Skip to content

France Identité Partenaires — ISO 18013-7 Annex C (Android DC API)

← Back to the Partenaires app overview

Android support

ISO 18013-7 Annex C Digital Credentials API presentation is supported on Android in Partenaires version 1.3.5016. This page does not claim equivalent support on iOS.

ISO 18013 reference

For live access to the latest published versions of the ISO/IEC 18013 documents, use the OpenWallet Foundation's mdoc.online.

ISO/IEC 18013-7 Annex C can mediate both same-device and cross-device presentations through the Digital Credentials API. The browser invokes the wallet through the API; this page focuses on the direct org-iso-mdoc mode tested with Partenaires. The credential remains an ISO/IEC 18013-5 mdoc.

Test the Android DC API flow

Use the OWF Multipaz verifier from a compatible browser. It is the reference verifier for the Partenaires Annex C test flow and exposes the W3C DC API (18013-7 Annex C) protocol option:

  1. Open the verifier page in a compatible browser.
  2. Select W3C DC API (18013-7 Annex C), not one of the OpenID4VP-over-DC-API options.
  3. Configure an mdoc request and the claims to request.
  4. Start the verification flow.
  5. Approve the wallet request in France Identité Partenaires.
  6. Confirm that Multipaz decrypts the response and validates the returned mdoc.

See the DC API verifier technical guide for the validation model before diagnosing a wallet failure.

Annex C message flow

The browser-mediated request uses the ISO 18013-7 Annex C mdoc protocol identifier:

protocol = org-iso-mdoc

At a high level, the verifier supplies:

  • a CBOR-encoded DeviceRequest, transported as base64url;
  • the encryptionInfo needed to establish the Annex C encrypted response;
  • the origin and session information needed to bind the request.

The wallet returns an encrypted response containing the mdoc DeviceResponse. The response must be decrypted using the Annex C session transcript before the verifier parses the documents.

Do not replace this exchange with an OID4VP request object, request_uri, dcql_query, direct_post.jwt, or an openid4vp:// QR code. Those belong to a different presentation profile.

What the verifier must validate

After decryption, the verifier must validate the mdoc rather than trusting displayed fields:

  • the DeviceResponse and Document CBOR structures;
  • the requested docType, namespaces, and elements;
  • issuer authentication and the correct issuer certificate chain;
  • MSO value digests;
  • device authentication and holder binding against the Annex C session transcript;
  • validity and status checks required by the test environment.

The test data and trust material page contains the Partenaires trust anchors. The ISO/IEC 18013-5 proximity guide explains the mdoc validation requirements in more detail.

For cross-cutting application and environment issues, see Troubleshooting.

References