---
title: "POST /openid4vc/issuers/sessions/create-offer"
method: POST
path: "/openid4vc/issuers/sessions/create-offer"
tags: ["OpenID4VC Issuance Sessions"]
---

# POST /openid4vc/issuers/sessions/create-offer

`POST /openid4vc/issuers/sessions/create-offer`

Create an OpenID4VC issuance session by creating a credential offer

## Headers

- `x-tenant-id` string

## Request body

- OpenId4VcIssuanceSessionsCreateOfferOptions
  - `baseUri` string — baseUri for the credential offer uri. By default `openid-credential-offer://` will be used if no value is provided. If a value is provided, make sure it contains the scheme as well as `://`.
  - `preAuthorizedCodeFlowConfig` OpenId4VciPreAuthorizedCodeFlowConfig, required
    - `preAuthorizedCode` string
    - `userPinRequired` boolean
  - `issuanceMetadata` RecordStringUnknown — Construct a type with a set of properties K of type T
  - `publicIssuerId` string, required — The public issuer id, used for hosting OpenID4VCI metadata and endpoints
  - `credentials` OpenId4VcIssuanceSessionCreateOfferSdJwtCredentialOptions[], required
    - `credentialSupportedId` string, required — The id of the `credential_supported` entry that is present in the issuer metadata. This id is used to identify the credential that is being offered.
    - `format` 'vc+sd-jwt', required
    - `issuer` object, required — The issuer of the credential. Only DID based issuance is supported at the moment.
      - `didUrl` string, required
      - `method` 'did', required
    - `payload` object, required — The payload of the credential that will be issued. If `vct` claim is included, it MUST match the `vct` claim from the issuer metadata. If `vct` claim is not included, it will be added automatically.
      - `vct` string
    - `disclosureFrame` DisclosureFrame, required

## Response `200`

Ok

- OpenId4VcIssuanceSessionsCreateOfferResponse
  - `issuanceSession` OpenId4VcIssuanceSessionRecord, required
    - `id` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time
    - `type` string, required
    - `publicIssuerId` string, required — The public issuer id, used for hosting OpenID4VCI metadata and endpoints
    - `state` 'OfferCreated' | 'OfferUriRetrieved' | 'AccessTokenRequested' | 'AccessTokenCreated' | 'CredentialRequestReceived' | 'CredentialIssued' | 'Error', required
    - `cNonce` string — cNonce that should be used in the credential request by the holder.
    - `cNonceExpiresAt` string, date-time — The time at which the cNonce expires.
    - `preAuthorizedCode` string — Pre authorized code used for the issuance session. Only used when a pre-authorized credential offer is created.
    - `userPin` string — Optional user pin that needs to be provided by the user in the access token request.
    - `issuanceMetadata` RecordStringUnknown — Construct a type with a set of properties K of type T
    - `credentialOfferPayload` OpenId4VciCredentialOfferPayload, required
      - `credential_issuer` string, required — REQUIRED. The URL of the Credential Issuer, the Wallet is requested to obtain one or more Credentials from.
      - `credentials` union[], required — REQUIRED. A JSON array, where every entry is a JSON object or a JSON string. If the entry is an object, the object contains the data related to a certain credential type the Wallet MAY request. Each object MUST contain a format Claim determining the format of the credential to be requested and further parameters characterising the type of the credential to be requested as defined in Appendix E. If the entry is a string, the string value MUST be one of the id values in one of the objects in the credentials_supported Credential Issuer metadata parameter. When processing, the Wallet MUST resolve this string value to the respective object.
        - union
          - union
            - object
              - …
            - object
              - …
            - object
              - …
          - string
      - `grants` Grant
        - `authorization_code` GrantAuthorizationCode
          - `issuer_state` string — OPTIONAL. String value created by the Credential Issuer and opaque to the Wallet that is used to bind the subsequent Authorization Request with the Credential Issuer to a context set up during previous steps.
          - `authorization_server` string — OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
        - `urn:ietf:params:oauth:grant-type:pre-authorized_code` GrantUrnIetf
          - `pre-authorized_code` string, required — REQUIRED. The code representing the Credential Issuer's authorization for the Wallet to obtain Credentials of a certain type.
          - `user_pin_required` boolean, required — OPTIONAL. Boolean value specifying whether the Credential Issuer expects presentation of a user PIN along with the Token Request in a Pre-Authorized Code Flow. Default is false.
          - `interval` number, double — OPTIONAL. The minimum amount of time in seconds that the Wallet SHOULD wait between polling requests to the token endpoint (in case the Authorization Server responds with error code authorization_pending - see Section 6.3). If no value is provided, Wallets MUST use 5 as the default.
          - `authorization_server` string — OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
      - `client_id` string — Some implementations might include a client_id in the offer. For instance EBSI in a same-device flow. (Cross-device tucks it in the state JWT)
    - `credentialOfferUri` string, required — URI of the credential offer. This is the url that cn can be used to retrieve the credential offer
    - `errorMessage` string — Optional error message of the error that occurred during the issuance session. Will be set when state is {@link OpenId4VcIssuanceSessionState.Error}
  - `credentialOffer` string, required

---

[API](https://skmtc.net/openwallet-foundation/apis/credo-rest-api.md) · [All operations](https://skmtc.net/openwallet-foundation/apis/credo-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openwallet-foundation/credo-rest-api/versions/33596742b733/schema)