Profile Annotation Issuer Registration PA

Profile Annotation Issuer Registration PA is a Profile Annotation used to indicate that the Profile Annotation Issuer is recognized by the OP Registry as meeting its registration requirements.

Terminology

For terms not explained in this document, please see Terminology.

Profile Annotation Issuer Registration PA Data Model

Complies with the Profile Annotation.

Property

Profile Annotation Issuer Registration PA Properties

Name	Type	Description
@context	string[]	REQUIRED. It MUST comply with OP VC Data Model. In addition, the third value MUST be "https://originator-profile.org/ns/cip/v1".
type	string[]	REQUIRED. It MUST be ["VerifiableCredential", "ProfileAnnotation"].
issuer	string	REQUIRED. It MUST be the OP ID of the OP Registry. The Profile Annotation Issuer Registration PA is a PA issued by the OP Registry. The OP Registry examines organizations that are candidates for Profile Annotation Issuers and issues this PA when they are deemed eligible.
credentialSubject	object	REQUIRED. A JSON-LD Node Object containing the following credentialSubject properties.

credentialSubject Properties

Name	Type	Description
id	string	REQUIRED. It MUST be the OP ID of the organization holding the Profile Annotation Issuer Registration PA (the Profile Annotation Issuer).
type	string	REQUIRED. It MUST be ProfileAnnotationIssuerRegistration.
name	string	OPTIONAL. PA name.
annotationIssuerName	string	REQUIRED. The name of the Profile Annotation Issuer.
description	string	OPTIONAL. The description regarding this Profile Annotation Issuer.
annotationScheme	string[]	REQUIRED. It MUST be an array of URIs that uniquely identify the Profile Annotations which this Profile Annotation Issuer is authorized to issue.
annotation	object	REQUIRED. It MUST be a Profile Annotation Policy that indicates the Profile Annotation Issuer registration scheme.

note

Regarding the ID of the Profile Annotation Issuer registration scheme, if the registration requirements are identical across Profile Annotation Issuer registration schemes operated by the same OP Registry, the IDs SHOULD be the same value.

Verification of Profile Annotation Issuer Registration PA

A verifier SHOULD perform verification on the Profile Annotation Issuer registration credential (PA) held by the Profile Annotation Issuer, in accordance with the OP VC Data Model and Securing Mechanism. The verification here concerns confirming the authenticity of the registration credential PA itself (as defined in VC Data Model 2.0 verification) and does not include determining whether the issuer is a trusted OP Registry.

Verification of Profile Annotation Issuer Authorization

Upon receiving a PA, a verifier SHOULD verify whether the issuer is a Profile Annotation Issuer authorized by the OP Registry using the following procedure. This verification corresponds to the validation defined in the VC Data Model 2.0 for determining whether the verifier's own requirements are met.

1. Verify that the issuer of the Profile Annotation Issuer Registration PA held by the Profile Annotation Issuer is an OP ID from a trusted OP Registry.
2. Verify that the ID of the certification scheme to which the PA under verification conforms is included in the credentialSubject.annotationScheme property of that Profile Annotation Issuer Registration PA.

If the Profile Annotation Issuer does not possess a Profile Annotation Issuer Registration PA, this check is treated as unperformed (unverified). While the inability to confirm authorization does not immediately imply that the PA under verification is itself invalid, how an unverified PA is handled—whether it is accepted or treated as invalid—depends on the verifier's policy.

The "Verification of Profile Annotation Issuer Registration PA" described in the previous section is a cryptographic verification that yields a definitive result. In contrast, while the procedure for this authorization check is deterministic once the OP Registry trusted by the verifier is established, the result may vary among verifiers because the choice of which OP Registry to trust depends on the verifier's policy.

Use Cases

The Profile Annotation Issuer Registration PA is used in the following use cases:

• The OP Registry manages organizations authorized to issue specific PAs.
• A verifier confirms that the issuer of a received PA holds the appropriate qualifications.
• The Profile Annotation Issuer proves its own qualification.

For example, when the OP Registry certifies a certification body authorized to issue an "Organization Existence Certificate," it issues a Profile Annotation Issuer Registration PA to that body. A verifier can verify that the issuer of a received "Organization Existence PA" has the appropriate qualifications by checking the Profile Annotation Issuer Registration PA held by that issuer.

Appendix

Example

This is non-normative.

Below is an example of Profile Annotation Issuer Registration PA.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://originator-profile.org/ns/credentials/v1",
    "https://originator-profile.org/ns/cip/v1",
    {
      "@language": "en"
    }
  ],
  "type": ["VerifiableCredential", "ProfileAnnotation"],
  "issuer": "dns:op-registry.example.org",
  "credentialSubject": {
    "id": "dns:profile-annotation-issuer.example.jp",
    "type": "ProfileAnnotationIssuerRegistration",
    "name": "Profile Annotation Issuer Certificate",
    "description": "This Profile Annotation Issuer is authorized to issue Organization Existence Certificates and Ad Verification Certificates.",
    "annotationIssuerName": "XX Certification Organization Co., Ltd.",
    "annotationScheme": [
      "urn:uuid:def09cbd-6e8e-4c73-856d-5e00dffde643",
      "urn:uuid:8029ece0-b327-4a7e-b586-3e442cb82d92"
    ],
    "annotation": {
      "id": "urn:uuid:5927e1da-e422-47c8-a5b8-efa6f5a45dd7",
      "type": "ProfileAnnotationPolicy",
      "name": "OP Registry Profile Annotation Issuer Registration Scheme",
      "description": "This is the Profile Annotation Issuer registration scheme operated by the OP Registry. The Profile Annotation Issuer PA is issued to organizations that meet the registration requirements.",
      "ref": "https://op-registry.example.org/profile-annotation-issuer-registration"
    }
  }
}

In this example, the OP Registry, dns:op-registry.example.org, issues a Profile Annotation Issuer Registration PA to the organization, dns:profile-annotation-issuer.example.jp. This organization is authorized to issue PAs that comply with two certification schemes (Organization Existence Certification and Ad Certification).