Table of Contents

Class Dcql

Namespace
Tessio.Verifier.OpenId4Vp
Assembly
Tessio.Verifier.OpenId4Vp.dll

Builders for OpenID4VP DCQL (Digital Credentials Query Language) queries, producing the JSON string expected by DcqlQueryJson.

public static class Dcql
Inheritance
Dcql
Inherited Members

Remarks

Two levels of builder, and the difference is how a claim is ADDRESSED, not how many credential types a query accepts. The params string[] overloads name claims, which assumes every claim sits at the top level of its credential. The DcqlClaim overloads address claims by PATH and accept claim sets, which is what a nested claim or a preference order over alternatives needs. Both levels can name several credential types in one query.

This used to tell callers to hand-write the JSON for a nested path or a claim set. A builder that covers only the easy shape does not prevent the hard one, it only decides where the hard one gets written: in a caller, where the path the query asks for sits apart from the code that reads the answer back, and nothing compares the two. Still hand-written, because nothing asks for them yet: claim value constraints, and more than one credential in a single query.

Fields

DefaultCredentialId

The credential id this builder puts on a single-credential query.

public const string DefaultCredentialId = "credential"

Field Value

string

Remarks

Nothing on the verify side REQUIRES this value. WalletResponseParser.ExtractCredentials enumerates every property of the vp_token object whatever its key, per OpenID4VP 1.0 section 8.1, so a query using other ids parses fine. Said the other way because the previous wording said the pipeline "expects" it, which reads as a constraint that is not there.

Methods

AgeOver(int, string)

Convenience for the common age check: a single SD-JWT VC credential of type vct requesting the boolean age_over_{age} claim.

public static string AgeOver(int age, string vct)

Parameters

age int
vct string

Returns

string

Mdoc(string, string, params string[])

A query for a single mdoc credential of document type docType, requesting each of elements from nameSpace (mdoc DCQL paths are [namespace, element]).

public static string Mdoc(string docType, string nameSpace, params string[] elements)

Parameters

docType string
nameSpace string
elements string[]

Returns

string

MdocByPath(string, IReadOnlyList<DcqlClaim>, params string[][])

A query for a single mdoc credential of document type docType, requesting claims by path, optionally preferring one combination of them over another.

public static string MdocByPath(string docType, IReadOnlyList<DcqlClaim> claims, params string[][] claimSets)

Parameters

docType string

The mdoc document type, which becomes meta.doctype_value.

claims IReadOnlyList<DcqlClaim>

Every claim the query may ask for. Each path is the full [namespace, element] of §7.2, because a caller spanning two namespaces cannot say so through a single namespace parameter. Mdoc(string, string, params string[]) keeps that parameter and builds these paths for you, since a caller naming elements in one namespace cannot have that problem.

claimSets string[][]

Each entry is a list of Id values, and ORDER IS THE PREFERENCE. Pass none to request every claim.

Returns

string

SdJwtVc(IReadOnlyList<string>, params string[])

A query for a single SD-JWT VC credential of ANY of vctValues, requesting each of claims by selective disclosure. Use this where one credential entry should accept several types, for example a base PID type and a member state's own.

public static string SdJwtVc(IReadOnlyList<string> vctValues, params string[] claims)

Parameters

vctValues IReadOnlyList<string>
claims string[]

Returns

string

Remarks

SPEC: OpenID4VP 1.0 §B.3.5 defines vct_values as "A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential", so an empty list is refused here rather than emitted. The verifier accepts a credential whose vct is any member of the array it sent.

SdJwtVc(string, params string[])

A query for a single SD-JWT VC credential of type vct, requesting each of claims by selective disclosure. Each entry is a top-level claim name.

public static string SdJwtVc(string vct, params string[] claims)

Parameters

vct string
claims string[]

Returns

string

SdJwtVcByPath(IReadOnlyList<string>, IReadOnlyList<DcqlClaim>, params string[][])

A query for a single SD-JWT VC credential of ANY of vctValues, requesting claims by path, optionally preferring one combination of them over another.

public static string SdJwtVcByPath(IReadOnlyList<string> vctValues, IReadOnlyList<DcqlClaim> claims, params string[][] claimSets)

Parameters

vctValues IReadOnlyList<string>

Credential types to accept. At least one, any of which matches.

claims IReadOnlyList<DcqlClaim>

Every claim the query may ask for, each addressed by path.

claimSets string[][]

Each entry is a list of Id values, and ORDER IS THE PREFERENCE. Pass none to request every claim.

Returns

string

Remarks

SPEC: OpenID4VP 1.0 section 6.4.1. With both claims and claim_sets present the verifier requests ONE combination, the wallet SHOULD return the first option it can satisfy, and if it can satisfy none it MUST NOT return any claims. That is what expresses "this claim, or failing that this one", which no list of claims alone can say.