UserInfo

curl -X GET 'https://sandbox.connect.hopae.com/userinfo' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIs...'

{
  "sub": "otV9EMJr-iG-dj-AHhrCslfdRkUUBQJ1",
  "hopae_loa": 3,
  "hopae_loa_label": "substantial",
  "missing_claims": [
    "email",
    "gender",
    "picture"
  ],
  "user": {
    "birthdate": "1905-04-04",
    "given_name": "OK",
    "family_name": "TESTNUMBER",
    "nationality": "LT",
    "name": "OK TESTNUMBER"
  },
  "provenance": {
    "presentation": {
      "channel": {
        "type": "centralized_idp",
        "transport": "internet"
      },
      "credentials": [
        {
          "type": "smartid",
          "issuer": {
            "id": "urn:hopae:issuer:ee:smartid",
            "authority_name": "SK ID Solutions AS",
            "is_government": false
          },
          "claims": {
            "documentNumber": "PNOLT-40504040001-MOCK-Q",
            "birthdate": "1905-04-04",
            "countryCode": "LT",
            "givenName": "OK",
            "surname": "TESTNUMBER"
          },
          "evidence": {
            "token": {
              "id_token": "<BASE64_ID_TOKEN>",
              "expires_at": "2025-10-31T05:43:14.000Z",
              "access_token": "<OPAQUE_ACCESS_TOKEN>",
              "token_type": "Bearer"
            },
            "names": "id_token;expires_at;access_token;token_type"
          }
        }
      ]
    },
    "_metadata": {
      "verification_id": "3162dd47a26b4218b5fa708761889e44",
      "verified_at": "2025-10-28T06:20:36.992Z"
    }
  }
}

GET

userinfo

curl -X GET 'https://sandbox.connect.hopae.com/userinfo' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIs...'

{
  "sub": "otV9EMJr-iG-dj-AHhrCslfdRkUUBQJ1",
  "hopae_loa": 3,
  "hopae_loa_label": "substantial",
  "missing_claims": [
    "email",
    "gender",
    "picture"
  ],
  "user": {
    "birthdate": "1905-04-04",
    "given_name": "OK",
    "family_name": "TESTNUMBER",
    "nationality": "LT",
    "name": "OK TESTNUMBER"
  },
  "provenance": {
    "presentation": {
      "channel": {
        "type": "centralized_idp",
        "transport": "internet"
      },
      "credentials": [
        {
          "type": "smartid",
          "issuer": {
            "id": "urn:hopae:issuer:ee:smartid",
            "authority_name": "SK ID Solutions AS",
            "is_government": false
          },
          "claims": {
            "documentNumber": "PNOLT-40504040001-MOCK-Q",
            "birthdate": "1905-04-04",
            "countryCode": "LT",
            "givenName": "OK",
            "surname": "TESTNUMBER"
          },
          "evidence": {
            "token": {
              "id_token": "<BASE64_ID_TOKEN>",
              "expires_at": "2025-10-31T05:43:14.000Z",
              "access_token": "<OPAQUE_ACCESS_TOKEN>",
              "token_type": "Bearer"
            },
            "names": "id_token;expires_at;access_token;token_type"
          }
        }
      ]
    },
    "_metadata": {
      "verification_id": "3162dd47a26b4218b5fa708761889e44",
      "verified_at": "2025-10-28T06:20:36.992Z"
    }
  }
}

Fetch verified user claims using the access token from /token.

The ID Token contains no PII. All personal attributes are returned only by /userinfo. Unsupported (requested) standard claims are listed in missing_claims. Verification context is provided in provenance. Evidence is included when the credential source returns it; the object contains a token payload and a semicolon‑delimited names list describing the keys. Keys vary by provider, so always read them from names. Content is relayed from the credential source.

Headers

string

default:"Bearer eyJhbGci..."

required

Bearer access token issued by /token.

Responses

string

required

Subject identifier. Stable per source identity across all clients.

string

Authentication Context Class Reference.

number

Numeric assurance level.

string

Human‑readable assurance label (e.g., substantial).

string[]

Requested standard claims not provided by the source. [] for match flows, unless the provider also exposes disclosed claims — then requested-but-unavailable disclosed claims are listed here.

string

Provider identifier that authenticated the subject. Mirrors the single element in amr.

string

Always present. One of disclosure (PII under user) or match (comparison envelope under match; user carries the verified subset of the fields you submitted).

object

Personal attributes (present per granted scopes and source availability). When verification_model is match, contains the verified subset of the fields you submitted via matchData — per-field providers: only fields with matched: true; aggregate providers: every submitted field when the aggregate outcome is true, otherwise empty.

Show User fields

string

Display name

string

Given nam

string

Family name

string

Birthdate in YYYY-MM-DD

string

Email address

boolean

Whether the email is verified

string

Phone number in E.164 format

boolean

Whether the phone number is verified

object | string

Structured address

string

ISO 3166-1 alpha‑2.

string

Middle name(s)

string

Casual name or handle

string

Preferred username

string

URL of the user’s profile page

string

Base64-encoded image data of the user’s profile picture

string

Gender value

string

Time zone (IANA)

string

Locale (BCP 47)

number

Unix timestamp of last profile update

object

Verification context for this event.

Show Presentation

string

centralized_idp, wallet, etc.

string

internet, nfc, etc.

array

Credentials presented for this verification.

string

Provider identifier used when initiating the verification (for example, smartid).

string

Issuer identifier.

string

Issuer display name.

boolean

Government authority flag.

object

Raw source claims, when available.

object

Token evidence object from the source (when provided). Includes token (provider-supplied key/value pairs) and names (semicolon-delimited list of keys present under token).

Show Metadata

string

Verification session id.

string

ISO 8601 verification timestamp.

object

Match envelope. Present only when verification_model is match.

Show Match fields

boolean

Aggregate outcome across all submitted fields.

string

per_field or aggregate. Determines the shape of details entries.

string[]

Field keys the RP submitted via matchData. OIDC-normalized names — the same keys you submitted (see Normalized User Data).

object

Outcomes keyed by submitted field name, present for both granularities. per_field entries expose matched (boolean), submitted_value (RP-supplied value, userinfo only and only on matchData fields), and optionally similarity (0–100) when the upstream verifier provides it; aggregate entries expose submitted_value only. May also carry passthrough verifier keys not in submitted_fields when the upstream provider emits them.

Example

curl -X GET 'https://sandbox.connect.hopae.com/userinfo' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIs...'

{
  "sub": "otV9EMJr-iG-dj-AHhrCslfdRkUUBQJ1",
  "hopae_loa": 3,
  "hopae_loa_label": "substantial",
  "missing_claims": [
    "email",
    "gender",
    "picture"
  ],
  "user": {
    "birthdate": "1905-04-04",
    "given_name": "OK",
    "family_name": "TESTNUMBER",
    "nationality": "LT",
    "name": "OK TESTNUMBER"
  },
  "provenance": {
    "presentation": {
      "channel": {
        "type": "centralized_idp",
        "transport": "internet"
      },
      "credentials": [
        {
          "type": "smartid",
          "issuer": {
            "id": "urn:hopae:issuer:ee:smartid",
            "authority_name": "SK ID Solutions AS",
            "is_government": false
          },
          "claims": {
            "documentNumber": "PNOLT-40504040001-MOCK-Q",
            "birthdate": "1905-04-04",
            "countryCode": "LT",
            "givenName": "OK",
            "surname": "TESTNUMBER"
          },
          "evidence": {
            "token": {
              "id_token": "<BASE64_ID_TOKEN>",
              "expires_at": "2025-10-31T05:43:14.000Z",
              "access_token": "<OPAQUE_ACCESS_TOKEN>",
              "token_type": "Bearer"
            },
            "names": "id_token;expires_at;access_token;token_type"
          }
        }
      ]
    },
    "_metadata": {
      "verification_id": "3162dd47a26b4218b5fa708761889e44",
      "verified_at": "2025-10-28T06:20:36.992Z"
    }
  }
}

{
  "sub": "dZwCCSTLVMlJlXKTgSERCsApC7OUnBKT",
  "amr": ["id-nik-match"],
  "provider_id": "id-nik-match",
  "verification_model": "match",
  "hopae_loa": 1,
  "hopae_loa_label": "none",
  "missing_claims": [],
  "user": {
    "name": "Test User",
    "birthdate": "1990-01-01"
  },
  "provenance": {
    "presentation": {
      "channel": { "type": "centralized_idp", "transport": "internet" },
      "credentials": [
        {
          "type": "id-nik-match",
          "claims": {
            "fullName": true,
            "dateOfBirth": true,
            "nationalIdNo": true
          },
          "issuer": {
            "authority_name": "Directorate General of Population and Civil Registration (Dukcapil)",
            "is_government": true
          },
          "evidence": {
            "token": {
              "integrator_jws": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
              "token_type": "integrator"
            },
            "names": "integrator_jws;token_type"
          }
        }
      ]
    },
    "_metadata": {
      "verification_id": "f34e2801c3914b3284f2829ea48eeafc",
      "verified_at": "2026-04-26T15:56:11.110Z",
      "status": "completed"
    }
  },
  "match": {
    "matched": true,
    "granularity": "per_field",
    "submitted_fields": ["name", "birthdate"],
    "details": {
      "name":      { "matched": true, "submitted_value": "Test User" },
      "birthdate": { "matched": true, "submitted_value": "1990-01-01" }
    }
  }
}

Evidence keys are provider-specific. Inspect names to determine which fields are present under evidence.token.

For match providers, provenance.presentation.credentials[].claims carries the upstream IDP response verbatim — typically per-field boolean confirmation from the source authority. This is the audit record of what the source agreed with, not a duplicate of match.details. Note the intentional naming asymmetry: matchData, match.submitted_fields, and match.details use OIDC-normalized keys (e.g. name, birthdate), while provenance claims keep the upstream IDP’s native keys (e.g. fullName, dateOfBirth) so the audit trail stays aligned with the source.

Overview

OIDC

REST API

Headers

Responses

Example

​Headers

​Responses

​Example

Headers

Responses

Example