Authorization Requests

Create OID4VP authorization requests to ask wallets for credential presentations

Create a request

POST /verifier/request
Authorization: Bearer oat_your_publishable_key
Content-Type: application/json

Simple request (namespace + attributes)

For quick integrations, specify a namespace and list of attributes:

{
  "version": "v1",
  "namespace": "eu.europa.ec.eudi.pid.1",
  "attributes": ["family_name", "given_name", "birth_date"]
}

DCQL request

For full control, provide a DCQL query directly:

{
  "version": "v1",
  "dcql_query": {
    "credentials": [{
      "id": "pid_credential",
      "format": "mso_mdoc",
      "meta": { "doctype_value": "eu.europa.ec.eudi.pid.1" },
      "claims": [
        { "path": ["eu.europa.ec.eudi.pid.1", "family_name"] },
        { "path": ["eu.europa.ec.eudi.pid.1", "given_name"] },
        { "path": ["eu.europa.ec.eudi.pid.1", "birth_date"] }
      ]
    }]
  }
}

See DCQL Queries for the full query syntax.

Request parameters

Field	Type	Required	Description
`version`	`"v1"` \| `"draft18"`	No	Protocol version. Default: `"v1"`
`namespace`	string	No	mDoc namespace for simple queries
`attributes`	string[]	No	Attribute names within the namespace
`claims`	array	No	Per-attribute namespace claims: `{ namespace, id, intent_to_retain }` for multi-namespace credentials
`scheme`	`"openid4vp"` \| `"mdoc-openid4vp"` \| `"haip-vp"` \| `"av"`	No	URL scheme for the request URI. `"av"` triggers the AV profile
`haip`	boolean	No	HAIP profile. Default: `true` for v1 (`haip-vp://`, `x509_hash`). Set `false` for plain OID4VP v1 (`openid4vp://`, `x509_san_dns`)
`callback`	boolean	No	Include a `redirect_uri` in the authorization response
`dcql_query`	object	No	Full DCQL query (see DCQL Queries)
`skip_trusted_authorities`	boolean	No	Skip trusted authority checking, accept credentials from any issuer

Either provide namespace + attributes for a simple query, or dcql_query for full control.

When skip_trusted_authorities is set to true, the API will not inject trusted_authorities into the DCQL query and will not validate the issuer against configured trusted issuers. This is useful for development and testing.

Response

{
  "url": "haip-vp://?client_id=x509_hash%3A...&request_uri=https%3A%2F%2Fapi.verifiables.com%2Fverifier%2Fauthorization%2Frequest.jwt%2F550e8400-e29b-41d4-a716-446655440000&request_uri_method=post",
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "version": "v1"
}

Field	Description
`url`	Deep link URI for the wallet (embed in QR code or redirect)
`id`	Request UUID to poll for the result
`version`	Protocol version used

Poll for result

GET /verifier/status/:request_id
Authorization: Bearer oat_your_publishable_key

Response states

Status	Description
`created`	Request created, waiting for the wallet to fetch it
`claimed`	Wallet fetched the request JWT
`valid`	Credential verified successfully
`failed`	Verification failed

Requests live for 600 seconds before the wallet responds, and the result is kept for 60 seconds after the response is processed. Once the record expires, the status endpoint returns:

{
  "error": "Authorization status not found"
}

Verified response

{
  "status": "valid",
  "verification": {
    "ISSUER_AUTH": [
      { "status": "✅", "check": "Issuer certificate must be valid" },
      { "status": "✅", "check": "The MSO must be valid at the time of verification" }
    ],
    "DEVICE_AUTH": [
      { "status": "✅", "check": "Device signature must be valid" }
    ]
  },
  "presentation": {
    "eu.europa.ec.eudi.pid.1": {
      "family_name": "Dupont",
      "given_name": "Marie",
      "birth_date": "1990-01-15"
    }
  }
}

verification groups checks by category; presentation is keyed by namespace (mDoc doctype) or SD-JWT vct. There is no credentials array. See Response Handling for details.

On this page