Source: oas/oas/oas-attestation/src/credential.rs. SHA-256: 63826d2acf8654122b01fedcc8b64fb39e08923edb9fc1d741bbdfdb14ef16f9.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

credential::VC_CONTEXT

The W3C Verifiable Credentials v1.1 context URI.

Per OAS Specification §14.1 (v1.2.0), this context is deprecated and will be removed in OAS v2.0.0 or after 2027-04-06, whichever occurs first. New credentials SHOULD declare [VC_CONTEXT_V2]; verifiers MUST accept either or both during the transition period.

pub const VC_CONTEXT: &str;

Source line: 21.

credential::VC_CONTEXT_V2

The W3C Verifiable Credentials Data Model v2.0 context URI.

Per OAS Specification §14.1 (v1.2.0), credentials SHOULD declare this context. The legacy [VC_CONTEXT] (v1.1) MAY be additionally declared during the deprecation transition period that ends 2027-04-06 or upon publication of OAS v2.0.0, whichever occurs first.

pub const VC_CONTEXT_V2: &str;

Source line: 29.

credential::OAS_ATTESTATION_CONTEXT

The OAS attestation context URI.

pub const OAS_ATTESTATION_CONTEXT: &str;

Source line: 32.

credential::ATTESTATION_PROOF_TYPE

The fixed proof type for Ed25519Signature2020 (the OAS baseline).

pub const ATTESTATION_PROOF_TYPE: &str;

Source line: 35.

credential::ContextMode

JSON-LD context declaration mode for an [OasCredential].

Per OAS Specification §14.1 (v1.2.0), credentials SHOULD declare the W3C Verifiable Credentials v2.0 context. For backward compatibility, they MAY additionally declare the v1.1 context until 2027-04-06 or until publication of OAS v2.0.0, whichever occurs first. Verifiers MUST accept either or both during the transition period.

The default is [ContextMode::Both], which emits both v2.0 and v1.1 contexts. This is the safest choice during the transition period — v1.1-only verifiers still accept the credential and v2.0-aware verifiers see the preferred context.

Examples

use oas_attestation::credential::{ContextMode, OasCredential, VC_CONTEXT, VC_CONTEXT_V2};
use oas_attestation::types::AttestationType;

// Default mode (Both) emits the v2.0 context first, then v1.1 for back-compat.
let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .issuance_date("2026-01-15T00:00:00Z")
    .attestation_type(AttestationType::SecurityAudit)
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .build()
    .unwrap();

assert!(cred.context.contains(&VC_CONTEXT_V2.to_string()));
assert!(cred.context.contains(&VC_CONTEXT.to_string()));

#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub enum ContextMode {
    /// Emit both v2.0 and v1.1 contexts in canonical order
    /// (v2.0 first, then v1.1, then the OAS attestation context).
    ///
    /// **Default during the transition period** per Spec §14.1. Maximizes
    /// interoperability with both v1.1-only and v2.0-aware verifiers.
    #[default]
    Both,
    /// Emit only the v2.0 context plus the OAS attestation context.
    ///
    /// Use this mode when targeting verifiers that explicitly require v2.0
    /// or after the v1.1 deprecation period ends (2027-04-06).
    V2Only,
    /// Emit only the v1.1 context plus the OAS attestation context.
    ///
    /// **Deprecated.** Reserved for migration tooling and legacy verifier
    /// compatibility. New code SHOULD use [`ContextMode::Both`] or
    /// [`ContextMode::V2Only`]. This mode will be removed in OAS v2.0.0.
    V1Only,
}

Source line: 74.

credential::ContextMode::context_uris

Returns the JSON-LD context URIs this mode emits, in canonical order.

The OAS attestation context is always appended last regardless of mode. The W3C VC context (v1.1, v2.0, or both) precedes it in the order defined by the variant.

Examples

use oas_attestation::credential::{
    ContextMode, OAS_ATTESTATION_CONTEXT, VC_CONTEXT, VC_CONTEXT_V2,
};

assert_eq!(
    ContextMode::Both.context_uris(),
    vec![VC_CONTEXT_V2, VC_CONTEXT, OAS_ATTESTATION_CONTEXT]
);
assert_eq!(
    ContextMode::V2Only.context_uris(),
    vec![VC_CONTEXT_V2, OAS_ATTESTATION_CONTEXT]
);
assert_eq!(
    ContextMode::V1Only.context_uris(),
    vec![VC_CONTEXT, OAS_ATTESTATION_CONTEXT]
);

pub fn context_uris(self) -> Vec<&'static str>;

Source line: 122.

credential::OasCredential

An OAS Verifiable Credential per Specification §13.1.

Combines the W3C VC Data Model v2.0 structure with OAS-specific constraints including did:oas issuer/subject requirements and the oasAttestationType field.

Examples

use oas_attestation::credential::OasCredential;
use oas_attestation::types::AttestationType;

let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .attestation_type(AttestationType::SecurityAudit)
    .issuance_date("2026-01-15T00:00:00Z")
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .build();
assert!(cred.is_ok());

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct OasCredential {
/// The JSON-LD context array.

#[serde(rename = "@context")]
pub context: Vec<String>,
/// The credential types (always includes `"VerifiableCredential"`).

#[serde(rename = "type")]
pub credential_type: Vec<String>,
/// The issuer's `did:oas` identifier.

pub issuer: String,
/// ISO 8601 timestamp when the credential was issued.

pub issuance_date: String,
/// Optional ISO 8601 expiration timestamp.

#[serde(skip_serializing_if = "Option::is_none")]
pub expiration_date: Option<String>,
/// The credential subject containing the attestation claims.

pub credential_subject: serde_json::Value,
/// The OAS attestation type per §13.2.

#[serde(skip_serializing_if = "Option::is_none")]
pub oas_attestation_type: Option<AttestationType>,
/// The Ed25519Signature2020 proof (populated after signing).

#[serde(skip_serializing_if = "Option::is_none")]
pub proof: Option<CredentialProof>
}

Source line: 157.

credential::CredentialProof

A credential proof per OAS Specification §13.1 / §14.4.

Carries either an Ed25519Signature2020 proof (the OAS baseline) or a W3C DataIntegrityProof (the §14.4 data-integrity-2025 registered format). The optional cryptosuite field distinguishes the two: Ed25519Signature2020 proofs MUST omit it (so the on-wire JSON is byte-identical to v1.1.0), while DataIntegrityProof proofs MUST set it (e.g., "eddsa-2022").

See OAS Specification §14.4 for the proof format registry that enumerates the supported (proof_type, cryptosuite) pairs.

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct CredentialProof {
/// Either `"Ed25519Signature2020"` (baseline) or `"DataIntegrityProof"`

/// (Spec §14.4 `data-integrity-2025` format).

#[serde(rename = "type")]
pub proof_type: String,
/// Cryptosuite identifier — REQUIRED for `DataIntegrityProof`,

/// MUST be omitted for `Ed25519Signature2020`. Examples: `"eddsa-2022"`,

/// `"ecdsa-2019"`, `"bbs-2023"`.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub cryptosuite: Option<String>,
/// ISO 8601 timestamp when the proof was created.

pub created: String,
/// Reference to the verification method used.

pub verification_method: String,
/// The purpose of this proof (e.g., `"assertionMethod"`).

pub proof_purpose: String,
/// The multibase-encoded (base58btc, `z` prefix) signature bytes.

pub proof_value: String
}

Source line: 201.

credential::OasCredential::builder

Creates a new [CredentialBuilder] for constructing credentials.

Returns

A builder with default context and type values pre-populated.

pub fn builder() -> CredentialBuilder;

Source line: 232.

credential::OasCredential::subject_id

Returns the subject DID from the credential subject.

Returns

The id field value from credentialSubject, or None if absent.

pub fn subject_id(&self) -> Option<&str>;

Source line: 241.

credential::OasCredential::to_json_without_proof

Returns a JSON representation of this credential without the proof field.

Used during proof generation and verification — the proof field must be absent from the canonical form.

Returns

A [serde_json::Value] with the proof field removed.

Errors

Returns [AttestationError::Json] if serialization fails.

pub fn to_json_without_proof(&self) -> Result<serde_json::Value, AttestationError>;

Source line: 260.

credential::OasCredential::validate

Validates this credential's structure per OAS §13.1 constraints.

Checks:

Issuer is a valid did:oas identifier
Credential subject id is a valid did:oas identifier
Required attestation-type fields are present (if type is set)

Returns

Ok(()) if the credential is structurally valid.

Errors

Returns an [AttestationError] variant describing the validation failure.

pub fn validate(&self) -> Result<(), AttestationError>;

Source line: 282.

credential::CredentialBuilder

Builder for constructing [OasCredential] instances.

Provides a fluent API for setting credential fields, with validation performed at build time.

Examples

use oas_attestation::credential::OasCredential;
use oas_attestation::types::AttestationType;

let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .attestation_type(AttestationType::SecurityAudit)
    .issuance_date("2026-01-15T00:00:00Z")
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .build();
assert!(cred.is_ok());

#[derive(Debug, Default)]
pub struct CredentialBuilder {

}

Source line: 336.

credential::CredentialBuilder::issuer

Sets the issuer DID.

Arguments

issuer - A did:oas identifier for the entity issuing this credential.

pub fn issuer(mut self, issuer: &str) -> Self;

Source line: 352.

credential::CredentialBuilder::subject_id

Sets the credential subject DID.

Arguments

subject_id - A did:oas identifier for the entity this credential is about.

pub fn subject_id(mut self, subject_id: &str) -> Self;

Source line: 362.

credential::CredentialBuilder::attestation_type

Sets the attestation type.

Arguments

attestation_type - The OAS §13.2 attestation type.

pub fn attestation_type(mut self, attestation_type: AttestationType) -> Self;

Source line: 372.

credential::CredentialBuilder::issuance_date

Sets the issuance date.

Arguments

date - ISO 8601 timestamp.

pub fn issuance_date(mut self, date: &str) -> Self;

Source line: 382.

credential::CredentialBuilder::expiration_date

Sets an optional expiration date.

Arguments

date - ISO 8601 timestamp.

pub fn expiration_date(mut self, date: &str) -> Self;

Source line: 392.

credential::CredentialBuilder::subject_claim

Adds a claim to the credential subject.

Arguments

key - The claim name.
value - The claim value.

pub fn subject_claim(mut self, key: &str, value: serde_json::Value) -> Self;

Source line: 403.

credential::CredentialBuilder::context_mode

Sets the JSON-LD context declaration mode per OAS Spec §14.1.

The default is [ContextMode::Both], which emits both the v2.0 and v1.1 W3C VC contexts during the deprecation transition period that ends 2027-04-06 or upon publication of OAS v2.0.0, whichever occurs first.

Arguments

mode - The [ContextMode] to use for this credential.

Examples

use oas_attestation::credential::{ContextMode, OasCredential, VC_CONTEXT, VC_CONTEXT_V2};
use oas_attestation::types::AttestationType;

let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .issuance_date("2026-01-15T00:00:00Z")
    .context_mode(ContextMode::V2Only)
    .attestation_type(AttestationType::SecurityAudit)
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .build()
    .unwrap();

assert!(cred.context.contains(&VC_CONTEXT_V2.to_string()));
assert!(!cred.context.contains(&VC_CONTEXT.to_string()));

pub fn context_mode(mut self, mode: ContextMode) -> Self;

Source line: 442.

credential::CredentialBuilder::build

Builds the credential, validating all constraints.

Returns

A validated [OasCredential] ready for signing.

Errors

Returns an [AttestationError] if required fields are missing or invalid.

pub fn build(self) -> Result<OasCredential, AttestationError>;

Source line: 456.

oas-attestation · credential

On this page