Credential IDP API

Base URL:

Environment	URL
Production	https://identity-credentials-idp.pro.cloud-w.envs.redisbe.com
Pre-production	https://identity-credentials-idp.pre.cloud-w.envs.redisbe.com

Interactive documentation (Swagger): GET <base-url>/swagger

Infrastructure endpoints

GET /health

Returns the service health status, including the database connection.

Authentication: none.

Response 200 OK:

{
  "status": "ok",
  "db": "connected"
}

---

GET /metrics

Exposes metrics in Prometheus format for monitoring with Grafana.

Authentication: none.

---

Standard OIDC endpoints

The IDP implements the full OpenID Connect protocol. The following endpoints are standard and must be used following the OpenID Connect Core 1.0 specification.

GET /.well-known/openid-configuration

OIDC discovery document. Returns the IDP configuration: endpoints, supported scopes, signing algorithms, authentication methods, and token types.

Authentication: none.

Response 200 OK: JSON with the standard OIDC Discovery fields, including:

{
  "issuer": "https://identity-credentials-idp.pro.cloud-w.envs.redisbe.com",
  "authorization_endpoint": ".../accounts/authorize",
  "token_endpoint": ".../accounts/token",
  "userinfo_endpoint": ".../accounts/userinfo",
  "jwks_uri": ".../accounts/jwks",
  "scopes_supported": ["openid", "profile", "email", "openid-vp-lear"],
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code"],
  "id_token_signing_alg_values_supported": ["RS256"],
  ...
}

Only RS256 for id_token

The id_token_signing_alg_values_supported field only includes RS256. This is due to a limitation of the AllAuth library that does not support EC algorithms for id_token signing. See the AllAuth issue for the status of this limitation.

---

GET /accounts/authorize

OAuth2 authorization endpoint. The OIDC client (Keycloak) redirects the user here to start authentication.

Query parameters (standard OAuth2/OIDC):

Parameter	Mandatory	Description
client_id	✅	ID of the client registered in the IDP.
redirect_uri	✅	Client return URI (must match the client configuration in the IDP).
response_type	✅	Must be code.
scope	✅	Requested scopes (e.g. openid profile email openid-vp-lear).
state	✅ (recommended)	Opaque value for CSRF prevention.
nonce	❌	Value to prevent replay attacks in id_token.

Response: redirect to the QR presentation form (IDP web interface).

---

POST /accounts/token

Exchanges an authorization code for access_token, id_token, and refresh_token.

Authentication: Basic Auth with client_id:client_secret or parameters in body depending on client configuration.

Body (form-urlencoded):

grant_type=authorization_code
&code=<authorization_code>
&redirect_uri=<redirect_uri>
&client_id=<client_id>

Response 200 OK:

{
  "access_token": "<JWT>",
  "id_token": "<JWT signed with RS256>",
  "refresh_token": "<token>",
  "token_type": "Bearer",
  "expires_in": 3600
}

The id_token includes the claims mapped according to the scope and the mappers configured for the active scope. Example claims for the scope openid-vp-lear:

{
  "sub": "empleado@empresa.es",
  "email": "empleado@empresa.es",
  "given_name": "Ana",
  "family_name": "López Fernández",
  "name": "Ana López Fernández",
  "preferred_username": "empleado@empresa.es",
  "organization": "Empresa S.A.",
  "organization_identifier": "ES-B12345678",
  "user_identifier": "E-00123",
  "power": "[{\"type\": \"domain\", \"domain\": \"ISBE\", ...}]"
}

Note: the power claim is serialized as a JSON string (result of str(power) in the mapper).

---

GET /accounts/userinfo

Returns the authenticated user's claims according to the scopes requested in the authorization.

Authentication: Authorization: Bearer <access_token>

Response 200 OK: JSON with the claims corresponding to the access_token.

---

---

GET /idp/api/auth/requests

Queries the status of a verification session. The user's browser polls this endpoint while waiting for the wallet to complete verification.

Authentication: none (public endpoint, accessible only with the session code).

Query parameters:

Parameter	Type	Description
session	string	Session code generated by the IDP when showing the QR.

Response 200 OK:

{
  "status": "PENDING"
}

Possible status values:

Value	Description
PENDING	The wallet has not yet presented the credential. The browser should continue polling.
SUCCESS	The credential was verified correctly. The browser should complete the OAuth2 flow.
FAILED	Verification failed (invalid credential, expired, or issuer not accredited).