Operate the standards-endpoints this tenant publishes: DID Doc, W3C Bitstring Status List v1.0, ETSI Trusted List, HAIP Wallet-Provider metadata + WUA/WIA minting.
Publishes this tenant as a did:web:- at the standard W3C well-known location. The verification method is your issuer's public JWK (auto-refreshes if you rotate the issuer cert).
Resolve any external DID (did:key / did:jwk / did:web / did:webvh) via /did.ashx?did=….
Compressed bitstring covering revocation + suspension state for VCs this tenant issued. Each credential references it via credentialStatus.statusListIndex. Published as a signed VC-JWT.
Publishes this tenant's TSPs as a signed XMLDSig LoTE (List of Trusted Entities). External verifiers walk //TSPService[] to know which issuer certs this tenant recognises.
Wallet-Provider metadata JWT + WUA (12-month Unit Attestation) and WIA (24-hour Instance Attestation) minting. Instances use WIA at OID4VCI issuance via attest_jwt_client_auth.
Issues + verifies Verifiable Credentials Data Model 2.0 (JSON credential + @context, JOSE envelope typ=vc+jwt). Complements the SD-JWT VC path in vci.ashx.
Profile flag advertised at /.well-known/openid-configuration under vp_formats_supported.mso_mdoc.iso18013-7_profile_supported: true. Verifiers walk the OID4VP request-object per Annex B.
Declare which OTHER tenants this tenant accepts credentials from. VCs issued by tenant A (iss = did:web:A) will verify at this tenant if A appears in the trust list. Trust is directional — add A here, and A must also add you for mutual acceptance.