Skip to main content

Ecosystem Enforcement Reference for Issuers

This page provides a reference of all checks and validations performed when issuing with an ecosystem enforced. For instructions on enforcing an ecosystem during issuance, see Enforcing an Ecosystem as an Issuer.

EUDI​

Before issuance​

When you create a credential with EUDI ecosystem enforced, the system performs the following checks:

  • Issuing identifier (issuer) must be a certificate
  • Issuing protocol must be OpenID4VCI 1.0
  • Schema must use SD-JWT VC and/or ISO mdoc as the credential format
  • If the issuing identifier contains a Registration Certificate (found in trustInformation of identifier), the credential schema being used must be listed as a provided attestation in this certificate

If any of these checks fail, the call to create a credential returns an error.

During issuance​

For all schemas requiring a Wallet Unit Attestation, the system performs the following checks:

  • The receiving wallet must provide attestations signed by a Wallet Provider
    • If requiresWalletInstanceAttestation is true, the wallet must have a valid instance attestation
    • If keyStorageSecurity is required, the wallet must have a valid key attestation that corresponds to the level prescribed
  • Wallet Provider's signing certificate must be found on the Wallet Provider trust list (subscribed with role WALLET_PROVIDER)

If any of these fail, the credential is changed to ERROR state and nothing is issued.

For any schemas not requiring either a key attestation or an instance attestation, no additional checks are made during issuance.

note

If you issue schemas requiring a Wallet Unit Attestation, the Wallet Provider check only works if your organization subscribes to the Wallet Provider trust list. See Prerequisites.

After issuance​

PID issuers are responsible for revoking credentials for any wallet unit whose instance attestation (WIA) has been revoked. Poll the following call on a schedule of your own choosing. Procivis One does not run this automatically:

POST /api/task/v1/run

{
"name": "ECOSYSTEM_LIFECYCLE_CHECK"
}

The system checks the attestations of all wallet units to which you have issued a credential marked with monitorCredentialLifetime. For any wallet unit that has been revoked, the system automatically revokes the credential. See Automatic revocation.