# Get a self-service request.


Returns the full snapshot of a request: status, credential definition, email, captured claims, extra fields, identification result (when applicable), offer id, and timestamps. The primary path for tenants to fetch details after receiving a self-service webhook (which carries only `request_id`).
Authentication: `deepcredentials.self-service` scope.

Endpoint: GET /b2b/v1/self-service/requests/{requestId}
Version: 1.0.0
Security: BearerAuth

## Security:

  - `BearerAuth` (unknown)
    http bearer JWT

## Path parameters:

  - `requestId` (string, required)

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Response 200:

  - `200` (unknown)
    Success response

## Response 200 fields (application/json):

  - `admin_filled_fields` (array, required)
    Claim keys the admin is expected to fill before approving.

  - `admin_filled_required` (array, required)
    Subset of admin_filled_fields that are mandatory for approval.

  - `admin_filled_types` (object, required)
    Value type per admin-filled claim key (e.g. "string", "boolean").

  - `claims` (object, required)
    Claim values captured up to the moment of the fetch.

  - `completed_at` (string)
    When the request left the pending state (RFC3339), if applicable.

  - `config_id` (string, required)
    UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `credential_definition` (object, required)
    A compact reference to the credential definition (id, vct, and name only).

  - `credential_definition.id` (string, required)
    Credential definition UUID. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `credential_definition.name` (string, required)
    Human-readable credential definition name.

  - `credential_definition.vct` (string, required)
    Verifiable credential type (vct).

  - `editable_field_sources` (object, required)
    Assignment source per editable key: "user_filled", "admin_filled", or
"identification_filled".

  - `editable_field_types` (object, required)
    Value type per editable claim key.

  - `editable_fields` (array, required)
    All claim keys the admin may supply or override on approval.

  - `email` (string)
    Email address supplied by the applicant, if any.

  - `environment` (string, required)
    Swiyu environment: "beta" or "production".

  - `extra_fields` (object, required)
    Additional free-form fields submitted by the applicant.

  - `failure_code` (string)
    Why a failed request failed, from a closed vocabulary: declined | expired | wrong_credential | invalid_credential | credential_revoked | credential_suspended | status_unknown | incomplete_credential | unknown.

  - `identification` (object)
    IdentificationDetail is non-nil only when the request went through an identification step. We expose the method key and the verified_attributes blob the provider returned (already decrypted at this point). Consumers can ignore it when present and identification was disabled at config time.

  - `identification.credential_status` (string)
    CredentialStatus is the token-status-list state of the credential the applicant identified with: "valid", "suspended" or "revoked". Empty when the provider resolved none (only the in-platform e-ID does) .
It is here because revocation does not stop a wallet from presenting a credential — the presentation verifies, and whether that is good enough is the verifier's policy. Automatic configs answer no and fail the request; a webhook-mode tenant is the verifier for their own flow, so they get the fact and decide.

  - `identification.method` (string, required)

  - `identification.verified_attributes` (object, required)

  - `offer_id` (string)
    UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `rejection_reason` (string)
    Reason provided when the request was rejected, if any.

  - `request_id` (string, required)
    UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `status` (string, required)
    Current lifecycle status of the request.
    Enum: "awaiting_identification", "awaiting_details", "awaiting_email", "awaiting_verification", "approved", "invitation_sent", "issued", "credential_issued", "rejected", "expired", "failed", "revoked"

  - `submitted_at` (string, required)
    When the applicant submitted the request (RFC3339).

## Response 400:

  - `400` (unknown)
    Invalid request. Common causes: missing or malformed X-Org-Id / X-Environment headers, or a missing required field in the request body.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401:

  - `401` (unknown)
    Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403:

  - `403` (unknown)
    Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404:

  - `404` (unknown)
    Resource not found. Either the resource ID is unknown, or the X-Org-Id you supplied is not an organization the authenticated service user is a member of.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429:

  - `429` (unknown)
    Rate limit exceeded.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500:

  - `500` (unknown)
    Internal server error.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.