eIDAS2: EU's digital identity regulation explained Learn more
← All posts

Blog

Product Update #32

August 25, 2026

Community & Enterprise Stack V1, OID4VCI/VP V1 and HAIP conformance and more

TL;DR

  • New release - Community & Enterprise Stack V1, Crypto2, and more.
  • Events – OID4VCI/VP V1 and HAIP conformance test passing, France Identité Interop.

Introducing the Community and Enterprise Stack V1 Editions

We are happy to announce the V1 of the walt.id Community and Enterprise Stack.

Explore the latest version of our Issuer, Verifier and Wallet products, supporting OID4VCI and OID4VP v1 across our two stacks:

Community Stack

Do you want build an end-to-end digital ID use case? Explore our new tutorial here.

Enterprise Stack

Do you want build an end-to-end digital ID use case? Explore our new tutorial here

Changes for each stack since our last release can be found below.

Community Stack (1.0)

Below are the highlights available through 1.0 of the identity lib. Check out the full change log for v1.0 here. Want to learn more about the identity lib in general? Check out our intro video.

1.0

Features

Crypto V2

We are happy to introduce crypto2, the next generation of our crypto lib for the walt.id stack. It re-architects key handling and extends multiplatform reach to more platforms incl. Android and iOS. It also introduces coroutine-native APIs, versioned key persistence, and pluggable software, device, remote-KMS, and HSM (PKCS#11) providers. A migration path for existing v1 keys is available.

Learn more here.

Improvements

Verifier2 / OpenID4VP

  • Made Verifier2 session bodies consistent: core is now core_flow for every flow, including DC API (#1821).
  • Unified rate-limit configuration and applied it to verifier protocol endpoints (#1994).
  • Added signed-request nonce-binding coverage for request_uri POST (#2015).
  • Replaced annex labels with protocol names for verification session creation parameters. DC API sessions use dc_api_openid4vp (OpenID4VP Annex D) or dc_api_18013_7 (ISO 18013-7 Annex C). For 18013-7, requestedElements is an alternative to dcql_query . (#1821)

Checkout the updated Verifier2 documentation here.

Wallet API 2

  • Added isolated presentation endpoints (preview claims, reject, then build/submit) (#1970). You can also learn more here in our docs.
  • Stored issuer and request metadata with received credentials (#1970).
  • Extended DID creation support in Wallet2 (#1980).
  • Wired transaction-data type profiles into Wallet2 present/preview/build/send, including urn:eudi:sca:payment:1, and kept Wallet2 route-handler overloads binary-compatible (#2084, #2076, #2088). You can learn more about the transaction data profiles here.

Checkout the updated Wallet2 documentation here.

Issuer / OpenID4VCI

  • Published stage and failure events across the OpenID4VCI issuance flow so integrators can observe stalls (PIN, rejected wallet, unusable IdP response) instead of waiting for session expiry (#2080).
  • Consumed pre-authorized grants atomically so a second token request with the same code returns invalid_grant. Invalid tx_code does not burn the grant (#2074) (Legacy Issuer, issuer2 already included this functionality)
  • Removed leftover issuer2 c_nonce compatibility paths (#2010).
  • Added EdDSA to the default proofSigningAlgValuesSupported (#2008).

Checkout the updated Issuer2 documentation here.

Trust Registry

  • Added ETSI TS 119 612 national TSL and EU LoTL XML support, source-assurance/acceptance policies, and official schema validation. Removed legacy walt.id JSON/XML pilot formats (#1931).

Crypto / KMS / X.509

  • Move to Crypto2 across the stack (KMS, credential-status signing, protocol crypto) and aligned ABI baselines for non-Android builds. Stored local v1 JWK keys migrate automatically; remote KMS keys stay on their cloud backends (#1954, #2044).
  • Stopped publishing Azure Key Vault / external-KMS URLs as JWT, JAR, JWKS, or DID kid values; public identifiers are JWK thumbprints or DID URL fragments (#2031).
  • Normalised Azure Key Vault EC signRaw output to ASN.1 DER, matching every other crypto backend (#2072).
  • Added an X.509 certificate util library for creating and signing CSRs and certificates (#1901).
  • Corrected the CWT status-list label (label 16) (#2021).
  • Returned clearer 400 messages when request bodies fail to decode (#2014).

Breaking Changes

Verifier2 session create

  • flow_type: "dc_api" is removed. Use "dc_api_openid4vp" or "dc_api_18013_7".
  • Nested config field core is now core_flow for all flows.
  • expectedOrigins must be HTTPS secure-context origins (no trailing slash).
  • Omitting clientId on unsigned cross-device sessions now sets redirect_uri:<response_uri>. Signed requests must supply a real clientId (not the redirect_uri: prefix).

Legacy Issuer API

  • Pre-authorized codes without tx_code are single-use. A second token exchange returns invalid_grant.
  • POST /onboard/iso-mdl/document-signers: iacaSigner requires the root CA PEM (#1901).

External KMS / DID

  • Published kid values are thumbprints / DID URLs, not vault or KMS locator URLs (#2031).
  • Newly issued did:jwk JWTs use kid {did}#0. Verifiers still accept older non-#0 kids (#2115, #2136).

Certificates

  • mdoc and SD-JWT profiles no longer share one end-entity certificate. mdoc uses a Document Signer leaf; SD-JWT uses a separate leaf. IACA stays a verifier trust anchor, not part of x5Chain (#2118).

Enterprise Stack (1.0)

Below are the new feature highlights available through 1.0 of the Enterprise Stack. Check out the full change log for 1.0 here. Want to learn more about the enterprise stack in general? Check out our intro video.

1.0

Features

Wallet2 as the default wallet

Wallet2 capabilities are now available under the /v2 paths. Updates include:

  • Migrated Enterprise UI and protocol routes to Wallet2 under /v2/{target}/wallet-service-api/....
  • Added isolated presentation steps (preview claims, reject, then build/submit).
  • Added urn:eudi:sca:payment:1 transaction-data support, authorized mdoc data types, and Wallet2 transaction-data profile discovery.

Checkout the new wallet2 docs here

Verifier2

  • Aligned verification-session create bodies across flow types, including Digital Credentials API.
  • Applied the shared rate-limit config to verifier protocol endpoints.

Checkout the updated Verifier2 docs here

Issuer2

  • Published stage and failure events across the OpenID4VCI issuance flow so integrators can observe why issuance stalled.
  • Added EdDSA to default proofSigningAlgValuesSupported.
  • Removed leftover c_nonce compatibility paths.

Checkout the updated Issuer2 docs here

PKCS#11 Support

Store and use signing keys on a PKCS#11 token through the Enterprise Stack Key Management Service.

Learn more here.

eIDAS2 Audit Logging

The eIDAS Audit Log records compliance evidence for credential issuance and presentation verification in the Enterprise Stack.

Learn more here.

Licensing

The Enterprise Stack now requires an active license to run. Choose an online activation via OpenID credential offer, or an offline .waltlicense bundle for air-gapped environments. The new /license/status endpoint gives super admins visibility into activation state, entitlements, and expiry.

Learn more here.

General

  • Added an endpoint to list all supported permissions. Learn more here.
  • Superadmin registration now uses a typed request object. Learn more here.

Crypto / KMS / X.509

  • Moved KMS, credential-status signing (CWT/JWT/W3C), client attestation, and Issuer2/Verifier2/Wallet2 crypto features over to the new Crypto2 lib.
  • Stored local v1 JWK keys are migrated automatically; remote KMS keys stay attached through the Enterprise KMS adapter.
  • PKCS#11 / HSM and cloud KMS paths run on the Crypto2 backends.
  • Published JWT/JAR/JWKS/DID kid values for external KMS keys are JWK thumbprints or DID URLs, not cloud-KMS locator URLs.
  • Added X.509 certificate helpers (CSR and certificate create/sign). ISO mDL document-signer onboarding requires the IACA root CA PEM.

Fixes an improvements

  • Mapped Wallet2 token-exchange failures to the upstream OAuth status (or 502) instead of a generic 500.
  • Friendlier 400 messages when request bodies fail to decode.
  • Covered retained KMS keys on verifier request_uri POST re-sign.
  • Corrected the CWT status-list content-type label (label 16).

Breaking Changes

Review these before upgrading. Legacy v1 protocol routes can still be turned on with feature flags where noted.

License required to run

The Enterprise API does not serve traffic without an active license. Unlicensed or restricted nodes return 503 on all routes except /livez, login/logout, GET /license/status, and usage-report export. Learn more here.

Legacy services disabled by default

  • Issuer v1, Verifier v1, and Wallet v1 protocol routes are off unless the corresponding feature flag is enabled (wallet-draft-routes for Wallet1).
  • New deployments should use Issuer2, Verifier2, and Wallet2.

Wallet

init-wallet removed

  • Old: POST /v1/{org}.{tenant}/wallet-service-api/init-wallet
  • New: POST /v1/{org}.{tenant}/resource-api/services/init with a composable wallet payload (optional KMS, DID store/service, credential store).
  • Response is a wallet result object. The service type is wallet2, not wallet.

Protocol routes moved to /v2

  • Wallet2 receive, present, client attestation, and dependency routes are /v2/{target}/wallet-service-api/..., not /v1.
  • Examples: .../credentials/receive/pre-authorized, .../credentials/present, .../client-attestation/obtain.

Receive body and response

  • useClientAttestation and runPolicies are no longer request fields. Client attestation is used automatically when the issuer advertises it and the wallet has a linked client attester.
  • Provide offerUrl (or offerJson) and optional keyReference / did.
  • Response is an object { "credentialIds": [...], "deferredTransactionIds": {} }, not an array of stored credentials.

Present body

  • didReference is now did (inline DID string or DID-store reference).
  • The full-flow present endpoint no longer accepts a credentials array; it DCQL-matches from the wallet credential store.
  • To present inline credentials, use POST /v2/{wallet}/wallet-service-api/credentials/present/isolated.

Verifier2

Protocol routes moved to /v2/.../verifier-service-api

  • Old: /v1/{target}/verifier2-service-api/{endpoint}
  • New: /v2/{target}/verifier-service-api/{endpoint}
  • Service create is unchanged: POST /v1/{target}/resource-api/services/create with "type": "verifier2".

DC API session body

  • flow_type: "dc_api" is removed. Use "dc_api_openid4vp" or "dc_api_18013_7".
  • Nested config field is core_flow, not core.
  • expectedOrigins must be HTTPS secure-context origins (no trailing slash). HTTP local origins are rejected.

Client ID

  • Omitting clientId on unsigned cross-device sessions now sets redirect_uri:<response_uri>. Signed requests must supply a real clientId.

DID service

  • Create DID fields keyId / keyIdSet are now keyReference / keyReferenceSet.
  • You may pass an inline key (JWK) instead of a stored-key reference.
  • URLs unchanged (POST /v1/{did-service}/did-service-api/dids/create/key|jwk|web).

Superadmin registration

  • The registration token is no longer a raw string. Send:
{
  "token": "superadmin-token"
}

Service dependencies

  • POST .../dependencies/add no longer accepts a raw path string. Send:
{
  "dependency": "org.tenant.kms"
}

Dev setup

  • POST /v1/admin/initial-setup is gone. Use POST /v1/dev/initial-setup (requires the dev-mode feature).

Data Retention service removed

  • Session and OAuth artefact expiry is handled by data ejection / TTLs. Remove Data Retention service configuration and calls. Learn more here.

External KMS key IDs

  • Published kid values in JWT, JAR, JWKS, and DID documents are thumbprints or DID URLs, not vault/KMS locator URLs.

ISO mDL document-signer onboarding

  • iacaSigner requires the IACA root CA PEM.

X.509 certificate store

  • PUT /v1/{target}/x509-store-api/certificates inserts or updates and returns the certificate.
  • POST /v1/{target}/x509-store-api/certificates inserts only and fails if the certificate id already exists.
  • The store no longer validates the certificate. type is ignored. Use metadata instead of deprecated complementaryMetadata for VICAL entries.

eIDAS audit

  • The durable eIDAS audit log is off unless the eidas-audit feature is enabled. Audit HTTP routes are absent when the feature is off.

Certificates

  • mdoc and SD-JWT issuance examples/profiles no longer share one end-entity certificate. mdoc uses a Document Signer leaf; SD-JWT uses a separate leaf. IACA stays a verifier trust anchor, not part of `x5Chain

OID4VCI/VP V1 & HAIP Compliance

Our latest Verifier and Issuer successfully passed the official conformance tests for OpenID4VCI, OpenID4VP and the OpenID4VC HAIP profiles.

Our wallet APIs and SDK also pass the official conformance tests for OpenID4VCI and OpenID4VP, as well as select test plans for OpenID4VC HAIP (support will be expanded via future releases)

walt.id x France Identité Wallet

The walt.id Verifier now works with the France Identité Wallet. Verify PIDs and Age Verification Credentials. Learn more about on the France Identité marketplace here.

Watch the video

PS: If you enjoy working with our tools, make sure to leave us a ⭐ on GitHub