Create a verifier agent with a verifier profile

Edit online

To enable OpenID for Verifiable Presentation flows, a verifier agent must be created. The DC Agency API credentials generated with this agent are used by the verifying application to integrate and interact with the agent.

The following example includes a verifier profile that defines a default exchange template. The metadata property in the profile specifies the verifier metadata values that is included in the authorization request sent to the wallet, as described in the OpenID for Verifiable Presentation specification. For more information, see API Specification.

POST - https://<hostname>/diagency/v1.0/diagency/agents 
{
    "method": "POST",
    "body": {
        "name": "didWebVerifier",
        "is_did_on_ledger": false,
        "agent_type": "verifier",
        "did_method": "did:web",
        "profile": {
          "verifier": {
            "root_of_trust": {
              "system_generated": {}
            },
            "metadata": {
              "response_types": [
                "vp_token"
              ],
              "vp_formats_supported": {
                "dc+sd-jwt": {
                  "sd-jwt_alg_values": [
                    "Ed25519"
                  ],
                  "kb-jwt_alg_values": [
                    "Ed25519"
                  ]
                },
                "mso_mdoc": {
                  "issuerauth_alg_values": [
                    -19
                  ],
                  "deviceauth_alg_values": [
                    -19
                  ]
                }
              }
            },
            "default_exchange_template": {
              "response_mode": "direct_post",
              "client_id_prefix": "x509_hash",
              "default_authorization_url_scheme": "openid4vp://",
              "ttl": 120
            }
          },
          "display": [
            {
              "locale": "en-AU",
              "name": "Trusted Verifier"
            }
          ]
        }    }
}

When the root of trust is set to system_generated, the response includes a self-signed public key certificate. Alternatively, you can upload your own CA-signed public key certificate along with its associated private key.

The root of trust key material is used to sign exchange specific ephemeral keys. When an exchange is created, one ephemeral key will be generated for authorization request signing when the request mode is JWT. This key will be signed by the verifier's root of trust private key.

Note: The private key is not returned by the API.

"verifier": {
  "root_of_trust": {
    "x5c": {
      "certificate": "-----BEGIN CERTIFICATE-----\nMIIBo...GB+F\n-----END CERTIFICATE-----",
      "private_key": ""
    }
  },
...      
}