Verification
Verification API
Request and verify credential presentations using OpenID for Verifiable Presentations (OID4VP)
The Verification API lets you request credential presentations from digital wallets using the OpenID for Verifiable Presentations (OID4VP) protocol.
How it works
- Your application creates an authorization request specifying which credentials and claims you need
- The API generates a signed JWT request and returns a URI for the wallet
- The wallet fetches the request, selects matching credentials, and sends an encrypted response
- Your application polls for the result or receives it via callback
Protocol versions
| Version | Protocol | Query format | Use case |
|---|---|---|---|
v1 | OID4VP 1.0 | DCQL | Recommended for new integrations |
draft18 | OID4VP Draft 18 | Presentation Exchange | Legacy wallet compatibility |
Version v1 is the default and implements the HAIP 1.0 profile with DCQL queries, encrypted responses, and x509_hash client identification.
Endpoints
| Method | Path | Auth | Description |
|---|---|---|---|
POST | /verifier/request | API key | Create an authorization request |
POST | /verifier/validate | API key | Parse and resolve an existing authorization request (wallet-side helper) |
GET | /verifier/status/:request_id | API key | Poll for presentation result |
POST | /verifier/response | API key | Submit a response (server-side wallets) |
Protocol endpoints (no API key)
These are called by wallets directly. You don't need to interact with them:
| Method | Path | Description |
|---|---|---|
GET/POST | /verifier/authorization/request.jwt/:id | Wallet fetches signed request (POST variant accepts wallet_nonce) |
POST | /verifier/authorization/response.jwt/:id | Wallet submits encrypted response |
POST | /verifier/authorization/response/:id | Wallet submits plain response (AV profile) |
GET/POST | /verifier/callback | Same-device redirect callback |
Supported formats
- mso_mdoc: ISO 18013-5 mobile documents (mDL, PID, etc.)
- dc+sd-jwt: SD-JWT Verifiable Credentials
Security features
All authorization requests are:
- Signed with the verifier's X.509 certificate (ES256)
- Encrypted: wallet responses use ECDH-ES with ephemeral keys
- Time-limited: request JWTs expire after 600 seconds
- Single-use: each request can only be consumed once
For how verification channels map to French AML identity-verification measures, see AML / LCB-FT.