{
  "info": {
    "name": "EDK Credential Status Profiles (local or approved test target)",
    "_postman_id": "0d3f7b2c-5e8a-4b6f-9c10-2d7e4a8b6f11",
    "description": "Customer-neutral request set for JWT Token Status List + SD-JWT VC, CWT Token Status List + ISO mDoc, and W3C VCDM 1.1/2.0 + StatusList2021. Replace every variable with values from a local or explicitly approved test deployment. Do not run this collection against a customer environment. Azure credential, BYOK, and BYOC mutations are disabled by default.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    { "key": "tenantToken", "value": "" },
    { "key": "tenantId", "value": "" },
    { "key": "tenantGatewayUrl", "value": "http://localhost:8080" },
    { "key": "tenantStatusListApiBaseUrl", "value": "http://localhost:8080/api/statuslist/v1" },
    { "key": "tenantCredentialDesignApiBaseUrl", "value": "http://localhost:8080/api/credential-design/v1" },
    { "key": "tenantKmsApiBaseUrl", "value": "http://localhost:8080/api/kms/v1" },
    { "key": "platformConfigApiBaseUrl", "value": "http://localhost:8080/api/platform/config/v1" },
    { "key": "tenantOid4vciApiBaseUrl", "value": "http://localhost:8080/api/oid4vci/v1" },
    { "key": "credentialEndpoint", "value": "" },
    { "key": "walletAccessToken", "value": "" },
    { "key": "statusListKmsResourceHandle", "value": "" },
    { "key": "statusListVerificationMethodId", "value": "did:web:issuer.example.com#status-list-signing" },
    { "key": "statusListId", "value": "" },
    { "key": "credentialIdentifier", "value": "" },
    { "key": "proofJwt", "value": "" },
    { "key": "kmsResourceHandle", "value": "" },
    { "key": "providerId", "value": "" },
    { "key": "providerNativeKeyAlias", "value": "" },
    { "key": "providerNativeCertificateId", "value": "" }
  ],
  "item": [
    {
      "name": "01 JWT Token Status List + SD-JWT VC",
      "description": "SD-JWT VC learning lane. Prerequisites: an SD_JWT_VC design advertised as dc+sd-jwt, a tenant status-signing selection, and a live OID4VCI offer/token flow. Run create -> public fetch -> issue -> revoke, then fetch again and verify the same credential is rejected. Inspect status.status_list.uri/idx and require application/statuslist+jwt. A created list or credential response alone is not end-to-end wallet evidence.",
      "item": [
        {
          "name": "Create JWT status list",
          "request": {
            "method": "POST",
            "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }],
            "body": { "mode": "raw", "raw": "{\n  \"correlationId\": \"employee-sd-jwt-revocation\",\n  \"spec\": \"token_status_list\",\n  \"purposes\": [\"revocation\"],\n  \"proofFormat\": \"jwt\",\n  \"hostingMode\": \"hosted\",\n  \"issuer\": \"did:web:issuer.example.com\",\n  \"signingKeyMode\": \"did:web\",\n  \"signingVerificationMethodId\": \"{{statusListVerificationMethodId}}\",\n  \"kmsResourceHandle\": \"{{statusListKmsResourceHandle}}\",\n  \"kmsKeyAlias\": \"status-list-signing\",\n  \"statusListUri\": \"{{tenantGatewayUrl}}/public/statuslists/employee-sd-jwt-revocation\",\n  \"length\": 131072,\n  \"bitsPerStatus\": 1,\n  \"ttlSeconds\": 300\n}" },
            "url": "{{tenantStatusListApiBaseUrl}}/statuslists",
            "description": "Creates the IETF JWT Token Status List used by the SD-JWT VC status.status_list reference."
          },
          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('status list created', () => pm.response.to.have.status(201));", "const j = pm.response.json();", "if (j.id) pm.collectionVariables.set('statusListId', j.id);"] } }]
        },
        {
          "name": "Fetch JWT status list",
          "request": { "method": "GET", "header": [{ "key": "Accept", "value": "application/statuslist+jwt" }], "url": "{{tenantGatewayUrl}}/public/statuslists/employee-sd-jwt-revocation", "description": "Public fetch; the response is a compact JWT containing the status_list bitstring." }
        },
        {
          "name": "Revoke SD-JWT status entry",
          "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"statusListIndex\": 1000,\n  \"value\": 1\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists/{{statusListId}}/status", "description": "Sets the allocated SD-JWT status entry to revoked. Fetch the public URI again after its cache policy allows it." }
        },
        {
          "name": "Issue SD-JWT VC (set credentialEndpoint)",
          "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{walletAccessToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"credential_identifier\": \"{{credentialIdentifier}}\",\n  \"proofs\": { \"jwt\": [\"{{proofJwt}}\"] }\n}" }, "url": "{{credentialEndpoint}}", "description": "OID4VCI credential request. The returned SD-JWT VC must contain status.status_list.uri and status.status_list.idx for the list above." },
          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('credential issued', () => pm.response.to.have.status(200));", "const j = pm.response.json();", "pm.expect((j.credentials && j.credentials[0] && j.credentials[0].credential) || j.credential, 'credential payload').to.be.a('string').and.not.empty;"] } }]
        }
      ]
    },
    {
      "name": "02 CWT Token Status List + ISO mDoc",
      "description": "ISO mdoc learning lane. Prerequisites: an MSO_MDOC design advertised as mso_mdoc, a DSC whose public key matches the selected KMS key, an admitted IACA/trust-domain attachment, and a live OID4VCI flow. Run create -> binary public fetch -> issue -> revoke, then refresh and verify rejection. Parse the credential and status publication as CBOR/COSE, require application/statuslist+cwt, and do not treat CWT status as VICAL evidence.",
      "item": [
        {
          "name": "Create CWT mDoc status list",
          "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"correlationId\": \"employee-mdoc-revocation\",\n  \"spec\": \"token_status_list\",\n  \"purposes\": [\"revocation\"],\n  \"proofFormat\": \"cwt\",\n  \"mdocProfile\": \"status_list\",\n  \"hostingMode\": \"hosted\",\n  \"issuer\": \"https://issuer.example.com\",\n  \"signingKeyMode\": \"x5c\",\n  \"kmsResourceHandle\": \"{{statusListKmsResourceHandle}}\",\n  \"kmsKeyAlias\": \"mdoc-status-signing\",\n  \"statusListUri\": \"{{tenantGatewayUrl}}/public/statuslists/employee-mdoc-revocation\",\n  \"length\": 256,\n  \"bitsPerStatus\": 1,\n  \"ttlSeconds\": 300\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists", "description": "Creates an ISO mDoc status_list profile. The response contains tenant-generated CWT material; the public endpoint serves raw COSE bytes." },
          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('CWT status list created', () => pm.response.to.have.status(201));", "const j = pm.response.json();", "if (j.id) pm.collectionVariables.set('statusListId', j.id);"] } }]
        },
        { "name": "Fetch CWT mDoc status list", "request": { "method": "GET", "header": [{ "key": "Accept", "value": "application/statuslist+cwt" }], "url": "{{tenantGatewayUrl}}/public/statuslists/employee-mdoc-revocation", "description": "The response is raw application/statuslist+cwt COSE_Sign1 bytes, not JSON or base64 text." } },
        { "name": "Revoke mDoc status entry", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"statusListIndex\": 42,\n  \"value\": 1\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists/{{statusListId}}/status", "description": "Sets the mDoc MSO status_list index to revoked; the verifier must refresh the raw CWT publication." } },
        { "name": "Issue ISO mDoc (set credentialEndpoint)", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{walletAccessToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"credential_identifier\": \"{{credentialIdentifier}}\",\n  \"proofs\": { \"jwt\": [\"{{proofJwt}}\"] }\n}" }, "url": "{{credentialEndpoint}}", "description": "OID4VCI mDoc request. Decode the opaque credential as CBOR and inspect the MSO status_list URI/index; do not parse it as a JWT." } }
      ]
    },
    {
      "name": "03 W3C VCDM 1.1 + StatusList2021",
      "description": "W3C VCDM 1.1 JWT learning lane. Create the design with the VCDM 1.1 context and advertise it as jwt_vc_json. Create and fetch the StatusList2021 VC-JWT, complete live OID4VCI issuance, inspect credentialStatus.statusListCredential/statusListIndex, revoke the same index, and verify rejection after refresh. The public status media type is application/vc+jwt; this folder provides contract requests but does not fabricate a runtime issuance response.",
      "item": [
        { "name": "Create VCDM 1.1 StatusList2021 list", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"correlationId\": \"employee-vcdm-11-revocation\",\n  \"spec\": \"bitstring_status_list\",\n  \"purposes\": [\"revocation\"],\n  \"proofFormat\": \"vc+jwt\",\n  \"hostingMode\": \"hosted\",\n  \"issuer\": \"did:web:issuer.example.com\",\n  \"signingKeyMode\": \"did:web\",\n  \"signingVerificationMethodId\": \"{{statusListVerificationMethodId}}\",\n  \"kmsResourceHandle\": \"{{statusListKmsResourceHandle}}\",\n  \"kmsKeyAlias\": \"status-list-signing\",\n  \"statusListUri\": \"{{tenantGatewayUrl}}/public/statuslists/employee-vcdm-11-revocation\",\n  \"length\": 131072,\n  \"bitsPerStatus\": 1,\n  \"ttlSeconds\": 300\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists", "description": "StatusList2021 is a W3C bitstring list. The hosted content type is application/vc+jwt." } },
        { "name": "Fetch VCDM 1.1 StatusList2021 credential", "request": { "method": "GET", "header": [{ "key": "Accept", "value": "application/vc+jwt" }], "url": "{{tenantGatewayUrl}}/public/statuslists/employee-vcdm-11-revocation", "description": "Public fetch of the StatusList2021 VC-JWT; evaluate credentialSubject.encodedList." } },
        { "name": "Create VCDM 1.1 credential design", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"credentialType\": { \"format\": \"W3C_VC\", \"type\": \"EmployeeCredential\", \"@context\": \"https://www.w3.org/2018/credentials/v1\" },\n  \"bindings\": [{ \"type\": \"EmployeeCredential\", \"@context\": \"https://www.w3.org/2018/credentials/v1\", \"credentialConfigurationId\": \"EmployeeCredentialV11\" }],\n  \"alias\": \"employee-vcdm-11\",\n  \"hostingMode\": \"LOCAL\"\n}" }, "url": "{{tenantCredentialDesignApiBaseUrl}}/designs/credentials", "description": "The corresponding OID4VCI configuration advertises format jwt_vc_json and the VCDM 1.1 context." } }
        , { "name": "Revoke VCDM 1.1 status entry", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"statusListIndex\": 42,\n  \"value\": 1\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists/{{statusListId}}/status", "description": "Updates the W3C bitstring entry; refresh the application/vc+jwt StatusList2021 credential before verification." } }
      ]
    },
    {
      "name": "04 W3C VCDM 2.0 + StatusList2021",
      "description": "W3C VCDM 2.0 JWT learning lane. Create the design with the VCDM 2.0 context and advertise it as jwt_vc_json-ld, not jwt_vc_json. Create and fetch the StatusList2021 VC-JWT, complete live OID4VCI issuance, inspect the VCDM 2.0 credentialStatus reference, revoke the same index, and verify rejection after refresh. The public status media type is application/vc+jwt; preserve real runtime issuance evidence separately.",
      "item": [
        { "name": "Create VCDM 2.0 StatusList2021 list", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"correlationId\": \"employee-vcdm-20-revocation\",\n  \"spec\": \"bitstring_status_list\",\n  \"purposes\": [\"revocation\"],\n  \"proofFormat\": \"vc+jwt\",\n  \"hostingMode\": \"hosted\",\n  \"issuer\": \"did:web:issuer.example.com\",\n  \"signingKeyMode\": \"did:web\",\n  \"signingVerificationMethodId\": \"{{statusListVerificationMethodId}}\",\n  \"kmsResourceHandle\": \"{{statusListKmsResourceHandle}}\",\n  \"kmsKeyAlias\": \"status-list-signing\",\n  \"statusListUri\": \"{{tenantGatewayUrl}}/public/statuslists/employee-vcdm-20-revocation\",\n  \"length\": 131072,\n  \"bitsPerStatus\": 1,\n  \"ttlSeconds\": 300\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists", "description": "Uses the same StatusList2021 bitstring mechanics, with a separate list URI for the VCDM 2.0 population." } },
        { "name": "Fetch VCDM 2.0 StatusList2021 credential", "request": { "method": "GET", "header": [{ "key": "Accept", "value": "application/vc+jwt" }], "url": "{{tenantGatewayUrl}}/public/statuslists/employee-vcdm-20-revocation", "description": "Public fetch of the StatusList2021 VC-JWT; evaluate credentialSubject.encodedList." } },
        { "name": "Create VCDM 2.0 credential design", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"credentialType\": { \"format\": \"W3C_VC\", \"type\": \"EmployeeCredential\", \"@context\": \"https://www.w3.org/ns/credentials/v2\" },\n  \"bindings\": [{ \"type\": \"EmployeeCredential\", \"@context\": \"https://www.w3.org/ns/credentials/v2\", \"credentialConfigurationId\": \"EmployeeCredentialV20\" }],\n  \"alias\": \"employee-vcdm-20\",\n  \"hostingMode\": \"LOCAL\"\n}" }, "url": "{{tenantCredentialDesignApiBaseUrl}}/designs/credentials", "description": "The corresponding OID4VCI configuration advertises format jwt_vc_json-ld and the VCDM 2.0 context." } }
        , { "name": "Revoke VCDM 2.0 status entry", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"statusListIndex\": 42,\n  \"value\": 1\n}" }, "url": "{{tenantStatusListApiBaseUrl}}/statuslists/{{statusListId}}/status", "description": "Updates the W3C bitstring entry; refresh the application/vc+jwt StatusList2021 credential before verification." } }
      ]
    },
    {
      "name": "05 Azure KMS, BYOK, and BYOC (opt-in)",
      "description": "These requests are intentionally disabled. Enable only with tenant-owned Azure coordinates and an explicitly approved local/test target. They never contact a customer environment by default.",
      "item": [
        { "name": "Attach Azure KMS resource", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"providerId\": \"azure-test\",\n  \"kind\": \"AZURE_KEY_VAULT\",\n  \"displayName\": \"Azure test KMS\",\n  \"configuration\": {\n    \"vaultUri\": \"https://example-vault.vault.azure.net/\",\n    \"applicationId\": \"<workload-application-id>\",\n    \"tenantId\": \"<entra-directory-tenant-id>\",\n    \"clientId\": \"<workload-client-id>\",\n    \"hsmType\": \"SOFTWARE\"\n  }\n}" }, "url": "{{platformConfigApiBaseUrl}}/tenants/{{tenantId}}/kms/resources:attach", "description": "Non-secret Azure coordinates only. This request is disabled by default.", "disabled": true } },
        { "name": "Register BYOK key", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"providerId\": \"{{providerId}}\",\n  \"alias\": \"{{providerNativeKeyAlias}}\",\n  \"kid\": \"<provider-canonical-key-id>\"\n}" }, "url": "{{tenantKmsApiBaseUrl}}/keys/register", "description": "Registers only a provider-native reference; private key material never crosses the API.", "disabled": true } },
        { "name": "Register BYOC provider-native certificate", "request": { "method": "POST", "header": [{ "key": "Authorization", "value": "Bearer {{tenantToken}}" }, { "key": "Content-Type", "value": "application/json" }], "body": { "mode": "raw", "raw": "{\n  \"providerId\": \"{{providerId}}\",\n  \"alias\": \"issuer-document-signer-leaf\",\n  \"providerCertificateId\": \"{{providerNativeCertificateId}}\",\n  \"kind\": \"trusted_certificate\",\n  \"source\": \"provider_native\"\n}" }, "url": "{{tenantKmsApiBaseUrl}}/certificates/register", "description": "Registers a provider-native public leaf. It does not export a PFX, follow AIA, or submit private material.", "disabled": true } }
      ]
    }
  ]
}