QSCD (remote SCD) API

Onboarding API

Requirement is to perform

Identification at ID BB
Payment at payment BB
SCD enrollment (install App, create keys)

After that the Create SCD and Certificate API is available

Create SCD and Certificate

Item	Type	Description
Certificate request	CSR	CSR (public key) is collected from SCD to create a Certificate. How the CSR is sent from a remote device is currently out of scope (can be e/mail/sms with request to install app, etc). Mandatory
SCD type	remote SCD App remote SCD App + Secure Element remote SCD eSIM remote SCD SIM	Type of SCD. Mandatory
SCD remote ID	String	ID in a remote system that handles the messaging between SCD-s, depends on SCD type. Mandatory
SCD key id	Number	They private key ID inside SCD for what the CSR corresponds with Mandatory
Name	X.509 Distinguished name	Mandatory
Document ID	String	Document ID based on what the verification has been performed. Optional
Authentication token	JWT	Authentication token as result of ID Building Block. Mandatory
Payment token	String	Payment token to indicate that payment has been done. If not present and payment is required HTTP 402 error is thrown. Optional

Create SCD and Certificate response

Item	Type	Description
SCD ID	String	SCD ID identifies the SCD and binds it with the Certificate to be used. Mandatory
Certificate	PEM	Certificate that was issued. Mandatory
Status & description	OK ERROR - in case of error also error description	Mandatory

List certificate

Item

Type

Descripiton

SCD ID

String

Mandatory

Authentication token

String

User can query his/her certificate & status, identification at ID BB required

Mandatory

List certificate response

Item

Type

Descripiton

Certificate

X.509

User’s certificate

Mandatory when Status is OK

Status & description

OK
ERROR - in case of error also error description should be added
EXPIRED
SUSPENDED - suspend cause should be added
REVOKED - also REOVOKE cause should be added

Mandatory

Update certificate status

Item

Type

Descripiton

SCD ID

String

Mandatory

Authentication Token

JWT

Authentication token is necessary and should belong to a user or an authority

Mandatory

Status & reason

SUSPENDED - add reason text
REVOKED - add reason text

Mandatory

Update certificate response

Item	Type	Descripiton
Status & description	ERROR - in case of error also error description should be added SUSPENDED - suspend cause should be added REVOKED - also REOVOKE cause should be added	Mandatory

Usage API

Sign

Item	Type	Descripiton
SCD ID	String	Mandatory
format	XAdES CAdES ASIC JWS	Pre format the signature in a given format so that it can be more easily inserted by the formatting library. Mandatory
hash	byte array in base64	Has to be signed. Hashing of document is responsibility of Signer Application and is done by formatting library. Mandatory
hash type	SHA2/3-256 SHA2/3-384 SHA2/3-512 BLAKE2B	Mandatory
data to be displayed	String	Information to be displayed on users device, can involve free text like “Accept childcare request”, transactionId, etc. Mandatory

Sign Response

Item	Type	Mandatory
signature	byte array in base64	signature that is preformatted according to format
certificate	X.509	certificate with public key