Ga naar inhoud

ADR-0039: ASI attributes described by the source (asi capability in source metadata)

Context and problem statement

Per data service, the ASIP must know three things:

  • Which attributes the source offers.
  • Which source fields make each attribute.
  • How to ask for these fields.

The first demo ASIP had this knowledge in code, as a BRP adapter. That breaks REQ-64: a GBO component works only with the description that the source publishes itself. With the adapter, a new source needs a code change in the ASIP.

Q-38 named three options: code, GBO configuration, or a description that the source publishes. On October 27, the direction became the third option, with a "copy only" mapping. ETSI expects attribute identifiers and value schemas from the EU catalogue of attributes. That catalogue did not exist on November 2, 2026.

This ADR extends ADR-0016 from EUDI issuance to the ASIP.

Decision

The decision has seven parts:

  1. The source describes its attributes. Source metadata schema 1.1 adds the capability asi next to eudi. The capability holds these parts:
    • authentic_source: the legal name and country, used in responses and discovery records.
    • graphql: one query document that ends in ...Selected, the subject variable, and the result pointer.
    • attributes: per attribute identifier, the source fields per member of the value.
  2. GBO keeps the shape of each value. GBO keeps a value_schema per attribute identifier in schemas/asi-attributes.json, until the EU catalogue of attributes provides it. The identifiers are provisional. The value schemas use only type, properties, required, items, and format.

  3. The source composes values with four operations. Each member of a value has exactly one operation:

    • pointer: copy a field.
    • join with separator: concatenate fields.
    • const: a fixed value.
    • each with pointer: per list element.

    Pointers are RFC 6901 JSON Pointers over GraphQL field names. This part deviates from the "copy only" direction of October 27. A source cannot always deliver a catalogue value with a copy only. An example is a house number made of three BRP fields.

  4. gbo-simple-v1 stays for the eudi capability only (ADR-0017). The two capabilities have different targets. The eudi target is wallet claims that the source defines. The asi target is values that the catalogue of GBO defines.

  5. The reconciler validates, and the ASIP reads the active release. The reconciler validates asi against the catalogue, as part of the source metadata (ADR-0016). If asi is invalid, the reconciler refuses the whole source. The ASIP reads the active release from the source registry every 5 seconds, with the reader role.
  6. One query per request. The ASIP replaces ...Selected with only the fields of the requested attributes and fragments (REQ-92). If the description does not name an attribute, the ASIP answers 404 and does not ask the source.
  7. Fuzzy matching follows the value schema. A string with a format, such as a date, matches exactly or does not match. Only strings without a format get MatchWithVariation (REQ-113).

Consequences

  • A new source for the ASIP needs a description and a configured data service. It needs no code. The discovery records and the legal name of the source follow the description without a restart.
  • If no current description exists (absent, without asi, or stale), the ASIP answers 503 for verify, retrieve, and discovery (REQ-93).
  • A source with asi gets release snapshot version 4.0. A source without asi stays at 3.0. Onboarding still refuses a document with only asi, because onboarding requires the issuance certificate sets.
  • Onboarding validates the form only. It does not validate against the GraphQL schema of the source. It also does not check whether the policy of the source allows the selection. A difference shows at the first request. A demo test holds the BRP description against rule ASI0001.
  • The ASIP still normalizes a code without a format, such as a nationality or a postal code. For codes, demo v0.9.0 does not meet REQ-113 (Q-70).
  • The shape of name and address is provisional (Q-71).

Open points

These points are open:

  • The authorization server takes its data services from AZSP_RESOURCES (main.go#L105), and not from the descriptions. This is the open part of ICTU/GBO-demo#592.
  • The identifiers and value schemas move to the EU catalogue of attributes when it exists (Q-31).
  • Which normalization applies per kind of value (Q-70)?
  • The document format is part of the open PSA S10 decision on the source-specific configuration (ADR-0016).

Traceability