API Reference Overview

New names

Credential Factory was formerly IaaS (Issuer as a Service), and Verification Gateway was formerly VaaS (Verification as a Service). Only the names changed: hostnames, API paths and your integration stay the same.

iDen2 exposes two API services. The reference pages in this section are generated directly from the OpenAPI specifications, so they always match the live API surface.

Service	Staging Host	Version	Spec
Credential Factory	iaas.stg.iden2.app	1.0.0	Swagger 2.0 source, rendered as OpenAPI 3.0
Verification Gateway	vaas.stg.iden2.app	1.0.0	Swagger 2.0 source, rendered as OpenAPI 3.0

Staging environment

All examples use the *.stg.iden2.app hosts, which are for development and testing only. Production hosts are TBD — contact the iDen2 platform team before going live. The staging specs list HTTP among the supported schemes as a staging artifact: always use HTTPS in production.

Authentication at a glance

API surface	Auth	Called by
Credential Factory Issuer API	OAuth 2.0 Bearer token (client_credentials)	Your backend
Verification Gateway Verifier API	OAuth 2.0 Bearer token (client_credentials)	Your backend
Verification Gateway Wallet API	None (public, state-scoped)	Holder wallets

See the Authentication guide for the full walkthrough.

Shared Error Model — RFC 9457 Problem Details

Both services use the same error structure for every non-2xx response: the RFC 9457 Problem Details object. Each endpoint's error table links back here.

Problem object schema

Field	Type	Required	Description	Example
type	string (URI)	No	URI identifying the problem type	https://api.iden2.net/problems/invalid-input
title	string	No	Short human-readable summary	Invalid Input
status	integer	No	HTTP status code	400
detail	string	No	Specific explanation of this occurrence	Invalid session ID format
instance	string (URI)	No	URI identifying this specific occurrence	/api/v1/sessions/invalid
serviceVersion	string	No	Service version that produced the error	1.0.0
subproblems	array<Problem>	No	Nested problems for compound validation errors	—

Example response

{
  "type": "https://api.iden2.net/problems/invalid-input",
  "title": "Invalid Input",
  "status": 400,
  "detail": "offerId must be a valid UUID",
  "instance": "/api/v1/iaas/credential-offers/not-a-uuid",
  "serviceVersion": "1.0.0"
}

Working with problems

• Branch program logic on type (a stable URI), not on the human-readable detail.
• For compound validation failures, iterate subproblems to surface every field error at once.
• Include serviceVersion and instance in support tickets.
• Retry guidance per status code lives in the Error Handling guide.

Conventions used across both APIs

• Identifiers — offerId and sessionId are UUIDs. Member and network identifiers (verifierMemberId, issuerMemberId, trustNetworkId) are URNs. Treat all of them as opaque.
• Timestamps — ISO 8601 UTC (e.g. 2025-01-15T10:00:00Z).
• Correlation — pass externalId on creation; it is echoed verbatim in all responses and callbacks (in Credential Factory's issuance_completed webhook the field is named userId, and revocation webhooks omit it).
• TTLs — offers and sessions expire and can never be revived; create a new one. Polling an expired offer returns 200 with status expired; acting on it (for example a wallet response) returns 410 Gone, or 409 Conflict once its expired status has been stored.
• Tenancy — you can only read your own offers and sessions; anything else returns 404.
• API versioning — the version is in the URL path (/api/v1/...). These docs always describe the current version.