POST 
/conformance/v3/auth-mock/token

The client proceeds with the code flow by calling the Token Endpoint with the required details. The client_assertion JWT must be signed using the client's private key, with the corresponding public key available through the jwks_uri parameter or included in the Client Metadata provided during the pre-registration step.

Request

application/x-www-form-urlencoded

Body

oneOf

Token Request (Pre-Authorized code)

grant_type Grant Typerequired

Possible values: [urn:ietf:params:oauth:grant-type:pre-authorized_code]

MUST have the value

urn:ietf:params:oauth:grant-type:pre-authorized_code

pre-authorized_code Pre-authorized code

The code representing the authorization to obtain Credentials of a certain type. In WCT v3 Holder wallet tests, the code corresponds to the string concatenation of the last 4 bytes (modulo 10) of the sha256 hash of the user DID. Example: the code corresponding to the DID

did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbsDbVZXdb3jzCagESyY4EE2x7Yjx3gNwctoEuRCKKDrdNP3HPFtG8RTvBiYStT5ghBHhHizH2Dy6xQtW3Pd2SecizL9b2jzDCMr7Ka5cRAWZFwvqwAtwTT7xet769y9ERh6

is "5910".

user_pin User PINrequired

OPTIONAL. String value containing a user PIN. This value MUST be present if

user_pin_required

was set to

true

in the Credential Offer. The string value MUST consist of maximum 8 numeric characters (the numbers 0 - 9). This parameter MUST only be used if the

grant_type

is

urn:ietf:params:oauth:grant-type:pre-authorized_code

.

Token Request (Authorization code, using client assertion)

grant_type Grant Typerequired

Possible values: [authorization_code]

MUST have the value

authorization_code

client_assertion Client Assertionrequired

Client assertion as a JWT.

client_assertion_type Client Assertion Typerequired

The format of the assertion as defined by the Authorisation Server.

client_id uri

OPTIONAL. The client identifier as described in Section 2.2 of OAuth 2.0. The "client_id" is unnecessary for client assertion authentication because the client is identified by the subject of the assertion. If present, the value of the "client_id" parameter MUST identify the same client as is identified by the client assertion.

code Authorisation Coderequired

An opaque value that can be used to redeem tokens from the token endpoint.

code

is returned if the

response_type

includes

code

. The code has a lifetime of 300 seconds. It MUST match the value from the authentication response.

redirect_uri Redirect URIrequired

MUST match the "redirect_uri" parameter included in the authorization request.

Token Request (Authorization code, using PKCE)

grant_type Grant Typerequired

Possible values: [authorization_code]

MUST have the value

authorization_code

client_id urirequired

OAuth 2.0 Client Identifier valid at the Authorisation Server.

Verifiable Accreditation Issuance: MUST be URL of the issuer requesting the accreditation that was registered with the Accreditation Issuer

code Authorisation Coderequired

An opaque value that can be used to redeem tokens from the token endpoint.

code

is returned if the

response_type

includes

code

. The code has a lifetime of 300 seconds. It MUST match the value from the authentication response.

code_verifier Code Verifierrequired

Wallet generated secure random token, used to validate the original

code_challenge

provided in initial Authorisation Request.

redirect_uri Redirect URIrequired

MUST match the "redirect_uri" parameter included in the authorization request.

Responses

200

OK

application/json

Schema

Schema

access_token JWSrequired

The access token issued by the Authorisation Server.

The Access Token MUST be signed by the Authorisation Server.

id_token JWSrequired

The ID token issued by the Authorisation Server.

token_type Token Typerequired

Possible values: [bearer]

The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes).

expires_in Expires inrequired

The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.

Lifetime must be 86400 seconds.

c_nonce Challenge Noncerequired

JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential (see Section 7.2 of OpenID for VCI). When received, the Wallet MUST use this nonce value for its subsequent credential requests until the Credential Issuer provides a fresh nonce.

c_nonce_expires_in Challenge Nonce expires inrequired

The lifetime in seconds of the c_nonce token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.

400

Bad Request

application/problem+json

Schema

Schema

type uri

Default value: about:blank

An absolute URI that identifies the problem type. When dereferenced, it SHOULD provide human-readable documentation for the problem type.

title string

A short summary of the problem type.

status int32

Possible values: >= 400 and <= 600

The HTTP status code generated by the origin server for this occurrence of the problem.

detail string

A human readable explanation specific to this occurrence of the problem.

instance uri

An absolute URI that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

Bad Request

{
  "title": "Bad Request",
  "status": 400,
  "detail": "Bad request."
}

Token Expired

{
  "title": "Token Expired",
  "status": 400,
  "detail": "The token has expired."
}

Issuer Not Found

{
  "title": "Issuer Not Found",
  "status": 400,
  "detail": "Issuer not found in the trusted apps registry."
}

401

Unauthorised

application/problem+json

Schema

Schema

type uri

Default value: about:blank

An absolute URI that identifies the problem type. When dereferenced, it SHOULD provide human-readable documentation for the problem type.

title string

A short summary of the problem type.

status int32

Possible values: >= 400 and <= 600

The HTTP status code generated by the origin server for this occurrence of the problem.

detail string

A human readable explanation specific to this occurrence of the problem.

instance uri

An absolute URI that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

Unauthorised

{
  "title": "Unauthorized",
  "status": 401,
  "detail": "You are not authorized to access the resources."
}

500

Internal Error

application/problem+json

Schema

Schema

type uri

Default value: about:blank

An absolute URI that identifies the problem type. When dereferenced, it SHOULD provide human-readable documentation for the problem type.

title string

A short summary of the problem type.

status int32

Possible values: >= 400 and <= 600

The HTTP status code generated by the origin server for this occurrence of the problem.

detail string

A human readable explanation specific to this occurrence of the problem.

instance uri

An absolute URI that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

Internal Server Error

{
  "title": "Internal Server Error",
  "status": 500,
  "detail": "The server encountered an internal error and was unable to complete your request"
}

Loading...