Skip to main content

Ecosystem Enforcement Reference for Issuers

This page provides a reference of all checks and validations performed when issuing with an ecosystem enforced. For instructions on enforcing an ecosystem during issuance, see Enforcing an Ecosystem as an Issuer.

EUDI​

Before issuance​

When you create a credential with EUDI ecosystem enforced, the system performs the following checks:

  • Issuing identifier (issuer) must be a certificate
  • Issuing protocol must be OpenID4VCI 1.0
  • Schema must use SD-JWT VC and/or ISO mdoc as the credential format
  • If the issuing identifier contains a Registration Certificate (found in trustInformation of identifier), the credential schema being used must be listed as a provided attestation in this certificate

If any of these checks fail, the call to create a credential returns an error.

During issuance​

For all schemas requiring a Wallet Unit Attestation, the system performs the following checks:

  • The receiving wallet must provide attestations signed by a Wallet Provider
    • If requiresWalletInstanceAttestation is true, the wallet must have a valid instance attestation
    • If keyStorageSecurity is required, the wallet must have a valid key attestation that corresponds to the level prescribed
  • Wallet Provider's signing certificate must be found on the Wallet Provider's trust list

If any of these fail, the credential is changed to ERROR state and nothing is issued.

For any schemas not requiring either a key attestation or an instance attestation, no additional checks are made during issuance.

After issuance​

PID issuers are responsible for revoking credentials for any wallet unit whose isntance attestation (WIA) has been revoked. Poll the following call on a schedule of your own choosing. Procivis One does not run this automatically:

POST /api/task/v1/run

{
"name": "ECOSYSTEM_LIFECYCLE_CHECK"
}

The system checks the attestations of all wallet units to which you have issued a PID (as determined by the schema IDs set in pidSchemaIds of your ecosystems configuration). For any wallet unit that has been revoked, the system automatically revokes the PID.

Trust verdicts​

trustInformation is currently always empty on issued credentials. Wallet provider trust is checked during issuance (see above), but the result and the name of the Wallet Provider is not exposed via the API.