Sign in

v18

latestOpenAPI 3.1.0raw.githubusercontent.com2026-07-20112546.2 KB
Verfifier OID4VP API

Get Request Object

Can return a RequestObjectDto as JSON Object or a SignedJWT String depending on JAR (JWT secured authorization request) flag in verifier management

get/oid4vp/api/request-object/{request_id}

Path parameters

request_idstring uuid required

Response

Request object either as plaintext or signed JWT.

The 'application/oauth-authz-req+jwt' representation is a compact serialized JWS (optionally nested JWE) representing the Request Object claims. As this is a JWT and not a JSON object, its structural requirements cannot be expressed as a JSON Schema and are documented here instead:

  • The JOSE header MUST require the 'profile_version' parameter to indicate the Swiss Profile version.
  • The JWT Claims Set corresponds to the RequestObject schema documented for the 'application/json' representation below, with 'request' and 'request_uri' claims strictly prohibited.

The 'application/json' representation is kept for documentation purposes only, mirroring the JWT Claims Set of the 'application/oauth-authz-req+jwt' representation; it is not actually returned when JAR (JWT-secured Authorization Request) is enabled.

client_idstring
response_typestring
response_mode'direct_post' | 'direct_post.jwt'

Supported response_mode as defined in OID4VP

response_uristring
noncestring
versionstring
scopestring

OAuth2 scope value identifying the DCQL query registered in the vqPS. MUST be present when a vqPS is injected into verifier_info. Mutually exclusive with dcql_query.

statestring

An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client.

audstring

Audience ("aud") JWT claim identifying the intended recipient of this Request Object. As the verifier cannot identify the wallet the Static Discovery metadata is used. MUST be "https://self-issued.me/v2"

profile_versionstring required

JWT header parameter indicating the Swiss Profile version used to produce this Request Object.

encrypted_response_enc_values_supportedstring[] required

JWE 'enc' algorithms accepted by the Verifier for an encrypted Authorization Response.

Example response

{
  "dcql_query": {
    "credentials": [
      {
        "id": "identity_credential_dcql",
        "format": "dc+sd-jwt",
        "meta": {
          "vct_values": [
            "https://credentials.example.com/identity_credential"
          ]
        },
        "claims": [
          {
            "path": [
              "given_name"
            ]
          },
          {
            "path": [
              "family_name"
            ]
          },
          {
            "path": [
              "address",
              "street_address"
            ]
          }
        ],
        "require_cryptographic_holder_binding": true
      },
      {
        "id": "university_degree_dcql",
        "format": "dc+sd-jwt",
        "meta": {
          "vct_values": [
            "https://credentials.example.com/university_degree"
          ]
        },
        "claims": [
          {
            "path": [
              "degree_name"
            ]
          },
          {
            "path": [
              "graduation_year"
            ]
          }
        ]
      }
    ],
    "credential_sets": [
      {
        "options": [
          [
            "identity_credential_dcql"
          ],
          [
            "university_degree_dcql"
          ]
        ],
        "required": true
      }
    ]
  }
}