Repository navigation
Clarify mismatch between dcql_query.credentials[*].format and vp_formats_supported verifier metadata #797
Description
There may be edge cases cases where the verifier sends a redirect-based OID4VP request to the wallet that requires vp_formats_supported with a list of VP formats that don't include any or all of the dcql_query.credentials[*].format attributes. It is undefined what the wallet should do in this case.
Should we assume the wallet returns an vp_formats_not_supported error or not return anything (which is always possible)? We could include this error condition as an additional item in the list of failure cases for vp_formats_not_supported error.
Any thoughts @c2bo @jogu @GarethCOliver @TimoGlastra ?
Metadata
Metadata
Assignees
Labels
No labels
Activity
charsleysa commentedon Sep 10, 2026
I would say the vp_formats_not_supported error is not quite correct and instead the wallet should treat it the same as no matching credentials found.
awoie commentedon Sep 17, 2026
Then we should say something in access_denied about this. vp_formats_supported is not part of the dcql query.
dpostnikov commentedon Sep 18, 2026
@awoie - existing text wouldn't work?
The Wallet did not have the requested Credentials to satisfy the Authorization Request.How would you suggest to enhance it?
brentzundel commentedon Sep 18, 2026
I am not at all understanding the edge case. It seems like if the wallet doesn't have credentials with any or all of the dcql_query.credentials[*].format attributes, that behavior is defined.
What am I not understanding?
c2bo commentedon Sep 23, 2026
I think I agree with @brentzundel here
awoie commentedon Sep 24, 2026
Ok, I think the interpretation works but it is not quite obvious because in this specific case, the authz request could be not consistent with the DCQL query. Can we perhaps say at least something in the access_denied section to include this case? Otherwise, to me it is not clear whether access_denied or invalid_request is more appropriate.
brentzundel commentedon Sep 24, 2026
Discussed today. @awoie will raise a PR that clarifies that access denied errors apply to this situation as well.
brentzundel commentedon Sep 24, 2026
@bc-pi recommends using
invalid requestas the error returnedGarethCOliver commentedon Sep 24, 2026
The reason for it being
invalid requestis that omitting the entry from the vp_formats_supported for a particular credential type violates a MUST condition for constructing the request:e.g. for IETF SD-JWTs section B.3.4 says 'The vp_formats_supported parameter of the Verifier metadata or Wallet metadata MUST have the Credential Format Identifier as a key...'
So a request that contains dc+sd-jwt but does not have dc+sd-jwt as a key is an invalid request, and rejecting it as such (independent of whether or not the Wallet has an SD-JWT) would be valid behavior.