> For the complete documentation index, see [llms.txt](https://dev.ishare.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev.ishare.eu/reference/claim-models.md).

# Claim models

{% hint style="info" %}
***This page must be considered part of the iSHARE Framework***

*This page is considered normative and is therefore compliant with RFC 2119.*
{% endhint %}

The endpoints that allow GET, PATCH or POST of parties, make use of claims as a way of structuring party information. This page contains the available claim models in the iSHARE Framework. Further claims and their models may be defined by dataspaces if needed.

> **Status vocabulary:** Claim `status` fields use the lifecycle values `active`, `inactive`, `revoked` and `suspended`. These are distinct from the certificate-authority status values used in the [Trusted List](/participant-registry-role/trusted-list.md): `granted`, `withdrawn`, `supervisionceased` and `undersupervision`.

* [#framework-compliance-claim](#framework-compliance-claim "mention")
* [#authorisation-registry-claim](#authorisation-registry-claim "mention")
* [#framework-agreement-claim](#framework-agreement-claim "mention")
* [#framework-role-claim](#framework-role-claim "mention")
* [#dataspace-membership-claim](#dataspace-membership-claim "mention")
* [#dataspace-agreement-claim](#dataspace-agreement-claim "mention")
* [#dataspace-role-claim](#dataspace-role-claim "mention")
* [#x509-certificate-chain-claim](#x509-certificate-chain-claim "mention")
* [#idp-assertion-claim](#idp-assertion-claim "mention")

## Level of Assurance applicability

Where a role claim includes `loa`, apply the following values by role:

| Role                   | `loa` requirement                        |
| ---------------------- | ---------------------------------------- |
| Service Consumer       | Required: `low`, `substantial` or `high` |
| Identity Provider      | Required: `low`, `substantial` or `high` |
| Identity Broker        | Required: `low`, `substantial` or `high` |
| Service Provider       | `not-applicable`                         |
| Entitled Party         | `not-applicable`                         |
| Participant Registry   | `not-applicable`                         |
| Authorisation Registry | `not-applicable`                         |

## Framework Compliance Claim

Participant claim that holds framework compliance. Contains the following attributes.

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the framework compliance (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate` <mark style="color:red;">(Required)</mark>\
  **String**. UTC timestamp of the start date of the framework compliance.
* `endDate` <mark style="color:red;">(Required)</mark>\
  **String**. UTC timestamp of the end date of the framework compliance.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `frameworkCompliance` for this type of claim.
* `frameworkId` <mark style="color:red;">(Required)</mark>\
  **String**. ID of the framework the compliance is claimed for.
* `capabilityUrl`\
  **String**. String (URI). Absolute HTTPS URL of the party's capabilities endpoint. No trailing slash. The response to `GET <capabilityUrl>/capabilities` MUST conform to the capabilities endpoint specification.
* `additionalInfo`\
  **Object**. Object which contains additional general contact information of the party.
  * `description`\
    **String**. A brief description of the party.
  * `logo`\
    **String**. URL pointing to the endpoint where company logo can be found.
  * `website`\
    **String**. Website address of the party.
  * `companyPhone`\
    **String**. General company phone number of the party.
  * `companyEmail`\
    **String**. General company email id of the party.
  * `publiclyPublishable` <mark style="color:red;">(Required)</mark>\
    **Boolean**. Consent to publicly publish the information contained in this additionalInfo object.
  * `countriesOfOperation`\
    **Array of strings**. An array of ISO 3166-1 alpha-2 country codes where the party operates (e.g. `["NL", "BE", "DE"]`).
  * `sectorIndustry`\
    **Array of strings**. An array of GICS based sectors/industry that party serves in.
  * `tags`\
    **Array of strings**. Keywords relevant for the party (e.g. `["logistics", "eu-north"]`). Note: changed from single string in v2.x — minor breaking change.

#### Example

```json
{
        "type": "frameworkCompliance",
        "id": "e1585bdd-a1a9-4bd3-bf7e-7fe64300907b",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
        "capabilityUrl": "",
        "status": "active",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "frameworkId": "iSHARE",
        "additionalInfo": {
          "description": "description",
          "logo": "https://logo.example.com/",
          "website": "https://www.example.com/",
          "companyPhone": "+310202343458",
          "companyEmail": "info@exmaple.com",
          "publiclyPublishable": "no",
          "countriesOfOperation": [
            "Netherlands",
            "Germany"
          ],
          "sectorIndustry": [
            "Energy"
          ],
          "tags": ""
        }
      }
```

## Authorisation Registry Claim

Presents the selected Authorisation Registry to be used for the participant. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of this claim instance (UUID), matching the `id` semantics of every other claim type on this page.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the framework compliance (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the authorisation registry claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the authorisation registry claim.
* `name` <mark style="color:red;">(Required)</mark>\
  **String**. The official name of the Authorisation Registry provider.
* `authRegistryId` <mark style="color:red;">(Required)</mark>\
  **String**. The iSHARE DID of the AR provider being selected.
* `authUrl` <mark style="color:red;">(Required)</mark>\
  **String**. The URL endpoint of the Authorisation Registry, where authorisations can be queried or checked for the party.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `authRegistry` for this type of claim.
* `dataspaceId`\
  **String**. Optional ID of the dataspace for which this AR is selected by the Entitled Party.
* `frameworkId`\
  **String**. Optional ID of the framework for which this AR is selected by the Entitled Party.
* `serviceProviderPartyId`\
  **String**. Optional party id of the Service Provider for which this AR is selected by the Entitled Party.

#### Example

```json
 {
        "type": "authRegistry",
        "id": "96a9a443-89cc-43a7-a64a-461a4d508713",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000000",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "name": "Test Authorisation Registry",
        "authRegistryId": "did:ishare:EU.NL.NTRNL-10000004",
        "authUrl": "https://some.server.com/abc",
        "status": "active",
        "frameworkId": "iSHARE",
        "dataspaceId": "DSP.EU.NL.DutchMobility",
        "serviceProviderPartyId": "did:ishare:EU.NL.NTRNL-10000003"
}
```

## Framework Agreement Claim

Presents the claims for the Accession Agreement and Terms of Use are required at minimum, may have additional agreements. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the framework agreement (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the framework agreement claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the framework agreement claim.
* `agreementType` <mark style="color:red;">(Required)</mark>\
  **String**. Descriptive type of the agreement. Framework or dataspace may define agreement types.
* `agreementId` <mark style="color:red;">(Required)</mark>\
  **String**. ID that refers to the agreement.
* `title` <mark style="color:red;">(Required)</mark>\
  **String**. The name of the agreement or agreement file
* `verificationHash`\
  **String**. The calculated hash of the agreement file that has been uploaded. Note agreements are not stored in the ledger, but only their hash. The verificationHash must be calculated using the SHA256 hashing algorithm.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `frameworkAgreement` for this type of claim.
* `frameworkId` <mark style="color:red;">(Required)</mark>\
  **String**. ID of the framework the agreement applies to.

#### Example

```json
 {
        "type": "frameworkAgreement",
        "id": "b2be77dc-20c6-4deb-8f2a-855cd34aacca",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000000",
        "agreementType": "Accession Agreement",
        "agreementId": "aa",
        "title": "Accession Agreement",
        "status": "active",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "verificationHash": "ae1d7d30f5db9497f21a7984a8a6f359",
        "frameworkId": "iSHARE"
}
```

## Framework Role Claim

When a data space defines its own roles for participants, it can be added through this claim. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the framework role (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate` <mark style="color:red;">(Required)</mark>\
  **String**. UTC timestamp of the start date of the framework role claim.
* `endDate` <mark style="color:red;">(Required)</mark>\
  **String**. UTC timestamp of the end date of the framework role claim.
* `roleId` <mark style="color:red;">(Required)</mark>\
  **String**. Name of the role as defined by the framework or dataspace. iSHARE defines the following roles: EntitledParty, ServiceConsumer, ServiceProvider, AuthorisationRegistry, ParticipantRegistry, IdentityProvider, IdentityBroker.
* `title`\
  **String**. Title of the role
* `loa` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Party's level of assurance. Available values are `low`, `substantial`, `high` and `not-applicable`; see [Level of Assurance applicability](#level-of-assurance-applicability).
* `compliancyVerified` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Compliance requirements of this role has been met by party. Possible values are yes, no and not-applicable.
* `legalAdherence` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Legal requirements of this role has been met by the party including signing of appropriate agreements. Possible values are yes, no and not-applicable.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `frameworkRole` for this type of claim.
* `frameworkId` <mark style="color:red;">(Required)</mark>\
  **String**. ID of the framework the role is claimed for.

#### Example

```json
{
        "type": "frameworkRole",
        "id": "716e3178-36d2-4658-92cb-e2d078ff7f4e",
        "roleId": "ServiceProvider",
        "title": "Service Provider",
        "status": "active",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "frameworkId": "iSHARE",
        "loa": "substantial",
        "compliancyVerified": "yes",
        "legalAdherence": "no",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000000"
}
```

## Dataspace Membership Claim

Participant claim that holds dataspace membership. Contains the following attributes.

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the dataspace membership (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the dataspace membership claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the dataspace membership claim.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `dataspaceMembership` for this type of claim.
* `dataspaceId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the dataspace of which the participant is a member of.
* `capabilityUrl`\
  **String**. String (URI). Absolute HTTPS URL of the party's capabilities endpoint. No trailing slash. The response to `GET <capabilityUrl>/capabilities` MUST conform to the capabilities endpoint specification.
* `legalAdherence` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Whether legal adherence is required, not required or not applicable. Possible values are `yes`, `no` and `not-applicable`.
* `additionalInfo`\
  **Object**. Object which contains additional general contact information of the party.
  * `description`\
    **String**. A brief description of the party.
  * `logo`\
    **String**. URL pointing to the endpoint where company logo can be found.
  * `website`\
    **String**. Website address of the party.
  * `companyPhone`\
    **String**. General company phone number of the party.
  * `companyEmail`\
    **String**. General company email id of the party.
  * `publiclyPublishable` <mark style="color:red;">(Required)</mark>\
    **String**. Consent to publicly publish the information contained in this additionalInfo object.
  * `countriesOfOperation`\
    **Array of strings**. An array of ISO 3166-1 alpha-2 country codes where the party operates (e.g. `["NL", "BE", "DE"]`).
  * `sectorIndustry`\
    **Array of strings**. An array of GICS based sectors/industry that party serves in.
  * `tags`\
    **Array of strings**. Keywords relevant for the party (e.g. `["logistics", "eu-north"]`). Note: changed from single string in v2.x — minor breaking change.

#### Example

```json
{
  "type": "dataspaceMembership",
  "id": "6fa964e4-f4c8-4dd5-93d6-71afe628b57b",
  "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
  "capabilityUrl": "https://capabilities.example.com",
  "dataspaceId": "DSP.EU.NL.DutchMobility",
  "status": "active",
  "startDate": "2025-02-12T00:00:00.000Z",
  "endDate": "2026-02-13T00:00:00.000Z",
  "legalAdherence": "no",
  "additionalInfo": {
    "description": "description",
    "logo": "https://logo.example.com/",
    "website": "https://www.example.com/",
    "companyPhone": "+310202343458",
    "companyEmail": "info@exmaple.com",
    "publiclyPublishable": "no",
    "countriesOfOperation": [
      "Netherlands",
      "Germany"
    ],
    "sectorIndustry": [
      "Energy"
    ],
    "tags": ""
  }
}
```

## Dataspace Agreement Claim

When a dataspace defines its own agreement for participants, it can be added through this claim. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the dataspace agreement (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the dataspace agreement claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the dataspace agreement claim.
* `agreementType` <mark style="color:red;">(Required)</mark>\
  **String**. Descriptive type of the agreement. Framework or dataspace may define agreement types.
* `agreementId` <mark style="color:red;">(Required)</mark>\
  **String**. ID that refers to the agreement.
* `title` <mark style="color:red;">(Required)</mark>\
  **String**. The name of the agreement or agreement file
* `verificationHash`\
  **String**. The calculated hash of the agreement file that has been uploaded. Note agreements are not stored in the ledger, but only their hash. The verificationHash must be calculated using the SHA256 hashing algorithm.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `dataspaceAgreement` for this type of claim.
* `dataspaceId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the dataspace of which the participant is a member of.

#### Example

```json
{
  "type": "dataspaceAgreement",
  "id": "e65c7982-6f8c-46a9-b32e-e9586850765e",
  "dataspaceId": "DSP.EU.NL.DutchMobility",
  "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
  "agreementType": "Terms of Use",
  "agreementId": "dmtou",
  "title": "tu",
  "status": "active",
  "startDate": "2025-02-12T00:00:00.000Z",
  "endDate": "2026-02-13T00:00:00.000Z",
  "verificationHash": "ae1d7d30f5db9497f21a7984a8a6f359"
}
```

## Dataspace Role Claim

When a data space defines its own roles for participants, it can be added through this claim. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the dataspace role (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the dataspace role claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the dataspace role claim.
* `roleId` <mark style="color:red;">(Required)</mark>\
  **String**. Name of the role as defined by the framework or dataspace.
* `title`\
  **String**. Title of the role
* `loa` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Party's level of assurance. Available values are `low`, `substantial`, `high` and `not-applicable`; see [Level of Assurance applicability](#level-of-assurance-applicability).
* `compliancyVerified` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Compliance requirements of this role has been met by party. Possible values are yes, no and not-applicable.
* `legalAdherence` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Legal requirements of this role has been met by the party including signing of appropriate agreements. Possible values are yes, no and not-applicable.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `dataspaceRole` for this type of claim.
* `dataspaceId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the dataspace of which the participant is a member of.

#### Example

```json
{
  "type": "dataspaceRole",
  "id": "216b5826-182b-4dec-8a28-f18da9bbab9d",
  "dataspaceId": "DSP.EU.NL.DutchMobility",
  "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
  "roleId": "ServiceBroker",
  "title": "Service Broker",
  "status": "active",
  "startDate": "2025-02-12T00:00:00.000Z",
  "endDate": "2026-02-13T00:00:00.000Z",
  "loa": "substantial",
  "compliancyVerified": "yes",
  "legalAdherence": "no"
}
```

## x509 Certificate Chain Claim

Required if no IDP assertion claim is present. x509Certificate claim must be a valid certificate issued by a Root from the trusted list. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the X.509 certificate (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the X.509 certificate claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the X.509 certificate claim.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `x509Certificate` for this type of claim.
* `subjectName` <mark style="color:red;">(Required)</mark>\
  **String**. subjectName as encoded in the X.509 certificate which corresponds with the party that is being requested from the Participant Registry. Used by the Participant Registry to match the certificate identifier.
* `certificateType` <mark style="color:red;">(Required)</mark>\
  **String**. Type of certificate
* `x5c` <mark style="color:red;">(Required)</mark>\
  **Array of strings**. Array of base64-encoded DER certificates per RFC 7515 §4.1.6: leaf certificate first, intermediate CAs, root last. No PEM headers.
* `x5t#s256` <mark style="color:red;">(Required)</mark>\
  **String**. The SHA256 fingerprint of the certificate

#### Example

```json
{
        "type": "x509Certificate",
        "id": "5ffb4bb9-2020-4045-a922-3bd84e78f709",
        "subjectName": "C=NL,O=Test Service Consumer,CN=Test Service Consumer,2.5.4.97=NTRNL-10000001",
        "certificateType": "eSeal",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "x5c": "MIIGiDCCBHCgAwIBAgIURMIL+omg6v5pU6qFOMFceG1YjDAwDQYJKoZIhvcNAQELBQAwXTEeMBwGA1UEAwwVZUlEQVNlU0VBTE9JRF9Jc3NDQUc0MRkwFwYDVQRhExBOVFJOTC1pU0hBUkVURVNUMRMwEQYDVQQKEwppU0hBUkVUZXN0MQswCQYDVQQGEwJYWDAeFw0yNDExMDYxNDQ1NDFaFw0yNzExMDYxNDQ1NDBaMGYxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVUZXN0IFNlcnZpY2UgQ29uc3VtZXIxHjAcBgNVBAMMFVRlc3QgU2VydmljZSBDb25zdW1lcjEXMBUGA1UEYQwOTlRSTkwtMTAwMDAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDYSKOvmB6UxEaYOPT7APgU4mauSh9vbPacJtM3a4cdzN8KippjoWSbgr6Jb4Fc7tGvNk6nvWZHlHzADFe0aQIGl8IDhuq1BhXJTxHZ4krw/6AEbC/GRcgtJdcanlc3WkM5rMEsoDRd8gOvNTnL7m52DIWb3RS8bCitVH6qn3hoWSwX9XeeU6JrGu1kp6lfT19u1zJKZuBaB0Ia4uzmM+QSd1kU6PeCXQ+trEfVUQkP8g/rzZGnSH8u7NqiwwUfFSiaUyq9P4Ip+K0JBTtAuQ9xpQ6wQxt0ioFNFb9ipmc3xxekowMRykZzEdoHO/ynY3W4sbTSl2eN4EmfHzQGRLJLAgMBAAGjggI1MIICMTAOBgNVHQ8BAf8EBAMCBkAwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBSzGk9CQOnYeJ1r//wksBCxNDzwiTBXBggrBgEFBQcBAQRLMEkwRwYIKwYBBQUHMAGGO2h0dHBzOi8vY2E3LmlzaGFyZXRlc3QubmV0Ojg0NDIvZWpiY2EvcHVibGljd2ViL3N0YXR1cy9vY3NwMBAGA1UdIAQJMAcwBQYDVR0gMB8GA1UdJQQYMBYGCCsGAQUFBwMEBgorBgEEAYI3CgMMMFsGCCsGAQUFBwEDBE8wTTATBgYEAI5GAQYwCQYHBACORgEGAjA2BggrBgEFBQcBAwwqVGhpcyBpcyB0ZXN0IGVzZWFsIGNlcnRpZmljYXRlIGZvciB0ZXN0aW5nMB4GBWeBDAMBBBUwExMDTlRSEwJOTAwIMTAwMDAwMDEwgccGA1UdHwSBvzCBvDCBuaCBtqCBs4aBsGh0dHBzOi8vY2E3LmlzaGFyZXRlc3QubmV0Ojg0NDIvZWpiY2EvcHVibGljd2ViL3dlYmRpc3QvY2VydGRpc3Q/Y21kPWNybCZpc3N1ZXI9Q04lM0RlSURBU2VTRUFMT0lEX0lzc0NBRzQlMkNvcmdhbml6YXRpb25JZGVudGlmaWVyJTNETlRSTkwtaVNIQVJFVEVTVCUyQ08lM0RpU0hBUkVUZXN0JTJDQyUzRFhYMB0GA1UdDgQWBBRdyUNPiwe2WprwzYgvyZ+6fC1oNDANBgkqhkiG9w0BAQsFAAOCAgEAsXZrFG5ajsFNgTflnbTfD6aL/W0O9uywQ7VTTurZHboHTxDIIL3Gq9Vj/d0vpJJgrfysnR/MBHC9fXonV9WuwSKho91mHquUc7ytlyFwoAN5ROVIR1RBhUosMG0JgTw5PgW9xXBogAZ+7EFDiM70BJUr+ojqlZ2yYS324IDCpgFe9ySXinzTg8+d3jBsQLE0IXnR/+dNNthHhAl1HLfl6wZ9RbPpZgp0AeCcdKbn1IfUzePYMnRyuDjRgnmQYVYD31Qa68gx5Ys1qb/fYwSSpeER0Zf06S0exPUYShtOwRlYqia2z8LgN4TurdwcDcTijmekE9+/oSSITehFroA2eHLsqYte8jQgFBPEcy2syFw1VFDqTa/GnJJkoFCf8jPnlnAHEFJmkhAZ3xeP1Dag30CP+aoCQVNykhO5Z73V6BpNhdpgaYX4B/QRePUhqUoYbHLefAlyO7SFRahycW+o66K5GueptgtQ2DrrjvCtaCG8EtJczihAjBN0OQZsQWnU8vooLss+Rmfg9MXTR8k85cYT9ZMdU/46zlgAMIaJizv8j4eHaKgfRBB1gw71oW97oW5QKQx861UrR1u0DJmSQSUwNYlopKVRnHvXJWUIreOqLfSSB/1uVQfvq0UzsJKdeOCKRLpXXgxB3w7S2+5KFETS7tcbZ6mIxZlJlh0VRSs=",
        "x5tS256": "4670551451113b19425f8d63c3d6ce444b58de60831101748e9fb97b3e8766f8",
        "status": "active"
}
```

## IDP Assertion Claim

Required if no x509Certificate claim is present. idpAssertion claim must be a valid assertion issued by an Identity Provider. Contains the following attributes:

* `id` <mark style="color:red;">(Required)</mark>\
  **String**. Unique identifier of the claim, must be a UUID.
* `status` <mark style="color:red;">(Required)</mark>\
  **String (enum)**. Status of the IDP Assertion (active, inactive, revoked or suspended).
* `registrarId` <mark style="color:red;">(Required)</mark>\
  **String**. Identifier of the party who registered the claim. This can be any of the Party ID from id (iSHARE ID) or alsoKnownAs attributes of that participant.
* `startDate`\
  **String**. UTC timestamp of the start date of the IDP Assertion claim.
* `endDate`\
  **String**. UTC timestamp of the end date of the IDP Assertion claim.
* `type` <mark style="color:red;">(Required)</mark>\
  **String(enum)**. Must contain `idpAssertion` for this type of claim.
* `assertion` <mark style="color:red;">(Required)</mark>\
  **String**. Value of the assertion.
* `verificationHash`\
  **String**. The calculated hash of the assertion that has been uploaded. The verificationHash must be calculated using the SHA256 hashing algorithm.

#### Example

```json
{
        "type": "idpAssertion",
        "id": "5ffb4bb9-2020-4045-a922-3bd84e78f709",
        "registrarId": "did:ishare:EU.NL.NTRNL-10000222",
        "startDate": "2025-02-12T00:00:00.000Z",
        "endDate": "2026-02-13T00:00:00.000Z",
        "assertion": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
        "verificationHash": "aef5bb5e3ab49150a53b89628ab8593315b6686f3f96497277feb9d658527acb",
        "status": "active"
}
```