Verifiable Credential Schemas & Vocabulary

This site contains the schemas and vocabulary supporting Verifiable Credentials in the iSHARE Trust Framework. The schemas are profiles of the W3C Verifiable Credentials Data Model 2.0, extended with the vocabulary that iSHARE adds: data rights, the agreements between organisations, and framework and collaboration roles. iSHARE publishes and maintains the schemas; credentials are issued by certified issuers on the Trusted Issuers List and verified by parties directly, without a central authority at the moment of access.

Data Rights Credential

How a data rights holder grants access to data at its source: policies, licences and access rules. Start here.
Verifiable Credential Schemas

The schemas are published as part of the iSHARE Trust Framework. This link will take you to the iSHARE Developer Portal.
Vocabulary

This link takes you to an overview of the vocabulary.
Credential packaging models

How the same participant data is packaged across three credential models: what each is, and when to use it.
Data rights

Data Rights Credential

The Data Rights Credential is where control over data is expressed. It answers one question: what may be done with a specific data resource. The data rights holder states who may access the data, for what purpose and on what terms, as policies, licences and access rules that travel with the credential while the data stays at its source. A data user presents it, together with the participant credentials it requires, to the party that holds the data.

A Data Rights Credential can require conditions of the data user, for example compliance with the Trust Framework, membership of a specific collaboration, or a particular role. Those conditions are proven with the participant credentials described in the next section. The Data Rights Credential is issued and consumed independently of how those participant credentials are packaged.

Conditions on the data user: participant credentials

Where the Data Rights Credential says what may be done with data, participant credentials say who a party is and what it is compliant with or entitled to do: its identity, its compliance with the Trust Framework, and its participation and role in a collaboration. A Data Rights Credential references these as conditions; the data user proves them by presenting the matching participant credentials. Throughout these schemas, "dataspace" refers to any collaboration operating under the Trust Framework — a data space, a sector initiative, a supply-chain or business network — not to data spaces alone.

Credential packaging models

The same participant data can be packaged as Verifiable Credentials at three levels of granularity. A claim is a single statement about a subject. A credential is the signed envelope that carries one or more claims and can be issued, presented and revoked on its own.

The three models package the same participant information differently, from one credential per claim (maximum flexibility and selective disclosure) to everything in a single credential (simplest to issue and present). All three are valid under the Trust Framework; which one an issuer uses depends on the needs of the collaboration it serves.

Model 1

Fully modular credentials

Every claim is issued as its own independently revocable credential, giving maximum flexibility and selective disclosure at the cost of more credentials to manage.

Examples: the Party ID base credential plus one decoded credential per claim are listed above, one worked example for each fully-modular credential type.

Model 2

Semi-modular credentials

The minimum practical split into two credentials: a Framework Compliance Credential carrying compliance with the Trust Framework (established at the organisation level), and a Dataspace Participant Credential carrying participation in a specific collaboration. Each can be issued and revoked independently. Neither carries identity attributes: a participant either uses an existing identity credential from a trusted third-party identity issuer, or receives a Party ID Credential from its certified issuer together with its Framework Compliance Credential.

Model 3 · Consolidated

Trusted Participant Credential

All information combined into a single Trusted Participant Credential, with one subject carrying identity plus the frameworks[] and dataspaces[] arrays. Simplest to issue and present; least granular for selective disclosure and revocation. Consolidated refers to the credential, not to the issuer: it is issued by a certified issuer like any other credential under the framework.

Shared building blocks

Shared examples

The decoded and enveloped credential payloads are listed under each packaging model above. The examples below are cross-cutting: presentations bundle credentials from more than one model, and the key is used to verify every signed envelope.