DCQL Queries with Selective Disclosure
DCQL (Digital Credentials Query Language) describes what a verifier requests: which credential types, matched how, and which claims. The claim selection is what drives selective disclosure: claims a query does not name are not revealed. Queries are stored on the verifier service (DCQL API reference).
SD-JWT query
Matches the EuPid by vct and requests only three of its claims. The holder's wallet discloses family name, given name, and the age attestation; everything else in the credential stays hidden:
- Overview
- Request
- Response
Create EuPid query
Endpoint: POST /queries
Captured response: Response capture pending the next QA-gate run.
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
mdoc query
Matches the Mdl by doctype. mdoc claim paths name the namespace first:
- Overview
- Request
- Response
Create Mdl query
Endpoint: POST /queries
Captured response: Response capture pending the next QA-gate run.
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Combined query
One query can request multiple credentials in a single presentation, each with its own claim selection:
- Overview
- Request
- Response
Create combined query
Endpoint: POST /queries
Captured response: Response capture pending the next QA-gate run.
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Listing and versioning
Stored queries are versioned; earlier versions can be inspected and restored through the version-history endpoints:
- Overview
- Request
- Response
List queries
Endpoint: GET /api/dcql/v1/queries
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
List combined query versions
Endpoint: GET /api/dcql/v1/queries/eupid-and-mdl/versions
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Bind the query to the verifier
Creating a DCQL query does not automatically enable a verifier instance to use it. Bind the query to the platform-created verifier party id resolved during tenant onboarding. The public verifier instance slug is routing/display data; the binding API keys the verifier by its party id:
- Overview
- Request
- Response
Bind combined query to verifier
Endpoint: POST /verifiers/{{verifierId}}/bindings
Captured response: Response capture pending the next QA-gate run.
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The binding can be listed from the verifier side or from the query side:
- Overview
- Request
- Response
List verifier DCQL bindings
Endpoint: GET /api/dcql/v1/verifiers/00000000-0000-4000-8000-000000000000/bindings
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
List combined query verifier bindings
Endpoint: GET /api/dcql/v1/queries/eupid-and-mdl/verifiers
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.