#Features

With the _features.conf you can control which Enterprise API features are enabled. They are managed via the feature manager.

A feature enabled here still has to be allowed by the active license. walt.id can also disable features remotely through the license. A development license requires dev-mode; a production license refuses to start when dev-mode is enabled.

#Available Features

#Base (always loaded)

enterprise — Enterprise base URL configuration (enterprise.conf)
database — Database configuration (database.conf)
auth — Authentication (auth.conf)
license — License enforcement (license.conf)
web — HTTP listener (web.conf)

#Optional

account-registration — Enable or disable account registration (default on)
admin — Administration endpoints
authservice — Enables user authentication (default on)
auto-fix-enterprise-service-dependency — Auto-add missing service dependencies. Temporary; do not enable in production
client-attester — Client Attester service
crypto-aws — AWS KMS key support (default on)
crypto-azure — Azure Key Vault key support (default on)
debug-endpoints — Enables various debug endpoints
dev-mode — Development routes and DID web resolver HTTPS (dev-mode.conf). Its /v1/dev/* routes additionally require a secret configured in dev-mode-access.conf
ebsi-v3.2-verifier-conformance-test — EBSI v3.2 conformance-test endpoints
eidas-audit — Durable eIDAS hash-chain audit log (off by default; appends sit on the OID4VCI callback path)
external-authorization-server-for-issuer — External Authorization Server for Issuer authorization-code flow
feature-flag-information-endpoint — Endpoints that list available features on this instance (default on)
healthchecks — Healthcheck endpoints (default on)
httpclient — Outbound HTTP client (httpclient.conf; default on)
issuer-draft-routes — Legacy Issuer service (OpenID4VCI Draft 13). Disabled by default
oidc-bridge — OIDC Bridge Service for VC-based IAM (default on)
openapi — OpenAPI endpoints (default on)
organization-creation — Enable or disable organization creation
persistence — Storage feature flag used by commons
persistence-user-permission-enforcement — Extra permission checks at the persistence layer (default on; still marked under development in the product)
prometheus — Prometheus metrics (prometheus.conf)
resource-access — Reusable credential profiles in resource-access.conf (required for PKCS#11 HSM backends and for configRef KMS / storage profiles)
superadmin-registration — Superadmin bootstrap tokens (superadmin-registration.conf)
telemetry — OpenTelemetry (telemetry.conf)
transaction-data-profiles — Verifier2 / Wallet2 transaction-data profile registry (default on)
trust-registry — Trust Registry Service
verifier-draft-routes — Legacy Verifier Service (OpenID4VP Draft 14 and Draft 20). Disabled by default
vical — VICAL Service and Registry
wallet-draft-routes — Legacy Wallet Service (type: "wallet", /v1 draft OpenID4VC routes)
x509 — X.509 Certificate Service and Store (default on)

The former data-retention feature is removed. See Session Data Ejection.

#Example Setup

_features.conf

enabledFeatures = [
    admin // adds routes for administration of globals
    #dev-mode // adds routes useful for development
    # superadmin-registration // enable only with deployment-specific credentials
    external-authorization-server-for-issuer
    vical
    # telemetry
    client-attester
    trust-registry
    oidc-bridge
    # eidas-audit // durable eIDAS hash-chain audit log
    # prometheus // Prometheus metrics
]
disabledFeatures = [
    # debug-endpoints
    # account-registration
    # issuer-draft-routes
    # verifier-draft-routes
    # x509
]

Last updated on September 28, 2026

Configuration Files Rate Limit