Configuration

In this section, the configuration of the wallet is explained. Configuration is used based on a config.yaml file which should be placed in the apps/backend folder. This config.yaml file is loaded when booting the application. The values get type checked, and it gives a clear error message if there is a configuration field missing or provided incorrectly. Next to the config.yaml file, you can also set environment variables. These override the values that are listed in the config.yaml file.

Databases

By default, the development database is sqlite. We use postgres databases for production type instances of the wallets.

Authentication

Authentication for frontend services can be done via OAuth. This helps users who need to login to several components to authenticate themselves faster. The wallet is tested against the SSO Bridge, with an Helm chart provided alongside the Helm chart of the wallet, but other OAuth services should be usable (e.g. Keycloak, or hosted OAuth services).

DID Method

Two DID methods are currently supported: did:web and did:tdw. A comparison between the two is given below. The decision of which configuration to select should be made based on the specific use case of the wallet.

	did:web	did:tdw	did:key
TSG Configuration value:	did:web:	did:tdw:	- (DID Key is only supported for DID resolution but not for creation)
Specification link:	W3C internal document	BCGov specification draft	W3C internal document
Supported version:	Unofficial draft	Draft v1	Unofficial draft v0.7
Underlying technology:	Web-based DID method that serves the DID Document as a JSON under a certain endpoint (.well-known path) of a web domain that is accessible by the public.	Web-based DID method that utilizes a public JSON Lines file hosted under a web domain to store each change (create, update, delete) that occurs on a DID Document. The DID Document is then resolved by fetching and processing the JSON Lines file.	Multibase Multicodec public key, with generated DID document
Identifier format:	did:web:{{public web domain}} e.g. did:web:example.com	did:tdw:{{public web domain}}:{{generated self-certifying identifier}} e.g. did:tdw:example.com:b7ep277b2mvxdpcrbja3iergubfy	did:key:{{ Public key }}
Advantages:	Straightforward implementation with no additional processing other than hosting DID Document on web server.	Additional security and validation mechanisms contained in the JSON Lines file that increases trustworthiness of DID Document.	No server implementation required, so very suitable for mobile wallets
Disadvantages:	Easily compromisable without notice by resolving parties when malicious access is gained to the web server.	DID Document is not directly available as extra processing to verify signatures and validate entry hashes retrieved from the JSON Lines file needs to be performed to resolve the DID Document.	DID document only contains the verification method, so additional properties like service are not supported

Tenants

A wallet process serves one or more tenants. A tenant is a participant in its own right: it has its own keys, DID, issuer configuration, credentials and members. There is no special "default" tenant — the first tenant is declared exactly like the hundredth, under initTenants, and at least one entry is required.

initTenants:
  - name: Alice Corp
    slug: alice-corp
    members:
      - identifier: alice
        role: owner
    didServices:
      - id: did:web:wallet.example:tenants:alice-corp#control-plane
        type: connector
        serviceEndpoint: https://cp.example/

Members are invited by identifier — a user id, username or email address. The user does not have to exist yet: the invite becomes a membership the first time that user signs in.

Addressing

Every tenant is addressed by its slug, whether the process serves one tenant or a hundred:

• DID and protocol endpoints: https://wallet.example/tenants/<slug>/..., with DID did:web:wallet.example:tenants:<slug>.
• Management API: X-Tenant-Slug: <slug> (or X-Tenant-Id) on every call.

There is no unprefixed surface and no root did:web:<host> DID.

Upgrading from a pre-multi-tenancy deployment

The multi-tenancy migration moved all existing data onto a tenant with slug default. To keep that data reachable, either:

• keep slug: default in your new initTenants entry — the bootstrap adopts the existing row and nothing moves; or
• rename the tenant first with PATCH /management/tenants/default and then declare the new slug.

Issue Configurations

Issue configurations define the structure, validation rules, and visual presentation of credential types that the wallet can issue and manage. Each configuration combines semantic interoperability through JSON-LD contexts with schema validation and visual styling.

JSON-LD Context and Schema Relationship

Issue configurations leverage both JSON-LD contexts and JSON Schema for comprehensive credential definition:

• JSON-LD Context (document or documentUrl): Defines semantic meaning of credential properties for interoperability across systems
• JSON Schema (schema): Defines structure, validation rules, and user interface information for credential properties

Schema-Driven User Interface

The JSON Schema directly influences how credentials are presented to users:

• Property Order: Schema property order determines display order in user interfaces
• Human-Readable Titles: The title property provides user-friendly labels instead of technical property names
• Example Values: The example property shows users expected data format
• Validation Rules: Properties like enum, pattern, and required ensure data quality and guide user input when issuing credentials

Visual Styling

Issue configurations support visual customization through:

• Background Color (backgroundColor): Hex color code for credential background
• Background Image (backgroundImage): URL or base64-encoded image for credential branding. PNG-based images are recommended for transparency support and support across applications.
• Text Color (textColor): Hex color code for credential text
• Display Metadata (name, description): Human-readable credential information

Possible configuration parameters

Key	Required	Type	Description	Default
DatabaseConfig
db	Yes	DatabaseConfig	Database configuration
db.type	Yes	"sqlite" | "postgres"	Type of database
db.database	Yes	String	Name of the database
db.synchronize		Boolean	Synchronize database schema
db{type=sqlite}	Yes	SQLiteConfig	Database configuration
db{type=sqlite}.type		"sqlite" | "postgres"	Type of database	"sqlite"
db{type=sqlite}.database	Yes	String	Name of the database
db{type=sqlite}.synchronize		Boolean	Synchronize database schema
db{type=postgres}	Yes	PostgresConfig	Database configuration
db{type=postgres}.host	Yes	String	Host of the database
db{type=postgres}.port	Yes	Number	Port of the database
db{type=postgres}.username	Yes	String	Username of the database
db{type=postgres}.password	Yes	String	Password of the database
db{type=postgres}.ssl		Unknown	SSL configuration of the database
db{type=postgres}.type		"sqlite" | "postgres"	Type of database	"postgres"
db{type=postgres}.database	Yes	String	Name of the database
db{type=postgres}.synchronize		Boolean	Synchronize database schema
ServerConfig
server		ServerConfig	Server configuration
server.listen		String	IP address the server listens on	"0.0.0.0"
server.port		Number	Port the server listens on	3000
server.publicDomain		String	Public domain of the server	"localhost"
server.publicAddress		String	Public address of the server	"http://localhost:3000"
server.subPath		String	Sub path of the server
AuthConfig
auth	Yes	AuthConfig	Management authentication configuration
auth.enabled		Boolean	Enable authentication	true
auth.openIdConfigurationURL		String	OpenID configuration URL
auth.callbackURL		URL	Callback URL the auth service will redirect users
auth.redirectURL		URL	Redirect URL to UI after login/logout
auth.clientId		String	Client ID
auth.clientSecret		String	Client secret (required for client_secret_post authentication)
auth.tokenEndpointAuthMethod		"client_secret_post" | "private_key_jwt"	Token endpoint authentication method: client_secret_post (default) or private_key_jwt	"client_secret_post"
auth.privateKeyJwk		Object	Private key in JWK format for private_key_jwt authentication. Alternative to privateKeyJwkFile.
auth.privateKeyJwkFile		String	Path to file containing private key JWK for private_key_jwt authentication. Alternative to privateKeyJwk.
auth.permissionPath		String	JSON path to extract permissions from the token	"$.permissions[*]"
NodemailerConfiguration
email		NodemailerConfiguration	Email configuration
email.enabled	Yes	Boolean	Enable email sending
email.smtpFrom		String	Email address to send emails from
email.smtpPort		Number	SMTP port	465
email.smtpSecure		Boolean	SMTP secure connection	true
email.smtpServer		String	SMTP server
email.smtpUser		String	SMTP user
email.smtpPassword		String	SMTP password
email.title		String	Title
InitKeyConfig
initKeys		InitKeyConfig[]	Initial key configurations
initKeys[].type	Yes	"EdDSA" | "ES384" | "X509"	Type of key
initKeys[].id	Yes	String	ID of the key
initKeys[].default		Boolean	Default key
initKeys[].existingKey		String	Existing PKCS#8 encoded key
initKeys[].existingCertificate		String	Existing PEM encoded certificate
AddScope
initScopes		AddScope[]	Initial scope configurations
initScopes[].alias	Yes	String	Alias of the scope
initScopes[].discriminator	Yes	String	Discriminator of the scope, variables must be enclosed in
initScopes[].description	Yes	String	Description of the scope
PresentationDefinition
initScopes[].presentationDefinition	Yes	PresentationDefinition	Presentation definition associated with the scope, should include variables from the discriminator
initScopes[].presentationDefinition.id	Yes	String	undefined
InputDescriptor
initScopes[].presentationDefinition.input_descriptors	Yes	InputDescriptor[]	undefined
initScopes[].presentationDefinition.input_descriptors[].id	Yes	String	undefined
initScopes[].presentationDefinition.input_descriptors[].name		String	undefined
initScopes[].presentationDefinition.input_descriptors[].purpose		String	undefined
Format
initScopes[].presentationDefinition.input_descriptors[].format		Format	undefined
JwtVpClaimFormat
initScopes[].presentationDefinition.input_descriptors[].format.jwt_vp		JwtVpClaimFormat	undefined
initScopes[].presentationDefinition.input_descriptors[].format.jwt_vp.alg	Yes	String	undefined
Constraint
initScopes[].presentationDefinition.input_descriptors[].constraints	Yes	Constraint	undefined
Field
initScopes[].presentationDefinition.input_descriptors[].constraints.fields		Field[]	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].path	Yes	String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].id		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].purpose		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].name		String	undefined
Filter
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter		Filter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.type	Yes	String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.const		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.enum		Array	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.exclusiveMinimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.exclusiveMaximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.format		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.minLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.maxLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.minimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.maximum		Unknown	undefined
NestedFilter
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.type		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.const		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.enum		Array	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.exclusiveMinimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.exclusiveMaximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.format		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.minLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.maxLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.minimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.maximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.not		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.pattern		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.contains		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.required		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.properties		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.allOf		NestedFilter[]	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.not.items		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.pattern		String	undefined
NestedFilter
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.type		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.const		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.enum		Array	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.exclusiveMinimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.exclusiveMaximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.format		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.minLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.maxLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.minimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.maximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.not		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.pattern		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.contains		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.required		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.properties		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.allOf		NestedFilter[]	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.contains.items		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.required		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.properties		Object	undefined
NestedFilter
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf		NestedFilter[]	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].type		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].const		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].enum		Array	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].exclusiveMinimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].exclusiveMaximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].format		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].minLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].maxLength		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].minimum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].maximum		Unknown	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].not		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].pattern		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].contains		NestedFilter	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].required		String	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].properties		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].allOf		NestedFilter[]	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.allOf[].items		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].filter.items		Object	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.fields[].optional		Boolean	undefined
initScopes[].presentationDefinition.input_descriptors[].constraints.limit_disclosure			undefined
initScopes[].presentationDefinition.name		String	undefined
initScopes[].presentationDefinition.purpose		String	undefined
Format
initScopes[].presentationDefinition.format		Format	undefined
JwtVpClaimFormat
initScopes[].presentationDefinition.format.jwt_vp		JwtVpClaimFormat	undefined
initScopes[].presentationDefinition.format.jwt_vp.alg	Yes	String	undefined
initScopes[].requirementSetId		String	undefined
initScopes[].revision		Unknown	undefined
initScopes[].digest		String	undefined
initScopes[].immutable		Boolean	undefined
InitCredentialConfig
initCredentials		InitCredentialConfig[]	Initial credential configurations
initCredentials[].context		Unknown	JSON-LD contexts for the credential	[]
initCredentials[].type		String	Types of the verifiable credential	[]
initCredentials[].id	Yes	String	ID of the credential
initCredentials[].proofType			Type of proof used for the credential	"ldp"
initCredentials[].keyId		String	ID of key signing the credential
initCredentials[].validityDurationMs		Number	Validity duration of self-issued credentials in milliseconds. Defaults to 3 months.	7776000000
initCredentials[].revocable		Boolean	Revocable credential	true
initCredentials[].credentialSubject	Yes	Object	Credential subject
initCredentials[].evidence		Object	Evidence attached to the verifiable credential
TrustAnchorConfig
trustAnchors		TrustAnchorConfig[]	Trust anchor configurations
trustAnchors[].id	Yes	String	DID of the trust anchor
trustAnchors[].credentialTypes		String	Credential types trusted of the trust anchor	[]
IssueConfigurationConfig
issueConfigurations	Yes	IssueConfigurationConfig[]	Issue configuration settings
issueConfigurations[].id	Yes	String	ID of the configuration
issueConfigurations[].credentialType	Yes	String	Credential type associated with the configuration
issueConfigurations[].proofType			Proof type for the credential	"jwt"
issueConfigurations[].evidence		Object	Evidence attached to credentials issued with this configuration
issueConfigurations[].documentUrl		URL	URL of the JSON-LD context
issueConfigurations[].document		Object	JSON-LD context body
issueConfigurations[].schema		Object	JSON-Schema of the issue configuration
issueConfigurations[].name		String	Display name of the issue configuration
issueConfigurations[].description		String	Description of the issue configuration
issueConfigurations[].backgroundColor		String	Background color for the credential display
issueConfigurations[].backgroundImage		String	Background image for the credential display, must be a URL
issueConfigurations[].textColor		String	Text color for the credential display
PresentationDefinition
issueConfigurations[].issuancePolicy		PresentationDefinition	Presentation definition that the holder must satisfy before this credential is issued
issueConfigurations[].issuancePolicy.id	Yes	String	undefined
InputDescriptor
issueConfigurations[].issuancePolicy.input_descriptors	Yes	InputDescriptor[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].id	Yes	String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].name		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].purpose		String	undefined
Format
issueConfigurations[].issuancePolicy.input_descriptors[].format		Format	undefined
JwtVpClaimFormat
issueConfigurations[].issuancePolicy.input_descriptors[].format.jwt_vp		JwtVpClaimFormat	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].format.jwt_vp.alg	Yes	String	undefined
Constraint
issueConfigurations[].issuancePolicy.input_descriptors[].constraints	Yes	Constraint	undefined
Field
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields		Field[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].path	Yes	String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].id		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].purpose		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].name		String	undefined
Filter
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter		Filter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.type	Yes	String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.const		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.enum		Array	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.exclusiveMinimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.exclusiveMaximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.format		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.minLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.maxLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.minimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.maximum		Unknown	undefined
NestedFilter
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.type		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.const		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.enum		Array	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.exclusiveMinimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.exclusiveMaximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.format		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.minLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.maxLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.minimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.maximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.not		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.pattern		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.contains		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.required		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.properties		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.allOf		NestedFilter[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.not.items		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.pattern		String	undefined
NestedFilter
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.type		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.const		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.enum		Array	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.exclusiveMinimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.exclusiveMaximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.format		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.minLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.maxLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.minimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.maximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.not		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.pattern		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.contains		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.required		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.properties		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.allOf		NestedFilter[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.contains.items		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.required		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.properties		Object	undefined
NestedFilter
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf		NestedFilter[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].type		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].const		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].enum		Array	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].exclusiveMinimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].exclusiveMaximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].format		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].minLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].maxLength		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].minimum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].maximum		Unknown	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].not		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].pattern		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].contains		NestedFilter	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].required		String	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].properties		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].allOf		NestedFilter[]	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.allOf[].items		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].filter.items		Object	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.fields[].optional		Boolean	undefined
issueConfigurations[].issuancePolicy.input_descriptors[].constraints.limit_disclosure			undefined
issueConfigurations[].issuancePolicy.name		String	undefined
issueConfigurations[].issuancePolicy.purpose		String	undefined
Format
issueConfigurations[].issuancePolicy.format		Format	undefined
JwtVpClaimFormat
issueConfigurations[].issuancePolicy.format.jwt_vp		JwtVpClaimFormat	undefined
issueConfigurations[].issuancePolicy.format.jwt_vp.alg	Yes	String	undefined
issueConfigurations[].canReIssue		Boolean	Whether credentials of this type may be automatically reissued before they expire. Defaults to true.	true
IssuanceConfig
issuance	Yes	IssuanceConfig	Issuance configuration
issuance.dcpProfile		"vc20-bssl/jwt"	DCP credential profile used for issuance and requests	"vc20-bssl/jwt"
issuance.preAuthorizedCodeTtlMs		Number	Lifetime of OID4VCI pre-authorized codes in milliseconds	300000
IssuerConfig
issuance.issuer	Yes	IssuerConfig[]	Issuer configuration
issuance.issuer[].tenantSlug		String	Tenant slug that acts as issuer (multi-tenant only)
issuance.issuer[].holderId	Yes	String	DID of the holder
issuance.issuer[].credentialType	Yes	String	Credential type to be issued
issuance.issuer[].credentialId		String	Stable logical credential ID to use for this configured issuance. Defaults to a holder-bound random ID.
issuance.issuer[].credentialSubject	Yes	Object	Credential subject
issuance.issuer[].preAuthorizedCode		String	Pre-authorized code
issuance.issuer[].validityDurationMs		Number	Validity duration of self-issued credentials in milliseconds. Defaults to 3 months.	7776000000
issuance.issuer[].reissueBeforeExpiryMs		Number	How long before a credential's expiry (in milliseconds) a reissue offer is sent to the holder. Defaults to 7 days. Reissuance can be disabled per credential type via the issue configuration's canReIssue flag.	604800000
DCPHolderConfig
issuance.dcp	Yes	DCPHolderConfig[]	DCP Holder configuration
issuance.dcp[].tenantSlug		String	Tenant slug that acts as holder/claimer (multi-tenant only)
issuance.dcp[].preAuthorizedCode	Yes	String	Pre-authorized code
issuance.dcp[].issuerId	Yes	String	DID identifier of the issuer
issuance.dcp[].credentialType	Yes	String	Credential type to be issued
issuance.dcp[].preferredProofType			Preferred proof type for the credential	"jwt"
OID4VCIHolderConfig
issuance.oid4vci	Yes	OID4VCIHolderConfig[]	OID4VCI Holder configuration
issuance.oid4vci[].tenantSlug		String	Tenant slug that acts as holder/claimer (multi-tenant only)
issuance.oid4vci[].preAuthorizedCode	Yes	String	Pre-authorized code
issuance.oid4vci[].issuerUrl	Yes	URL	Root URL of the issuer
issuance.oid4vci[].credentialType	Yes	String	Credential type(s) to be issued
issuance.statusListCount		Number	Maximum number of status list entries per StatusListCredential	1000
DidServiceConfig
didServices	Yes	DidServiceConfig[]	DID service configurations
didServices[].id	Yes	String	ID of the service
didServices[].type	Yes	String	Type of the service
didServices[].serviceEndpoint	Yes	URL	Service endpoint
DcpStsConfig
dcpSts		DcpStsConfig	DCP self-issued token configuration
dcpSts.tokenTtlSeconds		Number	Lifetime of DCP self-issued tokens in seconds	300
InitTenantConfig
initTenants	Yes	InitTenantConfig[]	Tenants served by this process, created on startup. At least one tenant must be declared; every tenant is addressed as /tenants/:slug/...
DidServiceConfig
initTenants[].didServices		DidServiceConfig[]	DID service configurations specific to this tenant
initTenants[].didServices[].id	Yes	String	ID of the service
initTenants[].didServices[].type	Yes	String	Type of the service
initTenants[].didServices[].serviceEndpoint	Yes	URL	Service endpoint
initTenants[].name	Yes	String	Display name of the tenant
initTenants[].slug	Yes	String	URL-safe slug for the tenant
InitTenantMemberConfig
initTenants[].members		InitTenantMemberConfig[]	Users granted access to this tenant on startup
initTenants[].members[].identifier	Yes	String	Username, email or auth subject id (sub) of the user
initTenants[].members[].username		String	Display name to record for the user, when known
initTenants[].members[].role		"owner" | "admin" | "member"	Role granted to the user within the tenant	"member"
RuntimeConfig
runtime	Yes	RuntimeConfig	Runtime configuration
runtime.title		String	Title of the wallet
runtime.acceptUnauthenticatedCredentialRequests		Boolean	Accept unauthenticated credential requests
runtime.issueMobileCredentials		Boolean	Issue mobile credentials
runtime.issueDebugCredentials		Boolean	Issue debug credentials
runtime.color		String	Primary color of the wallet	"#3B8BF6"
runtime.lightThemeUrl		String	Light theme logo URL
runtime.darkThemeUrl		String	Dark theme logo URL
DidConfig
did		DidConfig	DID configuration
did.method		"did:web:" | "did:tdw:"	Provided DID method	"did:web:"
did.keyFormat		"JWK" | "Multikey"	Provided key format	"JWK"
AuditModuleConfig
audit		AuditModuleConfig	Audit logging configuration
audit.enabled		Boolean	Enable audit logging	true
audit.minSeverity		"debug" | "info" | "warning" | "error" | "critical"	Minimum severity level to log	"info"
audit.logDenied		Boolean	Always log denied access attempts regardless of action type	true
audit.logDelegated		Boolean	Log delegated access attempts when enabled, while still respecting action-specific success filters	true
audit.logMutations		Boolean	Log successful mutation actions (create, update, delete, manage)	true
audit.logExecute	Yes	Boolean	Log successful execute actions
audit.logReads	Yes	Boolean	Log successful read actions — disabled by default as reads are frequent and rarely relevant for auditing
audit.sensitiveResources		Unknown	Resources that are always logged regardless of action-specific success filters	["w.key","w.credential","sso.user"]
AuditHandlersConfig
audit.handlers		AuditHandlersConfig	Handler configuration
audit.handlers.console	Yes	Boolean	Enable console audit log handler
audit.handlers.database		Boolean	Enable database audit log handler	true
audit.handlers.otlp	Yes	Boolean	Enable OTLP audit log handler
OtlpAuditHandlerConfig
audit.otlp		OtlpAuditHandlerConfig	OTLP audit log handler configuration
audit.otlp.url		String	OTLP HTTP logs endpoint URL	"http://localhost:4318/v1/logs"
audit.otlp.headers		Object	Additional HTTP headers to include in OTLP requests
audit.otlp.timeoutMillis		Unknown	OTLP export timeout in milliseconds	5000
audit.otlp.concurrencyLimit		Unknown	Maximum number of concurrent OTLP export requests	1
audit.otlp.serviceName		String	Service name included on OTLP log attributes	"tsg-dsp-api"
audit.otlp.serviceVersion		String	Optional service version included on OTLP log attributes