQaBqZGV2aWNlQXV0aKFvZGV2aWNlU2lnbmF0dXJlhEOhASag9lhALzj9UuVdvDr5rmcY8bFNCc6l6Fg3vJ6sKNbQI_9lCtYptsdvt1UlRwsdjjq9zCzEBHKk7_qiPWG2gqk7hFSV6WZzdGF0dXMA" ] }, "state": "57ce75d0-c42b-4779-988f-65ca3a07a060" }, "presented_presentations": { "credential_1": { "type": "mso_mdoc", "format": "mso_mdoc", "mdoc": { "credentialData": { "docType": "org.iso.18013.5.1.mDL", "org.iso.18013.5.1": { "family_name": "Doe", "given_name": "John", "birth_date": "1986-03-22" } }, "signed": "o2d2ZXJzaW9uYzEuMGlkb2N1bWVudHOBo2dkb2NUeXBldW9yZy5pc28uMTgwMTMuNS4xLm1ETGxpc3N1ZXJTaWduZWSiam5hbWVTcGFjZXOhcW9yZy5pc28uMTgwMTMuNS4xg9gYWFKkaGRpZ2VzdElEAGZyYW5kb21Q4UIX4I-RuJw7vj7kZneOmHFlbGVtZW50SWRlbnRpZmllcmtmYW1pbHlfbmFtZWxlbGVtZW50VmFsdWVjRG9l2BhYUqRoZGlnZXN0SUQBZnJhbmRvbVD77ijhXMuc28py7otb-U_ycWVsZW1lbnRJZGVudGlmaWVyamdpdmVuX25hbWVsZWxlbWVudFZhbHVlZEpvaG7YGFhYpGhkaWdlc3RJRAJmcmFuZG9tUP17CZpYgyeOizNR7CCJr75xZWxlbWVudElkZW50aWZpZXJqYmlydGhfZGF0ZWxlbGVtZW50VmFsdWVqMTk4Ni0wMy0yMmppc3N1ZXJBdXRohEOhASahGCFZAgwwggIIMIIBraADAgECAhQOjySvX3i3qy223oovdhycy1xphjAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI1MDUyOTA3MTgzOVoXDTI2MDgyOTA3MTgzOVowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM-g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB_ev8VXIle5hULJVP3kUID_uaUmYjX_G4zKBn6o4G-MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo-TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv-tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB_wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNJADBGAiEAy5KrvkE8FdcFYa0gx3nt-FGqkp_djOXeV0N2hCwrbEQCIQD92ZYswuIk9XdTOZBLkxQe2frXXPRWUv-TdgB1pUnnV1kC29gYWQLWpmd2ZXJzaW9uYzEuMG9kaWdlc3RBbGdvcml0aG1nU0hBLTI1Nmx2YWx1ZURpZ2VzdHOhcW9yZy5pc28uMTgwMTMuNS4xqwBYINkmb8SGjrc7AGjP6gkyvJ1pNbdZ6I-xwFA8f9PL2guiAVggg2tS4UeThS0khoqyZTViFHzWiuuRR1I4aUCEswwJ6tcCWCBhf1K133IForrOHf43caHLjpNTlAJVxHYT_SzmJ4eK1gNYINMP97ZPmf-QLX72eHRlgwN0evBd5GvLr-6cDYvT7L09BFggb0V8kEZVt9-_wzIBLAlhrytSmm7ajzC58n1yVf4uE7QFWCCBdiI7t2bTX4feg_2GwpgMysLgiravmc_awwdpD2Z0cQZYID7NylJKtQhbBuKye2pL1k5iFX6X38JHL-9AiGa0559RB1ggG_IJ-IWsyVPi4JWkVf2p2PVHkga6jjaA5gQA4SLQCb0IWCBA_JctXYaTi9Z1eH11APUEX4fVq0RlvySyY75Vx5bvaglYIFCx9IEHFGrffrbP97PsM-dwi8K5ZMqolCg-oGrF-mlwClggBo2e11n0snkAvTs49Yu5McIu_BQ4hYgQTiDXTTCkvsltZGV2aWNlS2V5SW5mb6FpZGV2aWNlS2V5pAECIAEhWCCbivZJ_SNgrc5cs-t2vALY5JKTAIFRU0kf6SkiXOYHOiJYIFKmuLlruK4K5two_cLoMGCIoOWUvQ5CysSpxpPLGK9aZ2RvY1R5cGV1b3JnLmlzby4xODAxMy41LjEubURMbHZhbGlkaXR5SW5mb6Nmc2lnbmVkwHgeMjAyNi0wNS0yMFQxMjozMToxMC4zNjE3Nzg1MzZaaXZhbGlkRnJvbcB4HjIwMjYtMDUtMjBUMTI6MzE6MTAuMzYxNzc4NzM2Wmp2YWxpZFVudGlswHgeMjAyNy0wNS0yMFQxMjozMToxMC4zNjE3Nzg4MzZaWEBpgFeAPp3GYOhzUo9aUpOyQfv6dQONcrJEVd6N_AvHOyoQyKDXrpYXST9Djj01iPAe5aR29TI7sWIkUiYwZxwBbGRldmljZVNpZ25lZKJqbmFtZVNwYWNlc9gYQaBqZGV2aWNlQXV0aKFvZGV2aWNlU2lnbmF0dXJlhEOhASag9lhALzj9UuVdvDr5rmcY8bFNCc6l6Fg3vJ6sKNbQI_9lCtYptsdvt1UlRwsdjjq9zCzEBHKk7_qiPWG2gqk7hFSV6WZzdGF0dXMA", "docType": "org.iso.18013.5.1.mDL", "signature": { "type": "signature-cose", "signerKey": { "type": "jwk", "jwk": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" } }, "x5cList": [ "MIICCDCCAa2gAwIBAgIUDo8kr194t6sttt6KL3YcnMtcaYYwCgYIKoZIzj0EAwIwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1MjkwNzE4MzlaFw0yNjA4MjkwNzE4MzlaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApFeGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT95FCA/7mlJmI1/xuMygZ+qOBvjCBuzAfBgNVHSMEGDAWgBSMIxGx+iVN4rkOzoyo5aPk3HTUFDAdBgNVHQ4EFgQU7S49LSeg/e0onfT44FVbL/rSKnswDgYDVR0PAQH/BAQDAgeAMCMGA1UdEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgcogYxdBQECMC0GA1UdHwQmMCQwIqAgoB6GHGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbS9jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAMuSq75BPBXXBWGtIMd57fhRqpKf3Yzl3ldDdoQsK2xEAiEA/dmWLMLiJPV3UzmQS5MUHtn611z0VlL/k3YAdaVJ51c=" ] }, "format": "mso_mdoc", "mso": { "version": "1.0", "digestAlgorithm": "SHA-256", "valueDigests": { "org.iso.18013.5.1": { ... }, "deviceKeyInfo": { "deviceKey": { ... } }, "docType": "org.iso.18013.5.1.mDL", "validityInfo": { "signed": "2026-05-20T12:31:10.361778536Z", "validFrom": "2026-05-20T12:31:10.361778736Z", "validUntil": "2027-05-20T12:31:10.361778836Z" } } } } }, "presented_credentials": { "credential_1": [ { "type": "vc-mdocs", "credentialData": { "docType": "org.iso.18013.5.1.mDL", "org.iso.18013.5.1": { "family_name": "Doe", "given_name": "John", "birth_date": "1986-03-22" } }, "signed": "o2d2ZXJzaW9uYzEuMGlkb2N1bWVudHOBo2dkb2NUeXBldW9yZy5pc28uMTgwMTMuNS4xLm1ETGxpc3N1ZXJTaWduZWSiam5hbWVTcGFjZXOhcW9yZy5pc28uMTgwMTMuNS4xg9gYWFKkaGRpZ2VzdElEAGZyYW5kb21Q4UIX4I-RuJw7vj7kZneOmHFlbGVtZW50SWRlbnRpZmllcmtmYW1pbHlfbmFtZWxlbGVtZW50VmFsdWVjRG9l2BhYUqRoZGlnZXN0SUQBZnJhbmRvbVD77ijhXMuc28py7otb-U_ycWVsZW1lbnRJZGVudGlmaWVyamdpdmVuX25hbWVsZWxlbWVudFZhbHVlZEpvaG7YGFhYpGhkaWdlc3RJRAJmcmFuZG9tUP17CZpYgyeOizNR7CCJr75xZWxlbWVudElkZW50aWZpZXJqYmlydGhfZGF0ZWxlbGVtZW50VmFsdWVqMTk4Ni0wMy0yMmppc3N1ZXJBdXRohEOhASahGCFZAgwwggIIMIIBraADAgECAhQOjySvX3i3qy223oovdhycy1xphjAKBggqhkjOPQQDAjAkMQswCQYDVQQGEwJVUzEVMBMGA1UEAwwMRXhhbXBsZSBJQUNBMB4XDTI1MDUyOTA3MTgzOVoXDTI2MDgyOTA3MTgzOVowIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCkV4YW1wbGUgRFMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQZYql0veM-g8nnAqBID6PFLaOCn5lQMTqwhBt4Hzq8XRd8QMB_ev8VXIle5hULJVP3kUID_uaUmYjX_G4zKBn6o4G-MIG7MB8GA1UdIwQYMBaAFIwjEbH6JU3iuQ7OjKjlo-TcdNQUMB0GA1UdDgQWBBTtLj0tJ6D97Sid9PjgVVsv-tIqezAOBgNVHQ8BAf8EBAMCB4AwIwYDVR0SBBwwGoYYaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tMBUGA1UdJQEB_wQLMAkGByiBjF0FAQIwLQYDVR0fBCYwJDAioCCgHoYcaHR0cHM6Ly9pYWNhLmV4YW1wbGUuY29tL2NybDAKBggqhkjOPQQDAgNJADBGAiEAy5KrvkE8FdcFYa0gx3nt-FGqkp_djOXeV0N2hCwrbEQCIQD92ZYswuIk9XdTOZBLkxQe2frXXPRWUv-TdgB1pUnnV1kC29gYWQLWpmd2ZXJzaW9uYzEuMG9kaWdlc3RBbGdvcml0aG1nU0hBLTI1Nmx2YWx1ZURpZ2VzdHOhcW9yZy5pc28uMTgwMTMuNS4xqwBYINkmb8SGjrc7AGjP6gkyvJ1pNbdZ6I-xwFA8f9PL2guiAVggg2tS4UeThS0khoqyZTViFHzWiuuRR1I4aUCEswwJ6tcCWCBhf1K133IForrOHf43caHLjpNTlAJVxHYT_SzmJ4eK1gNYINMP97ZPmf-QLX72eHRlgwN0evBd5GvLr-6cDYvT7L09BFggb0V8kEZVt9-_wzIBLAlhrytSmm7ajzC58n1yVf4uE7QFWCCBdiI7t2bTX4feg_2GwpgMysLgiravmc_awwdpD2Z0cQZYID7NylJKtQhbBuKye2pL1k5iFX6X38JHL-9AiGa0559RB1ggG_IJ-IWsyVPi4JWkVf2p2PVHkga6jjaA5gQA4SLQCb0IWCBA_JctXYaTi9Z1eH11APUEX4fVq0RlvySyY75Vx5bvaglYIFCx9IEHFGrffrbP97PsM-dwi8K5ZMqolCg-oGrF-mlwClggBo2e11n0snkAvTs49Yu5McIu_BQ4hYgQTiDXTTCkvsltZGV2aWNlS2V5SW5mb6FpZGV2aWNlS2V5pAECIAEhWCCbivZJ_SNgrc5cs-t2vALY5JKTAIFRU0kf6SkiXOYHOiJYIFKmuLlruK4K5two_cLoMGCIoOWUvQ5CysSpxpPLGK9aZ2RvY1R5cGV1b3JnLmlzby4xODAxMy41LjEubURMbHZhbGlkaXR5SW5mb6Nmc2lnbmVkwHgeMjAyNi0wNS0yMFQxMjozMToxMC4zNjE3Nzg1MzZaaXZhbGlkRnJvbcB4HjIwMjYtMDUtMjBUMTI6MzE6MTAuMzYxNzc4NzM2Wmp2YWxpZFVudGlswHgeMjAyNy0wNS0yMFQxMjozMToxMC4zNjE3Nzg4MzZaWEBpgFeAPp3GYOhzUo9aUpOyQfv6dQONcrJEVd6N_AvHOyoQyKDXrpYXST9Djj01iPAe5aR29TI7sWIkUiYwZxwBbGRldmljZVNpZ25lZKJqbmFtZVNwYWNlc9gYQaBqZGV2aWNlQXV0aKFvZGV2aWNlU2lnbmF0dXJlhEOhASag9lhALzj9UuVdvDr5rmcY8bFNCc6l6Fg3vJ6sKNbQI_9lCtYptsdvt1UlRwsdjjq9zCzEBHKk7_qiPWG2gqk7hFSV6WZzdGF0dXMA", "docType": "org.iso.18013.5.1.mDL", "signature": { "type": "signature-cose", "signerKey": { "type": "jwk", "jwk": { "kty": "EC", "crv": "P-256", "x": "GWKpdL3jPoPJ5wKgSA-jxS2jgp-ZUDE6sIQbeB86vF0", "y": "F3xAwH96_xVciV7mFQslU_eRQgP-5pSZiNf8bjMoGfo" } }, "x5cList": [ "MIICCDCCAa2gAwIBAgIUDo8kr194t6sttt6KL3YcnMtcaYYwCgYIKoZIzj0EAwIwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMMDEV4YW1wbGUgSUFDQTAeFw0yNTA1MjkwNzE4MzlaFw0yNjA4MjkwNzE4MzlaMCIxCzAJBgNVBAYTAlVTMRMwEQYDVQQDDApFeGFtcGxlIERTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGWKpdL3jPoPJ5wKgSA+jxS2jgp+ZUDE6sIQbeB86vF0XfEDAf3r/FVyJXuYVCyVT95FCA/7mlJmI1/xuMygZ+qOBvjCBuzAfBgNVHSMEGDAWgBSMIxGx+iVN4rkOzoyo5aPk3HTUFDAdBgNVHQ4EFgQU7S49LSeg/e0onfT44FVbL/rSKnswDgYDVR0PAQH/BAQDAgeAMCMGA1UdEgQcMBqGGGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbTAVBgNVHSUBAf8ECzAJBgcogYxdBQECMC0GA1UdHwQmMCQwIqAgoB6GHGh0dHBzOi8vaWFjYS5leGFtcGxlLmNvbS9jcmwwCgYIKoZIzj0EAwIDSQAwRgIhAMuSq75BPBXXBWGtIMd57fhRqpKf3Yzl3ldDdoQsK2xEAiEA/dmWLMLiJPV3UzmQS5MUHtn611z0VlL/k3YAdaVJ51c=" ] }, "format": "mso_mdoc", "mso": { "version": "1.0", "digestAlgorithm": "SHA-256", "valueDigests": { "org.iso.18013.5.1": { ... }, "deviceKeyInfo": { "deviceKey": { ... } }, "docType": "org.iso.18013.5.1.mDL", "validityInfo": { "signed": "2026-05-20T12:31:10.361778536Z", "validFrom": "2026-05-20T12:31:10.361778736Z", "validUntil": "2027-05-20T12:31:10.361778836Z" } } } ] } }, "timestamp": 1779281613892, "parent": "waltid.tenant1.verifier3" } ``` **Key Response Fields:** - **id**: _String_ - The verification session ID - **setup**: _Object_ - The complete session configuration that was used to create this verification session (the `VerificationSessionSetup` from the create request) - **creationDate**: _String_ - ISO 8601 timestamp when the session was created - **expirationDate**: _String_ - ISO 8601 timestamp when the session expires (default: 10 minutes after creation). Session will expire if left unused (no presentation pushed). Once a presentation is received, the session is no longer eligible for expiry. - **status**: _String_ - The current status of the verification session. Possible values: - `"UNKNOWN"` — Session ended up in unknown flow (should be avoided) - `"ACTIVE"` — Session was created and is active (can be used) - `"UNUSED"` — Session was not used yet, but not expired (can be used) - `"IN_USE"` — AuthorizationRequest was requested by wallet - `"VALIDATING_RECEIVED_REQUEST"` — Checking if received presentation will be processed - `"PROCESSING_FLOW"` — Received presentation is being processed (validation + policy execution) - `"EXPIRED"` — Verification request expired without being utilized - `"SUCCESSFUL"` — Verification completed fully successfully (all validation & policies passed) - `"FAILED"` — Verification was unsuccessful (presentation validation or policies failed) - **attempted**: _Boolean_ - Whether the wallet has attempted to respond to the verification request - **reattemptable**: _Boolean_ - Whether the user can retry this verification session if it failed - **policy_results**: _Object_ (optional) - Detailed results for all policies applied to the verification (only present after presentation is received): - **vp_policies**: _Object_ - Results for presentation-level policies (audience check, nonce check, envelope signature) - **vc_policies**: _Array_ - Results for credential-level policies (signature, expiry, schema, etc.). Each item contains `policy`, `success`, and `result`. - **overallSuccess**: _Boolean_ (computed) - Whether all policies passed - **presented_credentials**: _Object_ (optional) - The parsed credentials presented by the user, organized by credential ID **Note:** Instead of polling the session status, you can use **callbacks** or **Server Sent Events (SSE)** to be notified when the verification completes. See [Callbacks & SSE](https://docs.walt.id/community-stack/verifier2/callback-and-sse.md) for details. --- ## Understanding Flow Types and Core Concepts Now that you've seen verification in action, let's understand the underlying structure. ### Verification Session Structure A `VerificationSession` defines the full lifecycle: authorization request → user presentation → policy validation → final result. Every verification request follows this structure: ```json { "flow_type": "cross_device | same_device | dc_api", "core_flow": { /* common to all flows */ }, "url_config": { /* specific to cross_device and same_device */ }, "redirects": { /* optional */ } } ``` **Why this structure?** - **flow_type** determines how the credential request is delivered (QR code vs deep link vs browser API) - **core_flow** contains the credential query and policies (same regardless of delivery method) - **url_config** and **redirects** are flow-specific attributes This separation makes it easy to switch between flows without changing your credential requirements. ### Flow Type Comparison | Flow Type | Use Case | Required Attributes | User Experience | |-----------|----------|---------------------|-----------------| | `cross_device` | User scans QR code from desktop | None beyond core flow | Desktop shows QR → User scans with phone → Phone wallet opens | | `same_device` | User clicks link on mobile | `redirects` (success/error URLs) | Browser redirects to wallet → Wallet opens → User returns to browser | | `dc_api` | Browser-native credential exchange | `expectedOrigins` (array of allowed origins) | Browser shows native credential picker → User selects → Instant return | --- ## Advanced Options ### Requesting Specific Claims Mobile driver's licenses support selective disclosure. You can request specific claims using the `claims` array with namespace-qualified paths: ```json { "flow_type": "cross_device", "core_flow": { "dcql_query": { "credentials": [ { "id": "credential_1", "format": "mso_mdoc", "meta": { "doctype_value": "org.iso.18013.5.1.mDL" }, "claims": [ { "path": ["org.iso.18013.5.1", "family_name"] }, { "path": ["org.iso.18013.5.1", "given_name"] }, { "path": ["org.iso.18013.5.1", "birth_date"] }, { "path": ["org.iso.18013.5.1", "portrait"] } ] } ] } } } ``` This requests only specific claims from the mDL. The user's wallet will only disclose these specific data elements. ### Claim Values You can also request claims with specific values (for filtering): ```json { "claims": [ { "path": ["org.iso.18013.5.1", "issuing_country"], "values": ["US", "CA"] } ] } ``` This requests only mDLs issued by US or Canadian authorities. ### Custom Policies Beyond signature verification, you can apply additional policies: ```json "policies": { "vc_policies": [ { "policy": "signature" }, { "policy": "expired" }, { "policy": "not-before" } ] } ``` See [Policies](https://docs.walt.id/enterprise-stack/services/verifier2-service/policies/overview.md) for the complete list and configuration options. ### VICAL Trust Validation For mDL credentials, you can apply the VICAL (Verifiable Issuer Certificate Authority List) policy for trust validation: ```json "policies": { "vc_policies": [ { "policy": "signature" }, { "policy": "vical", "vical": "", "enableDocumentTypeValidation": false, "enableTrustedChainRoot": false, "enableSystemTrustAnchors": false, "enableRevocation": false } ] } ``` See the [VICAL policy documentation](https://docs.walt.id/enterprise-stack/services/verifier2-service/policies/available-policies.md#vical) for detailed parameter descriptions and configuration examples. ### Signed Requests Sign the authorization request JWT using a verifier signing key. This is required for: - **HAIP profile** compliance - **DC API Annex C** (ISO 18013-7) flows Enable by setting `signedRequest: true` in the request body. **Key Configuration Required:** Signed requests require a signing key (`key`) to be configured. You can either: - Set the `key` parameter during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters) as a service-wide default - Override or provide the `key` directly in the verification request body **Certificate Chain (`x5c`) Required for:** - X.509-based client authentication when using `x509_san_dns:` or `x509_hash:` as the `clientId` format - Signed Annex C (ISO 18013-7) requests The `x5c` parameter can be configured the same way as `key` — as a service-wide default or per-session override. ### Encrypted Responses The wallet can encrypt the VP token response. Enable by setting `encryptedResponse: true` in the request body. **Key Configuration Required:** Encrypted responses require a key (`key`) for decrypting the VP token response. Configure it during [verifier2 service creation](https://docs.walt.id/enterprise-stack/services/verifier2-service/setup.md#body-parameters) or provide it in the verification request body. ### Transaction Data Authorization Bind credential presentations to specific transactions via transaction data like payment authorization or account access. **Use Cases:** - Payment authorization (amount, currency, payee) - Account access requests (account ID, scope) - Custom transaction types via configuration **Supported Formats:** `dc+sd-jwt` and `mso_mdoc` For mDL credentials, the wallet embeds transaction data hashes in the DeviceSigned namespaces corresponding to the transaction data type. The verifier evaluates the `mso_mdoc/transaction-data-hash-check` policy to validate the binding. **Example Request:** ```json { "flow_type": "cross_device", "core_flow": { "dcql_query": { "credentials": [ { "id": "mdl", "format": "mso_mdoc", "meta": { "doctype_value": "org.iso.18013.5.1.mDL" }, "claims": [ { "path": ["org.iso.18013.5.1", "family_name"] }, { "path": ["org.iso.18013.5.1", "given_name"] } ] } ] } }, "openid": { "transactionData": [ { "type": "org.waltid.transaction-data.payment-authorization", "credential_ids": ["mdl"], "require_cryptographic_holder_binding": true, "transaction_data_hashes_alg": ["sha-256"], "amount": "42.00", "currency": "EUR", "payee": "ACME Corp" } ] } } ``` #### Transaction Data Parameters Each entry in the `transactionData` array includes: **Common Parameters (Required for all types):** - **type**: _String_ (required) — The transaction data type identifier. Must match a type defined in your [transaction-data-profiles configuration](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/transaction-data-profiles.md). Built-in types: - `"org.waltid.transaction-data.payment-authorization"` — For payment authorizations - `"org.waltid.transaction-data.account-access"` — For account access requests - **credential_ids**: _Array of Strings_ (required) — References the `id` fields from your DCQL `credentials` array. Specifies which credential(s) this transaction data applies to. Example: `["mdl"]` if your credential query has `"id": "mdl"`. - **require_cryptographic_holder_binding**: _Boolean_ (optional) - If provided, it must be set to `true`. Transaction data requires cryptographic holder binding (KB-JWT for SD-JWT VC, DeviceAuth for mDL). Requests with `false` are rejected per [OpenID4VP §B.3.3](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#appendix-B.3.3). - **transaction_data_hashes_alg**: _Array of Strings_ (optional) — Hash algorithms the wallet uses to bind transaction data. e.g. `["sha-256"]`. If omitted "sha-256" is used. **Type-Specific Parameters:** The remaining parameters depend on the `type` field and are defined by your transaction data profile configuration: - **For `payment-authorization` type:** - **amount**: _String_ — Payment amount (e.g., `"42.00"`) - **currency**: _String_ — Currency code (e.g., `"EUR"`) - **payee**: _String_ — Payee identifier or name (e.g., `"ACME Corp"`) - **For `account-access` type:** - **account_identifier**: _String_ — Account identifier - **access_scope**: _String_ — Scope of access being requested See [Transaction Data Profiles](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/transaction-data-profiles.md) for how to define custom types and fields. **Note:** **Encoding Behavior:** You pass transaction data entries as plain JSON objects in your verification request. The verifier service automatically base64url-encodes each entry before placing it in the authorization request sent to the wallet. Do not base64-encode the entries yourself. #### Constraints - `transaction_data` requires a `dcql_query`. Requests without one are rejected with `invalid_request`. - Each entry's `credential_ids` must reference DCQL credential query ids declared in the same request. - Each referenced credential query must use a transaction-data-capable format: `dc+sd-jwt` or `mso_mdoc`. - Transaction data with `require_cryptographic_holder_binding: false` is rejected. See [OpenID4VP §B.3.3](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#appendix-B.3.3). - Transaction-data types are configurable via transaction data profiles. Built-in profiles include `payment-authorization` and `account-access`. Custom types can be added through the [`transaction-data-profiles` configuration](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/transaction-data-profiles.md). - Available on `cross_device`, `same_device`, and `dc_api` (Annex D) flows via the `openid.transactionData` field. **Note:** **Automatic Policy Enforcement:** When `transactionData` is present, the verifier automatically adds the appropriate transaction-data hash-check policy (`dc+sd-jwt/transaction-data-hash-check` for SD-JWT, `mso_mdoc/transaction-data-hash-check` for mDL) to ensure the wallet properly binds the transaction data. This happens even if you specify custom `vp_policies`. Your custom policies are preserved; the hash-check policy is added on top. #### Discovery & Configuration To see which transaction data types your verifier service recognizes: ```bash curl -X 'GET' \ 'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/verifier2-service-api/transaction-data-profiles' \ -H 'accept: application/json' \ -H 'Authorization: Bearer {yourToken}' ``` This endpoint requires `CREATE_VERIFIER_SESSION` permission. See [Transaction Data Profiles](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/transaction-data-profiles.md) to add custom types. --- ## Next Steps - **Apply custom policies** — See [Policies](https://docs.walt.id/enterprise-stack/services/verifier2-service/policies/overview.md) for validation rules beyond signature verification - **Set up notifications** — Use callbacks or SSE instead of polling for session status - **Verify other credential types** — Try [W3C VC](https://docs.walt.id/enterprise-stack/services/verifier2-service/credential-verification/vc-oid4vp.md) or [SD-JWT VC](https://docs.walt.id/enterprise-stack/services/verifier2-service/credential-verification/sd-jwt-vc-oid4vp.md) - **Use DC API** — Try the [Digital Credentials API](https://docs.walt.id/community-stack/verifier2/credential-verification/dc-api.md) for browser-native credential exchange