w3c-ccg / traceability-interop

Verifiable Credentials for Supply Chain Interoperability Specification for HTTP

Home Page:https://w3id.org/traceability/interoperability

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Presentation Notify - Requester Identification in Request Body

coran-coley opened this issue · comments

For the "Notify" endpoint (presentations/available) the documentation for both OpenAPI and the spec doesn't appear to have an identifier for the caller integrated into the request.

This makes it difficult to ensure that the challenge used in a subsequent "Submit" call is being presented by the intended entity while keeping strictly to the spec for data exchange between partners (ie without demanding the information be added to a header or similar). Would it make sense for the DID of the endpoint caller be added to the request body of "Notify" so that the endpoint owner knows the identity of the entity they are returning a specific challenge to? Thank you.

Ex (request body from OpenAPI used):

{
  "query": [
    {
      "type": "QueryByExample",
      "requesterDid": "did:web:example.com:1234" //Proposed addition
      "credentialQuery": [
        {
          "type": [
            "VerifiableCredential"
          ],
          "reason": "We want to present credentials."
        }
      ]
    }
  ]
}

refer to #604 to remove this documentation discrepancy