This discussion describes a proposal for the revised /credential-offer-uri endpoint

Related issue: #45005

The proposed endpoint signature looks like this ...

    @GET
    @Produces({MediaType.APPLICATION_JSON, RESPONSE_TYPE_IMG_PNG})
    @Path(CREATE_CREDENTIAL_OFFER_PATH)
    public Response createCredentialOffer(
            @QueryParam("credential_configuration_id") String credConfigId,
            @QueryParam("pre_authorized") @DefaultValue("true") Boolean preAuthorized,
            @QueryParam("tx_code") @DefaultValue("false") Boolean withTxCode,
            @QueryParam("target_user") String targetUser,
            @QueryParam("expire") Integer expireAt,
            @QueryParam("type") @DefaultValue("uri") OfferResponseType responseType,
            @QueryParam("width") @DefaultValue("200") int width,
            @QueryParam("height") @DefaultValue("200") int height
    )

Credential Offers can be pre-authorized and/or bound to a specific target user.

Credential Offer Validity Matrix for the supported request parameters "pre_authorized", "username" combinations.

Pre-Authorized Offer

• A pre-authorized offer is authorized for the clientId from the current login session
• If targetUser is null or empty, it defaults to the user from the current login session
• If targetUser is equal to the current login, the generated offer is "self issued"
• To create an offer for another user, the issuing user must hold the code credential_offer_create role
• A pre-authorized offer can optionally have an associated tx_code
• An offer can optionally have a predefined expiry date

Non Pre-Authorized Offer

• If targetUser is null or empty, the generated offer is "anonymous"
• If targetUser is equal to the current login, the offer is "self issued"
• If targetUser is none of the above, the offer is "targeted"
• For a targeted offer, the issuing user must hold the code credential_offer_create role
• An offer can optionally have a predefined expiry date

Response Type

The response type parameter supports "Same Device" and "Cross Device" use cases.

This endpoint creates an internal credential offer state, which can then be accessed via a uniquely generated credential offer uri. It is the responsibility of the caller to communicate the credential offer to the target user in a secure manner.

If the response contains a generated tx_code, which protects a pre-auth offer with a second layer of security, this tx_code must be sent over an alternative communication channel (i.e. not together with the offer itself).