VC Knots Coverage

The following tables are organized based on OpenID for Verifiable Credential Issuance 1.0 and OpenID for Verifiable Presentations 1.0, and describe the current implementation scope of this repository.

✅ means that the feature is implemented for the relevant role. ❌ means that it is not implemented or is not available end to end. Conditions for configuration-dependent features are described in the notes column. ⏳ denotes pending test confirmation.

OpenID for Verifiable Credential Issuance 1.0

Specification section	Functional area	Specification role / feature	Issuer	Wallet	Notes
3.5	Issuance Flow	Pre-Authorized Code Flow	Since v0.6.0 ✅	✅	Current standard flow.
3.4	Issuance Flow	Authorization Code Flow	❌	❌	Not supported end to end.
4.1	Credential Offer	credential_offer (Pre-Authorized Code)	Since v0.6.0 ✅ Generate	✅ Parse	Reference-based credential_offer_uri is not supported.
3.5	Transaction Code	tx_code	Since v0.6.0 ✅ Issue / validate	✅ Send	Used in the Pre-Authorized Code Flow.
A.1	Credential Format	jwt_vc_json	Since v0.6.0 ✅ Issue	✅ Receive
A.3	Credential Format	dc+sd-jwt (SD-JWT VC)	Since v0.6.0 ✅ Issue	✅ Receive
A.2	Credential Format	mso_mdoc	❌	❌
6	Token Endpoint	Access Token issuance	Since v0.6.0 ✅	✅	Supports the Pre-Authorized Code Flow.
13.2	Client Authentication	private_key_jwt	Since v0.6.0 ✅ Validate	✅ Send	Client authentication method for registered OAuth clients at the Token Endpoint. The wallet supports only private_key_jwt and none (the default); client_secret_basic is not implemented, so an Authorization Server that omits token_endpoint_auth_methods_supported cannot be used (RFC 8414 section 2). Related section: 6.1
6.1	Client Authentication	Anonymous Pre-Authorized Token Request	Since v0.6.0 ✅ Conditional	✅ Send	The wallet omits client_id only when the Authorization Server Metadata sets pre-authorized_grant_anonymous_access_supported to true, whose default is false. Otherwise it sends client_id, and returns an error before sending when none is configured. Related section: 12.3
13.2	Sender Constraint	DPoP sender-constrained Access Token	Since v0.6.0 ✅	✅	Related sections: 6.1, 7.2, 8.2. External spec: RFC 9449
8	Credential Endpoint	Credential Request / Response	Since v0.6.0 ✅	✅
8.2	Credential Proof	JWT Proof	Since v0.6.0 ✅ Validate	✅ Generate	Only a single Proof is currently supported. The wallet omits iss only for an anonymous Pre-Authorized Token Request. Related section: 6.1
7.2	Nonce	OpenID4VCI c_nonce	Since v0.6.0 ✅ Issue	✅ Retrieve / use	Credential Proof nonce returned in the JSON body of POST /nonce.
7.2	Nonce	DPoP-Nonce	Since v0.6.0 ✅ Conditional	✅ Conditional	External spec: RFC 9449
12.2	Metadata	Credential Issuer Metadata	Since v0.6.0 ✅ Unsigned JSON	✅ Retrieve	Signed Metadata is not supported. The wallet rejects metadata whose credential_issuer does not match the Credential Offer.
6.1.1	Credential Selection	authorization_details	❌	❌	Not supported end to end in Token Requests / Responses.
3.3.4	Credential Selection	credential_identifier	❌	Partial	credential_identifiers integration in the Token Response is not supported. Related section: 6.2
3.3.2	Credential Issuance	Batch Credential Issuance	❌	❌
9	Credential Issuance	Deferred Credential Endpoint	❌	❌
10	Encryption	Credential Request encryption	❌	❌
10	Encryption	Credential Response encryption	❌	❌
11	Notification	Notification Endpoint	❌	❌

OpenID for Verifiable Presentations 1.0

Specification section	Functional area	Specification role / feature	Verifier	Wallet	Notes
5	Authorization Request	Authorization Request	Since v0.7.0 ✅ request_uri, URL-encoded parameters	⏳ request, request_uri, URL-encoded parameters
5	Authorization Request	Signed Authorization Request (JAR)	Since v0.7.0 ✅	⏳	Uses a Request Object. External spec: RFC 9101
5	Authorization Request	Encrypted Authorization Request (JAR)	❌	❌	External spec: RFC 9101
5.5	Credential Query	Authorization Request using scope	❌	❌
5.9.3	Client Identification	Client Identifier Prefix	Since v0.7.0 ✅ redirect_uri, x509_san_dns	⏳ redirect_uri, x509_san_dns
5.10	Request URI	Request URI Method	Since v0.7.0 ✅ GET	⏳ GET, POST
6	Credential Query	DCQL	Since v0.7.0 ✅	⏳	Uses dcql_query parameter. The Wallet discloses only the requested claims.
8.1	Authorization Response	Authorization Response	Since v0.7.0 ✅	⏳
8.2	Response Mode	Response Mode	Since v0.7.0 ✅ direct_post	⏳ direct_post
8.3	Authorization Response	Encrypted Authorization Response	❌	⏳
8.4	Transaction Data	Transaction Data	Since v0.7.0 ✅	⏳	Supported for dc+sd-jwt only.
8.5	Authorization Response	Authorization Error Response	❌	❌
10	Metadata	Wallet Metadata	❌	❌
11	Metadata	Verifier Metadata — client_metadata	Since v0.7.0 ✅	⏳ Parse
12	Client Authentication	Verifier Attestation JWT	❌	❌
Appendix A	Digital Credentials API	Digital Credentials API / DC API	❌	❌
Appendix B.1	Credential Format	jwt_vc_json format	Since v0.7.0 ✅	⏳
Appendix B.2	Credential Format	mso_mdoc (Mobile Documents / mdocs)	❌	❌
Appendix B.3	Credential Format	SD-JWT VC format (dc+sd-jwt)	Since v0.7.0 ✅	⏳	Only ES256 is supported as the signing algorithm.
Appendix B.3.6	Holder Binding	SD-JWT VC Key Binding / KB-JWT	Since v0.7.0 ✅	⏳	Only ES256 is supported as the signing algorithm.