w3c-ccg / vc-api

A specification for an HTTP API used to issue and verify Verifiable Credentials.
https://w3c-ccg.github.io/vc-api
Other
124 stars 47 forks source link

Add examples showing an exchange client sending different VPRs with only `acceptedCryptosuites` or `acceptedEnvelopes` #399

Open dlongley opened 4 months ago

dlongley commented 4 months ago

In the examples, each with VPR should accept any VC that will have one or more matching cryptosuites, per "acceptedCryptosuites", or one matching envelope per "acceptedEnvelopes".

The example should show that a client (e.g., wallet) can start an exchange (if the server supports it) by sending a VPR indicating what they will accept instead of an empty object ({}):

// in this example, the client will accept a number of options from the issuer
{
  "verifiablePresentationRequest": {
    "query": {
      "type": "QueryByExample",
      // allows any VC(s) from the issuer, so no specific "credentialQuery" property;
      // "credentialQuery" ... not present
      "acceptedCryptosuites": [
        "Ed25519Signature2020",
        "eddsa-rdfc-2022",
        "ecdsa-rdfc-2019",
        "bbs-2023",
        "ecdsa-sd-2023"
      ],
      "acceptedEnvelopes": [
        "application/jwt"
      ]
    }
  }
}
// in this example, the client will accept only an enveloped VC using VC-JWT
{
  "verifiablePresentationRequest": {
    "query": {
      "type": "QueryByExample",
      // allows any VC(s) from the issuer, so no specific "credentialQuery" property;
      // "credentialQuery" ... not present
      "acceptedEnvelopes": [
        "application/jwt"
      ]
    }
  }
}
msporny commented 3 months ago

The group discussed this on the 2024-07-23 call:

@dlongley noted that starting an exchange only supports accepting an empty object. We need to support an exchange providing information on what cryptosuites and envelopes it might support (at a minimum), but more generally, we need to support sending an arbitrary VPR so the server can know what to send.

Raise a PR that modifies the OAS to allow an arbitrary VPR to be sent from the client to the server.