Contents
1. Overview
This page specifies a Verification Service as needed in Synergy 4 of the OOTS - EUDI Wallet synergies proof-of-concept.
2. Verification service
2.1 Overview
Verification Service allows verification whether or not an evidence exists that associates a specified user to a set of attribute value pairs. Unlike evidence exchange in the Once-Only Technical System, It does not return this actual evidence. The service involves actors in two roles:
- a verification requester
- a verification provider
The role of verification requester could be used by a QTSP in order to be able to issue an Electronic Attestation of Attributes. The verification provider could be used by an Authentic Source that holds structured data about persons.
The service follows the request-response pattern.
The request contains data identifying the natural person data subject and a set of attribute value pairs.
There are two types of responses:
- A positive (match) response is used in case a successful match was found for the data subject for all the attribute value pairs.
- An error response in all all other situations including situations in which no match was found. This means that there may be no data of the requested type for the user or if there is, at least one of the specified attributes does not match the value specified in the request.
The Verification Service is defined as an instance of the QueryManager interface defined in ISO 15000-3:2023 and OASIS Regrep4 and derived from the OOTS evidence exchange as defined in chapter 4 of the OOTS Technical Design Documents. The messages conform to the Regrep XML schemas for registry information model (RIM) and Registry Services (RS) and the OOTS XML schema (SDG).
2.2 Request message
The request is derived from the OOTS evidence exchange request. It contains the following mandatory slots as child elements of the QueryRequest root element:
- SpecificationIdentifier is to be set to the value "eudi-evs:1.0".
- IssueDateTime is to be set to the date and time the request was issued in ISO datetime format.
- VerificationRequester identifies the party making the request. It contains a RIM collection of sdg:Agent elements.
- VerificationProvider identifier the party to which the request is issued. It contain an sdg:Agent element.
- IssuingPurposeQEAA is set to a Boolean value indicating the request is made in order to be able to issue a QEAA in case the verification yields a positive result.
- ExplicitRequestGiven is set to a Boolean value indicating the request is at the explicit request of a user of the VerificationRequester service.
The Query element is of the fixed type "VerificationQuery" and has three mandatory and one optional slots:
- NaturalPerson is of type AnyValueType and contains an sdg:NaturalPerson element containing personal identification data.
- EvidenceTypeClassification of type StringValueType contains the Semantic Repository URI of an evidence type retrieved from the Data Service Directory.
- RequiredAttributes of type MapValueType contains a set of entry keys and entry values.
An entry key shall follow a dotted pattern notation matching the path to the key in the authentic source data.
An entry key value shall be of type StringValueType or, if the source data support values in multiple languages, an InternationalStringValueType.
If the request is issued to obtain a deferred response to a previously issued request (see below, section 2.6), it shall contain the following additional slot:
- DeferredResponseIdentifier is to be set to the value of the VerificationResponseIdentifier issued in response to the original request, which resulted in a response with status Unavailable.
2.3 Positive response
The positive response is derived from the OOTS evidence exchange response. It contains the following mandatory slots as child elements of the QueryResponse root element:
- SpecificationIdentifier is to be set to the value "eudi-evs:1.0".
- VerificationResponseIdentifier of type StringValueType. It shall unique identify the response message using a GUID.
- IssueDateTime is to be set to the date and time the response was issued in ISO datetime format.
- VerificationRequester identifies the party making the request. It contain an sdg:Agent element.
- VerificationProvider identifier the party to which the request is issued. It contains a RIM collection of sdg:Agent elements.
The message shall contain a RegistryObjectList containing one RegistryObject. This RegistryObject shall contain the following three slots:
- VerificationPassed on type BooleanValueType. Its value shall be set to "true".
- RequiredAttributes of type MapValueType. Its content shall be a copy of the corresponding slot in the request message.
2.4 Error response
The negative response is derived from the OOTS evidence exchange response. It contains the following mandatory slots as child elements of the QueryResponse root element:
- SpecificationIdentifier is to be set to the value "eudi-evs:1.0".
- VerificationResponseIdentifier of type StringValueType. It shall unique identify the response message using a GUID.
- IssueDateTime is to be set to the date and time the response was issued in ISO datetime format.
- ErrorProvider of type AnyValueType shall contain an sdg:Agent identifying the entity creating the response.
- VerificationRequester identifies the party making the request. It contain an sdg:Agent element.
The message shall contain an Exception element.
In case the error is raised due to a non-match:
- the type of the Exception shall be of ObjectNotFoundExceptionType.
- the Exception shall contain two slots:
- TimeStamp of DateTimeValueType shall be the date and time at which the exception was raised, expressed in ISO datatime format.
- VerificationPassed on type BooleanValueType. Its value shall be set to "false".
2.5. Protocol Binding
The verification service uses eDelivery AS4 using the binding defined for OOTS Evidence Exchange defined in 4.7 - eDelivery Configuration (June 2024 errata).
2.6. Deferred Response
As in OOTS evidence exchange, the outcome of processing of the evidence request may not be immediately available. If this is the case, a response will be returned with a value "urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Unavailable" for the status attribute instead of "urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Success". The content of the QueryResponse element must contain an empty RegistryObjectList. The response MUST contain the rim:slot "ResponseAvailableDateTime" to indicate the expected time of availablity.
The status attribute is used to distinguish between a successful response using the value "urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Success" . If the status attribute "urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Unavailable" is used, there MUST be the rim:slot "ResponseAvailableDateTime" to indicate the time of availablity. In that case, the content of the QueryResponse element must contain a possibly empty RegistryObjectList. This the rim:slot "ResponseAvailableDateTime" is not used in case of a successful response.
3. Examples
3.1. Request example
This request uses attributes aimed to allow matching of authentic source data using the JSON representation of ELM used in examples such as the following:
<?xml version="1.0" encoding="UTF-8"?>
<query:QueryRequest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:rs="urn:oasis:names:tc:ebxml-regrep:xsd:rs:4.0"
xmlns:sdg="http://data.europa.eu/p4s"
xmlns:xmime="http://www.w3.org/2005/05/xmlmime"
xmlns:rim="urn:oasis:names:tc:ebxml-regrep:xsd:rim:4.0"
xmlns:query="urn:oasis:names:tc:ebxml-regrep:xsd:query:4.0"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xml="http://www.w3.org/XML/1998/namespace"
xmlns:eudiw="http://data.europa.eu/eu-digital-identity-wallet"
xml:lang="ES"
id="urn:uuid:361e43b5-bd1b-4eb5-9b1f-93971ce2e811">
<rim:Slot name="SpecificationIdentifier">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>eudi-evs:1.0</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="IssueDateTime">
<rim:SlotValue xsi:type="rim:DateTimeValueType">
<rim:Value>2028-03-10T17:08:10.872Z</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationRequester">
<rim:SlotValue xsi:type="rim:CollectionValueType" collectionType="urn:oasis:names:tc:ebxml-regrep:CollectionType:Set">
<rim:Element xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES12345</sdg:Identifier>
<sdg:Name lang="EN">QTSP Spain</sdg:Name>
<sdg:Name lang="ES">PCSC España</sdg:Name>
<sdg:Address>
<sdg:FullAddress>Huertas, 1080</sdg:FullAddress>
<sdg:PostCode>28012</sdg:PostCode>
<sdg:PostCityName>Madrid</sdg:PostCityName>
<sdg:AdminUnitLevel1>ES</sdg:AdminUnitLevel1>
<sdg:AdminUnitLevel2>ES300</sdg:AdminUnitLevel2>
</sdg:Address>
<sdg:Classification>ER</sdg:Classification>
</sdg:Agent>
</rim:Element>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationProvider">
<rim:SlotValue xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES54321</sdg:Identifier>
<sdg:Name lang="EN">Ministerio de Educación, Formación Profesional y Deportes</sdg:Name>
</sdg:Agent>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="IssuingPurposeQEAA">
<rim:SlotValue xsi:type="rim:BooleanValueType">
<!-- MUST be according to xs:boolean -->
<rim:Value>true</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="ExplicitRequestGiven">
<rim:SlotValue xsi:type="rim:BooleanValueType">
<!-- MUST be according to xs:boolean -->
<rim:Value>true</rim:Value>
</rim:SlotValue>
</rim:Slot>
<query:ResponseOption returnType="LeafClassWithRepositoryItem"/>
<query:Query queryDefinition="VerificationQuery">
<rim:Slot name="NaturalPerson">
<rim:SlotValue xsi:type="rim:AnyValueType">
<sdg:Person>
<sdg:LevelOfAssurance>High</sdg:LevelOfAssurance>
<sdg:Identifier schemeID="eidas">DE/ES/123123123</sdg:Identifier>
<sdg:FamilyName>Hermoso</sdg:FamilyName>
<sdg:GivenName>Emma</sdg:GivenName>
<sdg:DateOfBirth>2001-03-01</sdg:DateOfBirth>
<sdg:BirthName>Emma Hermoso</sdg:BirthName>
<sdg:PlaceOfBirth>Madrid, Spain</sdg:PlaceOfBirth>
<sdg:CurrentAddress>
<sdg:FullAddress>Kurfürstendamm 31, Berlin, Germany</sdg:FullAddress>
<sdg:PostCode>10719</sdg:PostCode>
<sdg:PostCityName>Berlin</sdg:PostCityName>
<sdg:AdminUnitLevel1>DE</sdg:AdminUnitLevel1>
<sdg:AdminUnitLevel2>DE300</sdg:AdminUnitLevel2>
</sdg:CurrentAddress>
<sdg:Gender>Female</sdg:Gender>
</sdg:Person>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="EvidenceTypeClassification">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>https://sr.oots.tech.ec.europa.eu/evidencetypeclassifications/ES/edf717b7-b373-40b1-b51b-cbb7c9d64de5</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="RequiredAttributes">
<rim:SlotValue xsi:type="rim:MapValueType">
<rim:Map>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.awardedBy.awardingBody.legalName</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:InternationalStringValueType">
<rim:Value>
<rim:LocalizedString xml:lang="ES" value="Universidad Pontificia Comillas (Universidad de la Iglesia Católica)"></rim:LocalizedString>
</rim:Value>
</rim:EntryValue>
</rim:Entry>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.title</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:InternationalStringValueType">
<rim:Value>
<rim:LocalizedString xml:lang="ES" value="Máster Universitario en Asuntos Internacionales: Economía, Política y Derecho"/>
</rim:Value>
</rim:EntryValue>
</rim:Entry>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.awardedBy.awardingBody.awardingDate</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:DateTimeValueType">
<rim:Value>2019-09-11T00:00:00+02:00</rim:Value>
</rim:EntryValue>
</rim:Entry>
</rim:Map>
</rim:SlotValue>
</rim:Slot>
</query:Query>
</query:QueryRequest>
3.2. Response Example
<?xml version="1.0" encoding="UTF-8"?>
<query:QueryResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:rs="urn:oasis:names:tc:ebxml-regrep:xsd:rs:4.0"
xmlns:rim="urn:oasis:names:tc:ebxml-regrep:xsd:rim:4.0"
xmlns:sdg="http://data.europa.eu/p4s"
xmlns:query="urn:oasis:names:tc:ebxml-regrep:xsd:query:4.0"
xmlns:xlink="http://www.w3.org/1999/xlink"
status="urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Success"
xmlns:xml="http://www.w3.org/XML/1998/namespace"
requestId="urn:uuid:361e43b5-bd1b-4eb5-9b1f-93971ce2e811">
<rim:Slot name="SpecificationIdentifier">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>oeudi-evs:1.0</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationResponseIdentifier">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>166155eb-d7a7-4cac-9086-8a85f0116462</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="IssueDateTime">
<rim:SlotValue xsi:type="rim:DateTimeValueType">
<rim:Value>2022-05-19T17:10:10.872Z</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationProvider">
<rim:SlotValue xsi:type="rim:CollectionValueType" collectionType="urn:oasis:names:tc:ebxml-regrep:CollectionType:Set">
<rim:Element xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES54321</sdg:Identifier>
<sdg:Name lang="EN">Ministerio de Educación, Formación Profesional y Deportes</sdg:Name>
<sdg:Address>
<sdg:FullAddress>Calle Alcalá, 34</sdg:FullAddress>
<sdg:PostCode>28014</sdg:PostCode>
<sdg:PostCityName>Madrid</sdg:PostCityName>
<sdg:AdminUnitLevel1>ES</sdg:AdminUnitLevel1>
<sdg:AdminUnitLevel2>ES300</sdg:AdminUnitLevel2>
</sdg:Address>
<sdg:Classification>EP</sdg:Classification>
</sdg:Agent>
</rim:Element>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationRequester">
<rim:SlotValue xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES12345</sdg:Identifier>
<sdg:Name lang="EN">QTSP Spain</sdg:Name>
<sdg:Name lang="ES">PCSC España</sdg:Name>
</sdg:Agent>
</rim:SlotValue>
</rim:Slot>
<rim:RegistryObjectList >
<rim:RegistryObject id="3434">
<rim:Slot name="VerificationPassed">
<rim:SlotValue xsi:type="rim:BooleanValueType">
<rim:Value>true</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="RequiredAttributes">
<rim:SlotValue xsi:type="rim:MapValueType">
<rim:Map>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.awardedBy.awardingBody.legalName</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:InternationalStringValueType">
<rim:Value>
<rim:LocalizedString xml:lang="ES" value="Universidad Pontificia Comillas (Universidad de la Iglesia Católica)"></rim:LocalizedString>
</rim:Value>
</rim:EntryValue>
</rim:Entry>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.title</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:InternationalStringValueType">
<rim:Value>
<rim:LocalizedString xml:lang="ES" value="Máster Universitario en Asuntos Internacionales: Economía, Política y Derecho"/>
</rim:Value>
</rim:EntryValue>
</rim:Entry>
<rim:Entry>
<rim:EntryKey xsi:type="rim:StringValueType">
<rim:Value>hasClaim.awardedBy.awardingBody.awardingDate</rim:Value>
</rim:EntryKey>
<rim:EntryValue xsi:type="rim:DateTimeValueType">
<rim:Value>2019-09-11T00:00:00+02:00</rim:Value>
</rim:EntryValue>
</rim:Entry>
</rim:Map>
</rim:SlotValue>
</rim:Slot>
</rim:RegistryObject>
</rim:RegistryObjectList>
</query:QueryResponse>
3.3 Error Example
<?xml version="1.0" encoding="UTF-8"?>
<query:QueryResponse xmlns:rim="urn:oasis:names:tc:ebxml-regrep:xsd:rim:4.0"
xmlns:query="urn:oasis:names:tc:ebxml-regrep:xsd:query:4.0"
xmlns:sdg="http://data.europa.eu/p4s" xmlns:rs="urn:oasis:names:tc:ebxml-regrep:xsd:rs:4.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xlink="http://www.w3.org/1999/xlink"
requestId="urn:uuid:361e43b5-bd1b-4eb5-9b1f-93971ce2e811"
status="urn:oasis:names:tc:ebxml-regrep:ResponseStatusType:Failure">
<rim:Slot name="SpecificationIdentifier">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>eudi-evs:1.0</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationResponseIdentifier">
<rim:SlotValue xsi:type="rim:StringValueType">
<rim:Value>530ad1e2-5eaf-4a9a-8192-227432eea95d</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="IssueDateTime">
<rim:SlotValue xsi:type="rim:DateTimeValueType">
<rim:Value>2022-05-19T17:10:10.872Z</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="ErrorProvider">
<rim:SlotValue xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES54321</sdg:Identifier>
<sdg:Name lang="EN">Ministerio de Educación, Formación Profesional y Deportes</sdg:Name>
<sdg:Address>
<sdg:FullAddress>Calle Alcalá, 34</sdg:FullAddress>
<sdg:PostCode>28014</sdg:PostCode>
<sdg:PostCityName>Madrid</sdg:PostCityName>
<sdg:AdminUnitLevel1>ES</sdg:AdminUnitLevel1>
<sdg:AdminUnitLevel2>ES300</sdg:AdminUnitLevel2>
</sdg:Address>
<sdg:Classification>ERRP</sdg:Classification>
</sdg:Agent>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationRequester">
<rim:SlotValue xsi:type="rim:AnyValueType">
<sdg:Agent>
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:9920">ES12345</sdg:Identifier>
<sdg:Name lang="EN">QTSP Spain</sdg:Name>
<sdg:Name lang="ES">PCSC España</sdg:Name>
<sdg:Address>
<sdg:FullAddress>Huertas, 1080</sdg:FullAddress>
<sdg:PostCode>28012</sdg:PostCode>
<sdg:PostCityName>Madrid</sdg:PostCityName>
<sdg:AdminUnitLevel1>ES</sdg:AdminUnitLevel1>
<sdg:AdminUnitLevel2>ES300</sdg:AdminUnitLevel2>
</sdg:Address>
</sdg:Agent>
</rim:SlotValue>
</rim:Slot>
<rs:Exception xsi:type="rs:ObjectNotFoundExceptionType" message="Object not found"
severity="urn:oasis:names:tc:ebxml-regrep:ErrorSeverityType:Error"
detail="The QueryRequest expects an object but it is not found in server"
code="EUDI:ERR:0001">
<rim:Slot name="Timestamp">
<rim:SlotValue xsi:type="rim:DateTimeValueType">
<!-- The 'rim:Value' of 'Timestamp' MUST be according to xsd:dateTime. -->
<rim:Value>2028-03-10T17:08:12.763Z</rim:Value>
</rim:SlotValue>
</rim:Slot>
<rim:Slot name="VerificationPassed">
<rim:SlotValue xsi:type="rim:BooleanValueType">
<rim:Value>false</rim:Value>
</rim:SlotValue>
</rim:Slot>
</rs:Exception>
</query:QueryResponse>
4. Discovery of Verification Service Providers
4.1 Overview
If the Verification Requester does not know the Verification Provider, its Access Service or the Evidence Type Classification, it shall discover these using the OOTS Common Services.
4.2 Evidence Broker
If the Verification Requester does not know the Evidence Type, it MAY use the Evidence Broker using the API provided by the OOTS Common Services:
https://oots.pages.code.europa.eu/tdd/apidoc/evidence-broker
No changes in API or other functionality are required on the side of the Evidence Broker.
4.3 Data Service Directory
If the Verification Requester does not know the Verification Provider, Access Service or Evidence Type Classification, it shall discover this using the API of the OOTS Data Service Directory.
https://oots.pages.code.europa.eu/tdd/apidoc/data-services-directory
Specifically, it will use an extended version of the following API:
https://oots.pages.code.europa.eu/tdd/apidoc/data-services-directory/find-data-services
The extension is described in the following RFC on the Common Services: EUDI Wallet Extensions. The extension adds an additional optional query parameter to the DSD Query, named "specification" that will be act as a filter for the access services. Its value is a version of the one of the three specifications and if absent, for backwards compatibility, it will assume the default oots specification e.g. oots-edm:1.0. For the verification service, the parameter shall be set in queries and set to the value "eudi-evs:1.0". This will instruct the Data Service Directory to only return Data Services that support the Verification Service.
The DSD response to lookups for the verification services follow the DSD API specification and the full specification provided in the OOTS Technical Design Documents, except that response data is filtered such that only AccessService elements that have their ConformsTo set to the value eudi-evs:1.0 are returned.
In the response, the value of the AccessService subelement Identifier shall be set to an Access Service that can provide verification requests received using eDelivery and the RegRep4 QueryManager protocol as profiled in section 3 above.
<sdg:Identifier schemeID="urn:cef.eu:names:identifier:EAS:0060">8889909098</sdg:Identifier>
Unlike the AccessService for Pub-EEA Issuing Services, the value shall be an organization identifier rather than an Internet-resolvable URI. The schemeID attribute is mandatory and shall identify an identification scheme registered in the EAS codelist.
5. Change Log
| Version | Date | Description |
|---|---|---|
| 0.1 | 25 June 2024 | First version |
| 0.2 | 4 September 2024 | Changes in response to PRE-ISC review of draft Implementing Regulation 20240809_45d-f - EEA _PRE-ISC:
|