Obtaining credentials

AfterSome use cases require credentials besides the X509Credential. Check the use case's Discovery Service and policy definitions to see which credentials you createdneed.

A credential is issued in one of two ways, depending on the use case:

Issued by When What you do A trusted third party The use case names an issuer, e.g. VZVZ or Vektis Receive the credential from the issuer and load it into the wallet The care organization itself (self-issued) The use case allows it, e.g. because there's no trusted issuer yet Issue it with your Nuts node, then load it into the wallet

Example: HealthcareProviderRoleTypeCredential

The HealthcareProviderRoleTypeCredential states the type of care organization, e.g. H1 (huisartsinstelling) or X3 (verplegings- of verzorgingsinstelling). Huisartsinzage requires it. VZVZ might issue it in the future; until then, care organizations issue it themselves.

Before you start

The care organization has a subject with some DID documents, it's time to give meaning to these identifiers. Without Verifiable Credentials, DIDs are just useless identifiers. They receive meaning when another party issues credentials to one of those DIDs. Attestations in the credentials will later be used for authentication & authorization.

Issueand a Verifiable Credential

With the Nuts node, you can issue any kind of credential from one of your subjects to any resolvabledid:web DID (did:nuts,see did:web,"Create did:keya andsubject").

did:jwk). What the meaning of

Issue the credential is and how it can be used is determined by the use case.

POST <internal Nuts interface>/internal/vcr/v2/issuer/vc
Content-Type: application/json

{
  "@context": "https://nuts.nl/www.w3.org/2018/credentials/v1",
  "type": "NutsOrganizationCredential"HealthcareProviderRoleTypeCredential",
  "issuer": "did:web:nuts.example.com:iam:issuer"657f064a-ebef-4f0f-aa87-88ed32db3142",
  "credentialSubject": {
    "id": "did:web:nuts.example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
    "organization": {
        "name"roleCodeNL": "Care bears",
        "city": "Care town"
    }X3"
  },
  "withStatusList2021Revocation"expirationDate": true"2027-10-27T00:00:00Z",
  "format": "jwt_vc"
}

See

APIissuer

Theand withStatusList2021RevocationcredentialSubject.id optionare allowsboth forthe credentialcare revocation.

organization's

Response:

DID:

{it "@context":[
    "https://nuts.nl/credentials/v1",
    "https://w3id.org/vc/status-list/2021/v1",
    "https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json",
    "https://www.w3.org/2018/credentials/v1"
  ],
  "type":["NutsOrganizationCredential","VerifiableCredential"],
  "id":"did:web:example.com:iam:issuer#f2fb02d3-6216-47b9-8e54-b30438a1090e",
  "issuanceDate":"2024-09-09T14:09:50.901123+02:00",
  "issuer":"did:web:example.com:iam"issuer",
  "credentialStatus":{
    "id":"https://example.com/statuslist/did:web:example.com:iam:issuer/1#5",
    "statusListCredential":"https://example.com/statuslist/did:web:example.com:iam:issuer/1",
    "statusListIndex":"5",
    "statusPurpose":"revocation",
    "type":"StatusList2021Entry"
  },
  "credentialSubject":{
    "id":"did:web:example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142",
    "organization":{
      "name":"Care bears",
      "city":"Care town"
    }
  },
  "proof":{...}
}

Load a Verifiable Credential

The Nuts node currently doesn't support a new (Nuts network is deprecated) method for exchanging Verifiable Credentials from issuer to holder. The issuer will have to sendissues the credential to theitself.

holderformat out-of-band.must be jwt_vc. The holderdefault canformat then(ldp_vc, uploadJSON-LD) fails, because no JSON-LD context defines roleCodeNL. Set expirationDate. Without it, the credential:node requires withStatusList2021Revocation.

The response is the credential as a JWT, in double quotes.

POST

Load /internal/vcr/v2/holder/did:web:example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142/vcthe {credential into the wallet

Issuing doesn't put the credential in the wallet. Load it as described in "@context":[Load "https://nuts.nl/credentials/v1"the credential into the wallet", "https://w3id.org/vc/status-list/2021/v1"using the response from the step above as the request body.

Lifecycle

Issue and load a new credential before expirationDate, "https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json",and "https://www.w3.org/2018/credentials/v1"when ],the "type":["NutsOrganizationCredential","VerifiableCredential"],care "id":"did:web:example.com:iam:issuer#f2fb02d3-6216-47b9-8e54-b30438a1090e",organization's "issuanceDate":"2024-09-09T14:09:50.901123+02:00",type "issuer":"did:web:example.com:iam"issuer",changes.

"credentialStatus":{

API "id":"https://example.com/statuslist/did:web:example.com:iam:issuer/1#5",reference: "statusListCredential":"https://example.com/statuslist/did:web:example.com:iam:issuer/1",Verifiable "statusListIndex":"5",Credential "statusPurpose":"revocation",Registry "type":"StatusList2021Entry"(v2)

}, "credentialSubject":{ "id":"did:web:example.com:iam:657f064a-ebef-4f0f-aa87-88ed32db3142", "organization":{ "name":"Care bears", "city":"Care town" } }, "proof":{...} }