---
title: "Wallet Management"
description: "Learn how to use the Wallet2 management endpoints to list and retrieve keys, DIDs, and credentials stored in a wallet."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/wallet2-service/management
generated: 2026-10-01
---
# Wallet Management

The **Wallet2 management** endpoints provide read access to the resources stored in a wallet — keys, DIDs, and credentials.

**Note:**

Ensure you have [set up a Wallet2 service](https://docs.walt.id/enterprise-stack/services/wallet2-service/setup.md) with linked KMS, DID Store, and Credential Store services before proceeding.

---

## List Keys

Retrieve all keys available in the wallet's linked KMS services.

**Option: CURL**

Endpoint: `GET /v2/{target}/wallet-service-api/keys`

**Example Request**

```bash
curl -X GET \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{org}.{tenant}.{wallet-id}/wallet-service-api/keys' \
  -H 'Authorization: Bearer {yourToken}'
```

**Response**

```json
[
  {
    "keyId": "waltid.tenant1.kms.key1",
    "keyType": "Ed25519"
  },
  {
    "keyId": "waltid.tenant1.kms.wallet_key",
    "keyType": "secp256r1"
  }
]
```

- `keyId` _String_ — The key's identifier — the dotted KMS resource path.
- `keyType` _String_ — walt.id key-type name, e.g. `Ed25519`, `secp256r1`, `secp256k1`, `RSA`.
- `algorithm` (optional) _String_ — Signing algorithm, when the KMS reports one; omitted otherwise.

---

## List DIDs

Retrieve all DIDs stored in the wallet's linked DID Store.

**Option: CURL**

Endpoint: `GET /v2/{target}/wallet-service-api/dids`

**Example Request**

```bash
curl -X GET \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{org}.{tenant}.{wallet-id}/wallet-service-api/dids' \
  -H 'Authorization: Bearer {yourToken}'
```

**Response**

```json
[
  {
    "did": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
    "document": {
      "@context": [
        "https://www.w3.org/ns/did/v1",
        "https://w3id.org/security/suites/jws-2020/v1"
      ],
      "id": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
      "verificationMethod": [
        {
          "id": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6#z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
          "type": "JsonWebKey2020",
          "controller": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
          "publicKeyJwk": {
            "kty": "OKP",
            "crv": "Ed25519",
            "x": "..."
          }
        }
      ],
      "authentication": ["did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6#z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6"],
      "assertionMethod": ["did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6#z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6"]
    }
  }
]
```

- `did` _String_ — The DID string.
- `document` _Object_ — The full DID document as a JSON object.

---

## List Credentials

Retrieve metadata for all credentials stored in the wallet's linked Credential Store. This endpoint returns lightweight metadata without the full credential payload.

**Option: CURL**

Endpoint: `GET /v2/{target}/wallet-service-api/credentials`

**Example Request**

```bash
curl -X GET \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{org}.{tenant}.{wallet-id}/wallet-service-api/credentials' \
  -H 'Authorization: Bearer {yourToken}'
```

**Response**

```json
[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "format": "dc+sd-jwt",
    "issuer": "did:web:issuer.example.org",
    "subject": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
    "label": "Identity Credential",
    "addedAt": "2024-01-15T10:30:00Z"
  },
  {
    "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "format": "jwt_vc_json",
    "issuer": "did:web:university.example.org",
    "subject": "did:key:z6Mkfriq1MqLBoPWecGoDLjguo1sB9brj6wT3qZ5BxkKpuP6",
    "label": "University Diploma",
    "addedAt": "2024-02-20T14:45:00Z"
  }
]
```

- `id` _String_ — Wallet-assigned credential identifier (UUID).
- `format` _String_ — Credential format (`dc+sd-jwt`, `jwt_vc_json`, `mso_mdoc`, etc.).
- `issuer` (optional) _String_ — The credential issuer's identifier.
- `subject` (optional) _String_ — The credential subject's identifier.
- `label` (optional) _String_ — Human-readable label (from credential display or user-assigned).
- `addedAt` _String_ — Timestamp when the credential was added to the wallet.

---

## Get Credential

Retrieve a specific credential by its ID, including the full credential payload.

**Option: CURL**

Endpoint: `GET /v2/{target}/wallet-service-api/credentials/{credentialId}`

**Example Request**

```bash
curl -X GET \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{org}.{tenant}.{wallet-id}/wallet-service-api/credentials/{credentialId}' \
  -H 'Authorization: Bearer {yourToken}'
```

**Path Parameters**

- `orgID` _String_ — Organization host alias.
- `target` _resourceIdentifier_ — The wallet's resource path, e.g. `waltid.tenant1.wallet`.
- `credentialId` _String_ — The stored credential's ID, e.g. `550e8400-e29b-41d4-a716-446655440000` — from [List Credentials](#list-credentials) or the receive response's `credentialIds`.

**Response**

The wrapper is always `{ id, credential, label?, addedAt, metadata? }`. The `credential` object's shape depends on the credential format — pick the matching tab:

**Option: SD-JWT VC**

`format: dc+sd-jwt` · `type: vc-sd_jwt` — adds `disclosures`, `disclosables`, `originalCredentialData`, `signedWithDisclosures`.

```json
{
  "id": "a2f705c5-7ec9-4113-8091-00982fffccd4",
  "credential": {
    "type": "vc-sd_jwt",
    "format": "dc+sd-jwt",
    "issuer": "https://issuer.example.org/.../openid4vci",
    "credentialData": {
      "given_name": "John",
      "family_name": "Doe",
      "birthdate": "1990-01-15",
      "vct": "https://issuer.example.org/.well-known/vct/.../identity_credential",
      "cnf": { "jwk": { "kty": "OKP", "crv": "Ed25519", "x": "Jfch6RO..." } }
    },
    "disclosures": [
      {
        "name": "birthdate",
        "value": "1990-01-15",
        "salt": "XWinP-V3uXnRMfgAZDtbjw",
        "encoded": "WyJYV2luUC1WM3VYblJNZmdBWkR0Ymp3IiwiYmlydGhkYXRlIiwiMTk5MC0wMS0xNSJd"
      }
    ],
    "signed": "eyJraWQiOiJHMzdKaUdyM3B0bEQ...",
    "signature": {
      "type": "signature-sd_jwt",
      "jwtHeader": { "kid": "G37JiGr3ptlD-YVW2APHZ7i4N43-vcIQZNFEuXzjwZw", "typ": "dc+sd-jwt", "alg": "EdDSA" }
    }
  },
  "addedAt": "2026-07-13T09:40:30Z"
}
```

**Option: W3C VC**

`format: jwt_vc_json` · `type: vc-w3c_2` (or `vc-w3c_1_1` for a credential issued against the W3C VC Data Model 1.1) — adds `issuer`, `subject`, `disclosables`.

```json
{
  "id": "f7d50cd6-87b3-476f-a47c-b8c18133fede",
  "credential": {
    "type": "vc-w3c_2",
    "format": "jwt_vc_json",
    "issuer": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp",
    "subject": "did:jwk:eyJrdHkiOiJPS1Ai...",
    "disclosables": {},
    "credentialData": {
      "@context": ["https://www.w3.org/ns/credentials/v2"],
      "type": ["VerifiableCredential", "UniversityDegree"],
      "issuer": { "id": "did:key:z6MkjoRhq1jSNJdLiruSXrFFxagqrztZaXHqHGUTKJbcNywp" },
      "credentialSubject": {
        "id": "did:jwk:eyJrdHkiOiJPS1Ai...",
        "degree": { "type": "BachelorDegree", "name": "Bachelor of Science and Arts" }
      },
      "validFrom": "2026-07-09T14:34:49Z",
      "validUntil": "2027-07-09T14:34:49Z"
    },
    "signed": "eyJraWQiOiJkaWQ6a2V5Ono2TWtqb1Jo...",
    "signature": {
      "type": "signature-jwt",
      "jwtHeader": { "kid": "did:key:z6MkjoRhq1j...#z6MkjoRhq1j...", "typ": "vc+jwt", "alg": "EdDSA" }
    }
  },
  "addedAt": "2026-07-13T09:45:10Z"
}
```

**Option: mDoc**

`format: mso_mdoc` · `type: vc-mdocs` — adds `docType` and `mso` instead of `issuer`/`subject`.

```json
{
  "id": "3b686a30-0504-4284-bcd1-fab711de4143",
  "credential": {
    "type": "vc-mdocs",
    "format": "mso_mdoc",
    "docType": "org.iso.18013.5.1.mDL",
    "credentialData": {
      "docType": "org.iso.18013.5.1.mDL",
      "org.iso.18013.5.1": {
        "family_name": "Doe",
        "given_name": "John",
        "birth_date": "1990-01-01",
        "document_number": "DL123456789",
        "issuing_country": "US"
      }
    },
    "signed": "ompuYW1lU3BhY2Vzo...",
    "signature": {
      "type": "signature-cose",
      "signerKey": { "type": "jwk", "jwk": { "kty": "EC", "crv": "P-256", "x": "dUpq6W...", "y": "urKlUB..." } },
      "x5cList": ["MIICITCCAcag...", "MIIBxTCCAWug..."]
    },
    "mso": {
      "version": "1.0",
      "digestAlgorithm": "SHA-256",
      "valueDigests": {
        "org.iso.18013.5.1": {
          "0": [98, 125, 80, -38, 31, 65, 93, -76, "..."],
          "1": [26, -99, -30, -107, -118, 2, 47, 44, "..."]
        }
      },
      "deviceKeyInfo": { "deviceKey": { "kty": 1, "crv": 6, "x": [37, -9, 33, -23, "..."] } },
      "docType": "org.iso.18013.5.1.mDL",
      "validityInfo": {
        "signed": "2026-07-09T14:35:52Z",
        "validFrom": "2026-07-09T14:35:52Z",
        "validUntil": "2027-07-09T14:35:52Z"
      }
    }
  },
  "addedAt": "2026-07-13T09:45:10Z"
}
```

- `id` _String_ — Wallet-assigned credential identifier (UUID).
- `credential` _Object_ — The fully-parsed credential (shape varies by format — see tabs above).
- `credential.type` _String_ — Parsed-kind discriminator: `vc-sd_jwt`, `vc-w3c_2` (or `vc-w3c_1_1` for W3C VC Data Model 1.1), or `vc-mdocs`.
- `credential.format` _String_ — Wire format: `dc+sd-jwt`, `jwt_vc_json`, `mso_mdoc`, …
- `credential.credentialData` _Object_ — The decoded credential claims/payload.
- `credential.signed` _String_ — The original encoded credential string (compact SD-JWT / JWT; base64url-CBOR for mDoc). There is **no `rawCredential` field**.
- `credential.signature` _Object_ — Parsed signature metadata (`type`, plus JWT header or COSE signer key).
- `label` (optional) _String_ — Human-readable label; omitted when not set.
- `addedAt` _String_ — Timestamp when the credential was added to the wallet.
- `metadata` (optional) _Object_ — Sidecar JSON stored with the credential. When the credential was received via OID4VCI, this may include `issuerDisplay` — an array of issuer display entries (`name`, `locale`, optional `logo` with `uri` / `alt_text`) captured from issuer metadata at receive time.

**Response Codes**

- `200` — Credential found and returned.
- `404` — Credential not found.

---

## Import Credential

Store a raw credential directly in the wallet's linked Credential Store. Use this when a credential was obtained outside the wallet, or when [Fetch Credential](https://docs.walt.id/enterprise-stack/services/wallet2-service/credential-receiving/isolated-flow.md#step-4-fetch-credential) returned raw credentials with `storeInWallet` left as `false`.

**Option: CURL**

Endpoint: `POST /v2/{target}/wallet-service-api/credentials/import`

**Example Request**

```bash
curl -X POST \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v2/{org}.{tenant}.{wallet-id}/wallet-service-api/credentials/import' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "rawCredential": "eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK3NkLWp3dCJ9...",
  "label": "Identity Credential"
}'
```

**Path Parameters**

- `orgID` _String_ — Organization host alias.
- `target` _resourceIdentifier_ — The wallet's resource path, e.g. `waltid.tenant1.wallet`.

**Body Parameters**

- `rawCredential` _String_ — Raw credential string. The wallet auto-detects JWT VC, SD-JWT VC, or mDoc and parses it server-side before storing it.
- `label` (optional) _String_ — Human-readable label to store with the credential.

**Example Response**

```json
{
  "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
  "credential": {
    "type": "vc-sd_jwt",
    "format": "dc+sd-jwt",
    "credentialData": {
      "given_name": "John",
      "family_name": "Doe"
    },
    "signed": "eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK3NkLWp3dCJ9..."
  },
  "label": "Identity Credential",
  "addedAt": "2026-07-13T09:45:10Z"
}
```

**Response Codes**

- `201` — Credential parsed and stored.
- `400` — Credential could not be parsed or the request body is invalid.
- `401` — Invalid authentication.

---

## Endpoint Summary

| Endpoint | Method | Description |
|---|---|---|
| `/v2/{target}/wallet-service-api/keys` | GET | List all keys in the wallet |
| `/v2/{target}/wallet-service-api/dids` | GET | List all DIDs in the wallet |
| `/v2/{target}/wallet-service-api/credentials` | GET | List credential metadata |
| `/v2/{target}/wallet-service-api/credentials/{credentialId}` | GET | Get a specific credential |
| `/v2/{target}/wallet-service-api/credentials/import` | POST | Import and store a raw credential |

---

## Related Documentation

- [Wallet Setup](https://docs.walt.id/enterprise-stack/services/wallet2-service/setup.md) — Configure a wallet service with linked stores
- [Accept Credentials via OID4VCI](https://docs.walt.id/enterprise-stack/services/wallet2-service/credential-receiving/overview.md) — Receive credentials into the wallet
- [Share Credentials via OID4VP](https://docs.walt.id/enterprise-stack/services/wallet2-service/credential-presenting/overview.md) — Present credentials from the wallet
- [KMS Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) — Key management configuration
- [DID Store Service](https://docs.walt.id/enterprise-stack/services/did-store-service/overview.md) — DID storage configuration
- [Credential Store Service](https://docs.walt.id/enterprise-stack/services/credential-store-service/overview.md) — Credential storage configuration