Obtaining credentials
Some use cases require credentials besides the X509Credential. Check the use case's Discovery Service and policy definitions to see which credentials you need. Credential types are defined in the credential catalog.
360-graden-clientbeeld
No other credentials are needed. You can skip this page.
A credential is issued in one of two ways, depending on the use case:
| Issued by | When | What you do |
|---|---|---|
| A trusted third party | The use case names an issuer, e.g. VZVZ or Vektis | Receive the credential from the issuer and load it into the wallet |
| The care organization itself (self-issued) | The use case allows it, e.g. because there's no trusted issuer yet | Issue it with your Nuts node, then load it into the wallet |
Self-issue a credential
The steps below use the HealthcareProviderRoleTypeCredential as example, from the Huisartsinzage use case.
The HealthcareProviderRoleTypeCredential states the type of care organization, e.g. H1 (huisartsinstelling) or X3 (verplegings- of verzorgingsinstelling). Huisartsinzage requires it. VZVZ might issue it in the future; until then, care organizations issue it themselves.
Before you start
- The care organization has a subject and a did:web DID (see "Create a subject").
Issue the credential
POST <internal Nuts interface>/internal/vcr/v2/issuer/vc
Content-Type: application/json
{
"@context": "https://www.w3.org/2018/credentials/v1",
"type": "HealthcareProviderRoleTypeCredential",
"issuer": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
"credentialSubject": {
"id": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
"roleCodeNL": "X3"
},
"expirationDate": "2027-10-27T00:00:00Z",
"format": "jwt_vc"
}
issuerandcredentialSubject.idare both the care organization's DID: it issues the credential to itself.formatmust bejwt_vc. The default format (ldp_vc, JSON-LD) fails, because no JSON-LD context definesroleCodeNL.- Set
expirationDate. Without it, the node requireswithStatusList2021Revocation.
The response is the credential as a JWT, in double quotes.
Load the credential into the wallet
Issuing doesn't put the credential in the wallet. Load it as described in "Load the credential into the wallet", using the response from the step above as the request body.
Lifecycle
Issue and load a new credential before expirationDate, and when the care organization's type changes.
API reference: Verifiable Credential Registry (v2)