Ctrlk
GitHubCommunityWhat's NewContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Inji Wallet Backend (Mimoto)

Inji Wallet Backend - Mimoto

Mimoto is a BFF(Backend for Frontend) for Inji Wallet. It's being used to get default configuration, download verifiable credentials (VC) and activate VC. It provides all necessary APIs to the Inji Wallet and acts as a proxy for resident services. Mimoto gets the request from Inji Wallet, performs all the validations and forwards it to respective services. Additionally, it subscribes to the web-sub event to be able to download the VC once it's ready.

Detailed API documentation of Mimoto is available here.

Support for downloading VC from multiple Issuers

Issuers Listing

The user is currently on the + button on the Home screen, which will open Add new card screen, where all the issuers are displayed Below issuers list API gives out all the issuers list.

get

This API provides data with search capability to populate the list of supported issuers in Inji Web, which is then displayed under the List of Issuers

Query parameters
searchstringOptional
Responses
200

OK

application/json
get/issuers
GET /v1/mimoto/issuers HTTP/1.1
Host: api.collab.mosip.net
Accept: */*
200

OK

{
  "id": "mosip.resident.vid",
  "version": "v1",
  "str": null,
  "responsetime": "2022-10-31T05:08:14.846Z",
  "metadata": null,
  "response": {
    "issuers": [
      {
        "issuer_id": "MOSIPInsurance",
        "credential_issuer": "MOSIPInsurance",
        "credential_issuer_host": "https://injicertify-insurance.collab.mosip.net",
        "protocol": "OpenId4VCI",
        "display": [
          {
            "name": "MOSIP Insurance",
            "logo": {
              "url": "https://api.collab.mosip.net/inji/mosip-logo.png",
              "alt_text": "MOSIP-Logo"
            },
            "title": "Download via LIC",
            "description": "Enter your policy number to download your card.",
            "language": "en"
          }
        ],
        "client_id": "3yz7-j3xRzU3SODdoNgSGvO_cD8UijH3AIWRDAg1x-M",
        ".well-known": "http://localhost:8088/.well-known/openid-credential-issuer"
      },
      {
        "issuer_id": "MOSIPNationalID",
        "credential_issuer": "MOSIPNationalID",
        "credential_issuer_host": "https://injicertify-mosipid.released.mosip.net",
        "protocol": "OpenId4VCI",
        "display": [
          {
            "name": "MOSIP National ID",
            "logo": {
              "url": "https://api.collab.mosip.net/inji/mosip-logo.png",
              "alt_text": "MOSIP-Logo"
            },
            "title": "Download via LIC",
            "description": "Enter your policy number to download your card.",
            "language": "en"
          }
        ],
        "client_id": "3yz7-j3xRzU3SODdoNgSGvO_cD8UijH3AIWRDAg1x-M",
        ".well-known": "http://localhost:8088/.well-known/openid-credential-issuer"
      }
    ]
  }
}

Retrieve accessToken for OIDC flow

This endpoint exchanges an OAuth 2.0 authorization code for an access token as part of the OpenID4VCI authorization flow for a Mimoto client registered with an Authorization Server (AS).

The issuer name is used to resolve the corresponding Authorization Server and its token endpoint from the issuer configuration (issuers-config.json). The client authenticates with the Authorization Server using the same cryptographic key pair that was registered during client registration. The token request includes a signed client assertion JWT to authenticate the client before the Authorization Server issues an access token.

Retrieve accessToken for OIDC flow

post

This endpoint allows you to retrieve the access token in exchange for the authorization code.

Path parameters
issuerstringRequired
Query parameters
Responses
200

OK

application/json
idstringOptional
versionstringOptional
strstring · nullableOptional
responsetimestring · date-timeOptional
metadataobject · nullableOptional
post/get-token/{issuer}
POST /v1/mimoto/get-token/{issuer}?arg0=[object+Object] HTTP/1.1
Host: api.collab.mosip.net
Accept: */*

{
  "id": "mosip.mimoto.issuers",
  "version": "v1",
  "str": null,
  "responsetime": "2024-04-25T05:56:55.890Z",
  "metadata": null,
  "response": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "bearer",
    "expires_in": 3600,
    "scope": "mosip_identity_vc_ldp",
    "refresh_token": "xyz123"
  },
  "errors": []
}

Online Login

A use case exists where a credential is activated or bound to an Authorization Server, enabling users to access an online service by authenticating with that bound credential.

Within the Inji ecosystem, this is available as the Veridonia National ID use case. In this flow, eSignet acts as the Authorization Server for the MOSIP/National ID credential issued through Inji Certify. Users can use this credential to authenticate and log in to service such as Health ID platforms.

Activate credentials

Credentials have to be activated in order to use them for online login. When a user selects Activate option, an OTP is sent to the user and credentials are activated.

  • To send an OTP to a user, the below API is called.

Wallet Binding - Generate Otp

post

This api is used to generate otp for wallet binding. This api is used as a proxy to call Identity Provider - Send Binding OTP Endpoint api internally.

Body
requestTimestringOptional
Responses
200

OK

application/json
idstringOptional
versionstringOptional
responsetimestringOptional
metadataobjectOptional
post/binding-otp
POST /v1/mimoto/binding-otp HTTP/1.1
Host: api.collab.mosip.net
Content-Type: application/json
Accept: */*
Content-Length: 99

{
  "requestTime": "{{$isoTimestamp}}",
  "request": {
    "individualId": "3816083254",
    "otpChannels": [
      "EMAIL"
    ]
  }
}
200

OK

{
  "id": null,
  "version": null,
  "str": null,
  "responsetime": null,
  "metadata": null,
  "response": {
    "maskedEmail": "mono@mono.com",
    "maskedMobile": "7897897890"
  },
  "errors": []
}

  • After successful OTP validation, a keypair is generated in the phone and the public key is synced with server. The mimoto receives a certificate and create thumbprint which it stores in the keystore securely. This is called as the activation process.

Wallet Binding - Bind Credential with wallet

post

This api is used to bind the credential with wallet. This api is used as a proxy to call Identity Provider - Wallet binding Endpoint api internally.

Body
requestTimestringOptional

The request time

Responses
200

OK

application/json
versionstring · nullableOptional
idstring · nullableOptional
responsetimestring · nullableOptional
metadatastring · nullableOptional
errorsobject[]Optional
post/wallet-binding
POST /v1/mimoto/wallet-binding HTTP/1.1
Host: api.collab.mosip.net
Content-Type: application/json
Accept: */*
Content-Length: 1012

{
  "requestTime": "2023-01-17T05:38:41.869Z",
  "request": {
    "authFactorType": "WLA",
    "format": "jwt",
    "individualId": "3816083254",
    "publicKey": "-----BEGIN RSA PUBLIC KEY-----\nMIICCgKCAgEAxo8hdrLl6nXyPSeSJu8xgmBBwVutacZS57rmIlHeKJfjYhKLT51v\n0k2IQqN2v6A3HOZqzKXh41p3RrxdSndkqqHwS0BLEVPNpKqYoEbe0tUICDpDSFaa\n7w87Z/OSGrw8bKpxmUT0xZ70+DGPhnWlMvPV5xenG1bVtf/vEq7cwQei1iNbNQRb\nqw/57e9LgmXdmbh/v5XOllT7rlUFmVFm4V4J3u6NH9iOPGlIKTplBlYyxlx6ayaR\n09Z6z4RJICG1MIipCv5qJwuzzXXpBja6gEG4xsN5K4W6b5GLt3IuzMMaQmReseRR\n46s53vBp7aqq1wrjs/CZ1SZqZ5ZG/nUchjTv+Nir0vPR9acvPB5j5qDgfdVz2sT/\nYL1HoeFPOIgcY1ydz+tUBm9F4AMCMZa7GbEmtAIWvxlQp6emo50/opdb51B3Teh3\neVQ+JqYYhOpuTEv0uHfhonXEsNfpGyttjR0FSAH2c6mI6UULi/PfLgcvKuqkhE+7\nlB0SFd852C993GqsY7qfxW1GvJpXYRvo6oRoFO8sj+St36MkmzJbm56AQn/9KWd5\nRLh13xrIUVRnW48y/Blchw/C68Ez1bmCyDeVe1WBPwel0zPl62jCtKawzCQiZcTL\n/ejmlKFHKQd980MwWN18OVakKU52CkO0NT+9ovgi0TRfLKvG6PQ1qGECAwEAAQ==\n-----END RSA PUBLIC KEY-----\n",
    "challengeList": [
      {
        "authFactorType": "OTP",
        "challenge": "111111",
        "format": "alpha-numeric"
      }
    ]
  }
}
200

OK

{
  "id": null,
  "version": null,
  "str": null,
  "responsetime": null,
  "metadata": null,
  "response": {
    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDqjCCApKgAwIBAgIGAYW+PCLUMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMT\nCE1vY2stSURBMB4XDTIzMDExNzA1MzgxMFoXDTIzMDEyNzA1MzgxMFowGTEXMBUG\nA1UEAxMOTW9jay11c2VyLW5hbWUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK\nAoICAQDGjyF2suXqdfI9J5Im7zGCYEHBW61pxlLnuuYiUd4ol+NiEotPnW/STYhC\no3a/oDcc5mrMpeHjWndGvF1Kd2SqofBLQEsRU82kqpigRt7S1QgIOkNIVprvDztn\n85IavDxsqnGZRPTFnvT4MY+GdaUy89XnF6cbVtW1/+8SrtzBB6LWI1s1BFurD/nt\n70uCZd2ZuH+/lc6WVPuuVQWZUWbhXgne7o0f2I48aUgpOmUGVjLGXHprJpHT1nrP\nhEkgIbUwiKkK/monC7PNdekGNrqAQbjGw3krhbpvkYu3ci7MwxpCZF6x5FHjqzne\n8GntqqrXCuOz8JnVJmpnlkb+dRyGNO/42KvS89H1py88HmPmoOB91XPaxP9gvUeh\n4U84iBxjXJ3P61QGb0XgAwIxlrsZsSa0Aha/GVCnp6ajnT+il1vnUHdN6Hd5VD4m\nphiE6m5MS/S4d+GidcSw1+kbK22NHQVIAfZzqYjpRQuL898uBy8q6qSET7uUHRIV\n3znYL33caqxjup/FbUa8mldhG+jqhGgU7yyP5K3foySbMlubnoBCf/0pZ3lEuHXf\nGshRVGdbjzL8GVyHD8LrwTPVuYLIN5V7VYE/B6XTM+XraMK0prDMJCJlxMv96OaU\noUcpB33zQzBY3Xw5VqQpTnYKQ7Q1P72i+CLRNF8sq8bo9DWoYQIDAQABMA0GCSqG\nSIb3DQEBCwUAA4IBAQAmbgQcW22AnrP/GH5lzt+Fy6t20lxqpMDIc3rCO6dzXMCR\n9ocjwLj7E243jGFbhHzC8637qOC8b5bYLZL2ND9ZehSu0qdz/0U0Kwt81rj/lihk\nvhD6xgx8g966AMZcZ0iQncyTzbdEukq6jMAtYfWvAu41rL0H5qvIFvxLHGOoxOYV\n0XZslWTC8B8TB3hzQ+HHexxSZbLSbB+sHFShubOlqqxE/zMj2O+c2FGYSOKlbTXi\nTd4m1WY/eJ4+0XjvEAAMZqLSLtnF5U1POz2onnk0u/lzsRnpxiqJY2++1WmCnuAT\nwDIwNEeAPotfm6tM1TjWuwakYrbSY7Ru0YjaFC1S\n-----END CERTIFICATE-----\n",
    "encryptedWalletBindingId": "qeCUuKEjRDUiDHfbYAsHv5L4RCiHe_KE7eKKjpw7jIo",
    "expireDateTime": "2023-01-27T05:38:10.000Z",
    "thumbprint": "rOe3ifBa0uIuKfArURKRKK5psE8YVdWxXbQoDXAvntk",
    "keyId": "1673933890260"
  },
  "errors": []
}

Configuration

The configurable properties for mimoto can be found at mimoto-default.properties. This property file is maintained as one for each deployment environment. On this repository, each environment configuration is placed in a corresponding branch specific to that environment.

Refer to mimoto-default.properties of Collab environment.

The implementers can choose to use the existing configurations or add new configurations to them.

Wallet Configurations

The Inji wallet configurations are defined in the inji-default.properties file, which acts as the source of default configuration values. These configurations are exposed through the Mimoto allProperties API and are consumed by the Inji wallet at runtime.

The properties retrieved through the allProperties API control various wallet functionalities, including credential downloads, storage validation, caching, and OpenID4VP capabilities.

Get all Inji app properties

get

Get all configurable properties for Inji.

Responses
200

Successfully retrieved all configurable properties for Inji.

application/json
errorsobject[]Optional
get/allProperties
GET /v1/mimoto/allProperties HTTP/1.1
Host: api.collab.mosip.net
Accept: */*
200

Successfully retrieved all configurable properties for Inji.

{
  "response": {
    "internal.auth.types.allowed": "otp,bio-Finger,bio-Iris,bio-Face",
    "auth.types.allowed": "demo,otp,bio-Finger,bio-Iris,bio-Face",
    "ekyc.auth.types.allowed": "demo,otp,bio-Finger,bio-Iris,bio-Face"
  },
  "errors": []
}

Property Descriptions

  1. cacheTTLInMilliSeconds: Defines the cache expiration time, in milliseconds, for API fallback. If an API request fails, the SDK uses the cached response for the APIs listed in the table below, provided the cache entry has not expired.

API Fallbacks available as cache

API
Endpoint

getAllProperties

/v1/mimoto/allProperties

fetchIssuers

/v1/mimoto/issuers

fetchTrustedVerifiersList

/v1/mimoto/verifiers

fetchIssuerWellknownConfig

{issuer}/.well-known/...

fetchIssuerAuthorizationServerMetadata

{server}/.well-known/...

  1. minStorageRequired: Defines the minimum available device storage required for operations such as VC downloads and VC backup restoration. If sufficient storage is not available, the operation cannot proceed, and an error screen is displayed.

  2. minStorageRequiredForAuditEntry: Defines the minimum available device storage required before initiating operations such as VC sharing, QR-based sharing, and BLE-based VC sharing, as these operations create audit history entries.

  3. aboutInjiUrl: Defines the "About Inji" URL, which is displayed on the application's "About Inji" page.

  4. VC Download-related Properties

    1. openId4VCIDownloadVCTimeout: Timeout, in milliseconds, for downloading a Verifiable Credential (VC) using the OpenID4VCI flow.

    2. disableCredentialOfferVcVerification: Disables verification of Verifiable Credentials (VCs) received through the OpenID4VCI credential offer flow.

  5. OpenID4VP-related Properties

    1. openid4vpWalletConfig: Defines wallet-specific configuration for the OpenID4VP flow.

    2. openid4vpClientValidation: Enables or disables client validation against the pre-registered client list for the OpenID4VP flow.

      1. true – validate clients against the pre-registered list.

      2. false – skip client validation.

    3. For more information, see Inji Wallet Usage

Wallet's Trusted / Pre-registered Verifier list

The Inji Wallet retrieves the list of pre-registered (trusted) verifiers from the Mimoto backend service.

  • Backend Service: Mimoto

  • API: /v1/mimoto/verifiers

The API response provides the list of trusted verifiers, which is then embedded into the walletConfig. This configuration is supplied to the Inji OpenID4VP library to execute client validation during the OpenID4VP flow.

get

This API retrieves all trusted verifiers for Inji Wallet.

Responses
200

OK

application/json
get/verifiers
GET /v1/mimoto/verifiers HTTP/1.1
Host: api.collab.mosip.net
Accept: */*
200

OK

{
  "verifiers": [
    {
      "client_id": "https://injiverify.collab.mosip.net",
      "redirect_uris": [
        "https://injiverify.collab.mosip.net/redirect"
      ],
      "response_uris": [
        "https://injiverify.collab.mosip.net/redirect"
      ]
    }
  ]
}
PreviousBackend Services
NextAuthorization Server for Authentication Using Inji Wallet Credentials

Last updated

Was this helpful?