Trusted Authorities

Trusted authorities let you constrain which issuers are accepted in a credential presentation. This is part of the HAIP 1.0 (High Assurance Interoperability Profile) specification.

Automatic injection

When you configure trusted issuers in the dashboard, the API automatically injects trusted_authorities into DCQL queries. No manual configuration is needed for most use cases.

How it works

The API extracts the Subject Key Identifier (SKI) from each trusted issuer's certificate. This is the value that appears as the Authority Key Identifier (AKI) extension in leaf credentials signed by those roots. The extracted identifiers are base64url-encoded and injected as aki-type trusted authorities.

Default queries

When creating a verification request with namespace + attributes (no custom dcql_query), the generated DCQL query automatically includes trusted_authorities:

POST /verifier/request
{
  "namespace": "eu.europa.ec.eudi.pid.1",
  "attributes": ["family_name", "given_name"]
}

The resulting DCQL query will contain:

{
  "credentials": [{
    "id": "eu_europa_ec_eudi_pid_1",
    "format": "mso_mdoc",
    "claims": [
      { "path": ["eu.europa.ec.eudi.pid.1", "family_name"] },
      { "path": ["eu.europa.ec.eudi.pid.1", "given_name"] }
    ],
    "trusted_authorities": [
      { "type": "aki", "values": ["<base64url-ski-1>", "<base64url-ski-2>"] }
    ]
  }]
}

Custom queries

Custom DCQL queries are also enriched automatically:

• Credentials without trusted_authorities: enriched with AKI values from matching trusted issuers
• Credentials with trusted_authorities: left as-is, never overwritten

AKI values are format-specific: mDoc credentials receive identifiers from mDoc-configured issuers, SD-JWT credentials from SD-JWT-configured issuers.

Manual usage

You can also specify trusted_authorities explicitly in any credential query. Explicitly provided values always take precedence over automatic injection:

{
  "credentials": [{
    "id": "pid_credential",
    "format": "mso_mdoc",
    "meta": { "doctype_value": "eu.europa.ec.eudi.pid.1" },
    "claims": [
      { "path": ["eu.europa.ec.eudi.pid.1", "family_name"] }
    ],
    "trusted_authorities": [
      { "type": "aki", "values": ["MIGfMA0GCSqGSIb3DQEBAQUAA4GN"] }
    ]
  }]
}

Authority types

AKI (Authority Key Identifier)

The most common type. The wallet checks that the credential issuer's certificate chain includes a certificate with the specified AKI:

{
  "type": "aki",
  "values": ["base64url-encoded-ski-value"]
}

You can specify multiple AKI values to trust several issuers:

{
  "type": "aki",
  "values": ["issuer-ski-1", "issuer-ski-2", "issuer-ski-3"]
}

ETSI Trust List

Reference an EU trust service list:

{
  "type": "etsi_tl",
  "values": ["https://tl.example.eu/trustedlist.xml"]
}

Multiple authority entries

You can combine different authority types. The wallet should satisfy at least one:

{
  "trusted_authorities": [
    { "type": "aki", "values": ["key-1"] },
    { "type": "etsi_tl", "values": ["https://tl.example.eu"] }
  ]
}

SD-JWT credentials

Trusted authorities work the same way for SD-JWT credentials:

{
  "credentials": [{
    "id": "pid_sdjwt",
    "format": "dc+sd-jwt",
    "meta": { "vct_values": ["eu.europa.ec.eudi.pid.1"] },
    "claims": [
      { "path": ["family_name"] }
    ],
    "trusted_authorities": [
      { "type": "aki", "values": ["issuer-key-id"] }
    ]
  }]
}

Skipping trusted authorities

To accept credentials from any issuer without authority checking, pass skip_trusted_authorities: true in the request:

{
  "namespace": "eu.europa.ec.eudi.pid.1",
  "attributes": ["family_name", "given_name"],
  "skip_trusted_authorities": true
}

This disables both the automatic AKI injection into the DCQL query and the issuer validation on the response. Useful for development, testing, or when accepting credentials from unknown issuers.

When to use

• Production deployments: Configure trusted issuers in the dashboard; AKI values are injected automatically
• Testing/development: Use skip_trusted_authorities: true or remove all trusted issuers to accept credentials from any issuer
• Manual override: Provide explicit trusted_authorities in your DCQL query to bypass automatic injection
• EUDI compliance: Required for EU Digital Identity Wallet ecosystem interoperability