Class DcApiPresentationRequestOptions

Namespace

Tessio.Verifier.OpenId4Vp

Assembly

Tessio.Verifier.OpenId4Vp.dll

Inputs to DcApiPresentationRequestBuilder: one OpenID4VP request sent through the Digital Credentials API rather than to a redirect wallet.

public sealed record DcApiPresentationRequestOptions : IEquatable<DcApiPresentationRequestOptions>

Inheritance

object

DcApiPresentationRequestOptions

Implements

IEquatable<DcApiPresentationRequestOptions>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Setting ClientId makes the request signed, because that is the rule the specification states: the client_id "MUST be omitted in unsigned requests" and "MUST be present in signed requests".

There is no response_uri and no state: the response comes back through the browser, and the transport defines no state. The wallet binds its answer to the page's origin and the nonce instead.

Properties

ClientId

The client identifier, including its prefix (for example x509_hash:... from X509Hash(X509Certificate2)). Set for a signed request, null for an unsigned one.

public string? ClientId { get; init; }

Property Value

string

ClientMetadataJson

The client_metadata object as a JSON string, from ClientMetadata. Required, because over this transport the wallet has no other source for vp_formats_supported.

public required string ClientMetadataJson { get; init; }

Property Value

string

DcqlQueryJson

The DCQL query as a JSON string.

public required string DcqlQueryJson { get; init; }

Property Value

string

EncryptedResponse

Whether the wallet encrypts its response (dc_api.jwt) or returns it in the clear (dc_api). Defaults to encrypted. An encrypted response needs exactly one encryption key in ClientMetadataJson.

public bool EncryptedResponse { get; init; }

Property Value

bool

ExpectedOrigins

The origins of the pages that may make this request, as a browser serializes them: lowercase scheme and host, no trailing slash, no path (https://verifier.example). At least one.

public required IReadOnlyList<string> ExpectedOrigins { get; init; }

Property Value

IReadOnlyList<string>

Remarks

A signed request sends them to the wallet as expected_origins. An unsigned one may not (Appendix A.2), so they are kept with the built request instead. Either way the verifier refuses a response that came through any other origin, which is what binds an unsigned request to the pages that may make it.

Nonce

Per-request nonce, cryptographically random and one-time.

public required string Nonce { get; init; }

Property Value

string

RequestLifetime

How long the request may be answered, which sets ExpiresAt and, for a signed request, its exp. The builder's default when unset.

public TimeSpan? RequestLifetime { get; init; }

Property Value

TimeSpan?

TransactionDataJson

Optional transaction_data as a JSON string.

public string? TransactionDataJson { get; init; }

Property Value

string