{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/guides/sidebars.yaml","api-docs-docs/openapi/self-service-v1.yaml":"api-docs-docs/openapi/self-service-v1.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Self-Service — Detailed Reference"},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"self-service--detailed-reference","__idx":0},"children":["Self-Service — Detailed Reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Read this when you need the full state machine, every webhook payload, idempotency semantics, or error codes. For a first integration walk through ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/self-service/quickstart"},"children":["Quickstart"]}," instead; for a concrete end-to-end example see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/self-service/city-card-example"},"children":["Walkthrough — City Card"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For machine-to-machine issuance where your backend already has all the data, use ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/issuance-flow"},"children":["Credential Offers"]}," instead — self-service is the share-link flow where the end-user (or an identification provider) supplies the data."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Credential validity is set on the config, not on `/decision`"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Self-service flows take the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["exp"]}," value from the config in effect when the request is submitted, not from the approval call. The decision API has no ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["validity_seconds"]}," field. Edits to the config affect only ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["future"]}," requests — credentials already issued (or invitations already sent) keep the validity snapshot taken when they were created. See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/issuance-flow#credential-validity"},"children":["Credential validity section in the Issuance Flow guide"]}," for the surrounding model."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"verification-modes","__idx":1},"children":["Verification modes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each config picks one of three modes — the mode decides who approves a submission."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mode"},"children":["Mode"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Who decides"},"children":["Who decides"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"When to use"},"children":["When to use"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["manual"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Portal admin (your team, in the DeepCredentials UI)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Low volume, human review in the loop."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["webhook"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your backend, via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/self-service/requests/{requestId}/decision"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Programmatic checks against your systems (e.g. HR database lookup)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["automatic"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["DeepCredentials, server-side, with no human or backend in the loop"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Self-asserted data only, no admin-filled claims, no identification step."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide focuses on the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["webhook"]}," mode — it's the one that touches the B2B API. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["manual"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["automatic"]}," configs use the same lifecycle but skip the webhook round-trip with your backend."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"request-lifecycle","__idx":2},"children":["Request lifecycle"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> awaiting_identification: User starts flow with identification\n [*] --> awaiting_verification: User submits self-declaration form\n awaiting_identification --> awaiting_verification: Identification callback (success)\n awaiting_identification --> failed: Identification callback (failure)\n awaiting_verification --> invitation_sent: Decision = approve (email opt-in)\n awaiting_verification --> issued: Decision = approve (no email)\n awaiting_verification --> rejected: Decision = reject\n invitation_sent --> issued: End-user opens redemption link\n issued --> credential_issued: Wallet accepts the credential\n issued --> expired: Offer TTL exceeded\n issued --> failed: Wallet rejected the credential\n\n rejected --> [*]\n credential_issued --> [*]\n expired --> [*]\n failed --> [*]\n","diagramHtml":"

User starts flow with identification

User submits self-declaration form

Identification callback (success)

Identification callback (failure)

Decision = approve (email opt-in)

Decision = approve (no email)

Decision = reject

End-user opens redemption link

Wallet accepts the credential

Offer TTL exceeded

Wallet rejected the credential

awaiting_identification

awaiting_verification

failed

invitation_sent

issued

rejected

credential_issued

expired

","diagramHtmlDark":"

User starts flow with identification

User submits self-declaration form

Identification callback (success)

Identification callback (failure)

Decision = approve (email opt-in)

Decision = approve (no email)

Decision = reject

End-user opens redemption link

Wallet accepts the credential

Offer TTL exceeded

Wallet rejected the credential

awaiting_identification

awaiting_verification

failed

invitation_sent

issued

rejected

credential_issued

expired

"},"children":["stateDiagram-v2\n [*] --> awaiting_identification: User starts flow with identification\n [*] --> awaiting_verification: User submits self-declaration form\n awaiting_identification --> awaiting_verification: Identification callback (success)\n awaiting_identification --> failed: Identification callback (failure)\n awaiting_verification --> invitation_sent: Decision = approve (email opt-in)\n awaiting_verification --> issued: Decision = approve (no email)\n awaiting_verification --> rejected: Decision = reject\n invitation_sent --> issued: End-user opens redemption link\n issued --> credential_issued: Wallet accepts the credential\n issued --> expired: Offer TTL exceeded\n issued --> failed: Wallet rejected the credential\n\n rejected --> [*]\n credential_issued --> [*]\n expired --> [*]\n failed --> [*]\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"status-reference","__idx":3},"children":["Status reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awaiting_identification"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["End-user is mid-flow at the identification provider. Not yet ready for decision."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awaiting_verification"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Submission complete, awaiting your decision. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["This is when the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["submitted"]}," webhook fires."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invitation_sent"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["You (or the portal) approved. A redemption link has been emailed to the end-user."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["issued"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The end-user opened the redemption link; a live credential offer was created and is waiting for their wallet to accept it."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_issued"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Terminal success — the wallet has the credential."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejected"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Terminal — you (or the portal) rejected the submission. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejection_reason"]}," carries the reason shown to the end-user."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expired"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Terminal — the credential offer expired before the wallet picked it up."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failed"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Terminal — issuance failed (identification error, wallet rejected the credential, etc)."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"end-to-end-interaction-webhook-mode","__idx":4},"children":["End-to-end interaction (webhook mode)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This sequence covers the full path: end-user clicks the share-link, optionally verifies through identification, submits, your backend approves, end-user picks up the credential."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n autonumber\n participant U as End User
(SPA + Wallet)\n participant P as DeepCredentials\n participant B as Your Backend\n\n U->>P: Open share-link `/self-service/`\n P-->>U: Render landing (credential definition, purpose, \"Start\")\n\n opt identification required\n U->>P: Click \"Open identification\"\n P->>P: Create request (status = awaiting_identification)\n P-->>U: Hand off to DeepID\n Note over U: User verifies via DeepID
(method choice happens there)\n U->>P: Return via callback\n P->>P: status → awaiting_verification,
verification_started_at = now\n end\n\n opt self-declaration only\n U->>P: Fill form + Submit\n P->>P: Create request (status = awaiting_verification,
verification_started_at = now)\n end\n\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.submitted
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n B->>P: GET /b2b/v1/self-service/requests/{id}\n P-->>B: 200 { status, claims, extra_fields, admin_filled_*, identification, ... }\n Note over B: Look up subject, validate against
admin_filled_required, decide\n\n Note over U: 3 s after verification_started_at, the SPA shows the
\"email me updates\" opt-in panel. If the next step happens
first (fast webhook decision), the panel never shows.\n opt user opts into delivery email\n U->>P: Set delivery email\n P-->>U: 200 OK\n end\n\n B->>P: POST /b2b/v1/self-service/requests/{id}/decision
{ \"decision\": \"approve\", \"admin_claims\": { ... } }\n P-->>B: 200 OK
(status: \"invitation_sent\" if email opt-in,
else \"issued\" + offer_id)\n\n alt email was opted in\n P->>P: Create credential invitation, status → invitation_sent\n P-->>U: Send redemption email\n Note over U: User opens email link
(or \"Show QR now\" on the status page)\n U->>P: Click redemption link / scan QR\n P->>P: status → issued, create live offer\n else no email opt-in\n P->>P: Create live offer directly, status → issued\n Note over U: SPA's polling picks up the offer and shows the QR\n end\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.approved
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n\n U->>P: OID4VCI exchange (wallet)\n P->>P: status → credential_issued\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.credential_issued
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n\n Note over U: Credential now in wallet\n","diagramHtml":"Your BackendDeepCredentialsEnd User(SPA + Wallet)Your BackendDeepCredentialsEnd User(SPA + Wallet)User verifies via DeepID(method choice happens there)opt[identification required]opt[self-declaration only]Look up subject, validate againstadmin_filled_required, decide3 s after verification_started_at, the SPA shows the\"email me updates\" opt-in panel. If the next step happensfirst (fast webhook decision), the panel never shows.opt[user opts into delivery email]User opens email link(or \"Show QR now\" on the status page)SPA's polling picks up the offer and shows the QRalt[email was opted in][no email opt-in]Credential now in walletOpen share-link `/self-service/<slug>`1Render landing (credential definition, purpose, \"Start\")2Click \"Open identification\"3Create request (status = awaiting_identification)4Hand off to DeepID5Return via callback6status → awaiting_verification,verification_started_at = now7Fill form + Submit8Create request (status = awaiting_verification,verification_started_at = now)9POST /your-webhookX-Webhook-Event: self_service.request.submitted{ \"data\": { \"request_id\": \"<uuid>\" } }10200 OK11GET /b2b/v1/self-service/requests/{id}12200 { status, claims, extra_fields, admin_filled_*, identification, ... }13Set delivery email14200 OK15POST /b2b/v1/self-service/requests/{id}/decision{ \"decision\": \"approve\", \"admin_claims\": { ... } }16200 OK(status: \"invitation_sent\" if email opt-in,else \"issued\" + offer_id)17Create credential invitation, status → invitation_sent18Send redemption email19Click redemption link / scan QR20status → issued, create live offer21Create live offer directly, status → issued22POST /your-webhookX-Webhook-Event: self_service.request.approved{ \"data\": { \"request_id\": \"<uuid>\" } }23200 OK24OID4VCI exchange (wallet)25status → credential_issued26POST /your-webhookX-Webhook-Event: self_service.request.credential_issued{ \"data\": { \"request_id\": \"<uuid>\" } }27200 OK28","diagramHtmlDark":"Your BackendDeepCredentialsEnd User(SPA + Wallet)Your BackendDeepCredentialsEnd User(SPA + Wallet)User verifies via DeepID(method choice happens there)opt[identification required]opt[self-declaration only]Look up subject, validate againstadmin_filled_required, decide3 s after verification_started_at, the SPA shows the\"email me updates\" opt-in panel. If the next step happensfirst (fast webhook decision), the panel never shows.opt[user opts into delivery email]User opens email link(or \"Show QR now\" on the status page)SPA's polling picks up the offer and shows the QRalt[email was opted in][no email opt-in]Credential now in walletOpen share-link `/self-service/<slug>`1Render landing (credential definition, purpose, \"Start\")2Click \"Open identification\"3Create request (status = awaiting_identification)4Hand off to DeepID5Return via callback6status → awaiting_verification,verification_started_at = now7Fill form + Submit8Create request (status = awaiting_verification,verification_started_at = now)9POST /your-webhookX-Webhook-Event: self_service.request.submitted{ \"data\": { \"request_id\": \"<uuid>\" } }10200 OK11GET /b2b/v1/self-service/requests/{id}12200 { status, claims, extra_fields, admin_filled_*, identification, ... }13Set delivery email14200 OK15POST /b2b/v1/self-service/requests/{id}/decision{ \"decision\": \"approve\", \"admin_claims\": { ... } }16200 OK(status: \"invitation_sent\" if email opt-in,else \"issued\" + offer_id)17Create credential invitation, status → invitation_sent18Send redemption email19Click redemption link / scan QR20status → issued, create live offer21Create live offer directly, status → issued22POST /your-webhookX-Webhook-Event: self_service.request.approved{ \"data\": { \"request_id\": \"<uuid>\" } }23200 OK24OID4VCI exchange (wallet)25status → credential_issued26POST /your-webhookX-Webhook-Event: self_service.request.credential_issued{ \"data\": { \"request_id\": \"<uuid>\" } }27200 OK28"},"children":["sequenceDiagram\n autonumber\n participant U as End User
(SPA + Wallet)\n participant P as DeepCredentials\n participant B as Your Backend\n\n U->>P: Open share-link `/self-service/`\n P-->>U: Render landing (credential definition, purpose, \"Start\")\n\n opt identification required\n U->>P: Click \"Open identification\"\n P->>P: Create request (status = awaiting_identification)\n P-->>U: Hand off to DeepID\n Note over U: User verifies via DeepID
(method choice happens there)\n U->>P: Return via callback\n P->>P: status → awaiting_verification,
verification_started_at = now\n end\n\n opt self-declaration only\n U->>P: Fill form + Submit\n P->>P: Create request (status = awaiting_verification,
verification_started_at = now)\n end\n\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.submitted
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n B->>P: GET /b2b/v1/self-service/requests/{id}\n P-->>B: 200 { status, claims, extra_fields, admin_filled_*, identification, ... }\n Note over B: Look up subject, validate against
admin_filled_required, decide\n\n Note over U: 3 s after verification_started_at, the SPA shows the
\"email me updates\" opt-in panel. If the next step happens
first (fast webhook decision), the panel never shows.\n opt user opts into delivery email\n U->>P: Set delivery email\n P-->>U: 200 OK\n end\n\n B->>P: POST /b2b/v1/self-service/requests/{id}/decision
{ \"decision\": \"approve\", \"admin_claims\": { ... } }\n P-->>B: 200 OK
(status: \"invitation_sent\" if email opt-in,
else \"issued\" + offer_id)\n\n alt email was opted in\n P->>P: Create credential invitation, status → invitation_sent\n P-->>U: Send redemption email\n Note over U: User opens email link
(or \"Show QR now\" on the status page)\n U->>P: Click redemption link / scan QR\n P->>P: status → issued, create live offer\n else no email opt-in\n P->>P: Create live offer directly, status → issued\n Note over U: SPA's polling picks up the offer and shows the QR\n end\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.approved
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n\n U->>P: OID4VCI exchange (wallet)\n P->>P: status → credential_issued\n P->>B: POST /your-webhook
X-Webhook-Event: self_service.request.credential_issued
{ \"data\": { \"request_id\": \"\" } }\n B-->>P: 200 OK\n\n Note over U: Credential now in wallet\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejected"]}," path swaps the decision payload for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{\"decision\": \"reject\", \"reason\": \"...\"}"]}," and the subsequent webhook becomes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.rejected"]},". No invitation is created. The rejection email is sent only if the user opted into delivery; without opt-in we still publish the webhook for the tenant's audit trail and skip the mail."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the wallet never finishes the OID4VCI exchange (offer TTL exceeded, wallet rejected the credential) DeepCredentials fires ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.offer_expired"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.failed"]}," instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_issued"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"delivery-email-is-opt-in","__idx":5},"children":["Delivery email is opt-in"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Email is never collected as a form field. ~3 seconds after the request enters ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awaiting_verification"]},", the SPA's waiting screen reveals an inline opt-in panel:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self-declaration only"]},": empty input, user types if they want updates."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identification"]},": input is pre-filled (read-only) with the address the identification provider returned — but the user still has to click the button to authorise delivery. We never email an address the user didn't actively confirm."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The 3-second buffer lets fast tenant decisions resolve before we ask: if your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/decision"]}," call lands while the user is still on the waiting page, the panel never appears and your approve webhook is delivered immediately."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the user closes the page without opting in (or your decision arrives before the 3-second delay), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["request.email"]}," stays NULL. On approve we then create the live credential offer directly and the SPA picks it up via status polling — no redemption email, but the credential still ships. On reject we publish the webhook and skip the rejection email."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"webhook-payload-contract","__idx":6},"children":["Webhook payload contract"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All six self-service webhooks (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["submitted"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["approved"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejected"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_issued"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offer_expired"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failed"]},") share the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["slim"]}," envelope:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"event\": \"self_service.request.submitted\",\n \"tenant_id\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"timestamp\": \"2026-05-16T10:00:00Z\",\n \"data\": {\n \"request_id\": \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\n }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["data"]}," field carries ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["only"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["request_id"]}," — no captured claims, email, or identification data are sent over the webhook channel. After receiving any of these events, call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/self-service/requests/{requestId}"]}," with your API credential to fetch the full snapshot."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Reconcile missed callbacks"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Webhook delivery currently makes one attempt and can be missed. The B2B self-service API has no list or discovery endpoint: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}," works only after your system already knows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["request_id"]},". If ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.submitted"]}," is missed, a portal administrator must find the request in the Requests view and approve or reject it there. Monitor the receiving endpoint and use the portal as the manual recovery path; do not assume the partner backend can discover a missed request through B2B."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"admin-claims-schema-on-the-get-snapshot","__idx":7},"children":["Admin-claims schema on the GET snapshot"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/self-service/requests/{requestId}"]}," response carries three"," ","fields that describe the claims the tenant is expected to fill — mirrors how"," ","verification ships ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requested_fields"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_subject_types"]},", so you"," ","can render a form or validate input dynamically instead of hard-coding what"," ","each config wants:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Shape"},"children":["Shape"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Meaning"},"children":["Meaning"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_fields"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["ordered ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string[]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Every claim key the config marked admin-filled, in the credential definition's declared claim order."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_types"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ [key]: \"string\" | \"boolean\" | \"integer\" | \"number\" | \"date\" | ... }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Value type per key — the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["value_type"]}," strings the credential definition uses."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_required"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string[]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Subset of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_fields"]}," where the credential definition marked the claim as mandatory. Anything in this list must be present in your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," payload on approve."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example fragment:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"admin_filled_fields\": [\"employee_id\", \"department\", \"office_number\"],\n \"admin_filled_types\": {\n \"employee_id\": \"string\",\n \"department\": \"string\",\n \"office_number\": \"integer\"\n },\n \"admin_filled_required\": [\"employee_id\", \"department\"]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the config has no admin-filled claims, all three are empty (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[]"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{}"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[]"]},") and you can approve without an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," body."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"overriding-user-supplied-claims","__idx":8},"children":["Overriding user-supplied claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_*"]}," describes only the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["contract"]},": which keys the admin is ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["expected"]}," to supply (and which are mandatory). It is not a whitelist — the decision endpoint accepts any credential definition claim in your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," payload, including keys the end-user already filled in (and keys pre-populated from an identification flow). When a key appears in more than one source, the layering is fixed: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["user → identification → admin"]},", with later layers winning."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To make this discoverable without a separate credential definition fetch, the snapshot also carries the full credential definition claim set:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Shape"},"children":["Shape"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Meaning"},"children":["Meaning"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["editable_fields"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["ordered ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string[]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Every claim key on the credential definition, in declared order."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["editable_field_types"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ [key]: value_type }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["value_type"]}," strings as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_types"]},", covering every key."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["editable_field_sources"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ [key]: \"user_filled\" | \"admin_filled\" | \"identification_filled\" }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Where each key is sourced by default — mirrors the config's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["field_assignments"]},". ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["identification_filled"]}," means the value was projected from the identification verified attributes via a tenant-managed mapping (configured in the portal)."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Typical usage: render a \"review & override\" form with one input per ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["editable_fields"]}," entry. Pre-fill from the snapshot's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["claims"]}," field — it already carries the merged result of user submission + identification mapping, so the same input shows whatever value would be stamped on the credential today. Submit only the keys the admin actually changed plus every ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_required"]}," key."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Identification pre-fill"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a config has ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["identification_filled"]}," claims, those values are sourced from DeepID's verified attributes at completion time. They land on the snapshot's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["claims"]}," field by the time you see the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["submitted"]}," webhook, just like user-supplied values — so a passive approve already issues the right credential. Mappings are tenant-managed via the portal; the B2B API never sets them."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Override is opt-in"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You don't have to override anything. If your backend only fills ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_required"]}," keys, the user-supplied values flow through untouched. The override channel exists for cases where the admin spots a typo, normalises capitalisation, or corrects a self-asserted value against an authoritative source."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"calling-the-decision-endpoint","__idx":9},"children":["Calling the decision endpoint"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.submitted"]}," webhook carries only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["request_id"]}," — no captured data. To decide, your backend goes through two calls:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Fetch the snapshot"]}," via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/self-service/requests/{requestId}"]},". The response returns the captured user claims, extra fields, identification result (if any), and the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_*"]}," schema you need to assemble ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["POST your decision"]}," to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/b2b/v1/self-service/requests/{requestId}/decision"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both calls use a Bearer token obtained for a DeepAdmin service user through DeepCloud, with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}," scope. There is no B2B API-key authentication path. You have 7 days (the invitation TTL) after the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["submitted"]}," event before the request expires."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-1-fetch-the-request-snapshot","__idx":10},"children":["Step 1: Fetch the request snapshot"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/self-service-v1"},"children":["Open in API reference →"]}]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"api-docs-docs/openapi/self-service-v1.yaml","operationId":"GET:b2b.GetSelfServiceRequest","parameters":{"path":{"requestId":"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8"}},"environments":{"https://api.dev.deepcredentials.swiss":{"BearerAuth":"YOUR_ACCESS_TOKEN"}},"environment":"https://api.dev.deepcredentials.swiss","codeSamplesResolved":[{"lang":"shell","title":"curl","source":"curl -i -X GET \\\n https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8 \\\n -H 'X-Environment: beta' \\\n -H 'X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08'"},{"lang":"javascript","title":"JavaScript","source":"const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\nconst resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}`,\n {\n method: 'GET',\n headers: {\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n }\n }\n);\n\nconst data = await resp.text();\nconsole.log(data);"},{"lang":"javascript","title":"Node.js","source":"import fetch from 'node-fetch';\n\nasync function run() {\n const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\n const resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}`,\n {\n method: 'GET',\n headers: {\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n }\n }\n );\n\n const data = await resp.text();\n console.log(data);\n}\n\nrun();"},{"lang":"python","title":"Python","source":"import requests\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + request_id\n\nheaders = {\n \"X-Org-Id\": \"497f6eca-6276-4993-bfeb-53cbbbba6f08\",\n \"X-Environment\": \"beta\"\n}\n\nresponse = requests.get(url, headers=headers)\n\ndata = response.json()\nprint(data)"},{"lang":"java","title":"Java","source":"import java.net.*;\nimport java.net.http.*;\nimport java.util.*;\n\npublic class App {\n public static void main(String[] args) throws Exception {\n var httpClient = HttpClient.newBuilder().build();\n\n var host = \"https://api.dev.deepcredentials.swiss\";\n var requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n var pathname = \"/b2b/v1/self-service/requests/%7BrequestId%7D\";\n var request = HttpRequest.newBuilder()\n .GET()\n .uri(URI.create(host + pathname ))\n .header(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n .header(\"X-Environment\", \"beta\")\n .build();\n\n var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n\n System.out.println(response.body());\n }\n}"},{"lang":"csharp","title":"C#","source":"using System;\nusing System.Net.Http;\nusing System.Threading.Tasks;\n\npublic class Program\n{\n public static async Task Main()\n {\n System.Net.Http.HttpClient client = new()\n {\n DefaultRequestHeaders =\n {\n {\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\"},\n {\"X-Environment\", \"beta\"},\n }\n };\n\n var RequestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n using HttpResponseMessage request = await client.GetAsync(\"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + RequestId);\n string response = await request.Content.ReadAsStringAsync();\n\n Console.WriteLine(response);\n }\n}"},{"lang":"php","title":"PHP","source":"/**\n * Requires libcurl\n */\n\nconst requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n$curl = curl_init();\n\ncurl_setopt_array($curl, [\n CURLOPT_HTTPHEADER => [\n \"X-Environment: beta\",\n \"X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08\"\n ],\n CURLOPT_URL => \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" . requestId,\n CURLOPT_RETURNTRANSFER => true,\n CURLOPT_CUSTOMREQUEST => \"GET\",\n]);\n\n$response = curl_exec($curl);\n$error = curl_error($curl);\n\ncurl_close($curl);\n\nif ($error) {\n echo \"cURL Error #:\" . $error;\n} else {\n echo $response;\n}"},{"lang":"go","title":"Go","source":"package main\n\nimport (\n \"fmt\"\n \"net/http\"\n \"io/ioutil\"\n)\n\nfunc main() {\n requestId := \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n reqUrl := \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + requestId\n req, err := http.NewRequest(\"GET\", reqUrl, nil)\n if err != nil {\n panic(err)\n }\n req.Header.Add(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n req.Header.Add(\"X-Environment\", \"beta\")\n res, err := http.DefaultClient.Do(req)\n if err != nil {\n panic(err)\n }\n defer res.Body.Close()\n body, err := ioutil.ReadAll(res.Body)\n if err != nil {\n panic(err)\n }\n\n fmt.Println(res)\n fmt.Println(string(body))\n}"},{"lang":"ruby","title":"Ruby","source":"require 'uri'\nrequire 'net/http'\nrequire 'openssl'\n\nrequest_id = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8'\nurl = URI('https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/' + request_id)\n\nhttp = Net::HTTP.new(url.host, url.port)\nhttp.use_ssl = true\n\nrequest = Net::HTTP::Get.new(url)\nrequest['X-Org-Id'] = '497f6eca-6276-4993-bfeb-53cbbbba6f08'\nrequest['X-Environment'] = 'beta'\n\nresponse = http.request(request)\nputs response.read_body\n"},{"lang":"r","title":"R","source":"library(httr)\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\n\n# create you own operator\n\"%&%\" <- function(x, y)paste0(x,y)\n\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" %&% request_id\n\ndata_req <- GET(\n url,\n add_headers(\"X-Org-Id\" = \"497f6eca-6276-4993-bfeb-53cbbbba6f08\", \"X-Environment\" = \"beta\"),\n verbose()\n)\n\ncontent(data_req)"}]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The response shape — including the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_*"]}," schema described above — is documented under the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/self-service-v1"},"children":["Self-Service API reference"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-2a-approve","__idx":11},"children":["Step 2a: Approve"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/self-service-v1"},"children":["Open in API reference →"]}]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"api-docs-docs/openapi/self-service-v1.yaml","operationId":"POST:b2b.DecideSelfServiceRequest","parameters":{"path":{"requestId":"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8"}},"requestBody":{"decision":"approve","admin_claims":{"employee_id":"E-12345","department":"Engineering"}},"environments":{"https://api.dev.deepcredentials.swiss":{"BearerAuth":"YOUR_ACCESS_TOKEN"}},"environment":"https://api.dev.deepcredentials.swiss","codeSamplesResolved":[{"lang":"shell","title":"curl","source":"curl -i -X POST \\\n https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8/decision \\\n -H 'Content-Type: application/json' \\\n -H 'X-Environment: beta' \\\n -H 'X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08' \\\n -d '{\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"employee_id\": \"E-12345\",\n \"department\": \"Engineering\"\n }\n }'"},{"lang":"javascript","title":"JavaScript","source":"const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\nconst resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}/decision`,\n {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n },\n body: JSON.stringify({\n decision: 'approve',\n admin_claims: {\n employee_id: 'E-12345',\n department: 'Engineering'\n }\n })\n }\n);\n\nconst data = await resp.json();\nconsole.log(data);"},{"lang":"javascript","title":"Node.js","source":"import fetch from 'node-fetch';\n\nasync function run() {\n const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\n const resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}/decision`,\n {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n },\n body: JSON.stringify({\n decision: 'approve',\n admin_claims: {\n employee_id: 'E-12345',\n department: 'Engineering'\n }\n })\n }\n );\n\n const data = await resp.json();\n console.log(data);\n}\n\nrun();"},{"lang":"python","title":"Python","source":"import requests\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + request_id + \"/decision\"\n\npayload = {\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"employee_id\": \"E-12345\",\n \"department\": \"Engineering\"\n }\n}\n\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-Org-Id\": \"497f6eca-6276-4993-bfeb-53cbbbba6f08\",\n \"X-Environment\": \"beta\"\n}\n\nresponse = requests.post(url, json=payload, headers=headers)\n\ndata = response.json()\nprint(data)"},{"lang":"java","title":"Java","source":"import java.net.*;\nimport java.net.http.*;\nimport java.util.*;\n\npublic class App {\n public static void main(String[] args) throws Exception {\n var httpClient = HttpClient.newBuilder().build();\n\n var payload = String.join(\"\\n\"\n , \"{\"\n , \" \\\"decision\\\": \\\"approve\\\",\"\n , \" \\\"admin_claims\\\": {\"\n , \" \\\"employee_id\\\": \\\"E-12345\\\",\"\n , \" \\\"department\\\": \\\"Engineering\\\"\"\n , \" }\"\n , \"}\"\n );\n\n var host = \"https://api.dev.deepcredentials.swiss\";\n var requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n var pathname = \"/b2b/v1/self-service/requests/%7BrequestId%7D/decision\";\n var request = HttpRequest.newBuilder()\n .POST(HttpRequest.BodyPublishers.ofString(payload))\n .uri(URI.create(host + pathname ))\n .header(\"Content-Type\", \"application/json\")\n .header(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n .header(\"X-Environment\", \"beta\")\n .build();\n\n var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n\n System.out.println(response.body());\n }\n}"},{"lang":"csharp","title":"C#","source":"using System;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing System.Text;\nusing System.Text.Json;\n\npublic class Program\n{\n public static async Task Main()\n {\n System.Net.Http.HttpClient client = new()\n {\n DefaultRequestHeaders =\n {\n {\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\"},\n {\"X-Environment\", \"beta\"},\n }\n };\n\n string json = JsonSerializer.Serialize(new\n {\n decision = \"approve\",\n admin_claims = new {\n employee_id = \"E-12345\",\n department = \"Engineering\"\n }\n });\n\n using StringContent postData = new(json, Encoding.UTF8, \"application/json\");\n var RequestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n using HttpResponseMessage request = await client.PostAsync(\"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + RequestId + \"/decision\", postData);\n string response = await request.Content.ReadAsStringAsync();\n\n Console.WriteLine(response);\n }\n}"},{"lang":"php","title":"PHP","source":"/**\n * Requires libcurl\n */\n\nconst requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n$curl = curl_init();\n\n$payload = array(\n \"decision\" => \"approve\",\n \"admin_claims\" => array(\n \"employee_id\" => \"E-12345\",\n \"department\" => \"Engineering\"\n )\n);\n\ncurl_setopt_array($curl, [\n CURLOPT_HTTPHEADER => [\n \"Content-Type: application/json\",\n \"X-Environment: beta\",\n \"X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08\"\n ],\n CURLOPT_POSTFIELDS => json_encode($payload),\n CURLOPT_URL => \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" . requestId . \"/decision\",\n CURLOPT_RETURNTRANSFER => true,\n CURLOPT_CUSTOMREQUEST => \"POST\",\n]);\n\n$response = curl_exec($curl);\n$error = curl_error($curl);\n\ncurl_close($curl);\n\nif ($error) {\n echo \"cURL Error #:\" . $error;\n} else {\n echo $response;\n}"},{"lang":"go","title":"Go","source":"package main\n\nimport (\n \"fmt\"\n \"bytes\"\n \"net/http\"\n \"io/ioutil\"\n)\n\nfunc main() {\n requestId := \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n reqUrl := \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + requestId + \"/decision\"\n var data = []byte(`{\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"employee_id\": \"E-12345\",\n \"department\": \"Engineering\"\n }\n }`)\n req, err := http.NewRequest(\"POST\", reqUrl, bytes.NewBuffer(data))\n if err != nil {\n panic(err)\n }\n req.Header.Add(\"Content-Type\", \"application/json\")\n req.Header.Add(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n req.Header.Add(\"X-Environment\", \"beta\")\n res, err := http.DefaultClient.Do(req)\n if err != nil {\n panic(err)\n }\n defer res.Body.Close()\n body, err := ioutil.ReadAll(res.Body)\n if err != nil {\n panic(err)\n }\n\n fmt.Println(res)\n fmt.Println(string(body))\n}"},{"lang":"ruby","title":"Ruby","source":"require 'json'\nrequire 'uri'\nrequire 'net/http'\nrequire 'openssl'\n\nrequest_id = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8'\nurl = URI('https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/' + request_id + '/decision')\n\nhttp = Net::HTTP.new(url.host, url.port)\nhttp.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest['Content-Type'] = 'application/json'\nrequest['X-Org-Id'] = '497f6eca-6276-4993-bfeb-53cbbbba6f08'\nrequest['X-Environment'] = 'beta'\nrequest.body = {\n decision: 'approve',\n admin_claims: {\n employee_id: 'E-12345',\n department: 'Engineering'\n }\n}.to_json\n\nresponse = http.request(request)\nputs response.read_body\n"},{"lang":"r","title":"R","source":"library(httr)\n\nbody = '{\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"employee_id\": \"E-12345\",\n \"department\": \"Engineering\"\n }\n}'\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\n\n# create you own operator\n\"%&%\" <- function(x, y)paste0(x,y)\n\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" %&% request_id %&% \"/decision\"\n\ndata_req <- POST(\n url,\n add_headers(\"Content-Type\" = \"application/json\", \"X-Org-Id\" = \"497f6eca-6276-4993-bfeb-53cbbbba6f08\", \"X-Environment\" = \"beta\"),\n body = body,\n encode = \"json\",\n verbose()\n)\n\ncontent(data_req)"},{"lang":"json","title":"Payload application/json","source":"{\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"is_employee\": true\n }\n}"}]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["required"]}," when the config has any claim keys marked admin-filled. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_filled_required"]}," from the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}," snapshot to know which keys you must supply. DeepCredentials merges your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," with the user-filled claims captured in the submission, validates the whole set against the credential definition schema, then creates the credential invitation and emails the end-user."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," may also include keys the end-user already filled in — your value overrides theirs (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#overriding-user-supplied-claims"},"children":["Overriding user-supplied claims"]}," above). Keys absent from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," flow through from the user submission unchanged."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-2b-reject","__idx":12},"children":["Step 2b: Reject"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/self-service-v1"},"children":["Open in API reference →"]}]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"api-docs-docs/openapi/self-service-v1.yaml","operationId":"POST:b2b.DecideSelfServiceRequest","parameters":{"path":{"requestId":"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8"}},"requestBody":{"decision":"reject","reason":"Employment start date does not match our HR records."},"environments":{"https://api.dev.deepcredentials.swiss":{"BearerAuth":"YOUR_ACCESS_TOKEN"}},"environment":"https://api.dev.deepcredentials.swiss","codeSamplesResolved":[{"lang":"shell","title":"curl","source":"curl -i -X POST \\\n https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8/decision \\\n -H 'Content-Type: application/json' \\\n -H 'X-Environment: beta' \\\n -H 'X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08' \\\n -d '{\n \"decision\": \"reject\",\n \"reason\": \"Employment start date does not match our HR records.\"\n }'"},{"lang":"javascript","title":"JavaScript","source":"const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\nconst resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}/decision`,\n {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n },\n body: JSON.stringify({\n decision: 'reject',\n reason: 'Employment start date does not match our HR records.'\n })\n }\n);\n\nconst data = await resp.json();\nconsole.log(data);"},{"lang":"javascript","title":"Node.js","source":"import fetch from 'node-fetch';\n\nasync function run() {\n const requestId = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8';\n const resp = await fetch(\n `https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/${requestId}/decision`,\n {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n 'X-Environment': 'beta'\n },\n body: JSON.stringify({\n decision: 'reject',\n reason: 'Employment start date does not match our HR records.'\n })\n }\n );\n\n const data = await resp.json();\n console.log(data);\n}\n\nrun();"},{"lang":"python","title":"Python","source":"import requests\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + request_id + \"/decision\"\n\npayload = {\n \"decision\": \"reject\",\n \"reason\": \"Employment start date does not match our HR records.\"\n}\n\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-Org-Id\": \"497f6eca-6276-4993-bfeb-53cbbbba6f08\",\n \"X-Environment\": \"beta\"\n}\n\nresponse = requests.post(url, json=payload, headers=headers)\n\ndata = response.json()\nprint(data)"},{"lang":"java","title":"Java","source":"import java.net.*;\nimport java.net.http.*;\nimport java.util.*;\n\npublic class App {\n public static void main(String[] args) throws Exception {\n var httpClient = HttpClient.newBuilder().build();\n\n var payload = String.join(\"\\n\"\n , \"{\"\n , \" \\\"decision\\\": \\\"reject\\\",\"\n , \" \\\"reason\\\": \\\"Employment start date does not match our HR records.\\\"\"\n , \"}\"\n );\n\n var host = \"https://api.dev.deepcredentials.swiss\";\n var requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n var pathname = \"/b2b/v1/self-service/requests/%7BrequestId%7D/decision\";\n var request = HttpRequest.newBuilder()\n .POST(HttpRequest.BodyPublishers.ofString(payload))\n .uri(URI.create(host + pathname ))\n .header(\"Content-Type\", \"application/json\")\n .header(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n .header(\"X-Environment\", \"beta\")\n .build();\n\n var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n\n System.out.println(response.body());\n }\n}"},{"lang":"csharp","title":"C#","source":"using System;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing System.Text;\nusing System.Text.Json;\n\npublic class Program\n{\n public static async Task Main()\n {\n System.Net.Http.HttpClient client = new()\n {\n DefaultRequestHeaders =\n {\n {\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\"},\n {\"X-Environment\", \"beta\"},\n }\n };\n\n string json = JsonSerializer.Serialize(new\n {\n decision = \"reject\",\n reason = \"Employment start date does not match our HR records.\"\n });\n\n using StringContent postData = new(json, Encoding.UTF8, \"application/json\");\n var RequestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n using HttpResponseMessage request = await client.PostAsync(\"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + RequestId + \"/decision\", postData);\n string response = await request.Content.ReadAsStringAsync();\n\n Console.WriteLine(response);\n }\n}"},{"lang":"php","title":"PHP","source":"/**\n * Requires libcurl\n */\n\nconst requestId = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n$curl = curl_init();\n\n$payload = array(\n \"decision\" => \"reject\",\n \"reason\" => \"Employment start date does not match our HR records.\"\n);\n\ncurl_setopt_array($curl, [\n CURLOPT_HTTPHEADER => [\n \"Content-Type: application/json\",\n \"X-Environment: beta\",\n \"X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08\"\n ],\n CURLOPT_POSTFIELDS => json_encode($payload),\n CURLOPT_URL => \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" . requestId . \"/decision\",\n CURLOPT_RETURNTRANSFER => true,\n CURLOPT_CUSTOMREQUEST => \"POST\",\n]);\n\n$response = curl_exec($curl);\n$error = curl_error($curl);\n\ncurl_close($curl);\n\nif ($error) {\n echo \"cURL Error #:\" . $error;\n} else {\n echo $response;\n}"},{"lang":"go","title":"Go","source":"package main\n\nimport (\n \"fmt\"\n \"bytes\"\n \"net/http\"\n \"io/ioutil\"\n)\n\nfunc main() {\n requestId := \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\";\n reqUrl := \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" + requestId + \"/decision\"\n var data = []byte(`{\n \"decision\": \"reject\",\n \"reason\": \"Employment start date does not match our HR records.\"\n }`)\n req, err := http.NewRequest(\"POST\", reqUrl, bytes.NewBuffer(data))\n if err != nil {\n panic(err)\n }\n req.Header.Add(\"Content-Type\", \"application/json\")\n req.Header.Add(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n req.Header.Add(\"X-Environment\", \"beta\")\n res, err := http.DefaultClient.Do(req)\n if err != nil {\n panic(err)\n }\n defer res.Body.Close()\n body, err := ioutil.ReadAll(res.Body)\n if err != nil {\n panic(err)\n }\n\n fmt.Println(res)\n fmt.Println(string(body))\n}"},{"lang":"ruby","title":"Ruby","source":"require 'json'\nrequire 'uri'\nrequire 'net/http'\nrequire 'openssl'\n\nrequest_id = '8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8'\nurl = URI('https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/' + request_id + '/decision')\n\nhttp = Net::HTTP.new(url.host, url.port)\nhttp.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest['Content-Type'] = 'application/json'\nrequest['X-Org-Id'] = '497f6eca-6276-4993-bfeb-53cbbbba6f08'\nrequest['X-Environment'] = 'beta'\nrequest.body = {\n decision: 'reject',\n reason: 'Employment start date does not match our HR records.'\n}.to_json\n\nresponse = http.request(request)\nputs response.read_body\n"},{"lang":"r","title":"R","source":"library(httr)\n\nbody = '{\n \"decision\": \"reject\",\n \"reason\": \"Employment start date does not match our HR records.\"\n}'\n\nrequest_id = \"8a3b1f2e-9c4d-4e5a-b1c2-d3e4f5a6b7c8\"\n\n# create you own operator\n\"%&%\" <- function(x, y)paste0(x,y)\n\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/self-service/requests/\" %&% request_id %&% \"/decision\"\n\ndata_req <- POST(\n url,\n add_headers(\"Content-Type\" = \"application/json\", \"X-Org-Id\" = \"497f6eca-6276-4993-bfeb-53cbbbba6f08\", \"X-Environment\" = \"beta\"),\n body = body,\n encode = \"json\",\n verbose()\n)\n\ncontent(data_req)"},{"lang":"json","title":"Payload application/json","source":"{\n \"decision\": \"approve\",\n \"admin_claims\": {\n \"is_employee\": true\n }\n}"}]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reason"]}," is shown to the end-user verbatim in the rejection email and on the status page."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"idempotency--races","__idx":13},"children":["Idempotency & races"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The decision endpoint is single-shot — a second call with the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requestId"]}," returns ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400 failed_precondition"]}," with the current state. If your backend retries on transport failure, treat a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failed_precondition"]}," response as confirmation the request was already decided."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"error-handling","__idx":14},"children":["Error handling"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"HTTP"},"children":["HTTP"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"code"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Meaning"},"children":["Meaning"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invalid_argument"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Decision is not ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["approve"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reject"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reason"]}," is missing on a reject, or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin_claims"]}," failed schema validation."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failed_precondition"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The request is in a state that doesn't accept a decision (already ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invitation_sent"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["issued"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejected"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failed"]},", or still ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awaiting_identification"]},"). Not idempotent — a second decision on an already-decided request returns this."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["unauthenticated"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permission_denied"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Auth missing, or the token lacks the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}," scope."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["not_found"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The request doesn't exist for this tenant. Common cause: a stale or incorrectly scoped ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requestId"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/error-handling"},"children":["Error Handling"]}," guide for the full taxonomy."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"see-also","__idx":15},"children":["See also"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/self-service/quickstart"},"children":["Quickstart"]}," — the four-step integration path."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/self-service/city-card-example"},"children":["Walkthrough — City Card"]}," — a concrete end-to-end example."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/self-service-v1"},"children":["Self-Service API reference"]}," — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /decision"]}," schemas."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/webhook-events-v1"},"children":["Webhook Events"]}," — full payload schemas for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["self_service.request.*"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/webhooks"},"children":["Webhooks guide"]}," — event delivery, signature verification, secret rotation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/issuance-flow"},"children":["Credential Issuance Flow"]}," — machine-to-machine alternative when your backend has all the data up front."]}]}]},"headings":[{"value":"Self-Service — Detailed Reference","id":"self-service--detailed-reference","depth":1},{"value":"Verification modes","id":"verification-modes","depth":2},{"value":"Request lifecycle","id":"request-lifecycle","depth":2},{"value":"Status reference","id":"status-reference","depth":3},{"value":"End-to-end interaction (webhook mode)","id":"end-to-end-interaction-webhook-mode","depth":2},{"value":"Delivery email is opt-in","id":"delivery-email-is-opt-in","depth":3},{"value":"Webhook payload contract","id":"webhook-payload-contract","depth":2},{"value":"Admin-claims schema on the GET snapshot","id":"admin-claims-schema-on-the-get-snapshot","depth":3},{"value":"Overriding user-supplied claims","id":"overriding-user-supplied-claims","depth":3},{"value":"Calling the decision endpoint","id":"calling-the-decision-endpoint","depth":2},{"value":"Step 1: Fetch the request snapshot","id":"step-1-fetch-the-request-snapshot","depth":3},{"value":"Step 2a: Approve","id":"step-2a-approve","depth":3},{"value":"Step 2b: Reject","id":"step-2b-reject","depth":3},{"value":"Idempotency & races","id":"idempotency--races","depth":3},{"value":"Error handling","id":"error-handling","depth":2},{"value":"See also","id":"see-also","depth":2}],"frontmatter":{"seo":{"title":"Self-Service — Detailed Reference"}},"lastModified":"2026-08-19T08:56:28.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/guides/self-service/flow","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}