### Fetch Credential Offer by Reference with HTTP GET

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of the HTTP GET request the Wallet sends to retrieve a Credential Offer referenced by credential_offer_uri, unless it is already cached.

```http
GET /credential_offer HTTP/1.1
Host: server.example.com
```

--------------------------------

### Send Credential Offer by Value with credential_offer Parameter

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer passed by value using the credential_offer parameter in a GET request. Line breaks within values are for display purposes only.

```http
GET /credential_offer?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22UniversityDegree_JWT%22,%
  22org.iso.18013.5.1.mDL%22%5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-
  type:pre-authorized_code%22:%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7
  JuMn5%22,%22tx_code%22:%7B%7D%7D%7D%7D
```

--------------------------------

### Nonce Response Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Nonce Response with a c_nonce value and an optional DPoP-Nonce header. The response must include Cache-Control: no-store.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
DPoP-Nonce: eyJ7S_zG.eyJH0-Z.HX4w-7v

{
  "c_nonce": "wKI4LT17ac15ES9bw8ac4"
}
```

--------------------------------

### di_vp proof type example in proofs parameter

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of the `proofs` parameter for the `di_vp` proof type. The W3C Verifiable Presentation must be secured with a Data Integrity Proof, with `proofPurpose` set to `authentication`, `domain` set to the Credential Issuer Identifier, and `challenge` set to the server-provided `c_nonce` when required. Line breaks within values are for display purposes only.

```json
{
  "di_vp": [
    {
      "@context": [
        "https://www.w3.org/ns/credentials/v2",
        "https://www.w3.org/ns/credentials/examples/v2"
      ],
      "type": [
        "VerifiablePresentation"
      ],
      "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
      "proof": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-2022",
          "proofPurpose": "authentication",
          "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5
           XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
          "created": "2023-03-01T14:56:29.280619Z",
          "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
          "domain": "did:web:audience.company.com",
          "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACi
           WFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
        }
      ]
    }
  ]
}
```

--------------------------------

### Nonce Request Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Nonce Request sent via HTTP POST to the nonce_endpoint. The request does not require an access token.

```http
POST /nonce HTTP/1.1
Host: credential-issuer.example.com
Content-Length: 0
```

--------------------------------

### Example of `proofs` parameter with JWT proof and decoded JWT

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Shows a non-normative example of a `proofs` parameter with a JWT proof, followed by its decoded JWT. The decoded JWT includes the required `typ` header `openid4vci-proof+jwt`, an `alg` of `ES256`, and a `jwk` header, along with the required `aud` and `iat` claims and an optional `nonce` claim.

```json
{
  "jwt": [
    "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2Iiwiand
    rIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiblVXQW9BdjNYWml0aDh
    FN2kxOU9kYXhPTFlGT3dNLVoyRXVNMDJUaXJUNCIsInkiOiJIc2tIVThCalVpMVU
    5WHFpN1N3bWo4Z3dBS18weGtjRGpFV183MVNvc0VZIn19.eyJhdWQiOiJodHRwcz
    ovL2NyZWRlbnRpYWwtaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAxOTYwND
    Q0LCJub25jZSI6IkxhclJHU2JtVVBZdFJZTzZCUTR5bjgifQ.-a3EDsxClUB4O3L
    eDD5DVGEnNMT01FCQW4P6-2-BNBqc_Zxf0Qw4CWayLEpqkAomlkLb9zioZoipdP-
    jvh1WlA"
  ]
}
```

```json
{
  "typ": "openid4vci-proof+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "nUWAoAv3XZith8E7i19OdaxOLYFOwM-Z2EuM02TirT4",
    "y": "HskHU8BjUi1U9Xqi7Swmj8gwAK_0xkcDjEW_71SosEY"
  }
}.{
  "aud": "https://credential-issuer.example.com",
  "iat": 1701960444,
  "nonce": "LarRGSbmUPYtRYO6BQ4yn8"
}
```

--------------------------------

### Key Attestation JWT Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Key Attestation in JWT format. The JWT is signed by the Wallet Provider or the Wallet's key storage component and contains the required `typ` header `key-attestation+jwt`, a digital signature algorithm, and the `attested_keys` array. The example shows the JOSE header and the JWT body separated by a period.

```json
{
  "typ": "key-attestation+jwt",
  "alg": "ES256",
  "x5c": ["MIIDQjCCA..."]
}
.
{
  "iss": "<identifier of the issuer of this key attestation>",
  "iat": 1516247022,
  "exp": 1541493724,
  "key_storage": [ "iso_18045_moderate" ],
  "user_authentication": [ "iso_18045_moderate" ],
  "attested_keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  ]
}
```

--------------------------------

### JSON-based Credential Example for Claims Path Pointers

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

A non-normative, simplified example of a JSON-based Credential used to illustrate claims path pointers. It contains nested objects, an array of objects, and an array of strings.

```json
{
  "name": "Arthur Dent",
  "address": {
    "street_address": "42 Market Street",
    "locality": "Milliways",
    "postal_code": "12345"
  },
  "degrees": [
    {
      "type": "Bachelor of Science",
      "university": "University of Betelgeuse"
    },
    {
      "type": "Master of Science",
      "university": "University of Betelgeuse"
    }
  ],
  "nationalities": ["British", "Betelgeusian"]
}
```

--------------------------------

### POST /token

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Documentation for the Token Endpoint, including the Token Request parameters and an example request.

```APIDOC
## [POST] /token

### Description
Exchanges an Authorization Code or Pre-Authorized Code for an Access Token and optionally a Refresh Token.

### Method
POST

### Endpoint
/token

### Parameters
#### Request Body
- **grant_type** (string) - Required - The grant type. For the Pre-Authorized Code Flow, use `urn:ietf:params:oauth:grant-type:pre-authorized_code`. For the Authorization Code Flow, use `authorization_code`.
- **code** (string) - Required for Authorization Code Flow - The Authorization Code obtained in a successful Authorization Response.
- **code_verifier** (string) - Required for Authorization Code Flow - The PKCE code verifier.
- **redirect_uri** (string) - Required for Authorization Code Flow - The redirect URI used in the Authorization Request.
- **client_assertion_type** (string) - Optional - The client assertion type, e.g., `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.
- **client_assertion** (string) - Optional - The client assertion value.
- **pre-authorized_code** (string) - Required if `grant_type` is `urn:ietf:params:oauth:grant-type:pre-authorized_code` - The code representing the authorization to obtain Credentials of a certain type.
- **tx_code** (string) - Optional - A Transaction Code value. MUST be present if a `tx_code` object was present in the Credential Offer.
- **authorization_details** (object) - Optional - If present, must be of type `openid_credential` and contain the Credential Issuer's identifier in the `locations` element when the Credential Issuer's metadata contains an `authorization_servers` parameter.
- **resource** (string) - Optional - The Credential Issuer's identifier value, recommended when using a scope value related to Credential issuance and the Credential Issuer's metadata contains an `authorization_servers` parameter.

### Request Example
```
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=SplxlOBeZQQYbYS6WxSbIA
&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
&redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJhbGciOiJSU...
```

### Response
#### Success Response (200)
- **access_token** (string) - The Access Token issued by the Authorization Server.
- **refresh_token** (string) - Optional - The Refresh Token, if issued.

#### Response Example
(Not provided in the source)

```

--------------------------------

### GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

```APIDOC
## GET /credential_offer

### Description
Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

### Method
GET

### Endpoint
/credential_offer

### Parameters
#### Query Parameters
- **credential_offer_uri** (string) - Required - URI that references a Credential Offer Object.

### Request Example
```
GET /credential_offer HTTP/1.1
Host: server.example.com
```

### Response
#### Success Response (200)
- **Content-Type** (string) - MUST be `application/json`.
- **Body** (object) - Credential Offer Object.

#### Response Example
```json
{
  "credential_issuer": "https://credential-issuer.example.com",
  "credential_configuration_ids": ["UniversityDegree_JWT"],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "oaKazRN8I0IbtZ0C7JuMn5",
      "tx_code": {}
    }
  }
}
```

```

--------------------------------

### Decoded Wallet Attestation JWT example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a decoded Wallet Attestation JWT. It includes the required claims for the client authentication method, such as 'iss', 'sub', 'cnf', and optional claims like 'wallet_name' and 'wallet_link'. The 'sub' claim is the client_id of the Wallet instance.

```json
{
  "typ": "oauth-client-attestation+jwt",
  "alg": "ES256",
  "kid": "11"
}
.
{
  "iss": "https://wallet-provider.example.com",
  "sub": "https://wallet.example.org",
  "wallet_name": "Wallet Solution X by Wonderland State Department",
  "wallet_link": "https://example.com/wallet/detail_info.html",
  "nbf": 1300815780,
  "exp": 1300819380,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "use": "sig",
      "crv": "P-256",
      "x": "18wHLeIgW9wVN6VD1Txgpqy2LszYkMf6J8njVAibvhM",
      "y": "-V4dS4UaLMgP_4fY4j8ir7cl1TXlFdAgcx55o7TkcSA"
    }
  }
}
```

--------------------------------

### Credential Offer by Reference with credential_offer_uri

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer by reference, typically used in QR codes due to size limitations. The credential_offer_uri parameter contains the URL to fetch the Credential Offer Object.

```uri
openid-credential-offer://?
  credential_offer_uri=https%3A%2F%2Fserver%2Eexample%2Ecom%2Fcredential-offer
  %2FGkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM
```

--------------------------------

### Credential Request with di_vp proof for W3C VCDM

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Request for one Credential in W3C VCDM format using a Credential identifier from the Token Response and key proof type `di_vp`. Line breaks within values are for display purposes only.

```http
POST /credential HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: BEARER czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "credential_identifier": "CivilEngineeringDegree-2023",
  "proofs": {
    "di_vp": [
      {
        "@context": [
          "https://www.w3.org/ns/credentials/v2",
          "https://www.w3.org/ns/credentials/examples/v2"
        ],
        "type": [
          "VerifiablePresentation"
        ],
        "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
        "proof": [
          {
            "type": "DataIntegrityProof",
            "cryptosuite": "eddsa-2022",
            "proofPurpose": "authentication",
            "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mq
             h5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
            "created": "2023-03-01T14:56:29.280619Z",
            "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
            "domain": "did:web:audience.company.com",
            "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7A
             CiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
          }
        ]
      }
    ]
  }
}
```

--------------------------------

### Credential Offer by Value for QR Code or Native App Link

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer by value that can be included in a QR code or a link to invoke a Wallet deployed as a native app. Line breaks within values are for display purposes only.

```uri
openid-credential-offer://?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22org.iso.18013.5.1.mDL%22%
  5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-type:pre-authorized_code%22
  :%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7JuMn5%22,%22tx_code%22:%7B%
  22input_mode%22:%22text%22,%22description%22:%22Please%20enter%20the%20serial
  %20number%20of%20your%20physical%20drivers%20license%22%7D%7D%7D%7D
```

--------------------------------

### GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Sends a Credential Offer by value using the `credential_offer` parameter. The Credential Offer is passed as a URL-encoded JSON object in the query string.

```APIDOC
## GET /credential_offer

### Description
Sends a Credential Offer by value using the `credential_offer` parameter. The Credential Offer is passed as a URL-encoded JSON object in the query string.

### Method
GET

### Endpoint
/credential_offer

### Parameters
#### Query Parameters
- **credential_offer** (string) - Required - URL-encoded Credential Offer Object containing `credential_issuer`, `credential_configuration_ids`, and `grants`.

### Request Example
```
GET /credential_offer?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.example.com%22,%22credential_configuration_ids%22:%5B%22UniversityDegree_JWT%22,%22org.iso.18013.5.1.mDL%22%5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-type:pre-authorized_code%22:%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7JuMn5%22,%22tx_code%22:%7B%7D%7D%7D%7D
```

### Response
#### Success Response (200)
No response body is specified in the source.

```

--------------------------------

### Token Response with authorization_details

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Token Response when the authorization_details parameter was used to request issuance of a certain Credential type. Shows the access_token, token_type, expires_in, and authorization_details with credential_configuration_id and credential_identifiers.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6Ikp..sHQ",
  "token_type": "Bearer",
  "expires_in": 86400,
  "authorization_details": [
    {
      "type": "openid_credential",
      "credential_configuration_id": "UniversityDegreeCredential",
      "credential_identifiers": [
        "CivilEngineeringDegree-2023",
        "ElectricalEngineeringDegree-2023"
      ]
    }
  ]
}
```

--------------------------------

### Authorization Request with authorization_details

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of an Authorization Request using the authorization_details parameter with a single credential_configuration_id. Sent by the User Agent to the Authorization Server in response to an HTTP 302 redirect response by the Wallet. Line breaks within values are for display purposes only.

```http
GET /authorize?
  response_type=code
  &client_id=s6BhdRkqt3
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256
  &authorization_details=%5B%7B%22type%22%3A%20%22openid_credential%22%2C%20%22
    credential_configuration_id%22%3A%20%22UniversityDegreeCredential%22%7D%5D
  &redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
  
Host: server.example.com
```

--------------------------------

### Browser GET Request with request_uri

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

GET request sent by the Browser to the Authorization Server using the request_uri obtained from the PAR response.

```HTTP
GET /authorize?client_id=s6BhdRkqt3
  &request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3A6esc_11ACC5bwc014ltc14eY22c
Host: server.example.com
```

--------------------------------

### Pushed Authorization Request (PAR) POST

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Pushed Authorization Request (PAR) example. Includes OAuth-Client-Attestation and OAuth-Client-Attestation-PoP headers. The request body contains response_type, client_id, code_challenge, code_challenge_method, redirect_uri, and authorization_details.

```HTTP
POST /par HTTP/1.1
Host: server.example.com
OAuth-Client-Attestation: eyJ...
OAuth-Client-Attestation-PoP: eyJ...
Content-Type: application/x-www-form-urlencoded

response_type=code
&client_id=CLIENT1234
&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
&code_challenge_method=S256
&redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
&authorization_details=...
```

--------------------------------

### Credential Request with jwt proof for SD-JWT VC

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Request for two Credential instances in IETF SD-JWT VC format using a Credential identifier from the Token Response and key proof type `jwt`. Line breaks within values are for display purposes only.

```http
POST /credential HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "credential_identifier": "CivilEngineeringDegree-2023",
  "proofs": {
    "jwt": [
      "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0
       eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiblVXQW9BdjNYWml0aDhFN2kxOU9kYXhPTFlG
       T3dNLVoyRXVNMDJUaXJUNCIsInkiOiJIc2tIVThCalVpMVU5WHFpN1N3bWo4Z3dBS18weGtj
       RGpFV183MVNvc0VZIn19",
      "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEva2V5cy8x
       IiwiYWxnIjoiRVMyNTYiLCJ0eXAiOiJKV1QifQ"
    ]
  }
}
```

--------------------------------

### Token Error Response Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Token Error Response with the invalid_request error code. The response includes the HTTP status code 400 and the error code in the JSON body.

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store

{
  "error": "invalid_request"
}
```

--------------------------------

### Deferred Credential Request Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

HTTP POST request to the Deferred Credential Endpoint. The request includes the required transaction_id and an Authorization header with a Bearer access token. The media type must be application/json when the request is not encrypted.

```http
POST /deferred_credential HTTP/1.1 
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "transaction_id": "8xLOxBtZp8"
}
```

--------------------------------

### Credential Error Response with unknown_credential_configuration

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Credential Error Response when an unsupported Credential Format is requested. The response uses HTTP status code 400 and includes the error code 'unknown_credential_configuration'.

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store

{
  "error": "unknown_credential_configuration"
}
```

--------------------------------

### Credential Request with credential_configuration_id and jwt proof

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Request for a Credential in ISO.18013-5 format using the Credential configuration identifier and a key proof type `jwt`. The request is sent to the Credential Endpoint via HTTP POST with `Content-Type: application/json` and an Authorization Bearer token. The `proofs` parameter contains a JWT proof of possession.

```http
POST /credential HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "credential_configuration_id": "org.iso.18013.5.1.mDL",
  "proofs": {
    "jwt": [
      "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEva2V5cy8x
       IiwiYWxnIjoiRVMyNTYiLCJ0eXAiOiJKV1QifQ"
    ]
  }
}
```

--------------------------------

### Token Request with authorization_details in Pre-Authorized Code Flow

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Token Request in a Pre-Authorized Code Flow without Client Authentication, using the authorization_details parameter to request a specific Credential Configuration. The authorization_details value is URL-encoded and contains the openid_credential type and the credential_configuration_id UniversityDegreeCredential.

```http
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code
&pre-authorized_code=SplxlOBeZQQYbYS6WxSbIA
&tx_code=493536
&authorization_details=%5B%7B%22type%22%3A%20%22openid_credential%22%2C%20%22
    credential_configuration_id%22%3A%20%22UniversityDegreeCredential%22%7D%5D
```

--------------------------------

### Credential Offer Endpoint

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

The Credential Offer Endpoint is used by a Credential Issuer to pass available information relevant for Credential issuance to an End-User's Wallet. It is invoked by the End-User, for example by clicking a link or scanning a QR code, and can be sent by value or by reference.

```APIDOC
## Credential Offer Endpoint

### Description
This endpoint is used by a Credential Issuer that is already interacting with an End-User who wishes to initiate a Credential issuance. It is used to pass available information relevant for the Credential issuance to ensure a convenient and secure process.

### Method
GET

### Endpoint
Wallet's Credential Offer Endpoint (as defined in client metadata)

### Parameters
#### Query Parameters
- **credential_offer** (object) - Optional - Object with the Credential Offer parameters. MUST NOT be present when the `credential_offer_uri` parameter is present.
- **credential_offer_uri** (string) - Optional - URL using the `https` scheme referencing a resource containing a JSON object with the Credential Offer parameters. MUST NOT be present when the `credential_offer` parameter is present.

### Request Example
```
https://wallet.example.com/credential-offer?credential_offer={"credential_issuer":"https://issuer.example.com","credential_configuration_ids":["UniversityDegreeCredential"],"grants":{"authorization_code":{}}}
```

### Response
#### Success Response (200)
No response body is defined for this endpoint.

### Error Handling
No error responses are defined in the source.
```

--------------------------------

### Notification Request for credential_failure

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Notification Request when a Credential was deleted by the End-User. The `event` value `credential_failure` is used for unsuccessful issuance cases, and the optional `event_description` provides additional human-readable ASCII information. The `event_description` must not include characters outside the set `%x20-21 / %x23-5B / %x5D-7E`.

```http
POST /notification HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "notification_id": "3fwe98js",
  "event": "credential_failure",
  "event_description": "Could not store the Credential. Out of storage."
}
```

--------------------------------

### Notification Request for credential_accepted

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Notification Request when a credential was successfully accepted by the End-User. The Wallet sends an HTTP POST to the Notification Endpoint with the required `notification_id` and `event` parameters in the entity-body using the `application/json` media type. The `event` value `credential_accepted` indicates the Credentials were successfully stored in the Wallet.

```http
POST /notification HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "notification_id": "3fwe98js",
  "event": "credential_accepted"
}
```

--------------------------------

### Deferred Credential Error Response

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Documentation for the Deferred Credential Error Response, including the additional error code `invalid_transaction_id` and an example response.

```APIDOC
## Deferred Credential Error Response

### Description
When the Deferred Credential Request is invalid, the Credential Issuer constructs the error response as defined in the Credential Error Response section. The additional error code `invalid_transaction_id` is specified for this endpoint.

### Error Response

#### Error Codes
- **invalid_transaction_id** - The Deferred Credential Request contains an invalid `transaction_id`. This error occurs when the `transaction_id` was not issued by the respective Credential Issuer or it was already used to obtain a Credential.

#### Example
```
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store

{
  "error": "invalid_transaction_id"
}
```

#### Additional Notes
- If the Credential Issuer can no longer issue the credential(s), the `credential_request_denied` error code should be used in response to a request. A wallet upon receiving this error SHOULD stop making requests to the deferred credential endpoint for the given `transaction_id`.
```

--------------------------------

### GET /.well-known/openid-credential-issuer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

This snippet documents the Credential Issuer Metadata retrieval endpoint, which is used by Wallets to fetch the Credential Issuer's configuration and capabilities.

```APIDOC
## GET /.well-known/openid-credential-issuer

### Description
Retrieves the Credential Issuer Metadata document, which contains information on the Credential Issuer's technical capabilities, supported Credentials, and display information. The Wallet sends an HTTP GET request to the well-known path derived from the Credential Issuer Identifier.

### Method
GET

### Endpoint
/.well-known/openid-credential-issuer

### Parameters
#### Query Parameters
- None explicitly defined.

#### Request Headers
- **Accept** (string) - Optional - Indicates the Content Type(s) the Wallet supports, signaling whether it supports signed metadata.
- **Accept-Language** (string) - Optional - Indicates the language(s) preferred for display.

### Request Example
```
GET /.well-known/openid-credential-issuer HTTP/1.1
Host: server.example.com
Accept-Language: fr-ch, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5
```

### Response
#### Success Response (200)
- Returns Credential Issuer Metadata as either an unsigned JSON document (media type `application/json`) or a signed JWT (media type `application/jwt`). The `Content-Type` header indicates the media type.

#### Response Example
Not provided in the source.
```

--------------------------------

### GET /authorize

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

The Authorization Request is an OAuth 2.0 Authorization Request that requests access to the Credential Endpoint. It can use the authorization_details parameter to specify the requested credentials.

```APIDOC
## GET /authorize

### Description
The Authorization Request is an OAuth 2.0 Authorization Request as defined in Section 4.1.1 of RFC 6749, which requests that access be granted to the Credential Endpoint. It can use the `authorization_details` parameter to convey details about the Credentials the Wallet wants to obtain.

### Method
GET

### Endpoint
/authorize

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Must be set to `code`.
- **client_id** (string) - Required - The client identifier.
- **code_challenge** (string) - Required - PKCE code challenge.
- **code_challenge_method** (string) - Required - PKCE code challenge method, e.g., `S256`.
- **authorization_details** (string) - Required - URL-encoded JSON array of authorization details objects. Each object must have `type` set to `openid_credential` and `credential_configuration_id` set to a valid identifier.
- **redirect_uri** (string) - Required - The redirect URI.

### Request Example
```
GET /authorize?
  response_type=code
  &client_id=s6BhdRkqt3
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256
  &authorization_details=%5B%7B%22type%22%3A%20%22openid_credential%22%2C%20%22
    credential_configuration_id%22%3A%20%22UniversityDegreeCredential%22%7D%5D
  &redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
  
Host: server.example.com
```

### Response
#### Success Response (302)
Redirect to the redirect_uri with an authorization code.

#### Response Example
HTTP/1.1 302 Found
Location: https://wallet.example.org/cb?code=...

```

--------------------------------

### POST /nonce

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

The Nonce Endpoint allows a Client to acquire a fresh c_nonce value. It is not a protected resource, so no access token is required. The Credential Issuer MUST offer this endpoint if it requires c_nonce values in proofs.

```APIDOC
## POST /nonce

### Description
This endpoint allows a Client to acquire a fresh `c_nonce` value. A Credential Issuer that requires `c_nonce` values to be incorporated into proofs in the Credential Request MUST offer a Nonce Endpoint.

### Method
POST

### Endpoint
`/nonce` (URL provided in the `nonce_endpoint` Credential Issuer Metadata parameter)

### Parameters
None. The request body is empty.

### Request Example
```
POST /nonce HTTP/1.1
Host: credential-issuer.example.com
Content-Length: 0
```

### Response
#### Success Response (200)
- **c_nonce** (string) - REQUIRED. String containing a challenge to be used when creating a proof of possession of the key. It is at the discretion of the Credential Issuer when to return a new challenge value as opposed to the one returned in the previous request. New challenge values MUST be unpredictable.
- **DPoP-Nonce** (header) - OPTIONAL. A DPoP nonce in an HTTP header as defined in Section 8.2 of RFC 9449. The Wallet uses the new nonce value in the DPoP proof when presenting an access token at the Credential Endpoint.

#### Response Example
```
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
DPoP-Nonce: eyJ7S_zG.eyJH0-Z.HX4w-7v

{
  "c_nonce": "wKI4LT17ac15ES9bw8ac4"
}
```
```

--------------------------------

### Credential Offer Parameters

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

The Credential Offer object is a JSON-encoded object containing parameters that the Wallet uses to initiate the credential issuance process. It includes the issuer URL, the credential configuration identifiers, and optionally the grant types supported.

```APIDOC
## Credential Offer Parameters

### Description
These are the parameters for the JSON-encoded Credential Offer object that is passed to the Wallet's Credential Offer Endpoint.

### Parameters
- **credential_issuer** (string) - Required - The URL of the Credential Issuer from which the Wallet is requested to obtain one or more Credentials.
- **credential_configuration_ids** (array of strings) - Required - A non-empty array of unique strings that each identify one of the keys in the `credential_configurations_supported` Credential Issuer metadata.
- **grants** (object) - Optional - Object indicating the Grant Types the Credential Issuer's Authorization Server is prepared to process for this Credential Offer. Each grant is represented by a name/value pair.
```

--------------------------------

### JWT proof with key attestation header

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Shows a JWT proof that also includes a `key_attestation` header, demonstrating how to convey key attestation data. The header includes `kid` and `key_attestation`, and the body includes `iss`, `aud`, `iat`, and `nonce` claims.

```json
{
  "typ": "openid4vci-proof+jwt",
  "alg": "ES256",
  "kid": "0",
  "key_attestation": <key attestation in JWT format>
}.{
  "iss": "s6BhdRkqt3",
  "aud": "https://server.example.com",
  "iat": 1659145924,
  "nonce": "tZignsnFbp"
}
```

--------------------------------

### POST /notification

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

This endpoint is used by the Wallet to notify the Credential Issuer of certain events for issued Credentials. It is an HTTP POST endpoint that accepts a JSON body with notification_id, event, and optional event_description. The Wallet must present a valid Access Token.

```APIDOC
## POST /notification

### Description
This endpoint is used by the Wallet to notify the Credential Issuer of certain events for issued Credentials. These events enable the Credential Issuer to take subsequent actions after issuance. The Wallet MUST present a valid Access Token issued at the Token Endpoint.

### Method
POST

### Endpoint
/notification

### Parameters
#### Request Body
- **notification_id** (string) - REQUIRED - String received in the Credential Response or Deferred Credential Response identifying an issuance flow that contained one or more Credentials with the same Credential Configuration and Credential Dataset.
- **event** (string) - REQUIRED - Type of the notification event. It MUST be a case sensitive string whose value is either `credential_accepted`, `credential_failure`, or `credential_deleted`. `credential_accepted` is to be used when the Credentials were successfully stored in the Wallet, with or without user action. `credential_deleted` is to be used when the unsuccessful Credential issuance was caused by a user action. In all other unsuccessful cases, `credential_failure` is to be used. Partial errors during issuance of multiple Credentials as a batch (e.g., one of the Credentials could not be stored) MUST be treated as the overall issuance flow failing.
- **event_description** (string) - OPTIONAL - Human-readable ASCII text providing additional information, used to assist the Credential Issuer developer in understanding the event that occurred. Values for the `event_description` parameter MUST NOT include characters outside the set `%x20-21 / %x23-5B / %x5D-7E`.

### Request Example
```
POST /notification HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "notification_id": "3fwe98js",
  "event": "credential_accepted"
}
```

### Response
#### Success Response (200)
The Credential Issuer returns success when it receives multiple identical calls from the Wallet for the same `notification_id`.

### Notes
- Communication with the Notification Endpoint MUST utilize TLS.
- The notification from the Wallet is idempotent.
- Additional Notification Request parameters MAY be defined and used. The Credential Issuer MUST ignore any unrecognized parameters.
```

--------------------------------

### POST /token

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

This snippet documents the Token Request endpoint used to request a specific Credential Configuration via the `authorization_details` parameter in a Pre-Authorized Code Flow.

```APIDOC
## POST /token

### Description
Requests a token for a specific Credential Configuration using the `authorization_details` parameter in a Pre-Authorized Code Flow.

### Method
POST

### Endpoint
/token

### Parameters
#### Request Body
- **grant_type** (string) - Required - The grant type, set to `urn:ietf:params:oauth:grant-type:pre-authorized_code`.
- **pre-authorized_code** (string) - Required - The pre-authorized code.
- **tx_code** (string) - Required - The transaction code.
- **authorization_details** (string) - Required - URL-encoded JSON array containing the `type` and `credential_configuration_id` fields.

### Request Example
```
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code
&pre-authorized_code=SplxlOBeZQQYbYS6WxSbIA
&tx_code=493536
&authorization_details=%5B%7B%22type%22%3A%20%22openid_credential%22%2C%20%22
    credential_configuration_id%22%3A%20%22UniversityDegreeCredential%22%7D%5D
```

### Response
#### Success Response (200)
- **access_token** (string) - The access token issued by the AS.
- **token_type** (string) - The type of the token.
- **expires_in** (integer) - The lifetime in seconds of the access token.
- **c_nonce** (string) - The nonce to be used for proof of possession.
- **c_nonce_expires_in** (integer) - The lifetime in seconds of the c_nonce.

#### Response Example
```
{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImJrLWtleSJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "c_nonce": "tZQvMY6Qb9i7",
  "c_nonce_expires_in": 120
}
```
```