Add OpenID4VP REST API modules for Presentation Definition management and VP verification

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.common/pom.xml

@@ -97,6 +97,11 @@
             <artifactId>org.wso2.carbon.identity.compatibility.settings.core</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.wso2.carbon.identity.openid4vc</groupId>
+            <artifactId>org.wso2.carbon.identity.openid4vc.presentation.authenticator</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
 </project>

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.common/src/main/java/org/wso2/carbon/identity/api/server/configs/common/ConfigsServiceHolder.java

@@ -32,6 +32,7 @@
 import org.wso2.carbon.identity.oauth2.fapi.services.FapiConfigMgtService;
 import org.wso2.carbon.identity.oauth2.impersonation.services.ImpersonationConfigMgtService;
 import org.wso2.carbon.identity.oauth2.token.handler.clientauth.jwt.core.JWTClientAuthenticatorMgtService;
+import org.wso2.carbon.identity.openid4vc.presentation.authenticator.service.OpenID4VPConfigService;
 import org.wso2.carbon.idp.mgt.IdentityProviderManager;
 import org.wso2.carbon.idp.mgt.IdpManager;
 import org.wso2.carbon.logging.service.RemoteLoggingConfigService;
@@ -290,4 +291,16 @@ public static FapiConfigMgtService getFapiConfigMgtService() {
 
         return FapiConfigMgtServiceHolder.SERVICE;
     }
+
+    /**
+     * Get OpenID4VPConfigService osgi service.
+     * Returns null if the OID4VP feature is not enabled/deployed.
+     *
+     * @return OpenID4VPConfigService
+     */
+    public static OpenID4VPConfigService getOpenID4VPConfigService() {
+
+        return (OpenID4VPConfigService) PrivilegedCarbonContext
+                .getThreadLocalCarbonContext().getOSGiService(OpenID4VPConfigService.class, null);
+    }
 }

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.common/src/main/java/org/wso2/carbon/identity/api/server/configs/common/Constants.java

@@ -298,7 +298,20 @@ public enum ErrorMessage {
                 "Server encountered an error while retrieving the FAPI configuration."),
         ERROR_CODE_FAPI_CONFIG_UPDATE("65037",
                 "Unable to update FAPI configuration.",
-                "Server encountered an error while updating the FAPI configuration.");
+                "Server encountered an error while updating the FAPI configuration."),
+
+        /**
+         * OpenID4VP configuration errors.
+         */
+        ERROR_CODE_OID4VP_NOT_ENABLED("65038",
+                "OpenID4VP feature is not enabled.",
+                "The OpenID4VP feature is not enabled in this deployment."),
+        ERROR_CODE_OID4VP_CONFIG_RETRIEVE("65039",
+                "Unable to retrieve OpenID4VP configuration.",
+                "Server encountered an error while retrieving the OpenID4VP configuration."),
+        ERROR_CODE_OID4VP_CONFIG_UPDATE("65040",
+                "Unable to update OpenID4VP configuration.",
+                "Server encountered an error while updating the OpenID4VP configuration.");
 
         private final String code;
         private final String message;

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.v1/pom.xml

@@ -204,6 +204,16 @@
             <groupId>commons-beanutils</groupId>
             <artifactId>commons-beanutils</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.wso2.carbon.identity.openid4vc</groupId>
+            <artifactId>org.wso2.carbon.identity.openid4vc.presentation.common</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wso2.carbon.identity.openid4vc</groupId>
+            <artifactId>org.wso2.carbon.identity.openid4vc.presentation.authenticator</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
 </project>

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.v1/src/gen/java/org/wso2/carbon/identity/api/server/configs/v1/ConfigsApi.java

@@ -40,6 +40,7 @@
 import org.wso2.carbon.identity.api.server.configs.v1.model.FraudDetectionConfig;
 import org.wso2.carbon.identity.api.server.configs.v1.model.ImpersonationConfiguration;
 import org.wso2.carbon.identity.api.server.configs.v1.model.ImpersonationPatch;
+import org.wso2.carbon.identity.api.server.configs.v1.model.OpenID4VPConfiguration;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthOAuth2Config;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthPassiveSTSConfig;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthSAML2Config;
@@ -359,6 +360,55 @@ public Response getAgentConfiguration() {
         return delegate.getAgentConfiguration();
     }
 
+    @Valid
+    @GET
+    @Path("/openid4vp")
+
+    @Produces({ "application/json" })
+    @ApiOperation(value = "Retrieve the tenant OpenID4VP configuration.",
+            notes = "Retrieve the tenant OpenID4VP configuration.",
+            response = OpenID4VPConfiguration.class, authorizations = {
+        @Authorization(value = "BasicAuth"),
+        @Authorization(value = "OAuth2", scopes = {})
+    }, tags={ "OpenID4VP Configurations", })
+    @ApiResponses(value = {
+        @ApiResponse(code = 200, message = "Successful Response", response = OpenID4VPConfiguration.class),
+        @ApiResponse(code = 400, message = "Bad Request", response = Error.class),
+        @ApiResponse(code = 401, message = "Unauthorized", response = Void.class),
+        @ApiResponse(code = 403, message = "Forbidden", response = Void.class),
+        @ApiResponse(code = 404, message = "Not Found", response = Error.class),
+        @ApiResponse(code = 500, message = "Server Error", response = Error.class)
+    })
+    public Response getOpenID4VPConfiguration() {
+
+        return delegate.getOpenID4VPConfiguration();
+    }
+
+    @Valid
+    @PUT
+    @Path("/openid4vp")
+
+    @Consumes({ "application/json" })
+    @Produces({ "application/json" })
+    @ApiOperation(value = "Update the tenant OpenID4VP configuration.",
+            notes = "Update the tenant OpenID4VP configuration.",
+            response = OpenID4VPConfiguration.class, authorizations = {
+        @Authorization(value = "BasicAuth"),
+        @Authorization(value = "OAuth2", scopes = {})
+    }, tags={ "OpenID4VP Configurations", })
+    @ApiResponses(value = {
+        @ApiResponse(code = 200, message = "Successful Response", response = OpenID4VPConfiguration.class),
+        @ApiResponse(code = 400, message = "Bad Request", response = Error.class),
+        @ApiResponse(code = 401, message = "Unauthorized", response = Void.class),
+        @ApiResponse(code = 403, message = "Forbidden", response = Void.class),
+        @ApiResponse(code = 500, message = "Server Error", response = Error.class)
+    })
+    public Response updateOpenID4VPConfiguration(
+            @ApiParam(value = "", required = true) @Valid OpenID4VPConfiguration openID4VPConfiguration) {
+
+        return delegate.updateOpenID4VPConfiguration(openID4VPConfiguration);
+    }
+
     @Valid
     @GET
     @Path("/provisioning/inbound/scim")

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.v1/src/gen/java/org/wso2/carbon/identity/api/server/configs/v1/ConfigsApiService.java

@@ -26,6 +26,7 @@
 import org.wso2.carbon.identity.api.server.configs.v1.model.CompatibilitySettings;
 import org.wso2.carbon.identity.api.server.configs.v1.model.CORSPatch;
 import org.wso2.carbon.identity.api.server.configs.v1.model.ImpersonationPatch;
+import org.wso2.carbon.identity.api.server.configs.v1.model.OpenID4VPConfiguration;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthOAuth2Config;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthPassiveSTSConfig;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthSAML2Config;
@@ -64,6 +65,10 @@ public interface ConfigsApiService {
 
       public Response getAgentConfiguration();
 
+      public Response getOpenID4VPConfiguration();
+
+      public Response updateOpenID4VPConfiguration(OpenID4VPConfiguration openID4VPConfiguration);
+
       public Response getInboundScimConfigs();
 
       public Response getIssuerUsageScopeConfig();

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.v1/src/gen/java/org/wso2/carbon/identity/api/server/configs/v1/model/OpenID4VPConfiguration.java

@@ -0,0 +1,161 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.carbon.identity.api.server.configs.v1.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.annotations.ApiModelProperty;
+
+import java.util.Objects;
+
+import javax.validation.Valid;
+
+/**
+ * OpenID4VP tenant-level configuration.
+ */
+public class OpenID4VPConfiguration {
+
+    private String clientIdScheme;
+    private String clientId;
+    private String responseMode;
+    private String registrationCertificate;
+    private Boolean rejectVcWithoutStatusClaim;
+
+    public OpenID4VPConfiguration clientIdScheme(String clientIdScheme) {
+
+        this.clientIdScheme = clientIdScheme;
+        return this;
+    }
+
+    @ApiModelProperty(example = "x509_san_dns",
+            value = "The client_id_scheme used when building the VP request JWT.")
+    @JsonProperty("clientIdScheme")
+    @Valid
+    public String getClientIdScheme() {
+        return clientIdScheme;
+    }
+
+    public void setClientIdScheme(String clientIdScheme) {
+        this.clientIdScheme = clientIdScheme;
+    }
+
+    public OpenID4VPConfiguration clientId(String clientId) {
+
+        this.clientId = clientId;
+        return this;
+    }
+
+    @ApiModelProperty(example = "x509_san_dns:myserver.example.com",
+            value = "Optional override for the client_id sent in VP requests. "
+                    + "Leave blank to auto-derive from the client ID scheme.")
+    @JsonProperty("clientId")
+    @Valid
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public OpenID4VPConfiguration responseMode(String responseMode) {
+
+        this.responseMode = responseMode;
+        return this;
+    }
+
+    @ApiModelProperty(example = "direct_post",
+            value = "The response_mode used in the VP request (direct_post or direct_post.jwt).")
+    @JsonProperty("responseMode")
+    @Valid
+    public String getResponseMode() {
+        return responseMode;
+    }
+
+    public void setResponseMode(String responseMode) {
+        this.responseMode = responseMode;
+    }
+
+    public OpenID4VPConfiguration registrationCertificate(String registrationCertificate) {
+
+        this.registrationCertificate = registrationCertificate;
+        return this;
+    }
+
+    @ApiModelProperty(value = "Optional verifier_attestation JWT for wallet registration.")
+    @JsonProperty("registrationCertificate")
+    @Valid
+    public String getRegistrationCertificate() {
+        return registrationCertificate;
+    }
+
+    public void setRegistrationCertificate(String registrationCertificate) {
+        this.registrationCertificate = registrationCertificate;
+    }
+
+    public OpenID4VPConfiguration rejectVcWithoutStatusClaim(Boolean rejectVcWithoutStatusClaim) {
+
+        this.rejectVcWithoutStatusClaim = rejectVcWithoutStatusClaim;
+        return this;
+    }
+
+    @ApiModelProperty(value = "When true, VCs that do not carry a status claim are rejected during verification.")
+    @JsonProperty("rejectVcWithoutStatusClaim")
+    @Valid
+    public Boolean getRejectVcWithoutStatusClaim() {
+        return rejectVcWithoutStatusClaim;
+    }
+
+    public void setRejectVcWithoutStatusClaim(Boolean rejectVcWithoutStatusClaim) {
+        this.rejectVcWithoutStatusClaim = rejectVcWithoutStatusClaim;
+    }
+
+    @Override
+    public boolean equals(java.lang.Object o) {
+
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        OpenID4VPConfiguration that = (OpenID4VPConfiguration) o;
+        return Objects.equals(this.clientIdScheme, that.clientIdScheme)
+                && Objects.equals(this.clientId, that.clientId)
+                && Objects.equals(this.responseMode, that.responseMode)
+                && Objects.equals(this.registrationCertificate, that.registrationCertificate);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(clientIdScheme, clientId, responseMode, registrationCertificate);
+    }
+
+    @Override
+    public String toString() {
+
+        StringBuilder sb = new StringBuilder();
+        sb.append("class OpenID4VPConfiguration {\n");
+        sb.append("    clientIdScheme: ").append(clientIdScheme).append("\n");
+        sb.append("    clientId: ").append(clientId).append("\n");
+        sb.append("    responseMode: ").append(responseMode).append("\n");
+        sb.append("    registrationCertificate: ").append("[REDACTED]").append("\n");
+        sb.append("}");
+        return sb.toString();
+    }
+}

components/org.wso2.carbon.identity.api.server.configs/org.wso2.carbon.identity.api.server.configs.v1/src/main/java/org/wso2/carbon/identity/api/server/configs/v1/core/ServerConfigManagementService.java

@@ -62,6 +62,10 @@
 import org.wso2.carbon.identity.api.server.configs.v1.model.FraudDetectionConfig;
 import org.wso2.carbon.identity.api.server.configs.v1.model.ImpersonationConfiguration;
 import org.wso2.carbon.identity.api.server.configs.v1.model.ImpersonationPatch;
+import org.wso2.carbon.identity.api.server.configs.v1.model.OpenID4VPConfiguration;
+import org.wso2.carbon.identity.openid4vc.presentation.authenticator.exception.VPAuthenticatorException;
+import org.wso2.carbon.identity.openid4vc.presentation.authenticator.service.OpenID4VPConfigService;
+import org.wso2.carbon.identity.openid4vc.presentation.common.constant.OpenID4VPConstants;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthOAuth2Config;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthPassiveSTSConfig;
 import org.wso2.carbon.identity.api.server.configs.v1.model.InboundAuthSAML2Config;
@@ -663,6 +667,66 @@ public FapiConfig updateFAPIConfiguration(FapiConfig fapiConfig) {
         }
     }
 
+    /**
+     * Retrieves the OpenID4VP configuration for the current tenant domain.
+     *
+     * @return OpenID4VPConfiguration the current OID4VP configuration.
+     */
+    public OpenID4VPConfiguration getOpenID4VPConfiguration() {
+
+        String tenantDomain = ContextLoader.getTenantDomainFromContext();
+        OpenID4VPConfigService configService = ConfigsServiceHolder.getOpenID4VPConfigService();
+        if (configService == null) {
+            throw handleException(Response.Status.NOT_IMPLEMENTED,
+                    Constants.ErrorMessage.ERROR_CODE_OID4VP_NOT_ENABLED, null);
+        }
+        try {
+            OpenID4VPConfigService.TenantConfig cfg = configService.getConfig(tenantDomain);
+            return new OpenID4VPConfiguration()
+                    .clientIdScheme(StringUtils.defaultIfBlank(
+                            cfg.getClientIdScheme(), OpenID4VPConstants.Defaults.CLIENT_ID_SCHEME))
+                    .clientId(cfg.getClientId())
+                    .responseMode(StringUtils.defaultIfBlank(
+                            cfg.getResponseMode(), OpenID4VPConstants.Defaults.RESPONSE_MODE))
+                    .registrationCertificate(cfg.getRegistrationCertificate())
+                    .rejectVcWithoutStatusClaim(
+                            cfg.getRejectVcWithoutStatusClaim() != null
+                                    ? cfg.getRejectVcWithoutStatusClaim() : Boolean.FALSE);
+        } catch (VPAuthenticatorException e) {
+            throw handleException(Response.Status.INTERNAL_SERVER_ERROR,
+                    Constants.ErrorMessage.ERROR_CODE_OID4VP_CONFIG_RETRIEVE, null);
+        }
+    }
+
+    /**
+     * Updates the OpenID4VP configuration for the current tenant domain.
+     *
+     * @param config the new OID4VP configuration.
+     * @return the updated OpenID4VPConfiguration.
+     */
+    public OpenID4VPConfiguration updateOpenID4VPConfiguration(OpenID4VPConfiguration config) {
+
+        String tenantDomain = ContextLoader.getTenantDomainFromContext();
+        OpenID4VPConfigService configService = ConfigsServiceHolder.getOpenID4VPConfigService();
+        if (configService == null) {
+            throw handleException(Response.Status.NOT_IMPLEMENTED,
+                    Constants.ErrorMessage.ERROR_CODE_OID4VP_NOT_ENABLED, null);
+        }
+        try {
+            OpenID4VPConfigService.TenantConfig tenantConfig = new OpenID4VPConfigService.TenantConfig();
+            tenantConfig.setClientIdScheme(config.getClientIdScheme());
+            tenantConfig.setClientId(config.getClientId());
+            tenantConfig.setResponseMode(config.getResponseMode());
+            tenantConfig.setRegistrationCertificate(config.getRegistrationCertificate());
+            tenantConfig.setRejectVcWithoutStatusClaim(config.getRejectVcWithoutStatusClaim());
+            configService.setConfig(tenantConfig, tenantDomain);
+            return config;
+        } catch (VPAuthenticatorException e) {
+            throw handleException(Response.Status.INTERNAL_SERVER_ERROR,
+                    Constants.ErrorMessage.ERROR_CODE_OID4VP_CONFIG_UPDATE, null);
+        }
+    }
+
     /**
      * Get the CORS config for a tenant.
      */