# Create a verification session.


Returns a QR code (base64 PNG) and deeplink that the end user scans with their wallet app. Poll GET /b2b/v1/verification-sessions/:sessionId or subscribe to webhook "verification.completed".

Endpoint: POST /b2b/v1/verification-sessions
Version: 1.0.0
Security: BearerAuth

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Request fields (application/json):

  - `allowed_issuer_dids` (array)
    Optional allow-list of issuer DIDs. Ignored for official credential definitions
with locked issuers (server uses credential definition policy).

  - `case_id` (string)
    Saved verification case to launch (multi-credential / OR). Preferred over
credential_definition_id/claims.

  - `claims` (array, required)
    DEPRECATED: use case_id. Claim names to request in the presentation (must exist
on the credential definition).

  - `credential_definition_id` (string, required)
    DEPRECATED: use case_id. Credential definition to verify against (UUID from the
tenant's credential definition catalog).

  - `purpose` (string)
    Optional text shown in wallet/consent context where supported.

  - `reference_id` (string)
    Optional correlation identifier from your system; echoed on the resource.

## Response 200 fields (application/json):

  - `deeplink` (string, required)
    Wallet app link, e.g. openid4vp://?client_id=...&request_uri=...

  - `expires_at` (string, required)
    Session TTL deadline (RFC3339).

  - `qr_content_base64` (string, required)
    Base64-encoded PNG; QR payload is the same URI as deeplink.

  - `session_id` (string, required)
    UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `status` (string, required)
    Lifecycle state of a verification session.
    Enum: "pending", "success", "failed", "expired"

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.