# Obtaining credentials

Some use cases require credentials besides the X509Credential. Check the use case's Discovery Service and policy definitions to see which credentials you need. Credential types are defined in the [credential catalog](https://nuts-foundation.github.io/nl-generic-functions-ig/credential-catalog.html).

<div class="callout info" markdown="1">

**360-graden-clientbeeld**

No other credentials are needed. You can skip this page.

</div>

A credential is issued in one of two ways, depending on the use case:

| Issued by | When | What you do |
|---|---|---|
| A trusted third party | The use case names an issuer, e.g. VZVZ or Vektis | Receive the credential from the issuer and load it into the wallet |
| The care organization itself (self-issued) | The use case allows it, e.g. because there's no trusted issuer yet | Issue it with your Nuts node, then load it into the wallet |

## Self-issue a credential

The steps below use the HealthcareProviderRoleTypeCredential as example, from the Huisartsinzage use case.

The [HealthcareProviderRoleTypeCredential](https://nuts-foundation.github.io/nl-generic-functions-ig/credential-HealthcareProviderRoleTypeCredential.html) states the type of care organization, e.g. `H1` (huisartsinstelling) or `X3` (verplegings- of verzorgingsinstelling). Huisartsinzage requires it. VZVZ might issue it in the future; until then, care organizations issue it themselves.

### Before you start

- The care organization has a subject and a did:web DID (see "Create a subject").

### Issue the credential

```http
POST <internal Nuts interface>/internal/vcr/v2/issuer/vc
Content-Type: application/json

{
  "@context": "https://www.w3.org/2018/credentials/v1",
  "type": "HealthcareProviderRoleTypeCredential",
  "issuer": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
  "credentialSubject": {
    "id": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
    "roleCodeNL": "X3"
  },
  "expirationDate": "2027-10-27T00:00:00Z",
  "format": "jwt_vc"
}
```

- `issuer` and `credentialSubject.id` are both the care organization's DID: it issues the credential to itself.
- `format` must be `jwt_vc`. The default format (`ldp_vc`, JSON-LD) fails, because no JSON-LD context defines `roleCodeNL`.
- Set `expirationDate`. Without it, the node requires `withStatusList2021Revocation`.

The response is the credential as a JWT, in double quotes.

### Load the credential into the wallet

Issuing doesn't put the credential in the wallet. Load it as described in "Load the credential into the wallet", using the response from the step above as the request body.

### Lifecycle

Issue and load a new credential before `expirationDate`, and when the care organization's type changes.

API reference: [Verifiable Credential Registry (v2)](https://nuts-node.readthedocs.io/en/latest/pages/integrating/api.html?urls.primaryName=Verifiable%20Credential%20Registry%20(v2))