[ { "path": ".gitignore", "content": ".idea\n" }, { "path": ".gitmodules", "content": "[submodule \"valuesets\"]\n\tpath = valuesets\n\turl = https://github.com/ehn-dcc-development/ehn-dcc-valuesets\n" }, { "path": "DCC.combined-schema.json", "content": "{\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"$id\": \"https://id.uvci.eu/DCC.combined-schema.json\",\n \"title\": \"EU DCC\",\n \"description\": \"EU Digital Covid Certificate\",\n \"$comment\": \"Schema version 1.3.2\",\n \"type\": \"object\",\n \"oneOf\": [\n {\n \"required\": [\n \"ver\",\n \"nam\",\n \"dob\",\n \"v\"\n ]\n },\n {\n \"required\": [\n \"ver\",\n \"nam\",\n \"dob\",\n \"t\"\n ]\n },\n {\n \"required\": [\n \"ver\",\n \"nam\",\n \"dob\",\n \"r\"\n ]\n }\n ],\n \"properties\": {\n \"ver\": {\n \"title\": \"Schema version\",\n \"description\": \"Version of the schema, according to Semantic versioning (ISO, https://semver.org/ version 2.0.0 or newer)\",\n \"type\": \"string\",\n \"pattern\": \"^\\\\d+.\\\\d+.\\\\d+$\",\n \"examples\": [\n \"1.0.0\",\n \"1.3.0\",\n \"1.3.1\",\n \"1.3.2\"\n ]\n },\n \"nam\": {\n \"description\": \"Surname(s), forename(s) - in that order\",\n \"$ref\": \"#/$defs/person_name\"\n },\n \"dob\": {\n \"title\": \"Date of birth\",\n \"description\": \"Date of Birth of the person addressed in the DCC. ISO 8601 date format restricted to range 1900-2099 or empty\",\n \"type\": \"string\",\n \"pattern\": \"^((19|20)\\\\d\\\\d(-\\\\d\\\\d){0,2}){0,1}$\",\n \"examples\": [\n \"1979-04-14\",\n \"1950\",\n \"1901-08\",\n \"\"\n ]\n },\n \"v\": {\n \"description\": \"Vaccination Group\",\n \"type\": \"array\",\n \"items\": {\n \"$ref\": \"#/$defs/vaccination_entry\"\n },\n \"minItems\": 1,\n \"maxItems\": 1\n },\n \"t\": {\n \"description\": \"Test Group\",\n \"type\": \"array\",\n \"items\": {\n \"$ref\": \"#/$defs/test_entry\"\n },\n \"minItems\": 1,\n \"maxItems\": 1\n },\n \"r\": {\n \"description\": \"Recovery Group\",\n \"type\": \"array\",\n \"items\": {\n \"$ref\": \"#/$defs/recovery_entry\"\n },\n \"minItems\": 1,\n \"maxItems\": 1\n }\n },\n \"$defs\": {\n \"dose_posint\": {\n \"description\": \"Dose Number / Total doses in Series: positive integer\",\n \"type\": \"integer\",\n \"minimum\": 1\n },\n \"issuer\": {\n \"description\": \"Certificate Issuer\",\n \"type\": \"string\",\n \"maxLength\": 80\n },\n \"person_name\": {\n \"description\": \"Person name: Surname(s), forename(s) - in that order\",\n \"anyOf\": [\n {\n \"required\": [\n \"fnt\"\n ]\n },\n {\n \"required\": [\n \"gnt\"\n ]\n }\n ],\n \"type\": \"object\",\n \"properties\": {\n \"fn\": {\n \"title\": \"Surname\",\n \"description\": \"The surname or primary name(s) of the person addressed in the certificate\",\n \"type\": \"string\",\n \"maxLength\": 80,\n \"examples\": [\n \"d'Červenková Panklová\"\n ]\n },\n \"fnt\": {\n \"title\": \"Standardised surname\",\n \"description\": \"The surname(s) of the person, transliterated ICAO 9303\",\n \"type\": \"string\",\n \"pattern\": \"^[A-Z<]*$\",\n \"maxLength\": 80,\n \"examples\": [\n \"DCERVENKOVA/auth/realms//protocol/openid-connect/auth`\n\n| Query-Param | Value | Description |\n| --- | --- | --- |\n| client_id | `user-access-ti` or `user-access-ti-simulator` | `user-access-ti` requires a RU SMCB . `user-access-ti-simulator` can be used in conjuction with the gematik KOPS. [Further Details](https://github.com/Digitaler-Impfnachweis/certification-apis/discussions/14) |\n| redirect_uri | connector://authenticated | custom-uri scheme |\n| response_type | code | |\n| scope | openid | |\n| nonce | | |\n\nTriggering of this call results in redirect which contains details for the next step. \n\nExample Request\n```\ncurl --request GET 'https:///auth/realms//protocol/openid-connect/auth?redirect_uri=connector://authenticated&response_type=code&scope=openid&client_id=user-access-ti&nonce=' -v\n```\nExample Response \n```\n< HTTP/2 200\n< content-length: 0\n< location: https:///auth/realms//login-actions/authenticate?session_code=kNJIzxgdw6GWYHdNIeI5aEA7x91b8-tuw0zdVHGMabE&execution=ab86f06d-69b0-44d3-8c7b-a980ed1dc3a7&client_id=user-access-ti&tab_id=WGEj4oBWvh4&auth_session_id=ce6ed41d-b46d-4a69-9ef7-ef5ab7ad63c0&tab_id=FBGZX-SyeqI\n< x-auth-challenge: 171c09de-2f1a-493a-bad7-ee4761a2bec3\n< set-cookie: AUTH_SESSION_ID=916a0ffc-ebca-408b-973c-c470ed000d62.keycloak-certificato-keycloakx-0-33399; Version=1; Path=/auth/realms/bmg-ti-certify/; SameSite=None; Secure; HttpOnly\n< set-cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNjlhM2ViOS1iNDgyLTRiNTctYjIwNC01M2E3NTg5ZTE1NWUifQ.eyJjaWQiOiJ1c2VyLWFjY2Vzcy10aSIsInB0eSI6Im9wZW5pZC1jb25uZWN0IiwicnVyaSI6ImNvbm5lY3RvcjovL2F1dGhlbnRpY2F0ZWQiLCJhY3QiOiJBVVRIRU5USUNBVEUiLCJub3RlcyI6eyJzY29wZSI6Im9wZW5pZCIsImlzcyI6Imh0dHBzOi8vaWQuY2VydGlmeS5kZW1vLnViaXJjaC5jb20vYXV0aC9yZWFsbXMvYm1nLXRpLWNlcnRpZnkiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6ImNvbm5lY3RvcjovL2F1dGhlbnRpY2F0ZWQiLCJub25jZSI6ImYyM2c0ZjRmNWczIn19.27XzBiLoMnSakd_e-OpCYCRkX449JK8WeVw-hSYchz0; Version=1; Path=/auth/realms/bmg-ti-certify/; HttpOnly\n```\n\n> **Important**: with the update to a new keycloak version, the previous cookie-less session handling is no longer available. To ensure the authentication flow works, please send the `AUTH_SESSION_ID` for subsequent requests.\n> The reason is that Keycloak deprecates and will remove cookie-less authentication flows.\n\n## 2. Receive Challenge \n\nResponse of step 1 contains the following header parameters:\n\n| Header | Value | Description |\n| --- | --- | --- |\n| x-auth-challenge | ... | Challenge in form of a UUID |\n| Location | | URI |\n\nBoth parameters are important and need to be saved temporary since they're relevant for step 4.\n\n## 3. Perform Signature operation with SMCB\n\nThis step takes care of signing the provided challenge with the SMCB. The steps are not illustrated here because there are dependent on the framework of the integrating system. Details about the interaction with the SMCB can be seen in the [sequence diagram](authentication/seq_diagram_smcb_iam.png).\n\nThe signature is created based on the provided challenge and must be hashed with `SHA-256`.\n\n**Supported Ciphers:** RSA and ECC\n\n**Signature Scheme:** RSASSA-PSS \n\n**SMC-B Certificate Requirements**\n\n| OID | Value | Description |\n| --- | --- | --- |\n| Policy | 1.2.276.0.76.4.77 | \"OID-Festlegung Zertifikatstyp\" |\n| ProfessionOID | 1.2.276.0.76.4.50 | \"Betriebsstätte Arzt\" |\n\nTest environments are not limited in respect to the `ProfessionOID`.\n\n## 4. Submit Signed challenge and SMCB public certificate\n\nCall action-uri from step 2 and add the following request headers \n\n| Header | Value | Description |\n| --- | --- | --- |\n| x-auth-signed-challenge | ... | the signed challenge as base64 encoded string |\n| x-auth-certificate | ... | the public certificate of the smcb as base64 encoded string |\n\n```\ncurl --location -viks --request GET 'https:///auth/realms//login-actions/authenticate?client_id=user-access-ti&execution=ab86f06d-69b0-44d3-8c7b-a980ed1dc3a7&session_code=xidVii9ba-WI2pLuVGA6VxKZRhCs6NmtbrwYFFaeh2k&tab_id=BpjQ0_H_Mvk&auth_session_id=0a4d8e20-3ed5-4af2-97bb-c7d16b7c7e00' \\\n--header 'x-auth-signed-challenge: WX/kLxPnAlhBOyvXAiCCgul2U07xJ+kiFCz9CHp3/gLGpOA7sSWgJVB/rY6MHve4mtqBhlvgwPfdfTc3ubPLK8I0GLCGTbsbwCBvm+FkC+OxN+5VkNp7Azwxhol7hWjEeTFj1C3raA5p6jBZ3FZMugySPXcKkSzpew8JzeVElDBdfl7z0drmBsVyDF2Cu9HOt1TU0qAqXgdf2Yhs+hvAme9J9iurfjOziUoGBNDR5FX2MQfAPToWVXuImrdmNqOJMHnT6eDk9hHQJeikVNwimMk2aB0FAz/U7B79XVnkAluWeRQ2F6R135gF4M2MXZy/floCljYisuzkrfU3uLB2wA==' \\\n--header 'x-auth-certificate: MIIHMzCCBhugAwIBAgICVnAwDQYJKoZIhvcNAQELBQAwgbYxCzAJBgNVBAYTAkRFMTowOAYDVQQKDDFULVN5c3RlbXMgSW50ZXJuYXRpb25hbCBHbWJIIC0gRzIgTG9zIDMgTk9ULVZBTElEMUgwRgYDVQQLDD9JbnN0aXR1dGlvbiBkZXMgR2VzdW5kaGVpdHN3ZXNlbnMtQ0EgZGVyIFRlbGVtYXRpa2luZnJhc3RydWt0dXIxITAfBgNVBAMMGFRTWVNJLlNNQ0ItQ0ExIFRFU1QtT05MWTAeFw0xNjEyMTQwNzM2MThaFw0yMTEyMTQyMzU5NTlaMHExCzAJBgNVBAYTAkRFMRcwFQYDVQQKDA5LWkJWIE5PVC1WQUxJRDEgMB4GA1UEBRMXMTIuODAyNzY4ODMxMTAwMDAwMTgxNjYxJzAlBgNVBAMMHkRyLiBTb3BoaWUgR8O2cmxpdHplclRFU1QtT05MWTCCASMwDQYJKoZIhvcNAQEBBQADggEQADCCAQsCggEBAIPYOVMEsaSDRrSPRiGql6z1K+PZhCzBPhqnROU4KR+45deY2yA+mtqhRmyhhWIFlGZqR813TJEfXq33osyktSiMvQRbICjFaHy38WMw3GG19Sz1jMPOEjdBmnNkgD4vjovcsZzfUPERW914MI3w3g/vQGLs0f91rCxq6lEw/KtFr0GsnsK+ZTpA5e9n9ULaQPqN/Q22BGhSoRsjWTotRH2HoRoE3FKM8RPOsJXiRKtGSJLiQxdrLWntBUElMbjpLLWXo2rWiAe2w/Cvz45PXWsiy8wirbIxvxm+HdW7FUrzE74Gh79HiPCL5g6gb9Rhdu8GyExJ5n3b+f70FzlH4MkCBEAAAIGjggOMMIIDiDAfBgNVHSMEGDAWgBSrVMi8OC5HcosnFo8PRDMzdN2QYDAdBgNVHQ4EFgQUlogy0lXlcxm/aBofSwkf+33/JE0wDgYDVR0PAQH/BAQDAgWgMHIGA1UdIARrMGkwUAYIKoIUAEwEgSMwRDBCBggrBgEFBQcCARY2aHR0cDovL3d3dy5oYmEtdGVzdC50ZWxlc2VjLmRlL3BvbGljaWVzL0VFX3BvbGljeS5odG1sMAkGByqCFABMBE0wCgYIKoIUAEwEgSowDAYDVR0TAQH/BAIwADCCAbAGA1UdHwSCAacwggGjMIG6oIG3oIG0hoGxbGRhcDovL2xkYXAtaGJhLXRlc3QudGVsZXNlYy5kZS9DTj1ULVN5c3RlbXMlMjBTTUMlMjBUZXN0LUNBJTIwMSxPVT1UcnVzdCUyMENlbnRlciUyMERldXRzY2hlJTIwVGVsZWtvbSxPPVQtU3lzdGVtcyUyMEVudGVycHJpc2UlMjBTZXJ2aWNlcyUyMEdtYkgsQz1ERT9DZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0MIHjoIHgoIHdhoHaaHR0cDovL2hiYS10ZXN0LnRlbGVzZWMuZGUvaGJhL2Rvd25sb2FkL2Rvd25sb2FkLmNybD9wYXRoPUNOJTNEVC1TeXN0ZW1zJTIwU01DJTIwVGVzdC1DQSUyMDElMkNPVSUzRFRydXN0JTIwQ2VudGVyJTIwRGV1dHNjaGUlMjBUZWxla29tJTJDTyUzRFQtU3lzdGVtcyUyMEVudGVycHJpc2UlMjBTZXJ2aWNlcyUyMEdtYkglMkNDJTNEREUlM0ZDZXJ0ZmljYXRlUmV2b2NhdGlvbkxpc3QwgaYGBSskCAMDBIGcMIGZpB4wHDELMAkGA1UEBhMCREUxDTALBgNVBAoMBEtaQlYwdzB1MHMwcTBDDEFCZXRyaWVic3N0w6R0dGUgTGVpc3R1bmdzZXJicmluZ2Vyb3JnYW5pc2F0aW9uIFZlcnRyYWdzemFobsOkcnp0ZTAKBggqghQATASBOxMeMi1TTUMtQi1PUkctVEstODgzMTEwMDAwMDE4MTY2MEIGCCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAYYmaHR0cDovL29jc3Auc21jYi50ZXN0LnRlbGVzZWMuZGUvb2NzcHIwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBABTVrgMm5hj0L+43QqvrLqnWwQvVpVIopdWwbm1kvdQVTV8C/RzBIBU6kAYS6mWB6nrT8JOMMRyk2mH/nK4tEgBF8IyXwpONY6QXvHkHrH6DFYsSdcLLQe4jF13c7WT7dC0s5EJAmNGUdJ1JEq6aVn6uAMwc3BRKCYtQPumH0wViJzr6p5SHHW7bKuZjDNxxM91xUcpoupMrnsr3vwGYbFKmFGQvp42tWkSmndv3wBrGGzPhORgy3WzgDCBdDrEpxWgU6wMwfkk/IrJahtkLJRt40T2s0pVnaUyunUTWxoteU0ro7SIVrnP65RqIyOrCJEj3B2wXk8YIBY5/mhv2ij4=' \\\n```\n\nThis will result in an auth code that can be used to obtain an access token in the next step. The response contains 2\nquery parameters attached to the redirect uri (see below): session_state and code. These need to be extracted.\n\n```\nHTTP/2 302\nlocation: connector://authenticated?session_state=9d56c0f8-295a-4db2-acbe-eaee7ace5238&code=0849d5f4-30fc-4c58-ae70-40b64e8bad3c.9d56c0f8-295a-4db2-acbe-eaee7ace5238.446dd6a3-54b2-4b6a-a385-d2a471dbb6af\n```\n\n## 5. Exchange code against token\n\nUse the token endpoint to obtain an access token.\n\nOIDC Token endpoint: `https:///auth/realms//protocol/openid-connect/token`\n\n| Header | Value | Description |\n| --- | --- | --- |\n| Content-Type | application/x-www-form-urlencoded | information will be send as url encoded data in the request body |\n\n| data | Value | Description |\n| --- | --- | --- |\n| grant_type | authorization_code | - |\n| redirect_uri | connector://authenticated | custom-uri scheme |\n| client_id | user-access-ti | |\n| session_state | ... | session state retrieved in previous request |\n| code | ... | the auth code retrieved in previous request |\n\nSample response:\n\n```\n{\n \"access_token\": \"eyJz93a...k4laUWw\",\n \"refresh_token\": \"GEbRxBN...edjnXbL\",\n \"id_token\": \"eyJ0XAi...4faeEoQ\",\n \"token_type\": \"Bearer\",\n \"expires_in\": 60,\n \"refresh_expires_in\": 1800,\n \"not-before-policy\": 1620218638,\n \"session_state\": \"9d56c0f8-295a-4db2-acbe-eaee7ace5238\",\n \"scope\": \"openid email profile\"\n}\n```\nPlease note that a system is meant to reuse the token until it expires. A standard OIDC [refresh_token flow](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens) should be imlemented. \n" }, { "path": "dcc-certify-api.html", "content": "\n\n\n\n \n Issuer Service API\n \n \n \n \n \n\n\n\n \n
API docs by Redocly

Issuer Service API (2.2.0)

Download OpenAPI specification:Download

UBIRCH GmbH: support@ubirch.com URL: https://ubirch.com License: Apache License, Version 2.0

The issuer service API generates signed\nDigital Green Certificate (DGC)\nconforming certificates.

\n
Copyright (C) 2021 IBM Deutschland GmbH\nCopyright (C) 2021 ubirch GmbH\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttps://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
\n

Certification

Issue a vaccination certificate.

Description

\n

Issue a health certificate based on the provided input according to spec 1.3.3 of the\nDigital Green Certificate (DGC).

\n

Authentication: clients connecting via Internet (not SNK/TI)\nneed an X.509 client certificate and must provide a list of authorized vaccination center id's.

\n

Applications: vaccination center software, patient information systems, integrators

\n
Authorizations:
AppBearerToken
header Parameters
X-Transaction-Id
string <hex> ^[A-Za-z0-9]{64}$
Example: 56e9926cd68bf5818e176196b324aeca05a2fe7ea10b486876d194898e9ccc22

The transaction id that identifies this request. Needs to be\na SHA256 of the actual transaction id encoded as hex string.

\n
X-UBIRCH-DCCType
required
string^[VTR]$
Examples:
  • V - Request a vaccination certificate signature.
  • T - Request a test certificate signature.
  • R - Request a recovery certificate signature.

The type of signature to be acquired. V - for vaccination certificates, T - for\ntest certificates, and R - for recovery certificates

\n
Request Body schema:

Digital Green Certificate request information. The value-sets are defined in the EU eHealthNetwork: Value Sets for Digital Green Certificates. version 1.0.

\n
required
Person name (object) or Person name (object) (Person name)

Name of the person which receives the certificate.

\n
dob
required
string <date> (Date of birth) (19|20)\\d{2}-\\d{2}-\\d{2}

Date of Birth of the person addressed in the DGC. ISO 8601 date format restricted to range 1900-2099

\n
required
Array of objects (VaccinationEntry) = 1 items

Vaccination Certificate Entry

\n

Responses

Endpoint for vaccination centers only - STAGING api server

\n
https://api.certify.demo.ubirch.com/api/certify/v2/issue

Endpoint for vaccination centers only - PRODUCTION api server

\n
https://api.certify.ubirch.com/api/certify/v2/issue

Endpoint for medical practitioners with TI access only - STAGING api server

\n
https://api.ru.impfnachweis.info/api/certify/v2/issue

Endpoint for medical practitioners with Gematik Kops simulator access only - requires no client-cert required - STAGING api server

\n
https://api-pvs.certify.demo.ubirch.com/api/certify/v2/issue

Endpoint for medical practitioners with TI access only - PRODUCTION api server

\n
https://api.impfnachweis.info/api/certify/v2/issue

Request samples

  • Payload
Content type
{
  • \"nam\": {
    • \"fn\": "Musterfrau-Dießner"
    },
  • \"dob\": "1979-04-14",
  • \"v\": [
    • {
      • \"id\": "string",
      • \"tg\": "string",
      • \"vp\": "string",
      • \"mp\": "string",
      • \"ma\": "string",
      • \"dn\": 1,
      • \"sd\": 1,
      • \"dt\": "2019-08-24"
      }
    ]
}

Sign a CBOR Web Token hash.

Description

\n

Verifies and signs the hash of a CBOR Web Token (CWT). This is the\nactual signature operation of the ECDSA\nalgorithm applied to the pre-hashed data of the CWT. It returns the skeleton of the signed CWT which needs to\nbe filled with the actual payload that was used in the process of creating the signature hash. This endpoint\nis used for a privacy friendly way to remotely sign certificates.

\n

Applications: secure backend integrators, vaccination web frontend

\n
Authorizations:
AppBearerToken
header Parameters
X-Location-Id
required
string <hex> ^[A-Za-z0-9]{64}$
Example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

The location id for which this certificate signature is acquired. Needs to be\na SHA256 of the actual location id encoded as hex string.

\n
X-Transaction-Id
required
string <hex> ^[A-Za-z0-9]{64}$
Example: 56e9926cd68bf5818e176196b324aeca05a2fe7ea10b486876d194898e9ccc22

The transaction id that identifies this request. Needs to be\na SHA256 of the actual transaction id encoded as hex string.

\n
X-UBIRCH-DCCType
required
string^[VTR]$
Examples:
  • V - Request a vaccination certificate signature.
  • T - Request a test certificate signature.
  • R - Request a recovery certificate signature.

The type of signature to be acquired. V - for vaccination certificates, T - for\ntest certificates, and R - for recovery certificates

\n
Request Body schema: text/plain

Base64 encoded SHA256 message digest of the CBOR Web Token prior to the application\nof the signature algorithm.

\n
string <base64>

Responses

Endpoint for vaccination centers only - STAGING api server

\n
https://api.certify.demo.ubirch.com/api/certify/v2/issue/hash

Endpoint for vaccination centers only - PRODUCTION api server

\n
https://api.certify.ubirch.com/api/certify/v2/issue/hash

Endpoint for medical practitioners with TI access only - STAGING api server

\n
https://api.ru.impfnachweis.info/api/certify/v2/issue/hash

Endpoint for medical practitioners with Gematik Kops simulator access only - requires no client-cert required - STAGING api server

\n
https://api-pvs.certify.demo.ubirch.com/api/certify/v2/issue/hash

Endpoint for medical practitioners with TI access only - PRODUCTION api server

\n
https://api.impfnachweis.info/api/certify/v2/issue/hash

Request samples

  • Payload
Content type
text/plain
TvQb78AX/5r+5ZkVYYeUW0Rn/4FB8ICt6sSdrwOq0EI=

Response samples

  • 200
Content type
application/cbor
<Signed Incomplete CBOR Web Token>
\n \n\n\n" }, { "path": "dcc-certify-api.yaml", "content": "openapi: 3.0.1\nservers:\n - url: https://api.certify.demo.ubirch.com/\n description: Endpoint for vaccination centers only - STAGING api server\n - url: https://api.certify.ubirch.com/\n description: Endpoint for vaccination centers only - PRODUCTION api server\n - url: https://api.ru.impfnachweis.info\n description: Endpoint for medical practitioners with TI access only - STAGING api server\n - url: https://api-pvs.certify.demo.ubirch.com\n description: Endpoint for medical practitioners with Gematik Kops simulator access only - requires no client-cert required - STAGING api server\n - url: https://api.impfnachweis.info\n description: Endpoint for medical practitioners with TI access only - PRODUCTION api server \ninfo:\n title: Issuer Service API\n description: |\n The issuer service API generates signed\n [Digital Green Certificate (DGC)](https://github.com/ehn-digital-green-development/ehn-dgc-schema/releases/tag/1.0.0)\n conforming certificates.\n\n ```\n Copyright (C) 2021 IBM Deutschland GmbH\n Copyright (C) 2021 ubirch GmbH\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n https://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n ```\n\n version: 2.2.0\n license:\n name: 'Apache License, Version 2.0'\n url: 'https://www.apache.org/licenses/LICENSE-2.0'\n contact:\n name: UBIRCH GmbH\n url: https://ubirch.com\n email: support@ubirch.com\npaths:\n # ===========================================================\n # Available API endpoints\n # ===========================================================\n /api/certify/v2/issue:\n post:\n tags:\n - Certification\n summary: Issue a vaccination certificate.\n description: |\n # Description\n\n Issue a health certificate based on the provided input according to spec 1.3.3 of the\n [Digital Green Certificate (DGC)](https://github.com/ehn-digital-green-development/ehn-dgc-schema/releases/tag/1.3.2).\n\n **Authentication:** clients connecting via Internet (not [SNK](https://www.kbv.de/html/sicheres_netz.php)/[TI](https://www.gematik.de/telematikinfrastruktur/))\n need an X.509 client certificate and must provide a list of authorized vaccination center `id`'s.\n\n **Applications:** vaccination center software, patient information systems, integrators\n parameters:\n - in: header\n name: X-Transaction-Id\n description: |\n The transaction id that identifies this request. Needs to be\n a SHA256 of the actual transaction id encoded as hex string.\n schema:\n type: string\n format: hex\n pattern: \"^[A-Za-z0-9]{64}$\"\n example: 56e9926cd68bf5818e176196b324aeca05a2fe7ea10b486876d194898e9ccc22\n# required: true\n - in: header\n name: X-UBIRCH-DCCType\n description: |\n The type of signature to be acquired. V - for vaccination certificates, T - for\n test certificates, and R - for recovery certificates\n schema:\n type: string\n pattern: \"^[VTR]$\"\n examples:\n vaccination:\n value: V\n summary: Request a vaccination certificate signature.\n test:\n value: T\n summary: Request a test certificate signature.\n recovery:\n value: R\n summary: Request a recovery certificate signature.\n required: true\n requestBody:\n description: >-\n Digital Green Certificate request information. The value-sets are defined in the\n [EU eHealthNetwork: Value Sets for Digital Green Certificates. version 1.0](https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_dt-specifications_en.pdf).\n content:\n application/json: #deprecated and required for backwards compatability\n schema:\n '$ref': '#/components/schemas/VaccinationCertificateRequest'\n application/vnd.dgc.v1+json:\n schema:\n oneOf:\n - '$ref': '#/components/schemas/VaccinationCertificateRequest'\n - '$ref': '#/components/schemas/RecoveryCertificateRequest'\n - '$ref': '#/components/schemas/TestCertificateRequest'\n application/vnd.dgc.v1.3+json:\n schema:\n oneOf:\n - '$ref': '#/components/schemas/VaccinationCertificateRequest'\n - '$ref': '#/components/schemas/RecoveryCertificateRequest'\n - '$ref': '#/components/schemas/TestCertificateRequest'\n examples:\n Vaccination Certification Request:\n description: |\n This is an example for a vaccination certification request.\n value:\n nam:\n fn: \"Musterfrau-Dießner\"\n gn: \"Erika Dörte\"\n dob: \"1979-04-14\"\n v:\n - id: \"IZ28215B\"\n tg: \"840539006\"\n vp: \"1119305005\"\n mp: \"EU/1/20/1528\"\n ma: \"ORG-100001699\"\n dn: 1\n sd: 2\n dt: \"2021-04-14\"\n Recovery Certification Request:\n description: |\n This is an example for a vaccination certification request.\n value:\n nam:\n fn: \"Musterfrau-Dießner\"\n gn: \"Erika Dörte\"\n dob: \"1979-04-14\"\n r:\n - id: \"BSNR12345\"\n tg: \"840539006\"\n fr: \"2021-04-21\"\n df: \"2021-05-01\"\n du: \"2021-10-21\"\n Test Certification Request:\n description: |\n This is an example for a test certification request.\n value:\n nam:\n fn: \"Musterfrau-Dießner\"\n gn: \"Erika Dörte\"\n dob: \"1979-04-14\"\n t:\n - id: \"TC12345\"\n tg: \"840539006\"\n tt: \"LP6464-4\"\n nm: \"Roche LightCycler qPCR\"\n tr: \"260415000\"\n sc: \"2021-04-13T14:20:00+00:00\"\n tc: \"Hauptbahnhof Köln\"\n\n responses:\n '200':\n description: Certificate response as PDF, encoded or binary token.\n headers:\n X-DGC-Id:\n schema:\n '$ref': 'DCC.combined-schema.json#/$defs/certificate_id'\n description: The generated certificate identifier contained in the certificate.\n example: \"01DE/IZ999999X/3B05FC5T96C6HY3YS4FS6H8DD#Z\"\n content:\n application/cbor+base45:\n schema:\n '$ref': '#/components/schemas/CertificateEncoded'\n application/cbor:\n schema:\n '$ref': '#/components/schemas/CertificateBinary'\n application/pdf:\n schema:\n '$ref': '#/components/schemas/CertificationPDF'\n '400':\n description: Invalid Request\n # WIP: define extended error messages if input is wrong\n '401':\n description: Authentication Failure (Credential missing)\n '403':\n description: Forbidden (Invalid Credentials)\n '406':\n description: Incorrect data model\n '500':\n description: Internal Server Error\n security:\n - AppBearerToken: [ ]\n\n /api/certify/v2/issue/hash:\n post:\n tags:\n - Certification\n summary: Sign a CBOR Web Token hash.\n description: |\n # Description\n Verifies and signs the hash of a [CBOR Web Token](https://tools.ietf.org/html/rfc8392) (CWT). This is the\n actual signature operation of the [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm)\n algorithm applied to the pre-hashed data of the CWT. It returns the skeleton of the signed CWT which needs to\n be filled with the actual payload that was used in the process of creating the signature hash. This endpoint\n is used for a privacy friendly way to remotely sign certificates.\n\n **Applications:** secure backend integrators, vaccination web frontend\n parameters:\n - in: header\n name: X-Location-Id\n description: |\n The location id for which this certificate signature is acquired. Needs to be\n a SHA256 of the actual location id encoded as hex string.\n schema:\n type: string\n format: hex\n pattern: \"^[A-Za-z0-9]{64}$\"\n example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n required: true\n - in: header\n name: X-Transaction-Id\n description: |\n The transaction id that identifies this request. Needs to be\n a SHA256 of the actual transaction id encoded as hex string.\n schema:\n type: string\n format: hex\n pattern: \"^[A-Za-z0-9]{64}$\"\n example: 56e9926cd68bf5818e176196b324aeca05a2fe7ea10b486876d194898e9ccc22\n required: true\n - in: header\n name: X-UBIRCH-DCCType\n description: |\n The type of signature to be acquired. V - for vaccination certificates, T - for\n test certificates, and R - for recovery certificates\n schema:\n type: string\n pattern: \"^[VTR]$\"\n examples:\n vaccination:\n value: V\n summary: Request a vaccination certificate signature.\n test:\n value: T\n summary: Request a test certificate signature.\n recovery:\n value: R\n summary: Request a recovery certificate signature.\n required: true\n requestBody:\n description: |\n Base64 encoded SHA256 message digest of the CBOR Web Token prior to the application\n of the signature algorithm.\n content:\n text/plain:\n schema:\n type: string\n format: base64\n example: \"TvQb78AX/5r+5ZkVYYeUW0Rn/4FB8ICt6sSdrwOq0EI=\"\n responses:\n '200':\n description: A signed incomplete CBOR Web Token.\n content:\n application/cbor:\n schema:\n type: string\n format: binary\n example: \"\"\n '400':\n description: Invalid Request\n '401':\n description: Authentication Failure (Credential missing)\n '403':\n description: Forbidden (Invalid Credentials)\n '406':\n description: Incorrect CBOR Data\n '500':\n description: Internal Server Error\n security:\n - AppBearerToken: [ ]\n\ncomponents:\n # ===========================================================\n # Request and response schema definitions\n # ===========================================================\n schemas:\n CertificateRequestBase:\n description: >-\n Common Digital Green Certificate (DGC) request data containing the name and date of birth of the person\n receiving the certificate.\n type: object\n required:\n - nam\n - dob\n properties:\n nam:\n title: Person name\n description: Name of the person which receives the certificate.\n type: object\n anyOf:\n - properties:\n fn:\n title: Family name\n description: The family or primary name(s) of the person addressed in the certificate\n type: string\n maxLength: 80\n example: \"Musterfrau-Dießner\"\n required: [ fn ]\n - properties:\n gn:\n title: Given name\n description: The given name(s) of the person addressed in the certificate\n type: string\n maxLength: 80\n example: \"Erika Dörte\"\n required: [ gn ]\n dob:\n title: Date of birth\n description: Date of Birth of the person addressed in the DGC. ISO 8601 date format restricted to range 1900-2099\n type: string\n format: date\n pattern: '(19|20)\\d{2}-\\d{2}-\\d{2}'\n example: '1979-04-14'\n\n VaccinationCertificateRequest:\n allOf:\n - '$ref': '#/components/schemas/CertificateRequestBase'\n - type: object\n description: >-\n Vaccination certificate request object. The value-sets are defined in the\n [EU eHealthNetwork: Value Sets for Digital Green Certificates. version 1.0](https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_dt-specifications_en.pdf).\n required:\n - v\n properties:\n v:\n description: Vaccination Certificate Entry\n type: array\n items:\n '$ref': '#/components/schemas/VaccinationEntry'\n minItems: 1\n maxItems: 1\n\n RecoveryCertificateRequest:\n allOf:\n - '$ref': '#/components/schemas/CertificateRequestBase'\n - type: object\n description: >-\n Recovery certificate request object. The value-sets are defined in the\n [EU eHealthNetwork: Value Sets for Digital Green Certificates. version 1.0](https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_dt-specifications_en.pdf).\n required:\n - r\n properties:\n r:\n description: Recovery Certificate Entry\n type: array\n items:\n '$ref': '#/components/schemas/RecoveryEntry'\n minItems: 1\n maxItems: 1\n\n TestCertificateRequest:\n allOf:\n - '$ref': '#/components/schemas/CertificateRequestBase'\n - type: object\n description: >-\n Test certificate request object. The value-sets are defined in the\n [EU eHealthNetwork: Value Sets for Digital Green Certificates. version 1.0](https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_dt-specifications_en.pdf).\n required:\n - t\n properties:\n t:\n description: Test Group\n type: array\n items:\n '$ref': '#/components/schemas/TestEntry'\n minItems: 1\n maxItems: 1\n\n VaccinationEntry:\n description: Single vaccination data entry.\n type: object\n required:\n - id\n - tg\n - vp\n - mp\n - ma\n - dn\n - sd\n - dt\n properties:\n id:\n description: >-\n Identifier of the administering location (i.e. vaccination center ID, BSNR or similar identifer).\n It will be used in the construction of the DGCI (digitial green certificate identifier).\n Due to the specification of the DGCI only the use of uppercase letters and numbers 0-9 are allowed.\n type: string\n pattern: \"^[0-9A-Z]+$\"\n tg:\n '$ref': 'DCC.combined-schema.json#/$defs/disease-agent-targeted'\n vp:\n '$ref': 'DCC.combined-schema.json#/$defs/vaccine-prophylaxis'\n mp:\n '$ref': 'DCC.combined-schema.json#/$defs/vaccine-medicinal-product'\n ma:\n '$ref': 'DCC.combined-schema.json#/$defs/vaccine-mah-manf'\n dn:\n '$ref': 'DCC.combined-schema.json#/$defs/dose_posint'\n sd:\n '$ref': 'DCC.combined-schema.json#/$defs/dose_posint'\n dt:\n description: ISO 8601 date of the vaccination\n type: string\n format: date\n\n RecoveryEntry:\n description: Single recovery data entry.\n type: object\n required:\n - id\n - tg\n - fr\n - df\n - du\n properties:\n id:\n description: >-\n Identifier of the health professional location (i.e. BSNR or similar identifer).\n It will be used in the construction of the DGCI (digitial green certificate identifier).\n Due to the specification of the DGCI only the use of uppercase letters and numbers 0-9 are allowed.\n type: string\n pattern: \"^[0-9A-Z]+$\"\n tg:\n '$ref': 'DCC.combined-schema.json#/$defs/disease-agent-targeted'\n fr:\n description: First positive test result date as ISO 8601.\n type: string\n format: date\n df:\n description: Certificate valid from date as ISO 8601.\n type: string\n format: date\n du:\n description: Certificate valid until date as ISO 8601.\n type: string\n format: date\n\n TestEntry:\n description: Test Entry\n required:\n - id\n - tg\n - tt\n - sc\n - tr\n - tc\n type: object\n properties:\n id:\n description: >-\n Identifier of the test center location (i.e. postal code or similar identifer).\n It will be used in the construction of the DGCI (digitial green certificate identifier).\n Due to the specification of the DGCI only the use of uppercase letters and numbers 0-9 are allowed.\n type: string\n pattern: \"^[0-9A-Z]+$\"\n tg:\n '$ref': 'DCC.combined-schema.json#/$defs/disease-agent-targeted'\n tt:\n '$ref': 'DCC.combined-schema.json#/$defs/test-type'\n nm:\n description: NAA Test Name\n type: string\n ma:\n '$ref': 'DCC.combined-schema.json#/$defs/test-manf'\n sc:\n description: Date/Time of Sample Collection\n type: string\n format: date-time\n tr:\n '$ref': 'DCC.combined-schema.json#/$defs/test-result'\n tc:\n description: Test center or laboratory\n type: string\n maxLength: 50\n\n CertificateEncoded:\n description: >-\n Base45 encoded and compressed Digital Green Certificate (DGC) according to EU specification. An encoded\n certificate can be directly rendered as a QR code according to the EU specification.\n type: string\n format: base45\n example: \"HC1:6BFOXN*TS0BI$ZD4N9:9S6RCVN5+O30K3/XIV0W23NTDEMWK4MI6UOS03CR83KLBKAVN74.CL91/8K6%KEG3983NS9SVBHABVCNN95SWMPHQUHQN%A400H%UBT16Y51Y9AT1:+P6YBKD0:XB7NGJQOIS7I$H%T5+XO8YJMVHBZJF 9NSG:PICIG%*47%S%*48YIZ73423ZQT-EJDG3XW44$22CLY.IE.KD+2H0D3ZCU7JI$2K3JQH5-Y3$PA$HSCHBI I7995R5ZFQETU 9R*PP:+P*.1D9RYO05QD/8D3FC:XIBEIVG395EP1E+WEDJL8FF3DE0OA0D9E2LBHHNHL$EQ+-CVYCMBB:AV5AL5:4A93MOJLWT.C3FDA.-B97U: KMZNKASADIMKN2GFLF9$HF.3O.X21FDLW4L4OVIOE1M24OR:FTNP8EFVMP9/HWKP/HLIJL8JF8JF172OTTHO9YW2E6LS7WGYNDDSHRSFXT*LMK8P*G8QWD8%P%5GPPMEVMTHDBESW2L.TN8BBBDR9+JLDR/1JGIF8BS0IKT8LB1T7WLA:FI%JI50H:EK1\"\n\n CertificateBinary:\n description: >-\n Binary representation of the Digital Green Certificate (DGC) according to EU specification.\n This is a pure CBOR Web Token (CWT) without compression and encoding and HC1: prefix.\n type: string\n format: binary\n example: \"\"\n\n CertificationPDF:\n description: >-\n A rendered PDF document containing the certificate information including a\n Digital Green Certificate (DGC) QR Code according to EU specification.\n type: string\n format: binary\n example: \"\"\n\n securitySchemes:\n AppBearerToken:\n type: http\n description: >-\n Authentication is based on a bearer token\n scheme: bearer\n bearerFormat: JWT\n" }, { "path": "dcc-reissue-api.html", "content": "\n\n\n\n \n Re-issue Service API\n \n \n \n \n \n\n\n\n \n
Documentation Powered by ReDoc

Re-issue Service API (2.0.0)

Download OpenAPI specification:Download

UBIRCH GmbH: mailto:support@ubirch.com URL: https://ubirch.com License: Apache License, Version 2.0

The re-issue service API generates signed\nDigital Green Certificate (DGC)\nconforming certificates with the short validity and based on current regulations. It is mainly used by Apps\nto re-issue validation certificates.

\n
Copyright (C) 2021 IBM Deutschland GmbH\nCopyright (C) 2021 ubirch GmbH\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.

Re-issuing

Re-issue a new certificate based on an existing valid certificate.

Description

\n

Re-issue a new certificate based on an existing valid certificate. This operation verifies the authenticity and\nthe integrity of the certificate, checks some formal rules of the content of the certificate and re-issues\na new certificate with a different validity and/or re-encoded specifics (i.e. series encoding) than the original\ncertificate.

\n

All certificates in a single request must adhere to same-person rule. Each request operates on certificates \nof one person.

\n

Applications: mobile applications, wallet apps

\n
Request Body schema: application/json

A list of valid Digital Green Certificate(s) (DGC) signed in Germany (DE) that are needed for re-issue.

\n
action
string
Enum: "renew" "extend" "combine"

The operation to execute on the input certificate(s). All certificates in a single request\nmust adhere to same-person rule. Each request operates on certificates of one person.

\n
    \n
  • renew - replace a certificate with a new version, i.e. booster recoding 2/2 -> 2/1
    • \n
  • extend - extend the technical validity of a certificate
    • \n
  • combine - combine multiple certificates (not used yet)
    • \n
\n
certificates
Array of strings <base45> (CertificateEncoded) non-empty

One or more certificates required for the operation.

\n

Responses

STAGING re-issue api server

\n
https://api.reissue.demo.ubirch.com/api/certify/v2/reissue

PRODUCTION re-issue api server

\n
https://api.reissue.ubirch.com/api/certify/v2/reissue

Request samples

  • Payload
Content type
application/json
{
  • \"action\": "renew",
  • \"certificates\": [
    • "HC1:6BFOXN*TS0BI$ZD4N9:9S6RCVN5+O30K3/XIV0W23NTDEMWK4MI6UOS03CR83KLBKAVN74.CL91/8K6%KEG3983NS9SVBHABVCNN95SWMPHQUHQN%A400H%UBT16Y51Y9AT1:+P6YBKD0:XB7NGJQOIS7I$H%T5+XO8YJMVHBZJF 9NSG:PICIG%*47%S%*48YIZ73423ZQT-EJDG3XW44$22CLY.IE.KD+2H0D3ZCU7JI$2K3JQH5-Y3$PA$HSCHBI I7995R5ZFQETU 9R*PP:+P*.1D9RYO05QD/8D3FC:XIBEIVG395EP1E+WEDJL8FF3DE0OA0D9E2LBHHNHL$EQ+-CVYCMBB:AV5AL5:4A93MOJLWT.C3FDA.-B97U: KMZNKASADIMKN2GFLF9$HF.3O.X21FDLW4L4OVIOE1M24OR:FTNP8EFVMP9/HWKP/HLIJL8JF8JF172OTTHO9YW2E6LS7WGYNDDSHRSFXT*LMK8P*G8QWD8%P%5GPPMEVMTHDBESW2L.TN8BBBDR9+JLDR/1JGIF8BS0IKT8LB1T7WLA:FI%JI50H:EK1"
    ]
}

Response samples

  • 200
  • 400
  • 411
Content type
application/json
[
  • {
    • \"certificate\": "HC1:6BFOXN*TS0BI$ZD4N9:9S6RCVN5+O30K3/XIV0W23NTDEMWK4MI6UOS03CR83KLBKAVN74.CL91/8K6%KEG3983NS9SVBHABVCNN95SWMPHQUHQN%A400H%UBT16Y51Y9AT1:+P6YBKD0:XB7NGJQOIS7I$H%T5+XO8YJMVHBZJF 9NSG:PICIG%*47%S%*48YIZ73423ZQT-EJDG3XW44$22CLY.IE.KD+2H0D3ZCU7JI$2K3JQH5-Y3$PA$HSCHBI I7995R5ZFQETU 9R*PP:+P*.1D9RYO05QD/8D3FC:XIBEIVG395EP1E+WEDJL8FF3DE0OA0D9E2LBHHNHL$EQ+-CVYCMBB:AV5AL5:4A93MOJLWT.C3FDA.-B97U: KMZNKASADIMKN2GFLF9$HF.3O.X21FDLW4L4OVIOE1M24OR:FTNP8EFVMP9/HWKP/HLIJL8JF8JF172OTTHO9YW2E6LS7WGYNDDSHRSFXT*LMK8P*G8QWD8%P%5GPPMEVMTHDBESW2L.TN8BBBDR9+JLDR/1JGIF8BS0IKT8LB1T7WLA:FI%JI50H:EK1",
    • \"relations\": [
      • {
        • \"index\": 0,
        • \"action\": "replace"
        }
      ]
    }
]
\n \n\n\n" }, { "path": "dcc-reissue-api.yaml", "content": "openapi: 3.0.1\nservers:\n - url: https://api.reissue.demo.ubirch.com/\n description: STAGING re-issue api server\n - url: https://api.reissue.ubirch.com/\n description: PRODUCTION re-issue api server\ninfo:\n title: Re-issue Service API\n description: |\n The re-issue service API generates signed\n [Digital Green Certificate (DGC)](https://github.com/ehn-digital-green-development/ehn-dgc-schema)\n conforming certificates with the short validity and based on current regulations. It is mainly used by Apps\n to re-issue validation certificates.\n\n ```\n Copyright (C) 2021 IBM Deutschland GmbH\n Copyright (C) 2021 ubirch GmbH\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n ```\n\n version: 2.0.0\n license:\n name: 'Apache License, Version 2.0'\n url: 'https://www.apache.org/licenses/LICENSE-2.0'\n contact:\n name: UBIRCH GmbH\n url: https://ubirch.com\n email: mailto:support@ubirch.com\npaths:\n # ===========================================================\n # Available API endpoints\n # ===========================================================\n /api/certify/v2/reissue:\n post:\n tags:\n - Re-issuing\n summary: Re-issue a new certificate based on an existing valid certificate.\n description: |\n # Description\n\n Re-issue a new certificate based on an existing valid certificate. This operation verifies the authenticity and\n the integrity of the certificate, checks some formal rules of the content of the certificate and re-issues\n a new certificate with a different validity and/or re-encoded specifics (i.e. series encoding) than the original\n certificate.\n \n All certificates in a single request must adhere to same-person rule. Each request operates on certificates \n of one person.\n\n *Applications:* mobile applications, wallet apps\n requestBody:\n description: |\n A list of valid Digital Green Certificate(s) (DGC) signed in Germany (DE) that are needed for re-issue.\n content:\n application/json:\n schema:\n type: object\n properties:\n action:\n description: |\n The operation to execute on the input certificate(s). All certificates in a single request\n must adhere to same-person rule. Each request operates on certificates of one person.\n \n - `renew` - replace a certificate with a new version, i.e. booster recoding 2/2 -> 2/1\n - `extend` - extend the technical validity of a certificate\n - `combine` - combine multiple certificates (not used yet)\n type: string\n required: true\n enum:\n - renew\n - extend\n - combine\n certificates:\n description: One or more certificates required for the operation.\n type: array\n required: true\n minItems: 1\n items:\n '$ref': 'dcc-certify-api.yaml#/components/schemas/CertificateEncoded'\n responses:\n '200':\n description: OK\n content:\n application/json:\n schema:\n description: |\n The result of the operation, which may be one or more certificates. For each certificate the \n executed operation is indicated.\n type: array\n items:\n '$ref': '#/components/schemas/CertificateReissueResponse'\n '400':\n description: Invalid Request\n content:\n application/json:\n schema:\n '$ref': '#/components/schemas/ErrorResponse'\n examples:\n BodyTooLarge:\n description: The request is too large and considered unacceptable.\n value:\n error: RI400-0100\n message: body too large\n InvalidRequest:\n description: The body does not contain parsable json or is missing required fields.\n value:\n error: RI400-0200\n message: invalid request\n ActionNotAcceptable:\n description: The action field contains none of the accepted values.\n value:\n error: RI400-0300\n message: action not acceptable\n WrongNumberOfCertificates:\n description: The number of certificates provided does not match the expected number for the case.\n value:\n error: RI400-0400\n message: wrong number of certificates\n InvalidCertificateFormat:\n description: |\n One or more certificats does not conform to the DCC serialization format,\n i.e. missing the 'HC1:' prefix.\n value:\n error: RI400-0500\n message: invalid certificate format\n InvalidCertificateEncoding:\n description: One or more certificates cannot be decoded.\n value:\n error: RI400-0600\n message: invalid certificate encoding\n InvalidCertificateCompression:\n description: One of the certificates cannot be decompressed.\n value:\n error: RI400-0700\n message: invalid certificate encoding\n InvalidCOSEEncoding:\n description: One of the certificates cannot be decoded to COSE/CBOR.\n value:\n error: RI400-0800\n message: invalid certificate format\n UnknownSigner:\n description: One of the certificates has a signature from an unknown signer.\n value:\n error: RI400-0900\n message: a certificate could not be verified\n NameMismatch:\n description: The certificates do not belong together due to a name mismatch.\n value:\n error: RI400-1000\n message: certificates not acceptable for action\n BirthDateMismatch:\n description: The certificates do not belong together due to a birth date mismatch.\n value:\n error: RI400-1100\n message: certificates not acceptable for action\n ConditionFailed:\n description: The certificates fail to meet the condition for reissuing.\n value:\n error: RI400-1200\n message: certificate not acceptable for action\n InvalidSignature:\n description: One of the certificates fails the signature verification.\n value:\n error: RI400-1300\n message: invalid signature\n RuleValidationError:\n description: One or more certificates are not valid.\n value:\n error: RI400-1400\n message: certificates not acceptable for action\n InvalidCountry:\n description: One or more certificates cannot be used for reissuing because of country restrictions.\n value:\n error: RI400-1500\n message: certificates not acceptable for action\n TooOldExpirationDate:\n description: The expiration date of the last issued cert is too old.\n value:\n error: RI400-1600\n message: expiration date too old to become extended\n TooEarlyExpirationDate:\n description: The expiration date of the last issued cert is too early.\n value:\n error: RI400-1700\n message: expiration date too young to become extended\n DateConflict:\n description: Two or more certificates reference the same date.\n value:\n error: RI400-1800\n message: at least two DCCs have the same date (dt and/or fr)\n InvalidUVCI:\n description: The UVCI of the last issued cert is invalid.\n value:\n error: RI400-1900\n message: invalid unique certificate identifier\n CertificateRevoked:\n description: One or more certificates are revoked.\n value:\n error: RI400-2000\n message: a certificate is revoked\n WrongIssuerCountry:\n description: Issuer country does not correlate with signing key country\n value:\n error: RI400-2100\n message: wrong issuer country\n '411':\n description: Length Required\n content:\n application/json:\n schema:\n '$ref': '#/components/schemas/ErrorResponse'\n example:\n LengthRequired:\n value:\n error: RI411-0100\n message: length required\n '429':\n description: Too Many Requests\n '500':\n description: Internal Server Error\n\ncomponents:\n schemas:\n CertificateReissueResponse:\n type: object\n properties:\n certificate:\n '$ref': 'dcc-certify-api.yaml#/components/schemas/CertificateEncoded'\n relations:\n description: Array of certificates related to this new certificate indicating the action.\n type: array\n items:\n '$ref': '#/components/schemas/CertificateReissueRelation'\n\n CertificateReissueRelation:\n type: object\n properties:\n index:\n description: The index of the related certificate from the request.\n type: number\n action:\n description: |\n The operational relation to the new certificate.\n (The nop action will be removed on production.)\n type: string\n enum:\n - replace\n - nop\n\n ErrorResponse:\n type: object\n properties:\n error:\n type: string\n description: A machine readable error code.\n message:\n type: string\n description: Human readable description of the error.\n required:\n - error\n\n\n" }, { "path": "dsc-update/README.md", "content": "# DSC TrustList Update API\n\nTo be able to validate [Digital COVID Certificates](https://ec.europa.eu/info/live-work-travel-eu/coronavirus-response/safe-covid-19-vaccines-europeans/eu-digital-covid-certificate_en) (DCCs) from different EU countries, the national verifier apps need to retrieve a list of public keys from all possible issuing authorities. Those are called Document Signing Certificates (DSCs).\nAs more institutions get authorised to issue vaccination certificates, this list has to be maintained and synchronised to the verifier apps.\n\nFor an EU wide synchronisation of the list of issuing authorities, the EU commission installed a centralised service called the [EU DCC Gateway](https://github.com/eu-digital-green-certificates/dgc-gateway): a collection of REST API endpoints to upload individual DSCs as well as [fetch the latest list of all DSCs](https://eu-digital-green-certificates.github.io/dgc-gateway/#/Trust%20Lists/downloadTrustList).\nOnly EU Member States are allowed to access the EU Gateway (secured via mTLS), so every country must additionally provide the collection of their acknowledged DSCs via a national backend.\nBilateral exchanges are not prohibited, and private institutions (airlines, commercial verifying vendors) might request access to the national endpoint.\nA removal of a DSC from the EU Gateway by a member state will be propagated to all verifier apps and is to be seen as invalidating all DCCs signed by this DSC.\n\nThis API spec defines the endpoint for the national backend that offers the list of Trusted DSCs to the verifier apps for seal verification.\nA periodical request to the EU Gateway (~ every 6h) is made to fetch the latest set of all DSCs from all EU member states connected to the EU gateway.\nAs the national backend is public, an additional signature element is added to the overall content provided by the EU Gateway.\n\n## Data Schema\n\nThe data structure that gets delivered looks as follows (inspired by the [COSE object](https://cose-wg.github.io/cose-spec/#rfc.appendix.C.1)):\n\n```json\no3SWKd9PKKaQcLqc+z0F6IJAK6lxaw/B1JCWETB9EZBYgT8F/+R29+vedCO/Wkz0aXgi8SOGkXIr2rW9fEk/Jg==\n{\"certificates\" : [\n {\n \"certificateType\": \"DSC\",\n \"country\": \"DE\",\n \"kid\": \"qroU+hDDovs=\",\n \"rawData\": \"MIICyDCCAbCgAwIBAgIGAXR3DZUUMA0GCSqGSIb3DQEBBQUAMBwxCzAJB ... Jpux30QRhsNZwkmEYSbRv+vp5/obgH1mL5ouoV5I=\",\n \"signature\": \"o53CbAa77LyIMFc5Gz+B2Jc275Gdg/SdLayw7gx0GrTcinR95zfTLr8nNHgJMYlX3rD8Y11zB/Osyt0...W+VIrYRGSEmgjGy2EwzvA5nVhsaA+/udnmbyQw9LjAOQ==\",\n \"thumbprint\": \"aaba14fa10c3a2fb441a28af0ec1bb4128153b9ddc796b66bfa04b02ea3e103e\",\n \"timestamp\": \"2021-05-12T21:48:50.583Z\",\n },\n...\n]}\n```\n\n- On the first line the base64 encoded signature of the contents of from the second line\n- On the second line a JSON map that looks the following:\n\nAs such we provide as data structure a list of entries each representing a Document Signing Certificate (DSC - field 'rawData') along with metadata, most notably the [kid](https://github.com/ehn-dcc-development/hcert-spec/blob/main/hcert_spec.md#333-key-identifier). An overall signature on the first line ensures that this list can be guaranteed to be complete as well as integer.\nThe signature over the Trusted List is calculated by building the SHA-256 hash over the JSON content of the second line, then signing it via ECDSA using prime256v1.\n\n## DGC Update / DCC Verification Flow\n\nThe high level flow for the DSC Update and DCC verification looks as follows:\n![](Ablaufdiagramm_validationFlowCertificate.png)\n\nAs can be seen in the diagram, the request for the latest list of trusted DGCs is decoupled from the actual DCC verification, which can be done offline.\nWhen updating the TrustedList of Document Signing Certificates (DSCs) it is important to check the authenticity and integrity of the list via the 'signature' field.\n" }, { "path": "dsc-update/dsc-update-api.yaml", "content": "openapi: '3.0.1'\nservers:\n - url: https://de.test.dscg.ubirch.com/trustList/DSC/\n description: Test / Demo Environment\n - url: https://de.dscg.ubirch.com/trustList/DSC/\n description: Productive Environment\ninfo:\n title: German Trusted List of DSCs\n description: >-\n This endpoint provides access to the List of Document Signing Certificates (DSCs) that Germany considers authorized to sign Digital Green Certificates (DGCs). The list gets periodially updated with the latest list from the [EU Gateway](https://eu-digital-green-certificates.github.io/dgc-gateway/). The data structure of the response is similar to the response from the Gateway - however we add an additional signature of the overall list to ensure authenticity and integrity.\n\n This is also why this is a plain text response: the first line contains the signature, the second line the actual content, a JSON object of DSC entries.\n \n ```\n Copyright (C) 2021 IBM Deutschland GmbH\n Copyright (C) 2021 ubirch GmbH\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n https://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n ```\n version: '0.1.1'\n license:\n name: 'Apache License, Version 2.0'\n url: 'https://www.apache.org/licenses/LICENSE-2.0'\n contact:\n name: UBIRCH GmbH\n url: https://ubirch.com\n email: support@ubirch.com\npaths:\n # ===========================================================\n # Available API endpoints\n # ===========================================================\n /DSC/:\n get:\n tags:\n - Trusted List of DSCs\n summary: The Trusted List of Document Signing Certificates.\n responses:\n '200':\n description: >-\n Returns a plain text containing two lines: the signature on the first line and the content on the second line. The content is a JSON map corresponding to the TrustedList datastructure. consists of a JSON array of objects representing the DSCs and additional metadata info.\n content: \n text/plain:\n schema:\n type: string\n example: >-\n yIMFc5Gz0... W+aA+/udQ==\n {\"certificates\":[{\"certificateType\": \"DSC\", \"country\": \"DE\", \"kid\": \"DEsVUSvpFAE=\", \"rawData\": \"MIIGwI...If1QHu/nyDtQ=\", \"signature\": \"MIAG...0O1AAAAAAAA\", \"thumbprint\": \"0c4b1551...2c6a57477\", \"timestamp\": \"2021-05-18T10:36:56+02:00\"}, ...]}\n\ncomponents:\n # ===========================================================\n # Request and response schema definitions\n # ===========================================================\n schemas:\n TrustedList:\n type: object\n properties:\n certificates:\n type: array\n items: \n $ref: '#/components/schemas/DSCEntry'\n DSCEntry:\n type: object\n properties:\n kid:\n type: string\n example: qroU+hDDovs=\n timestamp:\n type: string\n format: date-time\n country:\n type: string\n example: SE\n thumbprint:\n type: string\n example: aaba14fa10c3a2fb441a28af0ec1bb4128153b9ddc796b66bfa04b02ea3e103e\n signature:\n type: string\n example: >-\n o53Ct0... W+VIrYAOQ==\n rawData:\n type: string\n example: >-\n MIICyDCCAb...Jpux30QRhV5I=\n" }, { "path": "examples/01_example.txt", "content": "HC1:6BFOXN*TS0BI$ZD4N9:9S6RCVN5+O30K3/XIV0W23NTDEPWK G2EP4J0B3KLASMUG8GJL8LLG.3SA3/-2E%5VR5VVBJZILDBZ8D%JTQOL2009UVD0HX2JN*4CY009TX/9F/GZ%5U1MC82*%95HC2FCG2K80H-1GW$5IKKQJO0OPN484SI4UUIMI.J9WVHWVH+ZE/T9MX1HRIWQHCR2HL9EIAESHOP6OH6MN9*QHAO96Y2/*13A5-8E6V59I9BZK6:IR/S09T./0LWTHC0/P6HRTO$9KZ56DE/.QC$QUC0:GOODPUHLO$GAHLW 70SO:GOV636*2. KOKGKZGJMI:TU+MMPZ5OV1 V125VE-4RZ4E%5MK9BM57KPGX7K:7D-M1MO0Q2AQE:CA7ED6LF90I3DA+:E3OGJMSGX8+KL1FD*Y49+574MYKOE1MJ-69KKRB4AC8.C8HKK9NTYV4E1MZ3K1:HF.5E1MRB4WKP/HLIJL8JF8JF172M*8OEB2%7OREF:FO:7-WF11SKCU1MH8FWPVH%L635OBXTY*LPM6B9OBYSH:4Q1BQ:A5+I6:DQR9VKR8 BLHCFQMZA5:PHR14%GV4ZOP50$ A 3\n" }, { "path": "examples/README.md", "content": "# Examples\n\nThis directory contains examples that help understand the structure of the certificates and how to use the API.\n\n## Certificate Example and Structure\n\nThe following is an example QR code encoded according to the EU specification (created via web frontend):\n\n![Demo QR Code](01_example.png)\n\nThe [plain text representation](01_example.txt) of the QR code content:\n```\nHC1:6BFOXN*TS0BI$ZD4N9:9S6RCVN5+O30K3/XIV0W23NTDEPWK G2EP4J0B3KLASMUG8GJL8LLG.3SA3/-2E%5VR5VVBJZILDBZ8D%JTQOL2009UVD0HX2JN*4CY009TX/9F/GZ%5U1MC82*%95HC2FCG2K80H-1GW$5IKKQJO0OPN484SI4UUIMI.J9WVHWVH+ZE/T9MX1HRIWQHCR2HL9EIAESHOP6OH6MN9*QHAO96Y2/*13A5-8E6V59I9BZK6:IR/S09T./0LWTHC0/P6HRTO$9KZ56DE/.QC$QUC0:GOODPUHLO$GAHLW 70SO:GOV636*2. KOKGKZGJMI:TU+MMPZ5OV1 V125VE-4RZ4E%5MK9BM57KPGX7K:7D-M1MO0Q2AQE:CA7ED6LF90I3DA+:E3OGJMSGX8+KL1FD*Y49+574MYKOE1MJ-69KKRB4AC8.C8HKK9NTYV4E1MZ3K1:HF.5E1MRB4WKP/HLIJL8JF8JF172M*8OEB2%7OREF:FO:7-WF11SKCU1MH8FWPVH%L635OBXTY*LPM6B9OBYSH:4Q1BQ:A5+I6:DQR9VKR8 BLHCFQMZA5:PHR14%GV4ZOP50$ A 3\n```\n\nPseudo-code representation of the decoded CBOR Web Token (CWT):\n\n- Issuer: `DE`\n- Valid from: `Friday, May 7, 2021 1:09:05 PM`\n- Expires: `Saturday, May 7, 2022 1:09:05 PM`\n\n*(be aware that the CWT keys `1`, `4`, `6`, `-260` are actual integer keys in the CWT)*\n```json\n{\n \"1\": \"DE\",\n \"4\": 1651928945,\n \"6\": 1620392945,\n \"-260\": {\n \"1\": {\n \"v\": [\n {\n \"ci\": \"01DE/00000/1119349007/BW1DDJEZX2B0VGVYII1QN7DDU#S\",\n \"co\": \"DE\",\n \"dn\": 2,\n \"dt\": \"2021-05-07\",\n \"is\": \"Bundesministerium für Gesundheit\",\n \"ma\": \"ORG-100030215\",\n \"mp\": \"EU/1/20/1528\",\n \"sd\": 2,\n \"tg\": \"840539006\",\n \"vp\": \"1119349007\"\n }\n ],\n \"dob\": \"1970-01-01\",\n \"nam\": {\n \"fn\": \"Dießner Musterfrau\",\n \"gn\": \"Erika Dörte\",\n \"fnt\": \"DIESSNER 🔐 For JVM based systems, a JKS may be relevant:\n> ```shell\n> keytool -importkeystore -srckeystore demo.pfx -srcstoretype pkcs12 -destkeystore demo.jks -deststoretype JKS\n> ```\n\n## Certificate Issuing\n\nFor integrators (vaccination centers, patient information systems, etc.) the issuer api provides a way to send\ncertification requests. The following example demonstrators how to authenticate and use\nthe [API](../dcc-certify-api.yaml) to request a certificate for a vaccination data set:\n\n```bash\n# request a Base45 encoded certificate\ncurl \\\n --location \\\n --request POST 'https://api.certify.demo.ubirch.com/api/certify/v2/issue' \\\n --cert-type p12 \\\n --cert demo.pfx:$(cat demo.pwd) \\\n --header 'Accept: application/cbor+base45' \\\n --header 'Content-Type: application/json' \\\n --data-raw '{\n \"nam\": {\n \"fn\": \"Musterfrau\",\n \"gn\": \"Erika\"\n },\n \"dob\": \"1979-04-14\",\n \"v\": [{\n \"id\": \"IZ12345A\",\n \"tg\": \"840539006\",\n \"vp\": \"1119305005\",\n \"mp\": \"EU/1/20/1528\",\n \"ma\": \"ORG-100001699\",\n \"dn\": 1,\n \"sd\": 2,\n \"dt\": \"2021-04-14\"\n }]\n }' \n```\n\nThe result is:\n```\nHC1:6BFOXN*TS0BI$ZD.P9O6RZ.1LKLX97/3AOW2TCVM6K6+3R651WG%MP8*IVH53VDR%28WA1*QC3B:ZH6I1$4JN:IN1MPK95%LNF6JWEA2RIZHUP0D310TE.IS599WCK-/3O3GQH0W-2C-23/5Z17U45LQE1ZS$*S1CK9B9LGF9B9LW4G%89-8CNNE+47/GVD98-O LHG-K0C5$:O4IJZJJBY4.Z8Z.KAE1M8HVO2LFNAZ2RV4SHA-O9/IE%TE6UG+ZE V1+GO9+PGF6Z6NC8P$WA3AA9EPBDSM+Q8H4O670C57Q4UYQD*O%+Q.SQBDOBKLP64-HQ/HQ3IRE+QJDO4A7E:7LYPPTQQE2*ED.-B97U: KMZNKAS7CI*DD2IHLF95HFI1MAKJ%IH1FDLW4L4OVIOE1MA.DI1ITNP8EFDKLDD846SWKP/HLIJL8JF8JF172-KQ-K1O8N: V9NVF7HO-OH6J4SSZK2K:T14FNDMA$RN$F/W74YH DT3ZLA/DMMFI4FKPPT$M %SPPS3QQZ.142DAP3P.5FJDNBWQF7L10J5R11\n```\n\nTo test this certificate, you can use [this page](https://github.pathcheck.org/debug.html) and paste the Base45\ntext and use the [demo signing certificate](demo-dsc.crt) certificate to verify.\n\n## Possible Issues\n\n- X.509 client certificate is missing or invalid\n ```\n 400 Sorry, there is something invalid in your request. header is missing. X-Forwarded-Tls-Client-Cert\n ```\n- X.509 client certificate is not authorized for this endpoint\n ```\n 403 Sorry, the credential is invalid.\n ```\n" }, { "path": "examples/demo-dsc.crt", "content": "-----BEGIN CERTIFICATE-----\nMIIGljCCBE6gAwIBAgIQYCT++pDPSoNLST5Q8HGIbzA9BgkqhkiG9w0BAQowMKAN\nMAsGCWCGSAFlAwQCA6EaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgOiAwIBQDBg\nMQswCQYDVQQGEwJERTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSEwHwYDVQQDExhE\nLVRSVVNUIFRlc3QgQ0EgMi0yIDIwMTkxFzAVBgNVBGETDk5UUkRFLUhSQjc0MzQ2\nMB4XDTIxMDUwNzE3MDEzNVoXDTIyMDUxMDE3MDEzNVowgbUxCzAJBgNVBAYTAkRF\nMRQwEgYDVQQKEwtVYmlyY2ggR21iSDEUMBIGA1UEAxMLVWJpcmNoIEdtYkgxDjAM\nBgNVBAcMBUvDtmxuMQ4wDAYDVQQRDAU1MDY3MDEXMBUGA1UECRMOSW0gTWVkaWFw\nYXJrIDUxHDAaBgNVBGETE0RUOkRFLVVHTk9UUFJPVklERUQxFTATBgNVBAUTDENT\nTTAxNzI1NDM3MTEMMAoGA1UECBMDTlJXMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD\nQgAEQsykqO9mX0NkZ1D+/coSrySp8QmeQ/oR/EzwAz4AQbiert8MVTRmI7zmIFRZ\ndvUrnlj8G6l8dL2/cEfv7fmcYaOCAl8wggJbMB8GA1UdIwQYMBaAFFB2kqAa7IGu\nkcLdqAlSaDfeUYRPMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG\nMAkGBwQAjkYBBgIwgf4GCCsGAQUFBwEBBIHxMIHuMCsGCCsGAQUFBzABhh9odHRw\nOi8vc3RhZ2luZy5vY3NwLmQtdHJ1c3QubmV0MEcGCCsGAQUFBzAChjtodHRwOi8v\nd3d3LmQtdHJ1c3QubmV0L2NnaS1iaW4vRC1UUlVTVF9UZXN0X0NBXzItMl8yMDE5\nLmNydDB2BggrBgEFBQcwAoZqbGRhcDovL2RpcmVjdG9yeS5kLXRydXN0Lm5ldC9D\nTj1ELVRSVVNUJTIwVGVzdCUyMENBJTIwMi0yJTIwMjAxOSxPPUQtVHJ1c3QlMjBH\nbWJILEM9REU/Y0FDZXJ0aWZpY2F0ZT9iYXNlPzAXBgNVHSAEEDAOMAwGCisGAQQB\npTQCAgIwgb8GA1UdHwSBtzCBtDCBsaCBrqCBq4ZwbGRhcDovL2RpcmVjdG9yeS5k\nLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwVGVzdCUyMENBJTIwMi0yJTIwMjAxOSxP\nPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdIY3\naHR0cDovL2NybC5kLXRydXN0Lm5ldC9jcmwvZC10cnVzdF90ZXN0X2NhXzItMl8y\nMDE5LmNybDAdBgNVHQ4EFgQUcM7SUF3sDg0G9c5phK6TB2eVD3AwDgYDVR0PAQH/\nBAQDAgbAMD0GCSqGSIb3DQEBCjAwoA0wCwYJYIZIAWUDBAIDoRowGAYJKoZIhvcN\nAQEIMAsGCWCGSAFlAwQCA6IDAgFAA4ICAQCIhkHCgrk1yfslWjnX0W59QiUBfDZu\nHnFrww+CACkwjkvQvL8ruVljxQIc+KUqhfZGcwNqYnfckmr+fYoF16tFuLkvodiJ\n+vYsQEbSfMikW3z7WsE51TKE4Vkp7jP/Mcfz2BN8DxApG7puzBIiNLH5DNbPuE5e\nhm3jPE9xIJr4HCUAsawNREAI3gTzkWKb40YkU3fq0KVpv0/JE4MPXvtiDrsosVTk\njk+nfR3DT0Jj5xuOaZ6xAOvgRWnTOTnW/Khs8p9Y0vQcYDhRFIgl5jTA4VhRuxCt\nP4fkVxWHAjiYM6Nml9f9BjtMZ4pHrSZB7Vv6JRBTiO727yaU1GNPO0TR6U2VtJme\nmN9fAnUTQSbcML1osYDRDRsibmkQx44E87gDmjYVYjhC+eVUmmpKD9OKDXR6yj0V\n++ne2MSc/OAXZPHbp6lK3lwipj0X2eqvN4E0Z7IyhnbuWiEwZ74eBuZE7bt3EGYg\nJEiHwCU4VMtGwlxw4B4EVrFSGpC7Dld+e3R0j3xQkzMW5OvpjIG4lyKtsUlMq2j8\nu7ofDnwgh0U81ILT7WyMve+gZ7pojy/xICfqDZ0VwF9JLfqrq/tw33C9Hr/i9ipM\nhee7ihsVhQXvgV45LBHl3Z3ayu6WrvHTB5f+6hRRLxFzZDii+GPoFZ9tTmK2z6Mn\n1nAhddpGFS0o0Q==\n-----END CERTIFICATE-----\n" }, { "path": "templates/README.md", "content": "# DCC Print Templates (Germany)\n\nThis directory contains the German print templates as SVG. The templates have\nplaceholders in the form `$xx` where `xx` corresponds to the field names of the DCC schema.\n\n- [DCC Certificate of Recovery](RecoveryCertificateTemplate_v4.1.svg)\n- [DCC Test Certificate](TestCertificateTemplate_v4.1.svg)\n- [DCC Vaccination Certificate](VaccinationCertificateTemplate_v4.1.svg)\n\n> The templates contain DEMO overlays that need to be removed for production cases.\n\n## Fonts\n\nThe SVG templates require the free [Open Sans](https://fonts.google.com/specimen/Open+Sans) font.\n\n## QR Code Replacement\n\nWithin the SVG the QR Code is added by replacing `$qr` by a base64 encoded png image of the\nactual QR Code.\n" } ]