Issuing the Credentials over OID4VCI
There are two ways to get subject data into an issuance: supply it inline when creating the offer (the simple approach), or let connector invocations and manual contributions populate a pipeline session (the pipeline API). Both end in the same wallet-facing OID4VCI protocol. Backend schemas are in the OID4VCI Issuer API reference.
Simple approach: subject data in the offer
The backend creates a credential offer carrying the subject data and a pre-authorized code grant. The wallet scans the offer URI, exchanges the code for a token, and requests the credential.
- Overview
- Request
- Response
Create EuPid offer
Endpoint: POST /api/oid4vci/v1/backend/credential/offers
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The wallet resolves the offer and reads the pre-authorized code:
- Overview
- Request
- Response
Resolve credential offer
Endpoint: GET /oid4vci/acme/oid4vci/credentials/offers/00000000-0000-4000-8000-000000000000
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Issuer metadata announces the credential configurations and endpoints. The credential configuration entries are derived from the credential designs bound in the previous steps, including the SD-JWT VC vct, mdoc doctype, claim policy, and display/render data:
- Overview
- Request
- Response
Fetch OID4VCI metadata
Endpoint: GET /.well-known/openid-credential-issuer/oid4vci/acme
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The token request uses the pre-authorized code grant. The response carries the access token for the credential endpoint and the nonce that must appear in the proof of possession:
- Overview
- Request
- Response
Exchange pre-authorized code for token
Endpoint: POST /as/acme/token
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The credential request includes an ES256 proof JWT (type openid4vci-proof+jwt) signed by the key held by the wallet, with the issuer as audience and the nonce from the token response. The issued SD-JWT carries the selectively disclosable claims and the status claim referencing the hosted status list:
- Overview
- Request
- Response
Request EuPid credential
Endpoint: POST /oid4vci/acme/oid4vci/credential
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The backend session reflects the completed lifecycle:
- Overview
- Request
- Response
Check EuPid offer status
Endpoint: GET /api/oid4vci/v1/backend/credential/offers/e2e-eupid-001
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The Mdl follows the same sequence with namespace-qualified subject data; the response carries the ISO 18013-5 mdoc bound to the holder key:
- Overview
- Request
- Response
Create Mdl offer
Endpoint: POST /api/oid4vci/v1/backend/credential/offers
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Request Mdl credential
Endpoint: POST /oid4vci/acme/oid4vci/credential
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
mdoc PKI and Azure KMS
For an mso_mdoc credential, the issuer uses a KMS-backed private key for the issuer-authentication signature. When the configured provider exposes the public certificate chain, issuer metadata or key projections may include x5c or x5chain; these are public certificate-chain values, while the private key remains in the configured KMS (including Azure Key Vault when that provider is selected).
In the ISO 18013-5 terminology, the DSC (Document Signer Certificate) is the end-entity certificate that signs the MSO, and the IACA (Issuing Authority CA) is the CA that anchors DSCs. The mdoc format uses MSO_MDOC and a docType; an SD-JWT VC instead uses its vct. These identifiers describe different wire formats and must not be substituted for one another.
This configuration does not mean EDK generates an IACA or DSC, and it does not imply VICAL support. VICAL is the separate ISO 18013-5 Annex C binary CBOR/COSE_Sign1 trust artifact, not ETSI TS 119 602 JSON/JAdES material.
Pipeline API: attributes from connector invocations
When subject data comes from multiple systems, or issuance needs an approval gate, use the pipeline API instead of inline subject data. Automatic integrations are connector invocation bindings in PipelineConfiguration.invocationBindings; backend/admin systems can also manually contribute attributes into the same session keyed by correlation id. Completeness is evaluated against the credential's mandatory claims, and an approval decision releases issuance:
- Overview
- Request
- Response
Initialize pipeline session
Endpoint: POST /api/oid4vci/v1/backend/sessions
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Contribute attributes
Endpoint: POST /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/attributes
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Read accumulated attributes
Endpoint: GET /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/attributes
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Evaluate completeness
Endpoint: GET /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/completeness
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Approve issuance
Endpoint: POST /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/approve
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
After approval, the offer and wallet protocol proceed exactly as in the simple approach, with the pipeline-collected attributes as subject data.