---
title: "Request VCS IDP OIDC Configuration."
method: GET
path: "/issuer/{profileID}/{profileVersion}/.well-known/openid-credential-issuer"
tags: ["issuer"]
---

# Request VCS IDP OIDC Configuration.

`GET /issuer/{profileID}/{profileVersion}/.well-known/openid-credential-issuer`

Returns openid-config.

## Response `200`

OK

- WellKnownOpenIDIssuerConfiguration — WellKnownOpenIDIssuerConfiguration represents the OIDC Configuration response for cases when VCS serves as IDP.
  - `credential_issuer` string — The Credential Issuer's identifier.
  - `authorization_endpoint` string — URL of the OP's OAuth 2.0 Authorization Endpoint.
  - `credential_endpoint` string — URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
  - `batch_credential_endpoint` string — URL of the Credential Issuer's Batch Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components. If omitted, the Credential Issuer does not support the Batch Credential Endpoint.
  - `deferred_credential_endpoint` string — URL of the Credential Issuer's Deferred Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path, and query parameter components. If omitted, the Credential Issuer does not support the Deferred Credential Endpoint.
  - `notification_endpoint` string — URL of the Credential Issuer's Notification Endpoint. This URL MUST use the https scheme and MAY contain port, path, and query parameter components. If omitted, the Credential Issuer does not support the Notification Endpoint.
  - `credential_response_encryption` CredentialResponseEncryptionSupported — Object containing information about whether the Credential Issuer supports encryption of the Credential and Batch Credential Response on top of TLS
    - `alg_values_supported` string[], required — Array containing a list of the JWE [RFC7516] encryption algorithms (alg values) [RFC7518] supported by the Credential and Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
    - `enc_values_supported` string[], required — Array containing a list of the JWE [RFC7516] encryption algorithms (enc values) [RFC7518] supported by the Credential and Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
    - `encryption_required` boolean, required — Boolean value specifying whether the Credential Issuer requires the additional encryption on top of TLS for the Credential Response. If the value is true, the Credential Issuer requires encryption for every Credential Response and therefore the Wallet MUST provide encryption keys in the Credential Request. If the value is false, the Wallet MAY chose whether it provides encryption keys or not.
  - `credential_identifiers_supported` boolean — Boolean value specifying whether the Credential Issuer supports returning credential_identifiers parameter in the authorization_details Token Response parameter, with true indicating support. If omitted, the default value is false.
  - `signed_metadata` string — String that is a signed JWT. This JWT contains Credential Issuer metadata parameters as claims.
  - `display` CredentialDisplay[] — An array of objects, where each object contains display properties of a Credential Issuer for a certain language.
    - `name` string
    - `locale` string
    - `url` string
    - `background_color` string
    - `text_color` string
    - `logo` Logo
      - `uri` string, required — String value that contains a URI where the Wallet can obtain the logo of the Credential Issuer.
      - `alt_text` string
  - `credential_configurations_supported` object — An object that describes specifics of the Credential that the Credential Issuer supports issuance of. This object contains a list of name/value pairs, where each name is a unique identifier of the supported credential being described.
  - `registration_endpoint` string — URL of the OP's Dynamic Client Registration Endpoint.
  - `token_endpoint` string — URL of the OP's OAuth 2.0 Token Endpoint.
  - `token_endpoint_auth_methods_supported` string[] — JSON array containing a list of client authentication methods supported by this token endpoint. Default is "none".
  - `response_types_supported` string[] — JSON array containing a list of the OAuth 2.0 response_type values that this OP supports.
  - `scopes_supported` string[] — JSON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports.
  - `grant_types_supported` string[] — JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports.
  - `pre-authorized_grant_anonymous_access_supported` boolean — JSON Boolean indicating whether the issuer accepts a Token Request with a Pre-Authorized Code but without a client id. The default is false.

## Other responses

- `400` — Bad request

---

[API](https://skmtc.net/trustbloc/apis/verifiable-credential-service-vcs.md) · [All operations](https://skmtc.net/trustbloc/apis/verifiable-credential-service-vcs/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trustbloc/verifiable-credential-service-vcs/revisions/9e21ad997121/schema)