1 of 1

ID Authentication

eSignet is integrated with the MOSIP ID Authentication module as an authentication provider. The defined plugins interface has been implemented using the APIs available in the MOSIP ID Authentication module.

Here is a list of the APIs that have been integrated into the eSignet plugin interface implementation.

KYC Authentication API to perform authentication for an identity provider like eSignet
KYC Exchange API to share an encrypted KYC token to an identity provider
Key Binding API to authenticate a user to bind the ID and Wallet of an user
VC Exchange API to share the VC associate to a user who was authenticated earlier and has shared the associated KYC Token

Appendix - API Specifications

ID Authentication

Here is a list of the APIs that have been integrated into the eSignet plugin interface implementation.

KYC Authentication API to perform authentication for an identity provider like eSignet
KYC Exchange API to share an encrypted KYC token to an identity provider
Key Binding API to authenticate a user to bind the ID and Wallet of an user
VC Exchange API to share the VC associate to a user who was authenticated earlier and has shared the associated KYC Token

Appendix - API Specifications

KYC Authentication

API to perform the ID Authentication based on allowed auth policy. Does validation of provided path parameters before doing the actual authentication. Returns a new KYC token and partner specific user token. This API should be called from IdP service only.

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/key-auth/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}

Path parameters

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

Auth Request Body

id*string

IDA standard request ID. Eg: mosip.identity.kycauth

version*string

Version of the API. Current supported version is '1.0'

individualId*string

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionID*string

any random alpha numberic string. Allowed max size is 10.

requestTime*string

Request created time

specVersion*string

IDA Specification version. Current Supported version is 1.0

thumbprint*string

Thumbprint of the certificate used for encrypting the auth request.

domainUri*string

Domain uri of the server

env*string

Name of the environment

request*object

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

otp*string

This attributes is mandatory if OTP Authentication is performed.

staticPinstring

This is not supported auth factor in current IDA version.

timestamp*string

This attributes is mandatory if Demographics Authentication is performed.

demographics*object

This attributes is mandatory if Demographics Authentication is performed.

agestring

dobstring

namearray of object

languagestring

valuestring

dobTypearray of object

languagestring

valuestring

genderarray of object

languagestring

valuestring

phoneNumberstring

emailIdstring

addressLine1array of object

languagestring

valuestring

addressLine2array of object

languagestring

valuestring

addressLine3array of object

languagestring

valuestring

location1array of object

languagestring

valuestring

location2array of object

languagestring

valuestring

location3array of object

languagestring

valuestring

postalCodestring

fullAddressarray of object

languagestring

valuestring

metadataobject

property1object

property2object

biometrics*array of object

This attributes is mandatory if BIOMETRICS Authentication is performed.

data*object

Data attribute contains captured encrypted biometric. Data object should be formed as per the SBI Spec. All inner objects and inner attributes are mandatory as per SBI Specifications.

digitalIdobject

serialNostring

makestring

modelstring

typestring

deviceSubTypestring

deviceProviderstring

dpstring

dpIdstring

deviceProviderIdstring

dateTimestring

bioTypestring

bioSubTypestring

bioValuestring

deviceCodestring

deviceServiceVersionstring

transactionIdstring

timestampstring

purposestring

envstring

versionstring

domainUristring

requestedScoreinteger

qualityScoreinteger

hashstring

sessionKeystring

specVersionstring

thumbprintstring

keyBindedTokens*object

This attributes is mandatory if Key Binded Token Authentication is performed.

typestring

Token type for which the key needs to be binded. Supported token type(s): WLA (Wallet Local Auth)

tokenstring

TOken created in JWT format with below list of mandatory claims.

formatstring

In Which format the token needs to be generated. Current supported format is JWT.

consentObtained*boolean

User provided Consent either true or false

requestHMAC*string

HMAC value generated of the whole request.

requestSessionKey*string

Session key used to encrypt the request.

metadataobject

Any additional attributes needs to be processedin authentication.

property1object

property2object

allowedKycAttributesarray of string

Allowed KYC Attributes List.

itemsstring

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycauth

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the details whether auth is successful or not. If Auth successful kycToken will be included in the response otherwise kycToken will be null.

kycToken*string

If Auth successful kycToken will be included in the response otherwise kycToken will be null.

authToken*string

Partner Specific User Token will be generated and returned. Both auth success/failed case PSU token will be included in the response.

kycStatus*boolean

Auth Status. True will be returned if auth is successful otherwise false.

errors*array of object

In case of auth failed, respective all errors will be returned as an array. Each error object contains error code and error message. If auth success, error object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

kyc-exchange

API to validate kycToken returned in kyc-auth call that the kycToken belongs to the provided oidc-client-id and returns encrypted kyc to the caller. This API should be called from IdP service only.

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/kyc-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}

Path parameters

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

id*string

IDA standard request ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

requesttime*string

Request created time.

transactionID*string

Same transaction ID used in kyc-auth request.

individualId*string

UIN/VID of the individual.

kycToken*string

kyc token received in kycAuth API response.

consentObtained*array of string

List of consents obtained from user.

itemsstring

localesarray of string

user selected list of languages.

itemsstring

resTypestring

Response Type for the user claims. Currently defaulted to signed JWT.

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the user kyc. KYC will be build based the consented user claims.

encryptedKyc*string

JWT Signed user consented claims.

errors*array of object

In case of invalid kyc token, errors will be returned as an array. Each error object contains error code and error message. if kyc token is valid the errors object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

Key Binding

API to perform the ID Authentication based for the provided identity data and based on allowed auth policy. To identity the auth partner API will perform validation of provided path parameters before performing the actual authentication. Wallet will include a public key in the request to be binded for the input VID/UIN Returns a status of key binding, partner specific user token, certificate generated for the input public key (this certificate will be binded to the input VID/UIN). Certificate will be returned only when the authenticate is passed. This API should be called from eSignet service and from Inji Wallet.

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/identity-key-binding/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

OIDC-Client-Id*string

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

Auth Request Body

id*string

IDA standard request ID. Eg: mosip.identity.keybinding

version*string

Version of the API. Current supported version is '1.0'

individualId*string

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionID*string

any random alpha numberic string. Allowed max size is 10.

requestTime*string

Request created time

specVersion*string

IDA Specification version. Current Supported version is 1.0

thumbprint*string

Thumbprint of the certificate used for encrypting the auth request.

domainUri*string

Domain uri of the server

env*string

Name of the environment

request*object

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

otp*string

This attributes is mandatory if OTP Authentication is performed.

staticPinstring

This is not supported auth factor in current IDA version.

timestamp*string

This attributes is mandatory if Demographics Authentication is performed.

demographics*object

This attributes is mandatory if Demographics Authentication is performed.

agestring

dobstring

namearray of object

languagestring

valuestring

dobTypearray of object

languagestring

valuestring

genderarray of object

languagestring

valuestring

phoneNumberstring

emailIdstring

addressLine1array of object

languagestring

valuestring

addressLine2array of object

languagestring

valuestring

addressLine3array of object

languagestring

valuestring

location1array of object

languagestring

valuestring

location2array of object

languagestring

valuestring

location3array of object

languagestring

valuestring

postalCodestring

fullAddressarray of object

languagestring

valuestring

metadataobject

property1object

property2object

biometrics*array of object

This attributes is mandatory if BIOMETRICS Authentication is performed.

data*object

Data attribute contains captured encrypted biometric. Data object should be formed as per the SBI Spec. All inner objects and inner attributes are mandatory as per SBI Specifications.

digitalIdobject

serialNostring

makestring

modelstring

typestring

deviceSubTypestring

deviceProviderstring

dpstring

dpIdstring

deviceProviderIdstring

dateTimestring

bioTypestring

bioSubTypestring

bioValuestring

deviceCodestring

deviceServiceVersionstring

transactionIdstring

timestampstring

purposestring

envstring

versionstring

domainUristring

requestedScoreinteger

qualityScoreinteger

hashstring

sessionKeystring

specVersionstring

thumbprintstring

consentObtained*boolean

User provided Consent either true or false

requestHMAC*string

HMAC value generated of the whole request.

requestSessionKey*string

Session key used to encrypt the request.

metadataobject

Any additional attributes needs to be processedin authentication.

property1object

property2object

identityKeyBinding*object

Key details needs to be binded to the identity after successful authentication.

publicKeyJWK*object

At least 1 key input needs to be provided. The input public key to be in JWK format. Multiple keys are allowed to be binded to the same identity. Supported key type: RSA

additionalProp1*object

Public Key in JWK format. Eg: { "kty": "RSA", "e": "AQAB", "use": "sig", "alg": "RS256", "n": "p3Beq05VQmU_opZdrXtHLrJiXr7Yl4FnDt4UkvQEw8HGW-xY8UFfhF01zedrV1FHg38uqOlYbkLnYGRjyt_dgW2BZBEYpcB93sLWrdx59EquRyF4I6B_sq1gHijzBYXmOxFl8NBR6x2d7tyVgAV4YhJ3e070Ik2AUhZsHLDtiaPFKkxxo1cOjxsL5g5jBM-OOzonV6n61jjjexgWNNwYqop2viklmlQrrUE0VEnDOUwQowWtRqHbS4GDoUBb6ea9DONWxO1As6yDdKukb5KJ4O2z_okRmj9CN3u2ZanCW3xsI5_EBCHE7VpD1CWk5u_aFmCGJ7gIjI2uBfPmF-7qFw" }

additionalProp2object

additionalProp3object

authFactorType*string

Authe Factor Type for the binded key. Eg: WLA

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.keybinding

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the details whether auth is successful or not. If Auth successful kycToken will be included in the response otherwise kycToken will be null.

identityCertificate*string

If Auth successful a certificate will be generated using IDA Key Binding and returned as identity certificate.

authToken*string

Partner Specific User Token will be generated and returned. Both auth success/failed case PSU token will be included in the response.

bindingAuthStatus*boolean

Binding Auth Status. True will be returned if auth is successful and key binding is completed otherwise false.

errors*array of object

In case of auth failed, respective all errors will be returned as an array. Each error object contains error code and error message. If auth success, error object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

vci-exchange

API to validate kycToken returned in kyc-auth call that the kycToken belongs to the provided oidc-client-id & issued to the same identity used in kyc-auth and returns verifiable credentials to the caller. This API should be called from eSignet service.

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/vci-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

OIDC-Client-Id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

id*string

IDA standard request ID. Eg: mosip.identity.vciexchange

version*string

Version of the API. Current supported version is '1.0'

requesttime*string

Request created time.

transactionID*string

Tansaction ID used in kyc-auth request.

individualId*string

UIN/VID of the individual.

vcAuthToken*string

kyc token received in kycAuth API response.

credSubjectId*string

JWK DID of the Identity. Eg: did:jwk:ewogICAgImt0eSI6ICJSU0EiLAogICAgImUiOiAiQVFBQiIsCiAgICAibiI6ICJtaFZOaERpaW1WdTQxV0xCRWJzYVpLWUZRTTJrZXBHREQwWDRZNHp2VW8zZEVET3lTbDd0bXhha3RfVnlodXRJdWp3ZlJQMmxTTTRIQ2lZS3BYSXdBNmljVHIyWThDSnc2VDU1bWVRWWJmRHZxLV9QRXNWMDRobEYzUS10cnU2ajhPbUpRdWwzTGtSR05mN3Z6VFNSRmstUU9rcmNuVDRPaC1YbGhCRjhFNFFHNFdTVFF2Qk1xOVdTQ05lZjZkVWFOQ3JXY0lDQ1Q2bi1peHFKLTJBREEzYk5TcWpqS0REQktTM1VPRy1jbUlfTTdKY19BYWJod1JLLTM2blphWGJWLUdQYjR5UjdTNVY5MUhtdTZhS3JJdVdRM1ByY0FlWkZvZ1VuYjlLMUpHS0dhOWJ2S3F0TWd5TjNLdS1aMFdDT3Z1dUtMNndNNzduSDJWdGtJRDZNNVEiCn0

vcFormat*string

Verifiable credential format needed in response object. Supported Format : ldp_vc

credentialsDefinition*object

Credential Definition Object of the Identity.

credentialSubjectobject

List of optional claims to be added to the credential to be issued.

property1object

property2object

type*array of string

Issued credentials should have at least one type from the list of types.

itemsstring

contextarray of string

list of Context URI to validate the credential subject.

itemsstring

localesarray of string

list of locales to be included in the issued VC.

itemsstring

metadataobject

property1object

property2object

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the issued VC. Different response object types will be returned based the requested format. Eg: for ldp_vc the returned response object is JsonLDObject

errors*array of object

In case of invalid kyc token, errors will be returned as an array. Each error object contains error code and error message. if kyc token is valid the errors object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

kyc-exchange

API to validate kycToken returned in kyc-auth call that the kycToken belongs to the provided oidc-client-id and returns encrypted kyc to the caller. This API should be called from IdP service only.

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/kyc-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}

Path parameters

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

id*string

IDA standard request ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

requesttime*string

Request created time.

transactionID*string

Same transaction ID used in kyc-auth request.

individualId*string

UIN/VID of the individual.

kycToken*string

kyc token received in kycAuth API response.

consentObtained*array of string

List of consents obtained from user.

itemsstring

localesarray of string

user selected list of languages.

itemsstring

resTypestring

Response Type for the user claims. Currently defaulted to signed JWT.

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the user kyc. KYC will be build based the consented user claims.

encryptedKyc*string

JWT Signed user consented claims.

errors*array of object

In case of invalid kyc token, errors will be returned as an array. Each error object contains error code and error message. if kyc token is valid the errors object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

vci-exchange

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/vci-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

OIDC-Client-Id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

id*string

IDA standard request ID. Eg: mosip.identity.vciexchange

version*string

Version of the API. Current supported version is '1.0'

requesttime*string

Request created time.

transactionID*string

Tansaction ID used in kyc-auth request.

individualId*string

UIN/VID of the individual.

vcAuthToken*string

kyc token received in kycAuth API response.

credSubjectId*string

vcFormat*string

Verifiable credential format needed in response object. Supported Format : ldp_vc

credentialsDefinition*object

Credential Definition Object of the Identity.

credentialSubjectobject

List of optional claims to be added to the credential to be issued.

property1object

property2object

type*array of string

Issued credentials should have at least one type from the list of types.

itemsstring

contextarray of string

list of Context URI to validate the credential subject.

itemsstring

localesarray of string

list of locales to be included in the issued VC.

itemsstring

metadataobject

property1object

property2object

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycexchange

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the issued VC. Different response object types will be returned based the requested format. Eg: for ldp_vc the returned response object is JsonLDObject

errors*array of object

In case of invalid kyc token, errors will be returned as an array. Each error object contains error code and error message. if kyc token is valid the errors object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

KYC Authentication

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/key-auth/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}

Path parameters

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-id*string

OIDC client Id. Auto generated while creating OIDC client in PMS

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

Auth Request Body

id*string

IDA standard request ID. Eg: mosip.identity.kycauth

version*string

Version of the API. Current supported version is '1.0'

individualId*string

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionID*string

any random alpha numberic string. Allowed max size is 10.

requestTime*string

Request created time

specVersion*string

IDA Specification version. Current Supported version is 1.0

thumbprint*string

Thumbprint of the certificate used for encrypting the auth request.

domainUri*string

Domain uri of the server

env*string

Name of the environment

request*object

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

otp*string

This attributes is mandatory if OTP Authentication is performed.

staticPinstring

This is not supported auth factor in current IDA version.

timestamp*string

This attributes is mandatory if Demographics Authentication is performed.

demographics*object

This attributes is mandatory if Demographics Authentication is performed.

agestring

dobstring

namearray of object

languagestring

valuestring

dobTypearray of object

languagestring

valuestring

genderarray of object

languagestring

valuestring

phoneNumberstring

emailIdstring

addressLine1array of object

languagestring

valuestring

addressLine2array of object

languagestring

valuestring

addressLine3array of object

languagestring

valuestring

location1array of object

languagestring

valuestring

location2array of object

languagestring

valuestring

location3array of object

languagestring

valuestring

postalCodestring

fullAddressarray of object

languagestring

valuestring

metadataobject

property1object

property2object

biometrics*array of object

This attributes is mandatory if BIOMETRICS Authentication is performed.

data*object

Data attribute contains captured encrypted biometric. Data object should be formed as per the SBI Spec. All inner objects and inner attributes are mandatory as per SBI Specifications.

digitalIdobject

serialNostring

makestring

modelstring

typestring

deviceSubTypestring

deviceProviderstring

dpstring

dpIdstring

deviceProviderIdstring

dateTimestring

bioTypestring

bioSubTypestring

bioValuestring

deviceCodestring

deviceServiceVersionstring

transactionIdstring

timestampstring

purposestring

envstring

versionstring

domainUristring

requestedScoreinteger

qualityScoreinteger

hashstring

sessionKeystring

specVersionstring

thumbprintstring

keyBindedTokens*object

This attributes is mandatory if Key Binded Token Authentication is performed.

typestring

Token type for which the key needs to be binded. Supported token type(s): WLA (Wallet Local Auth)

tokenstring

TOken created in JWT format with below list of mandatory claims.

formatstring

In Which format the token needs to be generated. Current supported format is JWT.

consentObtained*boolean

User provided Consent either true or false

requestHMAC*string

HMAC value generated of the whole request.

requestSessionKey*string

Session key used to encrypt the request.

metadataobject

Any additional attributes needs to be processedin authentication.

property1object

property2object

allowedKycAttributesarray of string

Allowed KYC Attributes List.

itemsstring

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.kycauth

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the details whether auth is successful or not. If Auth successful kycToken will be included in the response otherwise kycToken will be null.

kycToken*string

If Auth successful kycToken will be included in the response otherwise kycToken will be null.

authToken*string

Partner Specific User Token will be generated and returned. Both auth success/failed case PSU token will be included in the response.

kycStatus*boolean

Auth Status. True will be returned if auth is successful otherwise false.

errors*array of object

In case of auth failed, respective all errors will be returned as an array. Each error object contains error code and error message. If auth success, error object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

Key Binding

POSThttps://api-internal.collab.mosip.net/idauthentication/v1/identity-key-binding/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

Auth-Partner-ID*string

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

IdP-LK*string

IdP Service License Key. This LK is similar MISP-LK.

OIDC-Client-Id*string

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

Auth Request Body

id*string

IDA standard request ID. Eg: mosip.identity.keybinding

version*string

Version of the API. Current supported version is '1.0'

individualId*string

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionID*string

any random alpha numberic string. Allowed max size is 10.

requestTime*string

Request created time

specVersion*string

IDA Specification version. Current Supported version is 1.0

thumbprint*string

Thumbprint of the certificate used for encrypting the auth request.

domainUri*string

Domain uri of the server

env*string

Name of the environment

request*object

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

otp*string

This attributes is mandatory if OTP Authentication is performed.

staticPinstring

This is not supported auth factor in current IDA version.

timestamp*string

This attributes is mandatory if Demographics Authentication is performed.

demographics*object

This attributes is mandatory if Demographics Authentication is performed.

agestring

dobstring

namearray of object

languagestring

valuestring

dobTypearray of object

languagestring

valuestring

genderarray of object

languagestring

valuestring

phoneNumberstring

emailIdstring

addressLine1array of object

languagestring

valuestring

addressLine2array of object

languagestring

valuestring

addressLine3array of object

languagestring

valuestring

location1array of object

languagestring

valuestring

location2array of object

languagestring

valuestring

location3array of object

languagestring

valuestring

postalCodestring

fullAddressarray of object

languagestring

valuestring

metadataobject

property1object

property2object

biometrics*array of object

This attributes is mandatory if BIOMETRICS Authentication is performed.

data*object

Data attribute contains captured encrypted biometric. Data object should be formed as per the SBI Spec. All inner objects and inner attributes are mandatory as per SBI Specifications.

digitalIdobject

serialNostring

makestring

modelstring

typestring

deviceSubTypestring

deviceProviderstring

dpstring

dpIdstring

deviceProviderIdstring

dateTimestring

bioTypestring

bioSubTypestring

bioValuestring

deviceCodestring

deviceServiceVersionstring

transactionIdstring

timestampstring

purposestring

envstring

versionstring

domainUristring

requestedScoreinteger

qualityScoreinteger

hashstring

sessionKeystring

specVersionstring

thumbprintstring

consentObtained*boolean

User provided Consent either true or false

requestHMAC*string

HMAC value generated of the whole request.

requestSessionKey*string

Session key used to encrypt the request.

metadataobject

Any additional attributes needs to be processedin authentication.

property1object

property2object

identityKeyBinding*object

Key details needs to be binded to the identity after successful authentication.

publicKeyJWK*object

At least 1 key input needs to be provided. The input public key to be in JWK format. Multiple keys are allowed to be binded to the same identity. Supported key type: RSA

additionalProp1*object

additionalProp2object

additionalProp3object

authFactorType*string

Authe Factor Type for the binded key. Eg: WLA

Response

Body

id*string

IDA standard response ID. Eg: mosip.identity.keybinding

version*string

Version of the API. Current supported version is '1.0'

responseTime*string

Response Time of the request.

response*object

The Response Object contains the details whether auth is successful or not. If Auth successful kycToken will be included in the response otherwise kycToken will be null.

identityCertificate*string

If Auth successful a certificate will be generated using IDA Key Binding and returned as identity certificate.

authToken*string

Partner Specific User Token will be generated and returned. Both auth success/failed case PSU token will be included in the response.

bindingAuthStatus*boolean

Binding Auth Status. True will be returned if auth is successful and key binding is completed otherwise false.

errors*array of object

In case of auth failed, respective all errors will be returned as an array. Each error object contains error code and error message. If auth success, error object will be null.

errorCodestring

Unique Error Code will be include if case of auth failure.

errorMessagestring

Error Code specific error message will be included in the error object.

Request

Response

const response = await fetch('https://api-internal.collab.mosip.net/idauthentication/v1/kyc-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "version": "text",
      "requesttime": "text",
      "transactionID": "text",
      "individualId": "text",
      "kycToken": "text",
      "consentObtained": [
        "text"
      ]
    }),
});
const data = await response.json();

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "response": {
    "encryptedKyc": "text"
  },
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}

const response = await fetch('https://api-internal.collab.mosip.net/idauthentication/v1/vci-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "version": "text",
      "requesttime": "text",
      "transactionID": "text",
      "individualId": "text",
      "vcAuthToken": "text",
      "credSubjectId": "text",
      "vcFormat": "text",
      "credentialsDefinition": {
        "type": [
          "text"
        ]
      }
    }),
});
const data = await response.json();

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}

const response = await fetch('https://api-internal.collab.mosip.net/idauthentication/v1/key-auth/delegated/{IdP-LK}/{Auth-Partner-ID}/{oidc-client-id}', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "version": "text",
      "individualId": "text",
      "transactionID": "text",
      "requestTime": "text",
      "specVersion": "text",
      "thumbprint": "text",
      "domainUri": "text",
      "env": "text",
      "request": {
        "otp": "text",
        "timestamp": "text",
        "demographics": {},
        "biometrics": [
          {
            "data": {}
          }
        ],
        "keyBindedTokens": {}
      },
      "consentObtained": false,
      "requestHMAC": "text",
      "requestSessionKey": "text"
    }),
});
const data = await response.json();

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "response": {
    "kycToken": "text",
    "authToken": "text",
    "kycStatus": false
  },
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}

const response = await fetch('https://api-internal.collab.mosip.net/idauthentication/v1/identity-key-binding/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "version": "text",
      "individualId": "text",
      "transactionID": "text",
      "requestTime": "text",
      "specVersion": "text",
      "thumbprint": "text",
      "domainUri": "text",
      "env": "text",
      "request": {
        "otp": "text",
        "timestamp": "text",
        "demographics": {},
        "biometrics": [
          {
            "data": {}
          }
        ]
      },
      "consentObtained": false,
      "requestHMAC": "text",
      "requestSessionKey": "text",
      "identityKeyBinding": {
        "publicKeyJWK": {},
        "authFactorType": "text"
      }
    }),
});
const data = await response.json();

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "response": {
    "identityCertificate": "text",
    "authToken": "text",
    "bindingAuthStatus": false
  },
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}