{
  "info": {
    "name": "CodeB Web Wallet backend — OEM integrator API",
    "description": "Postman collection for the CodeB Web Wallet backend API. Grouped by capability (A/B/C/D). Uses the `wallet-api-env` environment for {{tenant}}, {{clientId}}, {{accessToken}}, {{narrowToken}}. Contract of record: wallet-api.html (2026-08-12).",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
    "_postman_id": "codeb-wallet-api-2026-08-12"
  },
  "auth": {
    "type": "bearer",
    "bearer": [{ "key": "token", "value": "{{accessToken}}", "type": "string" }]
  },
  "variable": [],
  "item": [
    {
      "name": "A. Credential import (OID4VCI)",
      "description": "OID4VCI 1.0 FINAL holder-side calls against our own vci.ashx.",
      "item": [
        {
          "name": "A1 — GET issuer metadata",
          "request": {
            "method": "GET", "auth": { "type": "noauth" },
            "url": { "raw": "https://{{tenant}}/.well-known/openid-credential-issuer", "protocol": "https", "host": ["{{tenant}}"], "path": [".well-known", "openid-credential-issuer"] }
          }
        },
        {
          "name": "A2 — GET oauth-authorization-server metadata",
          "request": {
            "method": "GET", "auth": { "type": "noauth" },
            "url": { "raw": "https://{{tenant}}/.well-known/oauth-authorization-server", "protocol": "https", "host": ["{{tenant}}"], "path": [".well-known", "oauth-authorization-server"] }
          }
        },
        {
          "name": "A5 — POST /token (pre-authorized_code)",
          "request": {
            "method": "POST", "auth": { "type": "noauth" },
            "url": { "raw": "https://{{tenant}}/vci.ashx?token", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "token", "value": "" }] },
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "grant_type", "value": "urn:ietf:params:oauth:grant-type:pre-authorized_code" },
                { "key": "pre-authorized_code", "value": "{{preAuthCode}}" },
                { "key": "tx_code", "value": "{{txCode}}" }
              ]
            }
          }
        },
        {
          "name": "A6 — POST /nonce",
          "request": {
            "method": "POST", "auth": { "type": "noauth" },
            "url": { "raw": "https://{{tenant}}/vci.ashx?nonce", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "nonce", "value": "" }] }
          }
        },
        {
          "name": "A7 — POST /credential (SD-JWT)",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/vci.ashx?credential", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "credential", "value": "" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"format\": \"dc+sd-jwt\",\n  \"vct\":    \"urn:eudi:pid:1\",\n  \"proof\":  { \"proof_type\": \"jwt\", \"jwt\": \"{{proofJwt}}\" }\n}"
            }
          }
        },
        {
          "name": "A8 — POST /credential (mDoc)",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/vci.ashx?credential", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "credential", "value": "" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"format\":  \"mso_mdoc\",\n  \"doctype\": \"eu.europa.ec.eudi.pid.1\",\n  \"proof\":   { \"proof_type\": \"jwt\", \"jwt\": \"{{proofJwt}}\" }\n}"
            }
          }
        }
      ]
    },
    {
      "name": "B. Self-issue from OIDC identity",
      "item": [
        {
          "name": "B1 — GET /vci.ashx?available-attributes=1",
          "request": {
            "method": "GET",
            "url": { "raw": "https://{{tenant}}/vci.ashx?available-attributes=1", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "available-attributes", "value": "1" }] }
          }
        },
        {
          "name": "B2 — POST /vci.ashx?issue-in-session=1",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/vci.ashx?issue-in-session=1", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "issue-in-session", "value": "1" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"vct\": \"urn:eudi:pid:1\",\n  \"cnf\": {\n    \"jwk\": { \"kty\": \"EC\", \"crv\": \"P-256\", \"x\": \"{{walletJwkX}}\", \"y\": \"{{walletJwkY}}\" }\n  }\n}"
            }
          }
        }
      ]
    },
    {
      "name": "C. Credential presentation (OID4VP)",
      "item": [
        {
          "name": "C1 — GET /oidc.ashx?action=jar-proxy — BROWSER ONLY",
          "request": {
            "method": "GET",
            "description": "Native apps SHOULD fetch request_uri directly. This is here for parity with the browser wallet. Returns 400 unless caller is HTTPS + target is HTTPS + target host is public-routable.",
            "url": {
              "raw": "https://{{tenant}}/oidc.ashx?action=jar-proxy&url={{jarUrl}}",
              "protocol": "https", "host": ["{{tenant}}"], "path": ["oidc.ashx"],
              "query": [
                { "key": "action", "value": "jar-proxy" },
                { "key": "url", "value": "{{jarUrl}}" }
              ]
            }
          }
        },
        {
          "name": "C3 — POST /wallet-attestation.ashx",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/wallet-attestation.ashx", "protocol": "https", "host": ["{{tenant}}"], "path": ["wallet-attestation.ashx"] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"walletPublicJwk\": { \"kty\": \"EC\", \"crv\": \"P-256\", \"x\": \"{{walletJwkX}}\", \"y\": \"{{walletJwkY}}\" },\n  \"nonce\": \"{{waNonce}}\"\n}"
            }
          }
        }
      ]
    },
    {
      "name": "D. Wallet operations",
      "item": [
        {
          "name": "D1 — POST /wallet-session-token.ashx",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/wallet-session-token.ashx", "protocol": "https", "host": ["{{tenant}}"], "path": ["wallet-session-token.ashx"] }
          }
        },
        {
          "name": "D2 — POST /wallet-backup.ashx?action=save",
          "request": {
            "method": "POST",
            "auth": { "type": "bearer", "bearer": [{ "key": "token", "value": "{{narrowToken}}", "type": "string" }] },
            "url": { "raw": "https://{{tenant}}/wallet-backup.ashx?action=save", "protocol": "https", "host": ["{{tenant}}"], "path": ["wallet-backup.ashx"], "query": [{ "key": "action", "value": "save" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"v\": 1,\n  \"wrappedDeks\": [ { \"kek_id\": \"kek-1\", \"dek_cipher\": \"BASE64URL\" } ],\n  \"cipher\": \"BASE64URL\",\n  \"iv\":     \"BASE64URL\",\n  \"tag\":    \"BASE64URL\",\n  \"updatedUtc\": \"2026-08-12T19:00:00Z\",\n  \"hint\": \"iPhone 15 Pro\"\n}"
            }
          }
        },
        {
          "name": "D3 — GET /wallet-backup.ashx?action=load",
          "request": {
            "method": "GET",
            "auth": { "type": "bearer", "bearer": [{ "key": "token", "value": "{{narrowToken}}", "type": "string" }] },
            "url": { "raw": "https://{{tenant}}/wallet-backup.ashx?action=load", "protocol": "https", "host": ["{{tenant}}"], "path": ["wallet-backup.ashx"], "query": [{ "key": "action", "value": "load" }] }
          }
        },
        {
          "name": "D7 — POST /wallet-backup.ashx?action=delete",
          "request": {
            "method": "POST",
            "auth": { "type": "bearer", "bearer": [{ "key": "token", "value": "{{narrowToken}}", "type": "string" }] },
            "url": { "raw": "https://{{tenant}}/wallet-backup.ashx?action=delete", "protocol": "https", "host": ["{{tenant}}"], "path": ["wallet-backup.ashx"], "query": [{ "key": "action", "value": "delete" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": { "mode": "raw", "raw": "{ \"confirm\": \"delete\" }" }
          }
        },
        {
          "name": "D4 — POST /oidc.ashx?action=mdoc-cred-verify",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/oidc.ashx?action=mdoc-cred-verify", "protocol": "https", "host": ["{{tenant}}"], "path": ["oidc.ashx"], "query": [{ "key": "action", "value": "mdoc-cred-verify" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"issuerSigned\": \"BASE64URL_CBOR\",\n  \"docType\": \"eu.europa.ec.eudi.pid.1\"\n}"
            }
          }
        },
        {
          "name": "D5 — GET /business-wallet.ashx?action=identity",
          "request": {
            "method": "GET", "auth": { "type": "noauth" },
            "url": { "raw": "https://{{tenant}}/business-wallet.ashx?action=identity", "protocol": "https", "host": ["{{tenant}}"], "path": ["business-wallet.ashx"], "query": [{ "key": "action", "value": "identity" }] }
          }
        },
        {
          "name": "D6 — GET /oidc.ashx?action=end_session",
          "request": {
            "method": "GET", "auth": { "type": "noauth" },
            "url": {
              "raw": "https://{{tenant}}/oidc.ashx?action=end_session&post_logout_redirect_uri=https%3A%2F%2F{{tenant}}%2F",
              "protocol": "https", "host": ["{{tenant}}"], "path": ["oidc.ashx"],
              "query": [
                { "key": "action", "value": "end_session" },
                { "key": "post_logout_redirect_uri", "value": "https://{{tenant}}/" }
              ]
            }
          }
        },
        {
          "name": "D8 — POST /vci.ashx?self-offer",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/vci.ashx?self-offer", "protocol": "https", "host": ["{{tenant}}"], "path": ["vci.ashx"], "query": [{ "key": "self-offer", "value": "" }] },
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "body": { "mode": "raw", "raw": "{ \"vct\": \"urn:eudi:pid:1\" }" }
          }
        },
        {
          "name": "D9 — POST /oidc.ashx?action=data-deletion-request",
          "request": {
            "method": "POST",
            "url": { "raw": "https://{{tenant}}/oidc.ashx?action=data-deletion-request", "protocol": "https", "host": ["{{tenant}}"], "path": ["oidc.ashx"], "query": [{ "key": "action", "value": "data-deletion-request" }] }
          }
        }
      ]
    }
  ]
}