Standards

Name the edition. Define the profile. Test the behaviour.

Digital identity systems draw on international standards, implementation profiles and jurisdiction-specific rules. Those layers must be distinguished.

Reference set

We track the standards that shape mobile documents, travel credentials, verifiable credentials, wallet protocols, identity-system APIs and digital trust. The selected edition and profile depend on the use case, jurisdiction and deployment authority.

OSIA is the Secure Identity Alliance’s Open Standards Identity API initiative. ITU-T Recommendation X.1281 (03/2024) is in force and was twinned with OSIA v6.1.0; the OSIA project now lists v7.2 as its latest release. Those versions are related but not interchangeable. UrbanID advises on applying and testing a named interface release against programme architecture and integration requirements; this does not imply OSIA ownership, qualification or certification.

SIA OSIA reference · OSIA releases · ITU-T X.1281

Area	Reference	Status	Source
Identity-system interoperability	ITU-T Recommendation X.1281 (03/2024) — APIs for interoperability of identity management systems; technically equivalent to OSIA v6.1.0	In force; twinned with OSIA v6.1.0 (not the latest OSIA release)	Primary source
Travel credentials	ICAO Digital Travel Credentials (DTC), Virtual Component Data Structure and PKI Mechanisms, Technical Report v1.2 (2020)	Published technical report	Primary source
Travel credentials	ICAO Visible Digital Seal for Non-Constrained Environments (VDS-NC), Technical Report v1.4 (2022)	Published technical report	Primary source
Mobile documents	ISO/IEC 18013-5:2021 — Mobile driving licence (mDL) application	Published; revision in progress	Primary source
Mobile documents	ISO/IEC TS 18013-7:2024 — Mobile driving licence (mDL) add-on functions	Published; second edition under revision	Primary source
Credential exchange	OpenID for Verifiable Credential Issuance (OpenID4VCI) 1.0 Final	Final specification	Primary source
Credential exchange	OpenID for Verifiable Presentations (OpenID4VP) 1.0 Final	Final specification (July 2025)	Primary source
Credential exchange	OpenID4VC High Assurance Interoperability Profile (HAIP) 1.0 Final	Final profile (December 2025)	Primary source
Credential formats	RFC 9901 — Selective Disclosure for JSON Web Tokens	IETF Standards Track RFC (2025)	Primary source
Credential formats	SD-JWT-based Verifiable Digital Credentials, draft-ietf-oauth-sd-jwt-vc-23	Active Internet-Draft (31 October 2026); not final	Primary source
Credential formats	W3C Verifiable Credentials Data Model v2.0	W3C Recommendation (15 May 2025)	Primary source
Credential formats	W3C Decentralized Identifiers (DIDs) v1.0	W3C Recommendation (19 July 2022)	Primary source
European Digital Identity	European Digital Identity Wallet Architecture and Reference Framework v3.0.0	Published framework release (July 2026)	Primary source
Trust and cryptography	RFC 5280 — Internet X.509 Public Key Infrastructure Certificate and CRL Profile	IETF Standards Track RFC	Primary source
Trust and cryptography	RFC 6960 — X.509 Internet PKI Online Certificate Status Protocol (OCSP)	IETF Standards Track RFC	Primary source
Trust and cryptography	RFC 9052 and RFC 9053 — CBOR Object Signing and Encryption (COSE)	IETF Standards Track RFCs	Primary source

Implementation profiles

Standards do not choose trust policy for an ecosystem.

A protocol can define how messages and proofs are processed while leaving trust anchors, verifier authorisation, status policy and governance to the relevant ecosystem. Those decisions need their own authority, profile and operational evidence.

For example, SD-JWT VC remains an Internet-Draft in the IETF snapshot linked above, while RFC 9901 is final. ISO/IEC 18013-5:2021 is published but under revision. We state those differences rather than present the whole field as settled.

Review date: 4 November 2026. Standards status should be refreshed against the linked authorities before use in procurement or implementation.