Package-level declarations
Types
Intermediate DTO to hold the response to be sent from an OpenId4VpHolder to an OpenId4VpVerifier or DcApiVerifier.
Possible outcomes of creating an OpenID Authentication Response, to be sent back to the verifier.
An authorization response of the wallet, processed by OpenId4VpVerifier.validateAuthnResponse or DcApiVerifier.validateAuthnResponse: correlated with its request, which processing it has consumed, so that the request can't be answered again.
The validationReport of an authorization request, see at.asitplus.wallet.lib.validation.RequestObjectChecks, and the preparationState to answer it with, also if the request is rejected: either to answer the verifier with an error, or, where the policy of the wallet allows, after the user decided to proceed.
Intermediate result class to display information about the authentication process to the user, i.e., to let them make an informed decision.
Represents the OpenID client identifier scheme used to validate verifier identity. Use to select the client-id flavor (redirect URI, X.509, attestation) and derive IDs/URIs accordingly.
Sets x5chain to the certificate chain of clientIdScheme, e.g. for ISO mdoc reader authentication, falling back to the certificate of the key material for schemes without a chain.
Options for creating authorization requests (query, by value, or by reference). Use to control how the verifier delivers the request to the wallet.
This is a helper class to build a CredentialPresentationRequest from a collection of RequestOptionsCredential to be used in OpenId4VpRequestOptions.
Options for creating requests for the W3C Digital Credentials API in DcApiVerifier.createAuthnRequest, reflecting the exchange protocols available over that API, see at.asitplus.dcapi.request.ExchangeProtocolIdentifier.
Handles requests received through the W3C Digital Credentials API, similar to DcApiVerifier on the relying party side.
Opaque continuation state for a two-step DcApiHolder flow.
The validationReport of a request through the Digital Credentials API, and the preparationState to answer it with, also if the request is rejected, see DcApiHolder.startAuthorizationResponsePreparation.
Result of validating a DCAPI response, see DcApiVerifier.validateAuthnResponse
Implements a verifier for the Digital Credentials API, similar to OpenId4VpVerifier for OpenID4VP.
The wallet answered an ISO/IEC 18013-7 Annex C request with a device response carrying an error status instead of documents (ISO/IEC 18013-5, 10.3.6): 10 for a general error, 11 for a CBOR decoding error, 12 for a CBOR validation error. Annex C defines no other error, so this is the only one that reaches the verifier: declining or failing otherwise rejects the request in the browser. Like a presentation, it ends the request.
Handles ISO/IEC 18013-7 Annex C requests received through the W3C Digital Credentials API.
Result of validating an ISO/IEC 18013-7 Annex C response, see DcApiVerifier.validateAuthnResponse and DcApiCreationOptions.Iso180137AnnexC: the documents, or the error status of the wallet's device response.
Result of validating an ISO 18013-7 Annex C response, see DcApiVerifier.validateAuthnResponse and DcApiCreationOptions.Iso180137AnnexC
Low-level ISO/IEC 18013-7 Annex C device-response construction used by Iso180137AnnexCHolder.
Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).
Implements the wallet side of OpenID for Verifiable Presentations 1.0, without sending any HTTP request itself: every call returns an HttpExchange, whose requests the caller sends with any HTTP stack. The KDoc of each method lists the ProtocolRequests its exchange sends.
The verifier's answer to an authorization response posted with the response mode direct_post or direct_post.jwt, see OpenID4VP 1.0, 8.2.
Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).
A single source of trust in the relying party sending an authorization request, for one client identifier scheme, see OpenID4VP, Client Identifier Prefixes.
Parses authentication responses for OpenId4VpVerifier
The legacy result of a vp_token, projected from presentationValidations under the presentation policy of the verifier: an accepted presentation becomes its VerifyPresentationResult, a rejected one fails with the cause of its first rejecting check.
Functions
The answer of the response endpoint, after it has processed an authorization response or authorization error response posted with the response mode direct_post or direct_post.jwt: status 200 with a JSON object, holding redirectUri as redirect_uri if present (OpenID4VP 1.0 8.2), see OpenId4VpSuccess. The header Cache-Control: no-store keeps the redirect_uri out of caches, as it should carry a fresh secret against session fixation (OpenID4VP 1.0 14.2), as in the example of 8.2.
Loads the request object with CreatedRequest.loadRequestObject, passing the params the wallet may have sent (wallet_metadata and wallet_nonce for request_uri_method=post), and converts it to the response of the request URI: status 200 with the signed, optionally encrypted, request object as application/oauth-authz-req+jwt (OpenID4VP 1.0 5.10.1, RFC 9101 5.2.3).
The RelyingPartyValidator establishing the trust these sources established, to migrate from relyingPartyTrust: RelyingPartyTrust.Certificates become the anchors of the access certificate providers, also if there are none, so that configured trust stays required; RelyingPartyTrust.PreRegisteredClients and the verifier attester sources map to theirs. RelyingPartyTrust.Custom no longer takes effect, as it decides opaquely instead of returning the keys of the relying party, see ClientIdentifierTrust.
Validates reader authentication using the DC API session transcript bound to this request and calling origin.