Registration Certificates

The Registration Certificate signer issues Wallet-Relying Party Registration Certificates (WRPRC) as defined in ETSI TS 119 475. A registration certificate is a signed JWT that records what a relying party is registered for: its entitlements, the service it offers, and, for service providers, the credentials it may request and why.

tip

If you run the Wallet-Relying Party Registry service, use it to issue Registration Certificates. It is the managed and preferred interface, and it calls this signer for you.

Before you begin

A certificate identifier to sign with. Its certificate chain is included in every Registration Certificate it signs. See Certificates.
The REGISTRATION_CERTIFICATE_SIGN permission, when Core runs in STS authentication mode.

Registration Certificates are valid for at most 12 months. Your deployment may set a shorter maximum; see Validity.

Request

POST /api/signature/v1

A service provider that requests age verification from wallets:

{
  "issuer": "<certificate identifier ID>",
  "signer": "REGISTRATION_CERTIFICATE",
  "data": {
    "name": "Example Shop",
    "sub": {
      "id": "VATCH-CHE123456789",
      "legal_name": "Example Shop AG"
    },
    "country": "CH",
    "registry_uri": "https://registry.example.ch",
    "service": [
      { "lang": "en", "value": "Online shop for age-restricted goods" },
      { "lang": "de", "value": "Onlineshop für altersbeschränkte Waren" }
    ],
    "entitlements": [
      "https://uri.etsi.org/19475/Entitlement/Service_Provider"
    ],
    "credentials": [
      {
        "format": "dc+sd-jwt",
        "meta": { "vct_values": ["urn:eudi:pid:1"] },
        "claim": [{ "path": ["age_equal_or_over", "18"] }]
      }
    ],
    "purpose": [
      { "lang": "en", "value": "To verify that you are over 18" },
      { "lang": "de", "value": "Um zu prüfen, dass Sie über 18 sind" }
    ],
    "intended_use_id": "age-check",
    "privacy_policy": [
      {
        "type": "http://data.europa.eu/eudi/policy/privacy-policy",
        "policyURI": "https://shop.example.com/privacy"
      }
    ],
    "info_uri": "https://shop.example.com",
    "support_uri": "https://shop.example.com/support",
    "dpa": {
      "email": "info@dpa.example.ch",
      "phone": "+41 00 000 00 00",
      "uri": "https://dpa.example.ch"
    },
    "policy_id": ["0.4.0.19475.3.1"],
    "certificate_policy": "https://registry.example.ch/certificate-policy"
  }
}

caution

Unlike the other signers, Registration Certificate data uses snake_case field names, matching the claim names of ETSI TS 119 475. Several request fields have different names from the claims they produce; see From request to certificate.

`data` fields

Field	Type	Description
`name`	`string`	Required. The relying party's name, as shown to wallet users.
`sub`	`object`	Required. The relying party the certificate is issued to. See Subject.
`country`	`string`	Required. Country code of the relying party.
`registry_uri`	`string`	Required. URI of the registry where the relying party is registered.
`service`	`object[]`	Required. Description of the relying party's service, as language-tagged strings. See Language-tagged strings.
`entitlements`	`string[]`	Required. At least one entitlement. See Entitlements.
`credentials`	`object[]`	Service providers: required. The credentials and claims the relying party may request. See Credentials.
`purpose`	`object[]`	Service providers: required. Why the relying party requests the credentials, as language-tagged strings.
`intended_use_id`	`string`	Service providers: required. Identifier of the registered intended use.
`provided_attestations`	`object[]`	Optional. Attestations the relying party issues, for attestation providers. Same structure as `credentials`.
`privacy_policy`	`object[]`	Required. Must include a policy of type `http://data.europa.eu/eudi/policy/privacy-policy`. See Privacy policy.
`info_uri`	`string`	Required. URI with information about the relying party.
`support_uri`	`string`	Required. URI where wallet users can get support.
`dpa`	`object`	Required. Contact details of the data protection authority supervising the relying party: `email`, `phone`, and `uri`, all required.
`policy_id`	`string[]`	Required. Identifiers of the policies the certificate is issued under.
`certificate_policy`	`string`	Required. URI of the registrar's certificate policy.
`public_body`	`boolean`	Optional. Whether the relying party is a public sector body.
`act`	`object`	Optional. An intermediary acting on behalf of the relying party: `sub` (its identifier, required) and `name` (optional).

Unknown fields are rejected.

For the other request fields, see Creating a signature.

Subject

sub takes one of two shapes. Including fields from both is rejected.

Relying party	Fields
Legal person	`id`, `legal_name`
Natural person	`id`, `given_name`, `family_name`

id is the relying party's identifier, such as its registration number.

Entitlements

Each entitlement is given either as a URI or as its OID label. The certificate keeps the form you send.

Role	URI (`https://uri.etsi.org/19475/Entitlement/…`)	OID label
Service provider	`Service_Provider`	`id-etsi-wrpa-entitlement 1`
QEAA provider	`QEAA_Provider`	`id-etsi-wrpa-entitlement 2`
Non-qualified EAA provider	`Non_Q_EAA_Provider`	`id-etsi-wrpa-entitlement 3`
Public sector EAA provider	`PUB_EAA_Provider`	`id-etsi-wrpa-entitlement 4`
PID provider	`PID_Provider`	`id-etsi-wrpa-entitlement 5`
Qualified certificate for e-seal provider	`QCert_for_ESeal_Provider`	`id-etsi-wrpa-entitlement 6`
Qualified certificate for e-signature provider	`QCert_for_ESig_Provider`	`id-etsi-wrpa-entitlement 7`
Remote QSCD provider for e-seals	`rQSealCDs_Provider`	`id-etsi-wrpa-entitlement 8`
Remote QSCD provider for e-signatures	`rQSigCDs_Provider`	`id-etsi-wrpa-entitlement 9`
E-signature and e-seal creation provider	`ESig_ESeal_Creation_Provider`	`id-etsi-wrpa-entitlement 10`

If any entitlement is the service provider role, credentials, purpose, and intended_use_id are required.

Credentials

Entries in credentials and provided_attestations describe a credential by format, in the style of a DCQL credential query:

Field	Description
`format`	Required. The credential format, such as `dc+sd-jwt` or `mso_mdoc`.
`meta`	Required. Format-specific type information, such as `vct_values` for SD-JWT VC or `doctype_value` for mdoc.
`claim`	Optional. The claims, each with a `path` and optional `values`.

The field is claim, singular, as in ETSI TS 119 475. DCQL queries use claims, so change the name when you copy entries from a DCQL query.

{
  "format": "mso_mdoc",
  "meta": { "doctype_value": "eu.europa.ec.eudi.pid.1" },
  "claim": [{ "path": ["eu.europa.ec.eudi.pid.1", "age_over_18"] }]
}

Language-tagged strings

service and purpose are lists of language-tagged strings. Provide one entry per language:

{ "lang": "en", "value": "Online shop for age-restricted goods" }

lang is a BCP 47 language tag.

Privacy policy

privacy_policy is a list of typed policies:

{
  "type": "http://data.europa.eu/eudi/policy/privacy-policy",
  "policyURI": "https://shop.example.com/privacy"
}

The list must include a policy of the privacy policy type. Only that policy's URI is included in the certificate; other entries are ignored.

From request to certificate

The signed certificate is a JWT with the header type rc-wrp+jwt. Its x5c header contains the issuer's certificate chain.

Most data fields become claims of the same name. These do not:

Request field	Certificate claim
`sub.id`	`sub`
`sub.legal_name`	`sub_ln`
`sub.given_name`	`sub_gn`
`sub.family_name`	`sub_fn`
`service`	`srv_description`
`privacy_policy`	`privacy_policy`, as the URI of the privacy policy
`dpa`	`supervisory_authority`
`act`	`intermediary`
`provided_attestations`	`provides_attestations`

Core also adds:

iat, nbf, and exp, from the issuance time and the requested validity.
jti, the signature ID.
status, the certificate's entry on the signer's token status list.

Response

{
  "id": "4f1c2b7e-...",
  "result": "eyJ0eXAiOiJyYy13cnArand0IiwiYWxnIjoiRVMyNTYiLCJ4NWMiOlsi..."
}

result is the signed Registration Certificate. Return it to the relying party.

Store id to revoke the certificate or check its status later. It is also the certificate's jti. See Revocation and status.

Before you begin​

Request​

data fields​

Subject​

Entitlements​

Credentials​

Language-tagged strings​

Privacy policy​

From request to certificate​

Response​