Attribute Pipeline

The EDK issuance pipeline is the stateful runtime around OID4VCI. It stores the in-flight attribute bag, connector fields, approval state, deferral state, and audit-friendly lifecycle status. Automatic integration is connector-native: PipelineConfiguration.invocationBindings declares which connector invocations run at each OID4VCI stage.

Manual REST contribution is still supported for backend/admin use cases. In those request bodies, contributorId is provenance on contributed records. It is not the automatic runtime binding contract.

Guiding Principle: Provide Attributes as Late as You Can

Every attribute in an issuance session is sensitive data the EDK has to encrypt, store, and eventually delete. If the wallet might claim a credential minutes or hours after the offer was created, seed connector fields such as employee_id instead of the full payload and use connector invocations to fetch current values when /credential is called.

In practice:

• Seed short connector fields at offer/session start when possible.
• Pull authoritative values through connector invocations at OID4VCI_CREDENTIAL_REQUEST.
• Use async/deferred connector execution for slow systems.
• Retain issued evidence only through explicit OID4VCI_POST_ISSUANCE vault-retention bindings.

Integration Patterns

Pattern 1: Push Known Data

Use this when your backend already has every claim value and the wallet flow is short. Push attributes or connector fields through POST /api/oid4vci/v1/backend/credential/offers or the session contribution endpoints. The EDK stores attributes in the encrypted session bag and keeps connector fields available for connector invocations.

This is not the preferred default for long-lived or mutable data.

Pattern 2: Fetch Live Data at Credential Request

Use this for most production integrations. At offer/session start, seed a connector field such as employee_id. Bind an ENRICHMENT_SOURCE connector invocation at OID4VCI_CREDENTIAL_REQUEST. When the wallet calls /credential, the connector fetches the live data and returns producedFields; the pipeline persists those fields into the session bag and the claims assembler reads them.

Pattern 3: Async or Deferred Upstream

Use this when the upstream system cannot answer inside the wallet request window. Bind the connector invocation with an async/deferred execution policy. The EDK can wait for a configured sync window; if the integration is still pending, the wallet receives a deferred credential response and later /credential_deferred polling completes after the integration contributes its fields.

OID4VCI Connector Stages

Stage	Protocol moment	Common use
OID4VCI_START	Offer/session start	Audit, initialization, non-PII routing state
OID4VCI_AUTHORIZATION	Authorization-code flow and AS context	Capture userinfo context or presentation-derived values
OID4VCI_PRE_AUTHORIZED	Pre-authorized-code offer setup	Validate backend-triggered issuance context
OID4VCI_TOKEN	Token exchange	Resolve subject identifiers and risk state
OID4VCI_CREDENTIAL_REQUEST	Wallet calls /credential	Fetch current claims, dispatch async work
OID4VCI_PRE_ISSUE	Request/proof validated, before signing	Final enrichment, policy state, status-list prep
OID4VCI_DEFERRED	Wallet polls /credential_deferred	Re-run pending/deferred work
OID4VCI_POST_ISSUANCE	Credential response produced	Vault retention, evidence export, notifications
OID4VCI_NOTIFICATION_RECEIPT	Wallet sends notification	Receipt audit, downstream acknowledgement

The runtime uses the same connector invocation model at every stage. Later stages can consume fields produced earlier in the session.

Connector Fields vs Attributes

Attributes are fields that may end up in the credential, such as given_name, birth_date, or employment.department.

Connector fields are operational inputs and outputs for connector invocations, such as employee_id, email, identity_id, risk scores, callback handles, or AS/userinfo claims captured during the OID4VCI lifecycle. They are encrypted at rest like attributes, but they do not become credential claims unless a connector invocation or claim mapping deliberately writes them into the attribute bag.

This distinction is what makes late fetching useful: the session can carry one connector field for a long time and only materialize the full claim payload when the wallet is ready.

REST Groups Are a Wire-Format Convenience

The V1 contribution endpoints accept compact groups. A group factors out shared provenance, phase, timestamp, and retention once for a batch of attributes and connector fields. The HTTP adapter decodes groups into AttributeRecord values plus a connector-field map before the pipeline command runs.

This manual contribution shape does not define automatic connector execution. Automatic execution is configured through ConnectorInvocationBinding records in PipelineConfiguration.invocationBindings.

Backend Contributions and Callback Ingress

Use the tenant's HTTPS origin for these interfaces. Keep the returned correlationId with your business transaction; do not substitute the offer URI, access token, or connector run id for the pipeline session id.

All session paths below start with /api/oid4vci/v1/backend/sessions:

Method	Path suffix	Purpose
POST	(none)	Initialize a pipeline session
POST	/{correlationId}/attributes	Contribute compact attribute groups and connector fields
GET	/{correlationId}/attributes	Read the accumulated contribution state
GET	/{correlationId}/completeness	Evaluate missing fields and issuance gates
POST	/{correlationId}/approve	Apply an approval decision
POST	/{correlationId}/fail	Record a contributor failure
POST	/{correlationId}/callbacks/{callbackToken}	Contribute delayed data using a scoped callback capability

The callback endpoint is inbound to the issuer. It is not a webhook that reports credential issuance, revocation, or successful verification to your application. For outbound issuance integrations, configure a connector invocation at the appropriate protocol stage.

The callback token authorizes the contribution: this endpoint does not require a separate OAuth bearer token. The issuer validates the token, checks its correlationId against the path, and requires every group's contributorId to match the token's contributor. Treat the complete callback URL as a secret: exclude it from screenshots, analytics, shared request logs, and published examples. Use the callback URL supplied for that contribution rather than constructing or reusing a token for another session.

Accepted callback contributions always enter the DEFERRED pipeline phase; the caller cannot choose a different phase through the body. A successful contribution can wake a waiting credential request when a callback coordinator is configured. It does not itself prove that issuance has completed. Read completeness and approval state, then follow the wallet's credential or deferred-credential response to establish the outcome.

Session Lifecycle

Status	Meaning
CREATED	Session exists; protocol work has not completed.
PHASE_EXECUTING	A phase is running.
PHASE_COMPLETED	A phase completed and the session is between gates.
AWAITING_DEFERRED	Required data is not ready; the wallet can continue with deferred issuance.
AWAITING_APPROVAL	All data is present, but an operator decision is required.
READY	All gates are satisfied; the next credential/deferred request can issue.
COMPLETED	Credential issuance completed.
FAILED	Terminal failure.
EXPIRED	Session expired before completion.

AWAITING_DEFERRED usually means an async connector invocation or callback has not completed yet. AWAITING_APPROVAL is controlled by the credential binding approval policy.

Multiple Connector Invocations

A single credential may need several integrations. Bind each connector invocation to the phase where the data is most useful. For example:

• OID4VCI_TOKEN: resolve an email or subject id to an internal identity id.
• OID4VCI_CREDENTIAL_REQUEST: fetch HR and compliance fields using that identity id.
• OID4VCI_PRE_ISSUE: prepare status-list or policy evidence.
• OID4VCI_POST_ISSUANCE: retain proof/evidence in a vault.

Use connector subsetMapping.inputFields selectors and subsetMapping.producedFields selectors to make dependencies explicit. The field names should point at connector fields, protocol claims, or canonical fields rather than a separate pipeline connector-field model.

Retention

By default, the session bag is retained only until session expiry and cleanup. To keep data for re-issuance or audit evidence, bind an explicit OID4VCI_POST_ISSUANCE connector invocation with VAULT_RETENTION role and a materialization policy. This keeps retention deliberate, auditable, and tied to connector governance.

Putting It Together

For most production integrations:

1. Create the offer/session with connector fields, not full PII.
2. Bind connector invocations for live enrichment at OID4VCI_CREDENTIAL_REQUEST.
3. Use deferred execution for slow integrations.
4. Use OID4VCI_PRE_ISSUE for final state before signing.
5. Use OID4VCI_POST_ISSUANCE only when you intentionally retain or export issued evidence.

Next: Connector Invocations shows the binding shape and examples.