Trust Network API

The Trust Network API serves read-only trust network configuration — which issuers and verifiers belong to a network, their display metadata, and governance policies. Verification Gateway uses this data at verification time; holder wallets use it on the consent screen.

Preview — platform API

The Trust Network API is available at tnas.stg.iden2.app (staging). Authenticated endpoints require OAuth Bearer with scope network.read.all. Contact the iDen2 platform team for access.

What integrators need to know

Most verifier and issuer integrations never call TNAS directly. Verification Gateway embeds trust decisions in verificationResult.issuerTrusted and encodes your verifier identity in the authorizationUrl:

Parameter	Where	Used for
`verifier_member_id`	Inside `client_metadata` on `authorizationUrl`	Wallet displays your organisation name/logo on consent
`issuerMemberId`	`verificationResult` on completed sessions	Which trusted issuer signed the presented credential

If issuer_not_trusted appears as failureReason, the credential's issuer is not a member in good standing of your configured trust network — contact iDen2 to update network membership.

See Trust Networks for the conceptual model.

When to call TNAS directly

Use case	Caller	Typical endpoint
Wallet consent UI	Mobile wallet, custom wallet	Member lookup by `verifier_member_id`
Offline trust cache	Wallet SDK (preview)	`GET /v1/trust-network/config` with ETag
Platform / SI tooling	Your ops integration	Network and member listing
Security audit	Compliance reviewer	Export network configuration

Base URL and auth

Environment	Host
Staging	`tnas.stg.iden2.app`
Development	`tnas.dev.iden2.app`
Production	`tnas.iden2.app` (confirm with platform team)

Auth: OAuth 2.0 Bearer token with scope network.read.all (when OAuth is configured). Unauthenticated access is not available for member APIs.

Caching: All endpoints support ETag / If-None-Match. Wallets should cache configuration and revalidate — see response headers on each GET.

Key endpoints

Base path: /v1/trust-network

Method	Path	Description
`GET`	`/config`	Full registry configuration (all network `core.json` documents)
`GET`	`/networks`	List trust network IDs
`GET`	`/networks/{id}`	Single network metadata
`GET`	`/networks/{id}/members`	Members of a network
`GET`	`/networks/{id}/members/{memberId}`	Single member record (issuer or verifier)
`GET`	`/images/*`	Static trust-network assets (logos)

Example — list networks

curl https://tnas.stg.iden2.app/v1/trust-network/networks \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

Example — conditional fetch

curl https://tnas.stg.iden2.app/v1/trust-network/config \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "If-None-Match: \"abc123\""

A 304 Not Modified means your cached copy is still valid.

How Verification Gateway uses trust data

Wallet reads verifier_member_id from the OpenID4VP authorization request and optionally queries TNAS (or a cached bundle) to show who is asking.
Verification Gateway resolves the presented credential's issuer against the same trust network configuration.
Your backend reads verificationResult.issuerTrusted — you do not need a separate TNAS call for standard verification flows.

What integrators need to know​

When to call TNAS directly​

Base URL and auth​

Key endpoints​

Example — list networks​

Example — conditional fetch​

How Verification Gateway uses trust data​

Next steps​