#Present a W3C Verifiable Credentials (JWT/SD-JWT signature) via OID4VP

Endpoint: /v1/{target}/wallet-service-api/credentials/present | API Reference

Example Request

curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/wallet-service-api/credentials/present' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "requestUrl": "openid4vp://authorize?response_type=vp_token&client_id=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fverify&response_mode=direct_post&state=AAA_BBB_CCC_DDD&presentation_definition_uri=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fpd%2FAAA_BBB_CCC_DDD&client_id_scheme=redirect_uri&client_metadata=%7B%22authorization_encrypted_response_alg%22%3A%22ECDH-ES%22%2C%22authorization_encrypted_response_enc%22%3A%22A256GCM%22%7D&nonce=aaaaaaaa-bbbb-cccc-dddd-ffffffffffff&response_uri=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fverify%2FAAA_BBB_CCC_DDD",
  "keyReference": "example.kms.key1",
  "didReference": "example.didstore.did1",
  "credentials": [
    {
      "credential": "waltid.tenant22.credential-store-wallet1.3d629d4b-4111-461d-9233-b2224fd64486"
    }
  ]
}'

Path Parameters

• orgID: - When performing operations within an organization, it is essential to use the organization's Base URL or another valid host alias. For example, if your organization is named test, your default Base URL will be test.enterprise-sandbox.walt.dev when using the sandbox environment.
• target: resourceIdentifier - The target indicates the organization + tenant + wallet which should be used to present the credential ({organizationID}.{tenantID}.[walletID]), e.g. waltid.tenant1.wallet1

Body

{
  "requestUrl": "openid4vp://authorize?response_type=vp_token&client_id=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fverify&response_mode=direct_post&state=AAA_BBB_CCC_DDD&presentation_definition_uri=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fpd%2FAAA_BBB_CCC_DDD&client_id_scheme=redirect_uri&client_metadata=%7B%22authorization_encrypted_response_alg%22%3A%22ECDH-ES%22%2C%22authorization_encrypted_response_enc%22%3A%22A256GCM%22%7D&nonce=aaaaaaaa-bbbb-cccc-dddd-ffffffffffff&response_uri=https%3A%2F%2Fverifier.example.org%2Fopenid4vc%2Fverify%2FAAA_BBB_CCC_DDD",
  "keyReference": "example.kms.key1",
  "didReference": "example.didstore.did1",
  "credentials": [
    {
      "credential": "waltid.tenant22.credential-store-wallet1.3d629d4b-4111-461d-9233-b2224fd64486"
    }
  ]
}

Body Parameters

• requestUrl String - An OID4VCP Authorization URL.
• credentials (optional) Array - You can optionally provide a list of credential IDs from the linked credential store that you want to present. If you do not provide a list, the wallet will attempt to find matching credentials based on the presentation definition specified in the request URL. If a match is found, those credentials will be presented.
  Additionally, if the presentation definition requests a specific field in a credential and that field is selectively disclosable, the wallet will automatically share this field (but not any other selectively disclosable fields) when using the auto-matching mechanism.
  If you prefer, you can also explicitly specify which fields to disclose next to the credential ID under the "disclosures" field in the credential object, as illustrated in the example below.
  
  
  Click to expand and see credential with selective disclosure example

  
  

  Object in credentials

   {
   "credential": "org1.users.user1.credentialstore.credential2",
   "disclosures": [
     "$.name",
     "$.credentialSubject.achievement.description"
   ]
  }
  

  • credential String - ID of the credential
  • disclosures Array - An array of paths to the attributes that can be selectively disclosed and should be shared.
• keyReference (optional) String - The resource ID (target) of the key which owns the credential. Key can be stored in a linked KMS store or provided as a static key as described in the setup section.
• didReference (optional) String - The DID reference of a DID stored in a linked DID Store.
• key (optional) Object - A key object or reference key object, when using an external KMS, which owns the credential.
  
  
  Click to expand and see full key example

  
  

  Key Object

   {
   "type": "jwk",
   "jwk": {
     "kty": "OKP",
     "d": "ywmoRVTD9fexMtGW0lKE3o9_0ulfzGXr9xHGL0lPhhA",
     "crv": "Ed25519",
     "kid": "IQO7DILxtagpTLXkuHkRkJURb2GqcUIwXYZAcGwW1AU",
     "x": "JOsiIE7ME9UZ8y2H-P5RSuYAUiIfs1ywtdBjMGN7I5s"
   }
  }
  

  This key object can also be of the types tse, aws, or oci-rest-api when using external KMS providers. In this case, instead of providing the raw key, an object containing reference information that allows the walt.id Enterprise Stack to access keys stored externally is provided. Learn more about different keys here.

• did (optional) String - DID as a string, e.g. did:key:z6MktjQeU9dZp8VfK8M9N8Y2u5wV6JzZ2v6s6Q1P7pRkFJ8H

Response Codes

• 200 - Presentation was accepted

When the present endpoint is executed, in the background, the Wallet encapsulated the credentials to be presented within a Verifiable Presentation. It then signed this presentation using the Holder's key, which serves as cryptographic proof to the verifier that the Holder ( and therefore the Wallet controlling the key) has possession of the credentials being presented.