Obtaining credentials

Some use cases require credentials besides the X509Credential. Check the use case's Discovery Service and policy definitions to see which credentials you need.

A credential is issued in one of two ways, depending on the use case:

Issued by	When	What you do
A trusted third party	The use case names an issuer, e.g. VZVZ or Vektis	Receive the credential from the issuer and load it into the wallet
The care organization itself (self-issued)	The use case allows it, e.g. because there's no trusted issuer yet	Issue it with your Nuts node, then load it into the wallet

Example:Self-issue a credential

The steps below use the HealthcareProviderRoleTypeCredential (Huisartsinzage)as example, from the Huisartsinzage use case.

The HealthcareProviderRoleTypeCredential states the type of care organization, e.g. H1 (huisartsinstelling) or X3 (verplegings- of verzorgingsinstelling). Huisartsinzage requires it. VZVZ might issue it in the future; until then, care organizations issue it themselves.

Before you start

• The care organization has a subject and a did:web DID (see "Create a subject").

Issue the credential

POST <internal Nuts interface>/internal/vcr/v2/issuer/vc
Content-Type: application/json

{
  "@context": "https://www.w3.org/2018/credentials/v1",
  "type": "HealthcareProviderRoleTypeCredential",
  "issuer": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
  "credentialSubject": {
    "id": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
    "roleCodeNL": "X3"
  },
  "expirationDate": "2027-10-27T00:00:00Z",
  "format": "jwt_vc"
}

• issuer and credentialSubject.id are both the care organization's DID: it issues the credential to itself.
• format must be jwt_vc. The default format (ldp_vc, JSON-LD) fails, because no JSON-LD context defines roleCodeNL.
• Set expirationDate. Without it, the node requires withStatusList2021Revocation.

The response is the credential as a JWT, in double quotes.

Load the credential into the wallet

Issuing doesn't put the credential in the wallet. Load it as described in "Load the credential into the wallet", using the response from the step above as the request body.

Lifecycle

Issue and load a new credential before expirationDate, and when the care organization's type changes.

API reference: Verifiable Credential Registry (v2)