#Default Requests

Every time you create a verification session, you send the same things: the flow type, the credential query, the expiry. Default requests let you save those once on your Verifier2 service, so creating a session only needs the values that differ, or nothing at all.

#What Changes

Without a default, every session create carries the full body:

{
  "flow_type": "cross_device",
  "core_flow": {
    "signed_request": false,
    "encrypted_response": false,
    "expiration_duration": "PT5M",
    "dcql_query": {
      "credentials": [
        {
          "id": "pid",
          "format": "dc+sd-jwt",
          "meta": { "vct_values": ["https://credentials.example.com/identity_credential"] },
          "claims": [{ "path": ["family_name"] }]
        }
      ]
    }
  }
}

With that same body stored as a default, the call becomes:

{}

The service fills in everything you left out. Anything you do send in the call wins over the stored value.

#Prerequisites

• A Verifier2 service. See Setup.
• A bearer token with the update-default-requests permission and the permission to create verification sessions. Both are needed to store a default.

#Step 1: Store a Default

Store the body from the example above with a PUT. The last part of the URL, create-verification-session, names the API call the default applies to: the one behind POST /v2/{target}/verifier-service-api/verification-session/create. The body is an ordinary verification session request. Leave out any field you would rather send per call, except flow_type, which must always be included.

curl -X 'PUT' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{target}/verifier-service-api/default-requests/create-verification-session' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "flow_type": "cross_device",
  "core_flow": {
    "signed_request": false,
    "encrypted_response": false,
    "expiration_duration": "PT5M",
    "dcql_query": {
      "credentials": [
        {
          "id": "pid",
          "format": "dc+sd-jwt",
          "meta": {
            "vct_values": [
              "https://credentials.example.com/identity_credential"
            ]
          },
          "claims": [
            { "path": ["family_name"] }
          ]
        }
      ]
    }
  }
}'

{
  "flow_type": "cross_device",
  "core_flow": {
    "signed_request": false,
    "encrypted_response": false,
    "expiration_duration": "PT5M",
    "dcql_query": {
      "credentials": [
        {
          "id": "pid",
          "format": "dc+sd-jwt",
          "meta": { "vct_values": ["https://credentials.example.com/identity_credential"] },
          "claims": [{ "path": ["family_name"] }]
        }
      ]
    }
  }
}

#Step 2: Create a Session

Send an empty body. The stored default supplies everything.

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{target}/verifier-service-api/verification-session/create' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{}'

#Override Part of the Default

To change one thing, send only that. Nested objects merge key by key, but arrays are replaced, not appended.

{
  "core_flow": {
    "dcql_query": {
      "credentials": [
        {
          "id": "mdl",
          "format": "mso_mdoc",
          "meta": { "doctype_value": "org.iso.18013.5.1.mDL" }
        }
      ]
    }
  }
}

This session keeps flow_type, signed_request, encrypted_response and expiration_duration from the default, and replaces the PID credential query with the mDL one.

#Good to Know

• Explicit values win, including false over a stored true.
• Arrays and primitives are replaced wholesale. There is no "add to the list".
• Nothing to clear with null. To remove a default, delete it (see below).
• Clearing is safe to repeat. DELETE returns 204 even when nothing was stored.

#Read or Remove a Default

• List all stored defaults: GET /v2/{target}/verifier-service-api/default-requests (needs view-default-requests).
• Read one: GET …/default-requests/create-verification-session. Returns 404 if none is stored.
• Remove one: DELETE …/default-requests/create-verification-session.

Full details, permissions and the other services that support default requests: Default Requests.