目录

DID

This section describes the decentralized identifier (DID) capabilities.

DID provides identity authentication and verifiable credential management capabilities based on the W3C DID criterion. It supports DID key generation, digital credential import/query/deletion, and data signing.

Since: 26.0.0

Modules to Import

import { did } from '@kit.OnlineAuthenticationKit';

KeyAlgo

Enumerates key algorithms, which are used to generate DID keys.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
SM2 1 SM2 asymmetric cryptographic algorithm, a national commercial cryptography scheme.
SM4 2 SM4 symmetric cryptographic algorithm, a national commercial cryptography scheme.
P256 3 Elliptic curve cryptographic algorithm of the P256 type.
ED25519 4 Elliptic curve cryptographic algorithm of the ED25519 type.
AES128 5 AES128 cryptographic algorithm.
AES256 6 AES256 cryptographic algorithm.

AuthType

Describes authentication types, including PIN, fingerprint, and 3D face.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
UVM_PIN 1 PIN.
UVM_FACE 2 3D face.
UVM_FINGERPRINT 4 Fingerprint.

KeyPurpose

Enumerates key usages.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
ENCRYPT 1 Encryption.
DECRYPT 2 Decryption.
SIGN 3 Signing.
VERIFY 4 Signature verification.

CredentialType

Enumerates credential types.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
VC 1 Verifiable credential defined by the W3C protocol.
VP 2 Verifiable presentation defined by the W3C protocol.
SELECTIVE_DISCLOSURE_VC 3 Selective disclosure credential.
SELECTIVE_DISCLOSURE_VP 4 Selective disclosure presentation.

CryptoScheme

Enumerates encryption schemes.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
IFAA_FIXED_ENVELOPE 1 IFAA fixed envelope.
IFAA_SEPARATE_DECLARE_ENVELOPE 2 IFAA separate declaration envelope.

ApprovalScheme

Enumerates approval schemes.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
IFAA_OPERATOR_APPROVAL 1 IFAA operator approval.

AuthMode

Enumerates authentication modes.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Value Description
SINGLE 1 Independent biometric verification, that is, biometric verification is performed once during DID creation and once during certificate display.

KeyConfig

DID key generation configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
algorithm KeyAlgo No No Key generation algorithm.
purposeList KeyPurpose[] No No Key generation purpose list. A key can be used only for a single purpose. You cannot use the same key for both encryption/decryption and signature verification. When creating an encryption/decryption key, pass [1, 2]. When creating a signature verification key, pass [3, 4].

AuthenticatorConfig

Authenticator configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
authTypeList AuthType[] No No List of authenticator types.
requireBioId boolean No Yes Indicates whether the biometric/PIN authentication credential ID is returned. true indicates yes, and false indicates no. The default value is false.
authMode AuthMode No Yes Authentication mode. The default value is 1, indicating that the biometric verification is performed independently.

GenerateKeyRequest

DID key generation request.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
keyAlias string No No Alias of the new DID key. The value can contain up to 128 bytes and should not include sensitive keywords such as personal information. The default value is empty.
keyConfig KeyConfig No No Configuration of the new DID key.
authenticatorConfig AuthenticatorConfig No Yes Authenticator configuration of the new DID key. If this parameter is left empty, the key does not require biometric authentication access control.
extension string No Yes Extended information about the new DID key. The value can contain a maximum of 1024 bytes. The default value is empty. Currently, the following extended information is supported: {"systemPrompt": "half_modal"} indicates that a system semi-modal prompt is required. {"systemPrompt": "none"} indicates that no prompt is required.

GenerateKeyResponse

Response to DID key generation.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
publicKey Uint8Array No No New DID public key in ASN1 format.
bioId string No Yes Authenticator credential ID. The value can contain a maximum of 1024 bytes. The default value is empty.
certChain Array<Uint8Array> No No Certificate chain of the DID key.
extension string No Yes Extended information. The value contains a maximum of 10,000 bytes. The default value is empty.

DidKey

DID key information.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
keyAlias string No Yes DID key alias. The value contains a maximum of 128 bytes. The default value is empty.
keyId string No Yes DID key ID. The value contains a maximum of 256 bytes. The default value is empty.

ImportDidRequest

DID import request.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
isUpdate boolean No Yes The value true indicates that DID information is updated, and the value false indicates that DID information is imported. The default value is false.
did string No No DID identifier. The value contains a maximum of 256 bytes. The default value is empty.
didKeyList DidKey[] No No List of DID keys.
didDoc string No Yes DID document compliant with W3C standards. The maximum length is 10,000 bytes. The default value is empty.
additionalData string No Yes DID additional data. The maximum length is 10,000 bytes. The default value is empty.

SignRequest

Data signing request.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
inData Uint8Array No No Input data to be signed.
keyId string No No DID key ID. The value contains a maximum of 256 bytes. The default value is empty.

SignResponse

Data signing response.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
outData Uint8Array No No Signed output data in ASN1 format.
bioId string No Yes Authenticator credential ID. The value can contain a maximum of 1024 bytes. The default value is empty.

QueryDidConfig

DID query configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
requireDidKey boolean No Yes Indicates whether a DID key is returned. true indicates yes, and false indicates no. The default value is false.
requireDidDoc boolean No Yes Indicates whether a DID document is returned. true indicates yes, and false indicates no. The default value is false.
requireAdditionalData boolean No Yes Indicates whether additional data is returned. true indicates yes, and false indicates no. The default value is false.

QueryDidRequest

DID query request.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
did string No No DID identifier. The value contains a maximum of 256 bytes. The default value is empty.
queryDidConfig QueryDidConfig No Yes DID query configuration.

QueryDidResponse

DID query response.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
didKeyList DidKey[] No Yes List of DID keys.
didDoc string No Yes DID document compliant with W3C standards. The value contains a maximum of 10,000 bytes. The default value is empty.
additionalData string No Yes DID additional data. The value contains a maximum of 10,000 bytes. The default value is empty.

EncryptConfig

Encryption scheme configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
cryptoScheme CryptoScheme No No Encryption scheme.
encryptKey Uint8Array No No Encryption key.
keyId string No Yes DID key ID. The value contains a maximum of 256 bytes. The default value is empty.
algorithm KeyAlgo No No Encryption algorithm.

ApprovalData

Approval data.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
approvalScheme ApprovalScheme No No Approval scheme.
data string No Yes Approval data. The value contains a maximum of 10,000 bytes. The default value is empty.

DecryptConfig

Decryption scheme configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
cryptoScheme CryptoScheme No No Decryption scheme.
keyId string No No DID key ID. The value contains a maximum of 256 bytes. The default value is empty.
data string No Yes Decryption data. The value contains a maximum of 10,000 bytes. The default value is empty.

ApprovalConfig

Approval configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
approvalScheme ApprovalScheme No No Approval scheme.
publicKey Uint8Array No No Public key.
algorithm KeyAlgo No No Algorithm.

CredentialDisplayConfig

Credential display configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialDisplayName string No No Credential display name. The value can contain a maximum of 1024 bytes. The default value is empty.
issuerDisplayName string No No Issuer display name. The value can contain a maximum of 1024 bytes. The default value is empty.
propertyDisplayName string No No Property display name. The value contains a maximum of 10,000 bytes. The default value is empty.

AuthConfig

Authentication configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
requireAuth boolean No Yes Indicates whether user identity authentication is required. The value true indicates yes, and the value false indicates no. The default value is false.

CredentialSecurityConfig

Credential security configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
approvalConfig ApprovalConfig No Yes Approval configuration.
decryptConfig DecryptConfig No Yes Decryption configuration.
authConfig AuthConfig No Yes Authentication configuration.

ImportDigitalCredentialRequest

Request for importing a digital credential.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
did string No No DID identifier. The maximum length is 256 bytes. The default value is empty.
credentialType CredentialType No Yes Digital credential type.
isUpdate boolean No Yes true indicates that credential information is updated, and false indicates that credential information is imported. The default value is false.
securityConfig CredentialSecurityConfig No Yes Credential security configuration.
credentialData string No No Credential data. Currently, only the VC format compliant with W3C standards is supported. The maximum length is 10,000 bytes. The default value is empty.
displayConfig CredentialDisplayConfig No No Display configuration.
extension string No Yes Extended information. The value contains a maximum of 10,000 bytes. The default value is empty.

ImportDigitalCredentialResponse

Response to the request for importing a digital credential.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialSummary string No No Digest of a digital credential. The value contains a maximum of 10,000 bytes. The default value is empty.

HolderConfig

Holder configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
holderDid string No No Holder DID. The value can contain a maximum of 1024 bytes. The default value is empty.
holderDidKeyId string No No Holder DID key ID. The value can contain a maximum of 1024 bytes. The default value is empty.

CredentialFilter

Filter criteria for digital credentials.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialId string No Yes Digital credential ID. The value contains a maximum of 256 bytes. The default value is empty.
issuerDid string No Yes Issuer DID. The value can contain a maximum of 1024 bytes. The default value is empty.
credentialProvider string No Yes Credential provider. The value can contain a maximum of 1024 bytes. The default value is empty.
credentialDisclosurePropertyList string[] No Yes List of credential disclosure properties. The default value is empty.
credentialDisplayConfig CredentialDisplayConfig No Yes Credential display configuration.
credentialCategory string No Yes Credential type. The value can contain a maximum of 1024 bytes. The default value is empty.
extension string No Yes Extended information. The value can contain a maximum of 1024 bytes. The default value is empty.

PresentDisplayConfig

Display configuration.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
verifierDisplayName string No No Display name of the verifier. The value can contain a maximum of 1024 bytes. The default value is empty.
purpose string No No Purpose. The value can contain a maximum of 1024 bytes. The default value is empty.
extension string No Yes Extended information. The value contains a maximum of 10,000 bytes. The default value is empty.

GetDigitalCredentialRequest

Request for obtaining a digital credential.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialType CredentialType No Yes Credential type.
displayConfig PresentDisplayConfig No No Display configuration.
verifierDid string No Yes DID of the verifier. The value can contain a maximum of 1024 bytes. The default value is empty.
encryptConfig EncryptConfig No Yes Encryption configuration.
approvalData ApprovalData No Yes Approval data.
holderConfigList HolderConfig[] No No Holder configuration list.
credentialFilterList CredentialFilter[] No Yes List of credential filter criteria.
extension string No Yes Extended information. The value can contain a maximum of 1024 bytes. The default value is empty.

QueryDigitalCredentialResponse

Response to the request for querying digital credentials.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialSummaryList string[] No No Digital credential digest list.

GetDigitalCredentialResponse

Response to the request for obtaining digital credentials.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Name Type Read-Only Optional Description
credentialData string No No Credential data. Currently, only the VC and VP formats compliant with W3C standards are supported. The value can contain a maximum of 1024 bytes. The default value is empty.
bioId string No Yes Authenticator credential ID. The value can contain a maximum of 1024 bytes. The default value is empty.

did.generateKey

generateKey(context: common.Context, generateKeyRequest: GenerateKeyRequest): Promise<GenerateKeyResponse>

Generates a DID key. This API uses a promise to return the result. The maximum number of DID keys is 500.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
generateKeyRequest GenerateKeyRequest Yes Parameter for generating a DID key.

Returns

Type Description
Promise<GenerateKeyResponse> Promise used to return the DID key generation result.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600002 The user does not record biometric features or the authentication module is abnormal.
1024600003 The user canceled the operation.
1024600004 The key alias has been used.
1024600006 The security level of the authenticator on the device is lower than ATL4.
1024600007 Unknown error.
1024600012 The number of did keys has reached the maximum limit.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let generateKeyRequest: did.GenerateKeyRequest = {
  keyAlias: 'myDidKey',
  keyConfig: {
    algorithm: did.KeyAlgo.SM2,
    purposeList: [did.KeyPurpose.SIGN, did.KeyPurpose.VERIFY]
  },
  authenticatorConfig: {
    authTypeList: [did.AuthType.UVM_FINGERPRINT],
    requireBioId: true
  }
};

try {
  let response: did.GenerateKeyResponse = await did.generateKey(context, generateKeyRequest);
  console.info('Succeeded in generating did key', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to generate did key. Code: ${err.code}, message: ${err.message}`);
}

did.importDid

importDid(context: common.Context, importDidRequest: ImportDidRequest): Promise<void>

Imports DID information. This API uses a promise to return the result. The maximum number of DIDs is 50.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
importDidRequest ImportDidRequest Yes Parameter for importing a DID.

Returns

Type Description
Promise<void> Promise that returns no value.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600005 The key is invalid.
1024600007 Unknown error.
1024600008 The DID does not exist.
1024600011 The application does not have permission to perform this operation.
1024600013 The number of DIDs has reached the maximum limit.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let importDidRequest: did.ImportDidRequest = {
  isUpdate: false,
  did: 'did:example:123456',
  didKeyList: [{
    keyAlias: 'myDidKey',
    keyId: 'keyId123'
  }],
  didDoc: JSON.stringify({
    '@context': 'https://www.w3.org/ns/did/v1',
    id: 'did:example:123456'
  })
};

try {
  await did.importDid(context, importDidRequest);
  console.info('Succeeded in importing did');
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to import did. Code: ${err.code}, message: ${err.message}`);
}

did.queryDid

queryDid(context: common.Context, queryDidRequest: QueryDidRequest): Promise<QueryDidResponse>

Queries DID information. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
queryDidRequest QueryDidRequest Yes Parameter for querying the DID.

Returns

Type Description
Promise<QueryDidResponse> Promise used to return the DID query response.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600007 Unknown error.
1024600008 The DID does not exist.
1024600011 The application does not have permission to perform this operation.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let queryDidRequest: did.QueryDidRequest = {
  did: 'did:example:123456',
  queryDidConfig: {
    requireDidKey: true,
    requireDidDoc: true,
    requireAdditionalData: true
  }
};

try {
  let response: did.QueryDidResponse = await did.queryDid(context, queryDidRequest);
  console.info('Succeeded in querying did', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to query did. Code: ${err.code}, message: ${err.message}`);
}

did.deleteDid

deleteDid(context: common.Context, did: string): Promise<void>

Deletes a DID. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
did string Yes DID to be deleted. The maximum length is 256 bytes.

Returns

Type Description
Promise<void> Promise that returns no value.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600007 Unknown error.
1024600008 The DID does not exist.
1024600011 The application does not have permission to perform this operation.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

try {
  await did.deleteDid(context, 'did:example:123456');
  console.info('Succeeded in deleting did');
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to delete did. Code: ${err.code}, message: ${err.message}`);
}

did.sign

sign(context: common.Context, signRequest: SignRequest): Promise<SignResponse>

Signs data. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
signRequest SignRequest Yes Data signing parameter.

Returns

Type Description
Promise<SignResponse> Promise used to return the data signing result.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600002 The user does not record biometric features or the authentication module is abnormal.
1024600003 The user canceled the operation.
1024600005 The key is invalid.
1024600007 Unknown error.
1024600011 The application does not have permission to perform this operation.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let signRequest: did.SignRequest = {
  inData: new Uint8Array([0x01, 0x02, 0x03]),
  keyId: 'keyId123'
};

try {
  let response: did.SignResponse = await did.sign(context, signRequest);
  console.info('Succeeded in signing data', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to sign data. Code: ${err.code}, message: ${err.message}`);
}

did.importDigitalCredential

importDigitalCredential(context: common.Context, importDigitalCredentialRequest: ImportDigitalCredentialRequest): Promise<ImportDigitalCredentialResponse>

Imports a digital credential. This API uses a promise to return the result. The maximum number of credentials is 1000.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Required permission: ohos.permission.ACCESS_DIGITAL_IDENTITY

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
importDigitalCredentialRequest ImportDigitalCredentialRequest Yes Parameter for importing a digital credential.

Returns

Type Description
Promise<ImportDigitalCredentialResponse> Promise used to return the result of importing a digital credential.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
201 Permission denied.
801 Invalid device type.
1024600001 Invalid parameters.
1024600005 The key is invalid.
1024600007 Unknown error.
1024600008 The DID does not exist.
1024600009 Failed to decrypt the credential.
1024600014 The number of credentials has reached the maximum limit.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let importDigitalCredentialRequest: did.ImportDigitalCredentialRequest = {
  did: 'did:example:123456',
  credentialType: did.CredentialType.VC,
  isUpdate: false,
  credentialData: JSON.stringify({
    '@context': ['https://www.w3.org/2018/credentials/v1'],
    type: ['VerifiableCredential'],
    issuer: 'did:example:issuer123',
    issuanceDate: '2024-01-01T00:00:00Z',
    credentialSubject: {
      id: 'did:example:123456',
      name: 'Alice'
    }
  }),
  displayConfig: {
    credentialDisplayName: 'ID card',
    issuerDisplayName: 'Public security department',
    propertyDisplayName: 'Name'
  }
};

try {
  let response: did.ImportDigitalCredentialResponse =
    await did.importDigitalCredential(context, importDigitalCredentialRequest);
  console.info('Succeeded in importing digital credential', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to import digital credential. Code: ${err.code}, message: ${err.message}`);
}

did.queryDigitalCredential

queryDigitalCredential(context: common.Context, did?: string, credentialId?: string): Promise<QueryDigitalCredentialResponse>

Queries a digital credential. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
did string No DID identifier. The value contains a maximum of 256 bytes. The default value is empty.
credentialId string No Digital credential ID. The value contains a maximum of 256 bytes. The default value is empty.

Returns

Type Description
Promise<QueryDigitalCredentialResponse> Promise used to return the response to the digital credential query.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600007 Unknown error.
1024600010 The credential does not exist.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

try {
  let response: did.QueryDigitalCredentialResponse = await did.queryDigitalCredential(context, 'did:example:123456');
  console.info('Succeeded in querying digital credential', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to query digital credential. Code: ${err.code}, message: ${err.message}`);
}

did.deleteDigitalCredential

deleteDigitalCredential(context: common.Context, did?: string, credentialId?: string): Promise<void>

Deletes a digital credential. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Required permission: ohos.permission.ACCESS_DIGITAL_IDENTITY

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
did string No DID identifier. The value contains a maximum of 256 bytes. The default value is empty.
credentialId string No Digital credential ID. The value contains a maximum of 256 bytes. The default value is empty.

Returns

Type Description
Promise<void> Promise that returns no value.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
201 Permission denied.
801 Invalid device type.
1024600001 Invalid parameters.
1024600007 Unknown error.
1024600010 The credential does not exist.
1024600011 The application does not have permission to perform this operation.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

try {
  await did.deleteDigitalCredential(context, 'did:example:123456', 'credentialId123');
  console.info('Succeeded in deleting digital credential');
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to delete digital credential. Code: ${err.code}, message: ${err.message}`);
}

did.getDigitalCredential

getDigitalCredential(context: common.Context, getDigitalCredentialRequest: GetDigitalCredentialRequest): Promise<GetDigitalCredentialResponse>

Obtains a digital credential. This API uses a promise to return the result.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.DID

Atomic service API: This API can be used in atomic services since API version 26.0.0.

Since: 26.0.0

Parameters

Parameter Type Mandatory Description
context common.Context Yes Ability context.
getDigitalCredentialRequest GetDigitalCredentialRequest Yes Parameter for obtaining a digital credential.

Returns

Type Description
Promise<GetDigitalCredentialResponse> Promise used to return the result of obtaining a digital credential.

Error codes

For details about the error codes, please refer to Universal Error Codes and DID Error Codes.

Error Code Error Message
801 Invalid device type.
1024600001 Invalid parameters.
1024600002 The user does not record biometric features or the authentication module is abnormal.
1024600003 The user canceled the operation.
1024600006 The security level of the authenticator on the device is lower than ATL4.
1024600007 Unknown error.
1024600010 The credential does not exist.

Example

import { did } from '@kit.OnlineAuthenticationKit';
import { common } from '@kit.AbilityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// The following code for obtaining the context must be placed in the UI component class for calling.
let context: common.UIAbilityContext = this.getUIContext().getHostContext() as common.UIAbilityContext;

let getDigitalCredentialRequest: did.GetDigitalCredentialRequest = {
  credentialType: did.CredentialType.VC,
  displayConfig: {
    verifierDisplayName: 'Verifier',
    purpose: 'Identity verification'
  },
  holderConfigList: [{
    holderDid: 'did:example:123456',
    holderDidKeyId: 'keyId123'
  }]
};

try {
  let response: did.GetDigitalCredentialResponse = await did.getDigitalCredential(context, getDigitalCredentialRequest);
  console.info('Succeeded in getting digital credential', response);
} catch (error) {
  const err: BusinessError = error as BusinessError;
  console.error(`Failed to get digital credential. Code: ${err.code}, message: ${err.message}`);
}