# Create a credential offer.


Returns a deeplink and QR code for the wallet to scan. Optionally delivers the same offer out-of-band (currently: email).

Endpoint: POST /b2b/v1/credential-offers
Version: 1.0.0
Security: BearerAuth

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Request fields (application/json):

  - `claims` (object, required)
    Claim values for the credential. Key-value object of claim data for the credential. Keys must match the claim names defined in the credential definition, and values must match the expected types (string, boolean, integer, number). All mandatory claims from the credential definition must be provided.

  - `credential_definition_id` (string, required)
    Credential definition to issue (UUID from the tenant's credential definition
catalog).

  - `delivery` (object)
    DeliverySpec selects an out-of-band delivery method for a freshly-created credential offer. Today only `via=email` is supported; future modes (sms, push) slot in here without changing the endpoint signature. Email is validated up-front so a bad input fails before we spend the work of creating the offer.

  - `delivery.email` (string, required)
    Email recipient, required when via=email.

  - `delivery.via` (string, required)
    "email" is the only accepted value today; any other value rejects.

  - `offer_validity_seconds` (integer)
    Optional offer validity in seconds (default 600). This is the TTL of the QR/deeplink window before the wallet has to pick up the offer, not the lifetime of the credential itself.

  - `reference_id` (string)
    Optional correlation identifier from your system; echoed on the resource.

  - `validity_seconds` (integer)
    Optional credential lifetime in seconds (SD-JWT "exp" = iat + N). Omit to fall back to the credential definition's default_validity_seconds; when both are absent the credential is issued without an exp claim (never expires). Bounded by [60, 10 years].

## Response 200 fields (application/json):

  - `claims` (object, required)
    Claim values for the credential (echoed from the request).

  - `created_at` (string, required)
    When the offer was created (RFC3339).

  - `deeplink` (string, required)
    OID4VCI wallet deep link (e.g. openid-credential-offer://...).

  - `expires_at` (string, required)
    Offer TTL deadline (RFC3339).

  - `id` (string, required)
    UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `qr_content_base64` (string, required)
    Base64-encoded PNG; QR payload is the same URI as deeplink.

  - `status` (string, required)
    Lifecycle state of a credential offer.
    Enum: "pending", "issued", "accepted", "expired", "failed"

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.