OpenID for Verifiable Presentations

https://openid.net/specs/openid-4-verifiable-presentations-1_0.md
Admin
OpenID for Verifiable Presentations defines a mechanism on top of OAuth 2.0 for requesting and...
Tokens:49,911
Snippets:302
Trust Score:9.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### vp_formats_supported metadata parameter example

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of the vp_formats_supported metadata parameter. It lists supported credential formats and their algorithm values, here jwt_vc_json with ES256K and ES384.

```json
"vp_formats_supported": {
  "jwt_vc_json": {
    "alg_values": [
      "ES256K",
      "ES384"
    ]
  }
}
```

--------------------------------

### Attested object example

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of an attested object for the verifier_info parameter. Shows the format, data, and credential_ids fields.

```json
{
  "format": "jwt",
  "data": "eyJhbGciOiJFUzI1...EF0RBtvPClL71TWHlIQ",
  "credential_ids": [ "id_card" ]
}
```

--------------------------------

### Example Verifiable Presentation for ldp_vc

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a Verifiable Presentation for the `ldp_vc` Credential Format Identifier without a `proof` property. Shows how the `nonce` is included as the `challenge` and the `client_id` as the `domain` value in the proof.

```json
{
  "@context": [ ... ],
  "type": "VerifiablePresentation",
  "verifiableCredential": [ ... ],
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "ecdsa-rdfc-2019",
    "created": "2018-09-14T21:19:10Z",
    "proofPurpose": "authentication",
    "verificationMethod": "did:example:ebfeb1f712ebc6f1c276e12ec21#keys-1",    
    "challenge": "343s$FSFDa-",
    "domain": "x509_san_dns:client.example.org",
    "proofValue": "z2iAR...3oj9Q8"
  }
}
```

--------------------------------

### Transaction data content example

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of transaction data content after base64url decoding one of the strings in the transaction_data parameter. Shows the structure with type and credential_ids fields.

```json
{
  "type": "example_type",
  "credential_ids": [ "id_card_credential" ],
  // other transaction data type specific parameters
}
```

--------------------------------

### Matching Verifiable Credential with UniversityDegreeCredential

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a W3C Verifiable Credential that matches the `type_values` DCQL query above. Other claims are omitted for readability.

```json
{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://www.w3.org/2018/credentials/examples/v1"
  ],
  "type": ["VerifiableCredential", "UniversityDegreeCredential"]
}
```

--------------------------------

### VP Token Response

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Documentation for the VP Token response parameter, including its structure, location in the response, and examples.

```APIDOC
## VP Token Response

### Description
A VP Token is returned in the Authorization Response or the Token Response depending on the Response Type used. The VP Token is a JSON-encoded object containing entries where the key is the `id` value used for a Credential Query in the DCQL query and the value is an array of one or more Presentations that match the respective Credential Query.

### Response Parameters
- `vp_token` (object) - REQUIRED. JSON-encoded object with entries keyed by the `id` from the DCQL query. Each value is an array of Presentations. When `multiple` is omitted or `false`, the array MUST contain only one Presentation. Optional Credential Queries with no matching Credentials MUST NOT have an entry. Each Presentation is a string or object depending on the format.
- Other parameters such as `code`, `id_token`, and `iss` MAY be included as defined in their respective specifications.

### Response Location
- If `response_type` is `vp_token` or `vp_token id_token`, the VP Token is returned in the Authorization Response.
- If `response_type` is `code`, the VP Token is returned in the Token Response.

### Example Authorization Response (non-normative)
```
HTTP/1.1 302 Found
Location: https://client.example.org/cb#
  vp_token=...
```

### Example VP Token with a Single Presentation (non-normative)
```json
{
  "my_credential": ["eyJhbGci...QMA"]
}
```

### Example VP Token with Multiple Presentations (non-normative)
```json
{
  "my_credential": ["eyJhbGci...QMA", "eyJhbGci...QMA", ...]
}
```
```

--------------------------------

### Matching Verifiable Credential with BachelorDegree and AlumniCredential

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a W3C Verifiable Credential that matches the `type_values` DCQL query above. Other claims are omitted for readability.

```json
{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://www.w3.org/2018/credentials/examples/v1"
  ],
  "type": ["VerifiableCredential", "BachelorDegree", "AlumniCredential"]
}
```

--------------------------------

### Matching Verifiable Credential with IdentityCredential

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a W3C Verifiable Credential that matches the `type_values` DCQL query above. Other claims are omitted for readability.

```json
{
  "@context": [
    "https://www.w3.org/2018/credentials/v1"
  ],
  "type": ["VerifiableCredential", "IdentityCredential"]
}
```

--------------------------------

### GET /authorize

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

This endpoint is used to request a combination of a Verifiable Presentation and a Self-Issued ID Token for pseudonymous authentication. It is a non-normative example of a request that combines this specification with SIOPv2.

```APIDOC
## [GET] /authorize

### Description
This endpoint is used to request a combination of a Verifiable Presentation and a Self-Issued ID Token for pseudonymous authentication. It is a non-normative example of a request that combines this specification with SIOPv2.

### Method
GET

### Endpoint
/authorize

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Set to `vp_token id_token` to request both a Verifiable Presentation and an ID Token.
- **scope** (string) - Required - Set to `openid` to make this an OpenID Connect request.
- **id_token_type** (string) - Required - Set to `subject_signed` to request a Self-Issued ID Token.
- **client_id** (string) - Required - The Client Identifier of the Verifier, e.g., `x509_san_dns:client.example.org`.
- **redirect_uri** (string) - Required - The URI to which the Wallet will redirect the response.
- **dcql_query** (string) - Required - The query for the Verifiable Presentation.
- **nonce** (string) - Required - A nonce value to prevent replay.

### Request Example
```
GET /authorize?
  response_type=vp_token%20id_token
  &scope=openid
  &id_token_type=subject_signed
  &client_id=x509_san_dns%3Aclient.example.org
  &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
  &dcql_query=...
  &nonce=n-0S6_WzA2Mj HTTP/1.1
Host: wallet.example.com
```

### Response
#### Success Response (302 Found)
- **id_token** (string) - The Self-Issued ID Token.
- **vp_token** (string) - The Verifiable Presentation token.

#### Response Example
```
HTTP/1.1 302 Found
Location: https://client.example.org/cb#
  id_token=
  &vp_token=...
```
```

--------------------------------

### Response from Verifier to Wallet in direct_post mode

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Example response from the Verifier to the Wallet upon receiving the Authorization Response at the Response URI, using a response_code parameter. The response includes a redirect_uri with a fresh, cryptographically random value to prevent session fixation. If the response does not contain redirect_uri, the Wallet is not required to perform further steps.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "redirect_uri": "https://client.example.org/cb#response_code=091535f699ea575c7937fa5f0f454aee" 
}
```

--------------------------------

### Request Object Payload Example

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a payload for a request object returned by the Request URI endpoint. Contains client_id, response_uri, response_type, response_mode, dcql_query, nonce, wallet_nonce, and state.

```json
{
  "client_id": "x509_san_dns:client.example.org",
  "response_uri": "https://client.example.org/post",
  "response_type": "vp_token",
  "response_mode": "direct_post",
  "dcql_query": {...},
  "nonce": "n-0S6_WzA2Mj",
  "wallet_nonce": "qPmxiNFCR3QTm19POc8u",
  "state" : "eyJhb...6-sVA"
}
```

--------------------------------

### Example JSON-based Credential for Claims Path Pointer

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

A simplified JSON-based Credential used to illustrate claims path pointer semantics. It contains nested objects, arrays, and an array of objects, demonstrating how pointers select claims.

```json
{
  "name": "Arthur Dent",
  "address": {
    "street_address": "42 Market Street",
    "locality": "Milliways",
    "postal_code": "12345"
  },
  "degrees": [
    {
      "type": "Bachelor of Science",
      "university": "University of Betelgeuse"
    },
    {
      "type": "Master of Science",
      "university": "University of Betelgeuse"
    }
  ],
  "nationalities": ["British", "Betelgeusian"]
}
```

--------------------------------

### deviceauth_alg_values example with HMAC 256/256 using P-256

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Indicates the verifier supports DeviceMac with HMAC 256/256, where the MAC key is established via ECDH using keys on the P-256 curve as per Section 9.1.3.5 of ISO.18013-5.

```json
{
  "deviceauth_alg_values": [ -65537 ]
}
```

--------------------------------

### type_values DCQL query example

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of the `type_values` parameter within a DCQL query. It defines three alternative sets of fully expanded types that a Verifiable Credential must match.

```json
"type_values":[
  [
      "https://www.w3.org/2018/credentials#VerifiableCredential",
      "https://example.org/examples#AlumniCredential",
      "https://example.org/examples#BachelorDegree"
  ],
  [
      "https://www.w3.org/2018/credentials#VerifiableCredential",
      "https://example.org/examples#UniversityDegreeCredential"
  ],
  [
      "IdentityCredential"
  ]  
]
```

--------------------------------

### Authorization Request with Request Object by reference

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of an Authorization Request with a request object passed by reference, followed by the HTTP request the Wallet might send to the request_uri to retrieve the actual request.

```http
GET /authorize?
  client_id=x509_san_dns%3Aclient.example.org
  &request_uri=https%3A%2F%2Fclient.example.org%2Frequest%2Fvapof4ql2i7m41m68uep
  &request_uri_method=post HTTP/1.1
```

```http
POST /request/vapof4ql2i7m41m68uep HTTP/1.1
Host: client.example.org
Content-Type: application/x-www-form-urlencoded

wallet_metadata=%7B%22vp_formats_supported%22%3A%7B%22dc%2Bsd-jwt%22%3A%7B%22sd-jwt_alg
_values%22%3A%20%5B%22ES256%22%5D%2C%22kb-jwt_alg_values%22%3A%20%5B%22ES256%22%5D%7D%7
D%7D&
wallet_nonce=qPmxiNFCR3QTm19POc8u
```

--------------------------------

### Authorization Request URL using request_uri

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of an Authorization Request that refers to the Request Object from the previous example via the `request_uri` parameter. The request can be displayed to the End-User directly as a link or as a QR Code.

```text
https://wallet.example.com?
  client_id=https%3A%2F%2Fclient.example.org%2Fcb
  &request_uri=https%3A%2F%2Fclient.example.org%2F567545564
```

--------------------------------

### Example Verifiable Presentation payload for jwt_vc_json

Source: https://openid.net/specs/openid-4-verifiable-presentations-1_0.md

Non-normative example of a Verifiable Presentation payload for the `jwt_vc_json` Credential Format Identifier. Shows how the `nonce` and `client_id` values are bound to the presentation: the `nonce` is included as the `nonce` claim and the `client_id` as the `aud` claim.

```json
{
  "iss": "did:example:ebfeb1f712ebc6f1c276e12ec21",
  "jti": "urn:uuid:3978344f-8596-4c3a-a978-8fcaba3903c5",
  "aud": "s6BhdRkqt3",
  "nonce": "343s$FSFDa-",
  "nbf": 1541493724,
  "iat": 1541493724,
  "exp": 1573029723,
  "vp": {
    "@context": [
      "https://www.w3.org/2018/credentials/v1",
      "https://www.w3.org/2018/credentials/examples/v1"
    ],
    "type": ["VerifiablePresentation"],

    "verifiableCredential": [""]
  }
}
```
Tokens:
Raw