API Reference

This array includes a list of identifiers for credential configurations that will be included in the credential offer. These identifiers are the id elements returned in the response when you create a credential configuration. To issue multiple credential formats of the same credential in a single flow, include all the required credential configuration id elements in the request payload.

Specifies a list of additional request parameters that the wallet can include in the authentication request.

The credentials to include in the offer, provided either as an array of mDocs credential configuration identifiers, or as a map of those identifiers to claim set identifiers.

Unique system generated identifier to reference the user for this offer. This can be obtained by searching for a user. If not provided, a new user entity will be created.

When credentialBundleId is provided and userId is omitted, the offer is automatically scoped to the userId associated with that bundle.

Configure whether a second-factor transaction code is required for this offer. If a configuration is provided, a code will be generated for the offer, and the end user must submit it during credential retrieval. If an incorrect transaction code is entered three times by the holder, the credential offer is permanently invalidated and the wallet can no longer claim the credential.

The identifier of an existing credential bundle. When provided, the issued credential replaces the credential in the specified bundle rather than creating a new bundle, updating the credential in place. The bundle keeps its credentialBundleId and credentialReferenceId, so references you hold against the bundle stay valid.

credentials must still be provided, and must name exactly one credential configuration that resolves to the same credential type as the bundle. A bundle holds a single credential type, so an offer naming more than one configuration cannot target one.

If the bundle was issued for a claim set, credentials must use the map form and name exactly that claim set. Use the array form only for a bundle issued without a claim set. See Update a credential issued for a claim set.

When userId is omitted and credentialBundleId is supplied, the offer is automatically scoped to the bundle's userId. When userId is provided, it must match the bundle's userId.

If the bundle is bound to a wallet instance, only that wallet instance can claim the offer. MATTR VII checks the claiming wallet's client attestation key against the key bound to the bundle, and does not issue a credential if they do not match. To make sure only the wallet instance that holds the credential can claim an update, issue the original credential with Wallet Attestation.

If a prior offer targeting the same bundle has expired or was not claimed, you may call this endpoint again with the same credentialBundleId.

Credential update is offered as an open beta preview feature and is not generally available yet. It is available on all tenants, and its behavior may change in a way that breaks existing integrations before it becomes generally available.

Additional user claims that are available during credential issuance for this offer.

The claims for each claim set, keyed by credential configuration identifier and then by claim set identifier.

This property requires the map form of credentials, and every claim set identifier it references must be listed against the same credential configuration in credentials.

Claims provided here are specific to a single claim set. Where the same claim name also appears in the sibling claims object, the claim set value is used for that credential.

This array includes a list of claims that will be persisted against the user object in the MATTR VII database. These claims are then available for any future credential offers or issuance operations for this user. By default no claims are persisted, and it is recommended to consider carefully which claims to persist, if any, as this has implications for data privacy and security. When claimSets is provided, the listed claims are also persisted from each claim set against the user's claimSets.

Specifies when the offer will expire. Once the offer expires, the user can no longer use it to claim a credential, and a new offer must be generated. The expiration period can include any combination of minutes and seconds. By default, the offer expires in 5 minutes, and the maximum allowed duration is 10 minutes.