Issuing the Credentials over OID4VCI
There are two ways to get subject data into an issuance: supply it inline when creating the offer (the simple approach), or let connector invocations and manual contributions populate a pipeline session (the pipeline API). Both end in the same wallet-facing OID4VCI protocol. Backend schemas are in the OID4VCI Issuer API reference.
Simple approach: subject data in the offer
The backend creates a credential offer carrying the subject data and a pre-authorized code grant. The wallet scans the offer URI, exchanges the code for a token, and requests the credential.
In this walkthrough the wallet's holder key is generated through the tenant gateway so the proof of possession can be signed during the run; in production the key lives in the holder's wallet:
- Overview
- Request
- Response
Generate wallet holder key
Endpoint: POST /api/kms/v1/keys
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Create EuPid offer
Endpoint: POST /api/oid4vci/v1/backend/credential/offers
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The wallet resolves the offer and reads the pre-authorized code:
- Overview
- Request
- Response
Resolve credential offer
Endpoint: GET /oid4vci/credentials/offers/00000000-0000-4000-8000-000000000000
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Issuer metadata announces the credential configurations and endpoints. The credential configuration entries are derived from the credential designs bound in the previous steps, including the SD-JWT VC vct, mdoc doctype, claim policy, and display/render data:
- Overview
- Request
- Response
Fetch OID4VCI metadata
Endpoint: GET /.well-known/openid-credential-issuer
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The token request uses the pre-authorized code grant. The response carries the access token for the credential endpoint and the nonce that must appear in the proof of possession:
- Overview
- Request
- Response
Exchange pre-authorized code for token
Endpoint: POST /token
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The credential request includes an ES256 proof JWT (type openid4vci-proof+jwt) signed by the holder key, with the issuer as audience and the nonce from the token response. The issued SD-JWT carries the selectively disclosable claims and the status claim referencing the hosted status list:
- Overview
- Request
- Response
Request EuPid credential
Endpoint: POST /oid4vci/credential
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The backend session reflects the completed lifecycle:
- Overview
- Request
- Response
Check EuPid offer status
Endpoint: GET /api/oid4vci/v1/backend/credential/offers/e2e-eupid-001
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The Mdl follows the same sequence with namespace-qualified subject data; the response carries the ISO 18013-5 mdoc bound to the holder key:
- Overview
- Request
- Response
Create Mdl offer
Endpoint: POST /api/oid4vci/v1/backend/credential/offers
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Request Mdl credential
Endpoint: POST /oid4vci/credential
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Pipeline API: attributes from connector invocations
When subject data comes from multiple systems, or issuance needs an approval gate, use the pipeline API instead of inline subject data. Automatic integrations are connector invocation bindings in PipelineConfiguration.invocationBindings; backend/admin systems can also manually contribute attributes into the same session keyed by correlation id. Completeness is evaluated against the credential's mandatory claims, and an approval decision releases issuance:
- Overview
- Request
- Response
Initialize pipeline session
Endpoint: POST /api/oid4vci/v1/backend/sessions
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Contribute attributes
Endpoint: POST /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/attributes
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Read accumulated attributes
Endpoint: GET /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/attributes
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Evaluate completeness
Endpoint: GET /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/completeness
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Approve issuance
Endpoint: POST /api/oid4vci/v1/backend/sessions/e2e-pipeline-001/approve
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
After approval, the offer and wallet protocol proceed exactly as in the simple approach, with the pipeline-collected attributes as subject data.