Presentation Configuration

Fields of a presentation configuration, as accepted by POST /api/verifier/config and in config/<tenant>/presentation/<id>.json. PATCH /api/verifier/config/{id} accepts the same fields, all optional. For the task-oriented guide see Configure Verification.

Fields

The table is generated at build time from the Zod schema the backend validates with. The schema is strict: unknown fields are rejected. dcql_query.credentials[] has one shape per format (mso_mdoc and dc+sd-jwt).

Field	Required	Type / allowed values	Description
id	yes	string	Presentation configuration identifier.
description	no	string or null	Optional presentation configuration description.
lifeTime	no	integer (minimum 1)	Presentation request lifetime in seconds.
skewSeconds	no	integer (minimum 0)	Clock skew tolerance in seconds.
statusCheckMode	no	string: strict | best_effort | disabled	Revocation/status check mode.
dcql_query	yes	object	DCQL query defining requested credentials and claims.
dcql_query.credentials	yes	array of one of 2 shapes	Credential queries requested by the verifier.
dcql_query.credentials[].id	yes	string	Credential query identifier.
dcql_query.credentials[].multiple	no	boolean	Allow multiple matching credentials.
dcql_query.credentials[].claim_sets	no	array of array of string	Optional claim set constraints.
dcql_query.credentials[].trusted_authorities	no	array of one of 2 shapes	Optional trusted authority constraints.
dcql_query.credentials[].trusted_authorities[].type	yes	string: etsi_tl	Only when type is etsi_tl. Trusted authority type discriminator for ETSI trust lists.
dcql_query.credentials[].trusted_authorities[].values	yes	array of object	Only when type is etsi_tl. Trust list references for ETSI TL verification.
dcql_query.credentials[].trusted_authorities[].values[].trustListId	no	string	Only when type is etsi_tl. Optional trust list id reference.
dcql_query.credentials[].trusted_authorities[].values[].url	no	string	Only when type is etsi_tl. Optional trust list URL reference.
dcql_query.credentials[].trusted_authorities[].values[].verifierKey	no	object	Only when type is etsi_tl. Optional verifier key material.
dcql_query.credentials[].trusted_authorities[].values[].verifierX509Der	no	string	Only when type is etsi_tl. Optional verifier certificate in DER/base64 form.
dcql_query.credentials[].trusted_authorities[].type	yes	string: openid_federation	Only when type is openid_federation. Trusted authority type discriminator for OpenID Federation.
dcql_query.credentials[].trusted_authorities[].values	yes	array of string	Only when type is openid_federation. OpenID Federation authority identifiers.
dcql_query.credentials[].format	yes	string: mso_mdoc	Only when format is mso_mdoc. Credential format discriminator.
dcql_query.credentials[].meta	yes	object	Only when format is mso_mdoc.
dcql_query.credentials[].meta.doctype_value	yes	string	Only when format is mso_mdoc. Expected mDoc doctype value.
dcql_query.credentials[].claims	no	array of object	Only when format is mso_mdoc. Optional mDoc claim-level constraints.
dcql_query.credentials[].claims[].id	no	string	Only when format is mso_mdoc. Optional claim query id.
dcql_query.credentials[].claims[].path	yes	array of string | number	Only when format is mso_mdoc. Path to the claim value in presented credentials.
dcql_query.credentials[].claims[].values	no	array of one of 3 shapes	Only when format is mso_mdoc. Optional allowed values for the claim. A disclosed value must equal one of them in type and value.
dcql_query.credentials[].claims[].intent_to_retain	no	boolean	Only when format is mso_mdoc. Whether relying party intends to retain the claim.
dcql_query.credentials[].format	yes	string: dc+sd-jwt	Only when format is dc+sd-jwt. Credential format discriminator.
dcql_query.credentials[].meta	yes	object	Only when format is dc+sd-jwt.
dcql_query.credentials[].meta.vct_values	yes	array of string	Only when format is dc+sd-jwt. Accepted VCT values.
dcql_query.credentials[].claims	no	array of object	Only when format is dc+sd-jwt. Optional claim-level constraints.
dcql_query.credentials[].claims[].id	no	string	Only when format is dc+sd-jwt. Optional claim query id.
dcql_query.credentials[].claims[].path	yes	array of string | number	Only when format is dc+sd-jwt. Path to the claim value in presented credentials.
dcql_query.credentials[].claims[].values	no	array of one of 3 shapes	Only when format is dc+sd-jwt. Optional allowed values for the claim. A disclosed value must equal one of them in type and value.
dcql_query.credential_sets	no	array of object	Optional higher-level credential set requirements.
dcql_query.credential_sets[].options	yes	array of array of string	Alternative credential query id combinations.
dcql_query.credential_sets[].required	no	boolean	Whether this credential set is mandatory.
transaction_data	no	array of object or null	Optional transaction data descriptors.
transaction_data[].type	yes	string	Transaction data type identifier.
transaction_data[].credential_ids	yes	array of string	Credential query ids this transaction data applies to.
transaction_data[].payload	no	any	Transaction details. Required for TS12 SCA transaction data.
registration_cert	no	object or null	Optional registration certificate request settings.
registration_cert.id	no	string
registration_cert.body	no	object
registration_cert.body.privacy_policy	no	string
registration_cert.body.support_uri	no	string
registration_cert.body.intermediary	no	string
registration_cert.body.purpose	no	array of object
registration_cert.body.purpose[].lang	yes	string
registration_cert.body.purpose[].content	yes	string
registration_cert.body.credentials	no	array of object
registration_cert.body.provides_attestations	no	array of string
registration_cert.jwt	no	string
registrationCertImportJwt	no	string or null	Optional imported registration certificate JWT.
registrationCertImportId	no	string or null	Optional registrar-side registration certificate id.
registrationCertBodyPrivacyPolicy	no	string or null	Optional registration certificate privacy policy URI.
registrationCertBodySupportUri	no	string or null	Optional registration certificate support URI.
registrationCertBodyIntermediary	no	string or null	Optional registration certificate intermediary.
registrationCertBodyPurpose	no	array of object or null	Optional registration certificate purpose entries.
registrationCertBodyPurpose[].lang	no	string
registrationCertBodyPurpose[].content	no	string
webhookEndpointId	no	string or null	Optional webhook endpoint id for presentation callbacks.
attached	no	array of object or null	Optional attachments included with presentation requests.
attached[].format	yes	string	Attachment format identifier.
attached[].data	yes	any	Attachment payload.
attached[].credential_ids	no	array of string	Optional credential query ids bound to this attachment.
redirectUri	no	string or null	Optional redirect URI after presentation completion.
accessKeyChainId	no	string or null	Access key chain that signs the request, determines the client_id and signs readerAuth; without it, an access key chain of the tenant is used.
readerAuth	no	boolean or null	Whether reader authentication is required for mDoc requests.

Defaults and behavior

Field	Default and behavior
id	Used as requestId in presentation requests.
description	Internal only; not shown to the wallet user.
lifeTime	300. Seconds until a request created from this configuration expires (expiresAt of the session).
skewSeconds	60. Clock skew tolerance for credential time checks; a request can override it.
statusCheckMode	strict: status lists are checked and verification fails if a status list cannot be fetched or validated, or if an SD-JWT VC's status claim has no status_list. Credentials without status information are accepted. best_effort: verification continues without the status result when the status list is unavailable. disabled: no status check. Applies to SD-JWT VC and mDOC, including ISO 18013-7.
dcql_query	See DCQL. <TENANT_URL> anywhere in the query is replaced with <PUBLIC_URL>/issuers/<tenant>.
transaction_data	Sent with every request unless the request sets its own transaction_data. Ignored for ISO 18013-7. See Transaction Data.
registration_cert	Strategies jwt, id, body. Only attached when the tenant has a registrar configuration. See Registration Certificates.
registrationCert*	Flat form fields used by the Web Client. They are converted into registration_cert (only when registration_cert is not sent) and are not stored.
webhookEndpointId	ID of a webhook endpoint that receives results. A request can override it with an inline webhook.
attached	Stored with the configuration; currently not sent to the wallet.
redirectUri	Same-device redirect target. {sessionId} is replaced with the session ID. A request can override it, except for ISO 18013-7. See Receive Results.
accessKeyChainId	Access key chain that signs the request, determines the client_id and signs readerAuth. Without it, EUDIPLO uses an access key chain of the tenant; set it when the tenant has several.
readerAuth	false. ISO 18013-7 only: sign the DeviceRequest with the access key chain. Requires the db KMS provider for that key.

Validation rules

Rules that the table cannot show:

• dcql_query.credentials needs at least one entry; credential query IDs contain only letters, digits, _ and -, and are unique.
• meta is required: vct_values (at least one) for dc+sd-jwt, doctype_value for mso_mdoc.
• Every ID in claim_sets must reference the id of a claim in the same credential query; claim IDs are unique.
• transaction_data entries whose type starts with urn:eudi:sca: must be a supported TS12 type with a valid payload.

Server-managed fields

Responses also contain createdAt, updatedAt and registrationCertCache (the registration certificate EUDIPLO resolved, with fingerprints and expiry). They are read-only and not part of the schema, so the API rejects them in a request body. EUDIPLO clears the cache when registration_cert or dcql_query changes and refreshes it in the background. To force a new certificate, call POST /api/verifier/config/{id}/registration-cert/reissue.