Skip to main content

Ecosystem Enforcement Reference for Issuers

This page provides a reference of all checks and validations performed when issuing with an ecosystem enforced. For instructions on enforcing an ecosystem during issuance, see Enforcing an Ecosystem as an Issuer.

EUDI​

Before issuance​

When you create a credential with EUDI ecosystem enforced, the system performs the following checks:

  • Issuing identifier (issuer) must be a certificate
  • Issuing protocol must be OpenID4VCI 1.0
  • Schema must use SD-JWT VC and/or ISO mdoc as the credential format
  • If the issuing identifier contains a Registration Certificate (found in trustInformation of identifier), the credential schema being used must be listed as a provided attestation in this certificate

If any of these checks fail, the call to create a credential returns an error.

During issuance​

For all schemas requiring a Wallet Unit Attestation, the system performs the following checks:

  • The receiving wallet must provide attestations signed by a Wallet Provider
    • If requiresWalletInstanceAttestation is true, the wallet must have a valid instance attestation
    • If keyStorageSecurity is required, the wallet must have a valid key attestation that corresponds to the level prescribed
  • Wallet Provider's signing certificate must be found on the Wallet Provider's trust list

If any of these fail, the credential is changed to ERROR state and nothing is issued.

For any schemas not requiring either a key attestation or an instance attestation, no additional checks are made during issuance.

After issuance​

PID issuers are responsible for revoking credentials for any wallet unit whose instance attestation (WIA) has been revoked. Run the ECOSYSTEM_LIFECYCLE_CHECK task on a schedule; Procivis One does not run it automatically. See Tasks.

Each run checks the attestations of all wallet units to which you have issued a credential marked with monitorCredentialLifetime, and revokes the credential for any wallet unit that has been revoked. See Automatic revocation.