Credentials and presentations
These are the exact definitions the showcase runs on. The registry operates an issuer service for the credentials it awards and verifier services for the presentations it requests; the employer operates its own verifier. Everything is carried as SD-JWT verifiable credentials (dc+sd-jwt), signed with keys whose x509 certificates are registered on a trust list, so the Wallet shows both organisations as trusted service providers.
Credential: Verifiable Student ID
Issued by the registry when the school validates a registration. Every claim is mandatory at issuance and individually disclosable afterwards, so the holder decides field by field what a later verifier sees.
| Property | Value |
|---|---|
| Credential type (vct) | VerifiableStudentID |
| Format | dc+sd-jwt (SD-JWT verifiable credential) |
| Issuance flow | Pre-authorised code with a one-time transaction code |
| Revocation | Status list (status_list) |
| Validity | 1825 days (5 years) |
| Trust anchor | x509 certificate, registered on the trust list |
| Claim | Type | Meaning |
|---|---|---|
commonName, displayName | string | The learner's full name as registered |
firstName, familyName | string | Name parts confirmed by the identity credential |
dateOfBirth | string (date) | From the identity credential |
mail | string | Contact email |
id, identifier | string | Registry record identifiers |
eduPersonPrincipalName | string | The learner identifier at the registry, for example ulid-…@nlr.gov.example |
eduPersonAffiliation[], eduPersonPrimaryAffiliation, eduPersonScopedAffiliation[] | array of string, string | The role at the institution, for example student and [email protected] |
eduPersonAssurance[] | array of string (URI) | Identity assurance level of the registration |
schacHomeOrganization | string | The institution's domain |
schacPersonalUniqueCode[], schacPersonalUniqueID | array of string, string | Sectoral unique codes for the learner |
Credential: National Diploma
Issued after the graduation decision and the fee payment, in the same Wallet session as the payment presentation. The claim set models the W3C Verifiable Credentials 2.0 and Open Badges education fields semantically, carried as an SD-JWT credential for selective disclosure.
| Property | Value |
|---|---|
| Credential type (vct) | urn:education:diploma:1 |
| Format | dc+sd-jwt |
| Issuance flow | Dynamic credential request: the payment presentation and the issuance complete in one Wallet session, with no separate offer |
| Revocation | Status list (status_list); a revoked diploma fails every later verification |
| Validity | 3650 days (10 years) |
| Trust anchor | x509 certificate, registered on the trust list |
| Claim | Type | Meaning |
|---|---|---|
learnerName | string | The graduate's name |
qualificationName | string | For example Upper Secondary Diploma, Natural Sciences |
qualificationCode | string | The framework code, for example NQF-4-NATSCI |
awardingInstitution | string | The school that decided the graduation |
awardDate | string (date) | Date of the award |
programme, result | string | Programme name and final result |
ulid | string | The learner identifier in the registry |
graduationDecisionHash | string (SHA-256 hex) | Hash of the school's signed graduation decision text, binding the credential to the institution's decision |
Presentation: learner sign-in
The education portal signs the learner in with a presentation request instead of a password. The request is a DCQL query answered over OpenID4VP (vp_token, direct_post), with the verifier identified by the x509_hash client identifier scheme.
| Requested credential | Fields |
|---|---|
Person identification dataurn:eu.europa.ec.eudi:pid:1 | given_name, family_name, birthdate, email, address |
The registry stores no raw identity attribute: the learner record is keyed by a pairwise pseudonym derived from stable identity claims, and the shared values only prefill the registration form transiently.
Presentation: diploma fee payment
The fee is confirmed by presenting a payment credential together with signed transaction data (the amount, currency, payee and transaction identifier), so the Wallet shows the learner exactly what is being authorised. Two definitions exist so the learner can choose the instrument; both carry the payment transaction data type.
| Requested credential | Fields |
|---|---|
Payment account credentialhttps://oid4vc.igrant.io/service/vct-metadata/payment_account | iban, bic, currency |
Payment card credentialhttps://oid4vc.igrant.io/service/vct-metadata/card | pan_last_four, scheme, scheme_logo |
The transaction data names the payee (the Ministry, with its registry identifier ESR-MOE-0001), the EUR 50 amount, and the execution date. The verified presentation is the payment evidence; the funds movement itself is a sandbox ledger entry.
Presentation: employer qualification check
The employer's verifier requests two credentials in one presentation, and only the listed fields. Date of birth, address, grades, and the learner identifier are not requested, and the Wallet never sends them.
| Requested credential | Fields |
|---|---|
Person identification dataurn:eu.europa.ec.eudi:pid:1 | given_name, family_name, email |
National Diplomaurn:education:diploma:1 | learnerName, qualificationName, qualificationCode, awardingInstitution, awardDate |
The verification result the employer sees covers four proofs: the signature and integrity of each credential, issuer trust against the trust list, and the live revocation status from the status list. After the registry revokes a diploma, the same request is rejected.
Trust configuration
Each definition signs or requests with its own key, and each key's x509 certificate is registered individually on the trust list: separate certificates for the Student ID issuer, the diploma issuer, the sign-in verifier, the payment verifier, and the employer's verifier. That is why the Wallet labels both organisations Trusted Service Provider on every screen of the walkthrough.