Skip to content
Registry StackDocsDevelopment (unreleased)

List the complete Evidence request shapes available to the authenticated caller

GET
/v1/evidence-definitions
curl --request GET \
  --url https://example.com/v1/evidence-definitions \
  --header 'Authorization: Bearer <token>'

Authorizations

Section titled “Authorizations”

Responses

Section titled “ Responses ”

200

Section titled “200”

Requester-scoped Evidence definitions

Media typeapplication/json
Requester-scoped Evidence definitions Version 1
object
assuranceProfile
required
string
Allowed values: local production evidence-grade
audience
required
string format: uri
<= 512 characters
definitions
required
Array<object>
<= 16384 items unique items
object
concepts
required
Array<object>
>= 1 items <= 16 items unique items
object
concept
required
string format: uri
<= 512 characters
form
required
One of:
string
Allowed values: boolean integer string date-bucket time-bucket entity-reference structured
handle
required
string
/^[a-z][a-z0-9._-]{0,127}$/
required
required
boolean
configurationRevision
required
string
/^sha256:[a-f0-9]{64}$/
evidenceType
required
string format: uri
<= 512 characters
handle
required
string
/^[a-z][a-z0-9._-]{0,127}$/
kind
required
string
Allowed values: criterion information-requirement constraint
purpose
required
string
/^[a-z][a-z0-9._:-]{0,127}$/
referenceFrameworks
required
Array<string>
>= 1 items <= 16 items unique items
requirement
required
string format: uri
<= 512 characters
responseFormats
required
Array<string>
>= 1 items <= 4 items unique items
Allowed values: signed-jws unsigned-json sd-jwt-vc sd-jwt-vc-batch
subjectBindingMode

What the subject bindings in this requirement’s assertions are derived under. The vocabulary is closed and carries no default: absence means audience-scoped, stated here so a relying party reading a definition without the key knows the requirement issues audience-scoped assertions and is not reading an omission it has to resolve elsewhere. A definition that does carry the key states the mode explicitly.

string
Allowed values: audience-scoped holder-bound
subjects
required
Array<object>
>= 1 items <= 8 items unique items
object
cardinality
required
string
Allowed values: one
role
required
string
/^[a-z][a-z0-9._-]{0,63}$/
selector
required
object
fields
required
Array
>= 1 items <= 16 items unique items
One of:
object
maximumBytes
required
integer
>= 1 <= 8192
minimumBytes
required
integer
>= 1 <= 8192
name
required
string
/^[a-z][a-z0-9._-]{0,63}$/
type
required
string
Allowed values: string
profile
required
string
/^[a-z][a-z0-9._-]{0,127}$/
valueOrigin
required
string
Allowed values: request authenticated-context authenticated-grant
holderBoundBatchMaxSize
required

The effective deployment ceiling for one holder-bound batch. A protocol adapter may advertise no larger batch than this value.

integer
>= 1 <= 16
issuedBy
required
string format: uri
<= 512 characters
providedBy
required
string format: uri
<= 512 characters
schema
required
string
Allowed values: registry.evidence-definitions/v1
Example
{
  "assuranceProfile": "local",
  "definitions": [
    {
      "concepts": [
        {
          "form": "boolean"
        }
      ],
      "kind": "criterion",
      "responseFormats": [
        "signed-jws"
      ],
      "subjectBindingMode": "audience-scoped",
      "subjects": [
        {
          "cardinality": "one",
          "selector": {
            "fields": [
              {
                "type": "string"
              }
            ],
            "valueOrigin": "request"
          }
        }
      ]
    }
  ],
  "schema": "registry.evidence-definitions/v1"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

traceparent
string
/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

400

Section titled “400”

Malformed discovery request

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: evidence.invalid_request
detail
required
string
Allowed values: the Evidence request is invalid
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Evidence request is invalid
traceId
required
string
/^(?!0{32}$)[0-9a-f]{32}$/
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request
code
required
string
Allowed values: evidence.invalid_request
detail
required
string
Allowed values: the Evidence request is invalid
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Evidence request is invalid
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request
Example
{
  "code": "evidence.invalid_request",
  "detail": "the Evidence request is invalid",
  "status": 400,
  "title": "Evidence request is invalid",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

traceparent
string
/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

401

Section titled “401”

Authentication failed

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: evidence.invalid_request
detail
required
string
Allowed values: the Evidence request is invalid
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Evidence request is invalid
traceId
required
string
/^(?!0{32}$)[0-9a-f]{32}$/
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request
code
required
string
Allowed values: auth.invalid_credential
detail
required
string
Allowed values: bearer access token validation failed
status
required
integer
Allowed values: 401
title
required
string
Allowed values: Bearer access token is invalid
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/auth/invalid_credential
Example
{
  "code": "auth.invalid_credential",
  "detail": "bearer access token validation failed",
  "status": 401,
  "title": "Bearer access token is invalid",
  "type": "https://id.registrystack.org/problems/registry-evidence/auth/invalid_credential"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

WWW-Authenticate
string
/^Bearer realm=\"registry-evidence\", resource_metadata=\"https?://[^\"]+/\.well-known/oauth-protected-resource\"$/
traceparent
string
/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

429

Section titled “429”

Request rate exceeded

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: evidence.invalid_request
detail
required
string
Allowed values: the Evidence request is invalid
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Evidence request is invalid
traceId
required
string
/^(?!0{32}$)[0-9a-f]{32}$/
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request
code
required
string
Allowed values: evidence.rate_limited
detail
required
string
Allowed values: the Evidence request rate is exhausted
status
required
integer
Allowed values: 429
title
required
string
Allowed values: Evidence request rate is exhausted
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/rate_limited
Example
{
  "code": "evidence.rate_limited",
  "detail": "the Evidence request rate is exhausted",
  "status": 429,
  "title": "Evidence request rate is exhausted",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/rate_limited"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Retry-After
string
Allowed values: 1
traceparent
string
/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

503

Section titled “503”

Service temporarily unavailable

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: evidence.invalid_request
detail
required
string
Allowed values: the Evidence request is invalid
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Evidence request is invalid
traceId
required
string
/^(?!0{32}$)[0-9a-f]{32}$/
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request
code
required
string
Allowed values: service.unavailable
detail
required
string
Allowed values: the request could not be served
status
required
integer
Allowed values: 503
title
required
string
Allowed values: Service is unavailable
type
required
string
Allowed values: https://id.registrystack.org/problems/registry-evidence/service/unavailable
Example
{
  "code": "service.unavailable",
  "detail": "the request could not be served",
  "status": 503,
  "title": "Service is unavailable",
  "type": "https://id.registrystack.org/problems/registry-evidence/service/unavailable"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

traceparent
string
/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.