Introduction

What Valitel does

Valitel is a relying party as a service. It creates the OpenID4VP request a wallet answers, serves the signed request object, receives and decrypts the presentation, verifies the issuer signature, the trust chain, the holder binding and the replay protection, and gives you back the claims that were disclosed — over a plain JSON API you can call from any language.

Your backend never handles credential formats, trust lists or wallet protocols. It creates a verification, shows the holder a QR code or deep link, and reads the result.

The verification lifecycle

1. Create. POST /v1/verifications with a template or your own DCQL query. You get a session id and a wallet_uri, and the session is pending.
2. Present. Render wallet_uri as a QR code or a deep link — or let the drop-in widget do it. The holder approves the request in their wallet, and the wallet posts its response to Valitel.
3. Verify. Valitel checks the presentation: issuer signature, trust chain, certificate revocation, holder binding, and that this session has not already been answered.
4. Deliver. The session becomes completed, failed or expired. Read the result by polling the API, by receiving a signed webhook, or by redeeming a same-device response code.

Base URL and versioning

All merchant endpoints live under /v1 on a single origin:

https://api.valitel.eu

Requests and responses are JSON (application/json), with two deliberate exceptions on the wallet-facing routes, which no merchant calls: the request object is a compact JWT and the wallet's response is form-encoded.

The machine-readable contract is the API's own OpenAPI 3.1 document, generated from the schemas the API validates against, so it cannot drift from runtime behaviour:

curl -s https://api.valitel.eu/openapi.json

If this site and /openapi.json ever disagree, the JSON is right.

Standards

The specifications Valitel's verifier is built around. Where only part of a profile is implemented, the table says so.

Where to go next