@triveria/wallet 0.0.328 → 0.0.330

package/api.d.ts

@@ -126,6 +126,12 @@ export interface CredentialDraftMetadata {
     'vcdmVersion'?: VcdmVersion;
     'vcdmName'?: string;
     'vcdmDescription'?: string;
+    /**
+     * The credential\'s VCDM `renderMethod` entries (W3C VCDM only): UNTP `RenderTemplate2024` (`type`, `name`, `mediaQuery`, `template`, `url`, `mediaType` `text/html` or `text/plain`, `digestMultibase`, nothing else, and a `template` or an https `url` with a `digestMultibase`) or W3C `TemplateRenderMethod` (`renderSuite` `html`, `card` or `nfc`, `renderProperty` JSON pointers, `template` a `data:` URL or an https URL, with a `digestMultibase` when remote). Other types are kept as given. Replaces the draft\'s render methods; an empty array removes them.
+     */
+    'renderMethod'?: Array<{
+        [key: string]: any;
+    }>;
     'credentialSchemaType'?: CredentialSchemaType;
     'id': string;
     'name': string;
@@ -175,6 +181,33 @@ export interface CredentialIssuanceInit {
 export interface CredentialIssuanceInitResult {
     'issuanceQueueItemId': string;
 }
+export interface CredentialIssueDirectPublishFailure {
+    'error': string;
+    'message': string;
+    'credentialId': string;
+}
+export interface CredentialIssueDirectRequest {
+    /**
+     * The wallet\'s credential issuer that signs, as in `issue/init`. Defaults to the draft\'s issuer, or the wallet\'s only one.
+     */
+    'issuerId'?: string;
+    'publish'?: UntpLinkOptions;
+}
+export interface CredentialIssueDirectResult {
+    'credentialId': string;
+    /**
+     * The media type of `raw`, e.g. `application/vc+jwt`.
+     */
+    'mediaType': string;
+    /**
+     * The signed credential.
+     */
+    'raw': string;
+    /**
+     * The public URL of the credential, with `publish`.
+     */
+    'publicUrl'?: string;
+}
 /**
  * Default value of signingKeyIdentifier is DID.
  */
@@ -358,6 +391,12 @@ export interface CredentialPatchPayload {
     'contexts'?: Array<any>;
     'vcdmName'?: string;
     'vcdmDescription'?: string;
+    /**
+     * The credential\'s VCDM `renderMethod` entries (W3C VCDM only): UNTP `RenderTemplate2024` (`type`, `name`, `mediaQuery`, `template`, `url`, `mediaType` `text/html` or `text/plain`, `digestMultibase`, nothing else, and a `template` or an https `url` with a `digestMultibase`) or W3C `TemplateRenderMethod` (`renderSuite` `html`, `card` or `nfc`, `renderProperty` JSON pointers, `template` a `data:` URL or an https URL, with a `digestMultibase` when remote). Other types are kept as given. Replaces the draft\'s render methods; an empty array removes them.
+     */
+    'renderMethod'?: Array<{
+        [key: string]: any;
+    }>;
     /**
      * ID of the credential issuer (`CredentialIssuerDefinition.id`, from the wallet configuration or the trust framework) that issues the draft. When set, the draft can only be queued for issuance by this issuer.
      */
@@ -601,6 +640,76 @@ export declare const DeferredStatusEnum: {
     readonly Error: "error";
 };
 export type DeferredStatusEnum = typeof DeferredStatusEnum[keyof typeof DeferredStatusEnum];
+/**
+ * A change to the wallet\'s DID document.
+ */
+export interface DidDocumentPatch {
+    /**
+     * The subject\'s other identifiers, as absolute URIs. Replaces the current ones; empty removes them.
+     */
+    'alsoKnownAs'?: Array<string>;
+    'addServices'?: Array<DidService>;
+    /**
+     * Ids of the services to remove, as fragments of the DID (without `#`).
+     */
+    'removeServiceIds'?: Array<string>;
+}
+/**
+ * A DID document service (DID Core 1.0 §5.4).
+ */
+export interface DidService {
+    /**
+     * The service id as a fragment of the DID, without `#` (`[A-Za-z0-9:_.-]+`).
+     */
+    'id': string;
+    /**
+     * The service type, e.g. the UNTP link type `https://test.uncefact.org/vocabulary/link-type/dia`.
+     */
+    'type': string;
+    'serviceEndpoint': DidServiceEndpoint;
+}
+/**
+ * @type DidServiceEndpoint
+ * A service endpoint: an absolute URI, a link target, or a set of those. URIs are https, or http for localhost.
+ */
+export type DidServiceEndpoint = Array<DidServiceEndpointOneOfInner> | LinkTarget | string;
+/**
+ * @type DidServiceEndpointOneOfInner
+ */
+export type DidServiceEndpointOneOfInner = LinkTarget | string;
+export interface DidTrustFailure {
+    'subject': string;
+    'source'?: string;
+    /**
+     * Why: e.g. `no recognition found`, `recognition credential invalid`, `invalid digital identity anchor`, `not listed in the recognition credential`, `trust anchor not active`, `trust anchor key mismatch`, `recognition chain too long`, `too many recognition candidates`, `recognition verification budget exhausted`, `register not allowed for the registrar`.
+     */
+    'code': string;
+    'error': string;
+}
+export interface DidTrustPolicyResult {
+    'credentialType': string;
+    /**
+     * False when no policy is configured for the credential type.
+     */
+    'evaluated': boolean;
+    'ok': boolean;
+    'reason'?: string;
+}
+/**
+ * Whether the wallet\'s trust framework trusts a DID, and how it established it.
+ */
+export interface DidVerification {
+    'did': string;
+    'trustFramework': TrustFrameworkType;
+    'trusted': boolean;
+    /**
+     * What did not hold, and why.
+     */
+    'failures': Array<DidTrustFailure>;
+    'policy'?: DidTrustPolicyResult;
+    'untp'?: UntpDia;
+    'verifiedAt': string;
+}
 export interface DocumentSignatureValidity {
     'verificationResult': DocumentSignatureValidityVerificationResultEnum;
     /**
@@ -670,6 +779,36 @@ export interface EbsiSpecificWalletData {
     'proxyUrl'?: string;
     'configuration': EbsiConfiguration;
 }
+export interface EnrollmentInitPayload {
+    'wallet': WalletCreatePayload;
+    /**
+     * Seconds until the enrollment expires; the deployment\'s default (7 days) when unset, at most its maximum (30 days).
+     */
+    'expiresIn'?: number;
+}
+export interface EnrollmentInitResponse {
+    /**
+     * The one-time enrollment state. Hand it to the user who enrolls; it is not shown again.
+     */
+    'state': string;
+    /**
+     * Identifies the enrollment for listing and revoking.
+     */
+    'enrollmentId': string;
+    'tenantId': string;
+    'expiresAt': string;
+}
+export interface EnrollmentListItem {
+    'enrollmentId': string;
+    'walletName': string;
+    'issuerProxyUrl'?: string;
+    /**
+     * The owner id of the Tenant Owner who created it.
+     */
+    'createdBy': string;
+    'createdAt': string;
+    'expiresAt': string;
+}
 /**
  * Prepares to accredit legal entity\'s DID
  */
@@ -895,6 +1034,26 @@ export type InteractionAuthorizationRequirementsRequirementTypeEnum = typeof Int
 export interface IssuanceRequirementsToVerify {
     'verifiedFields': Array<FieldsToVerify>;
 }
+export interface IssuerDetachedJwsSignRequest {
+    /**
+     * The payload to sign, base64url encoded; at most 64 KiB decoded.
+     */
+    'payload': string;
+    /**
+     * The JWS `typ`, one of `issuer.jws.allowedTypes`.
+     */
+    'typ': string;
+}
+export interface IssuerDetachedJwsSignResult {
+    /**
+     * The compact detached JWS, `<protected header>..<signature>`.
+     */
+    'jws': string;
+    /**
+     * The verification method of the wallet\'s DID that signed.
+     */
+    'kid': string;
+}
 export interface IssuerDisplayItem {
     'name'?: string;
     'locale'?: string;
@@ -904,18 +1063,18 @@ export interface IssuerLogo {
     'uri'?: string;
     'alt_text'?: string;
 }
-export interface LinkedVpCreateRequest {
-    'presentationDefinition': PresentationDefinition;
-    'credentialsToPresent': Array<InputDescriptorSuitableCredentials>;
-    'expirationDate'?: string;
-}
-export interface LinkedVpMetadata {
-    'linkedVpId': string;
-    'linkedVpUrl': string;
+/**
+ * A link target (RFC 9264 §4.2) as UNTP uses it for service endpoints. Other members, e.g. `accessRole`, are kept.
+ */
+export interface LinkTarget {
+    [key: string]: any;
+    'href': string;
+    'title'?: string;
     /**
-     * IDs of the credentials presented in the linked VP.
+     * The media type of the target, e.g. `application/vc+jwt`.
      */
-    'presentedCredentials': Array<string>;
+    'type'?: string;
+    'hreflang'?: Array<string>;
 }
 /**
  * Sort flag controls the sort direction by the time created
@@ -1108,6 +1267,42 @@ export interface PresentationResponse {
      */
     'redirectUri'?: string;
 }
+export interface RenderMethodInfo {
+    /**
+     * The index of the method in the credential\'s `renderMethod`.
+     */
+    'index': number;
+    'kind': RenderMethodInfoKindEnum;
+    /**
+     * `template2024` for a `RenderTemplate2024`, the `renderSuite` of a `TemplateRenderMethod`.
+     */
+    'renderSuite'?: string;
+    'name'?: string;
+    'mediaQuery'?: string;
+    /**
+     * The media type the method renders to.
+     */
+    'mediaType'?: string;
+    /**
+     * Whether the wallet can render with the method.
+     */
+    'renderable': boolean;
+}
+export declare const RenderMethodInfoKindEnum: {
+    readonly RenderTemplate2024: "RenderTemplate2024";
+    readonly TemplateRenderMethod: "TemplateRenderMethod";
+    readonly Unknown: "unknown";
+};
+export type RenderMethodInfoKindEnum = typeof RenderMethodInfoKindEnum[keyof typeof RenderMethodInfoKindEnum];
+/**
+ * A render suite; `template2024` is a UNTP `RenderTemplate2024`.
+ */
+export declare const RenderSuite: {
+    readonly Html: "html";
+    readonly Card: "card";
+    readonly Template2024: "template2024";
+};
+export type RenderSuite = typeof RenderSuite[keyof typeof RenderSuite];
 /**
  * Info needed to revoke legal entity\'s DID
  */
@@ -1148,6 +1343,19 @@ export declare const SystemImpactStatusEnum: {
     readonly Critical: "critical";
 };
 export type SystemImpactStatusEnum = typeof SystemImpactStatusEnum[keyof typeof SystemImpactStatusEnum];
+/**
+ * The part of the wallet config that belongs to the wallet\'s tenant. A wallet joins a tenant only by enrollment, and only a Tenant Owner of that tenant changes this block, through PATCH /wallets/{wallet_id}. It is ignored on wallet create and, for anyone else, on wallet patch.
+ */
+export interface TenantConfig {
+    /**
+     * The tenant the wallet belongs to. It never changes.
+     */
+    'tenantId'?: string;
+    /**
+     * The issuer proxy the wallet\'s clients use: an absolute URL, https when the deployment runs with production=true. An empty string clears it. Not declared as format uri, which rejects the empty string; the wallet validates any other value and answers 400 when it is not such a URL.
+     */
+    'issuerProxyUrl'?: string;
+}
 /**
  * A transaction_data object (OpenID4VP 1.0 §5.1). Type-specific fields are kept as given.
  */
@@ -1157,13 +1365,14 @@ export interface TransactionData {
     'credential_ids': Array<string>;
 }
 /**
- * What trust framework should we use with this wallet. This property COULD NOT change later. Supported frameworks: EBSI - the European Blockchain Services Infrastructure, IDTL - IDUnion Trust List, EUDI - European Digital Identity wallet, Noop - personal key based no-op trust framework (mainly for the personal use)
+ * What trust framework should we use with this wallet. This property COULD NOT change later. Supported frameworks: EBSI - the European Blockchain Services Infrastructure, IDTL - IDUnion Trust List, EUDI - European Digital Identity wallet, Noop - personal key based no-op trust framework (mainly for the personal use), UNTP - UN Transparency Protocol: a self-hosted did:web, and every DID the wallet resolves a key of must be anchored by a Digital Identity Anchor of a trusted registrar.
  */
 export declare const TrustFrameworkType: {
     readonly Ebsi: "EBSI";
     readonly Idtl: "IDTL";
     readonly Noop: "NOOP";
     readonly Eudi: "EUDI";
+    readonly Untp: "UNTP";
 };
 export type TrustFrameworkType = typeof TrustFrameworkType[keyof typeof TrustFrameworkType];
 export interface TrustListAddRequest {
@@ -1206,6 +1415,263 @@ export interface TrustListSource {
 export interface TrustListsResponse {
     'trust_lists': Array<TrustListSource>;
 }
+/**
+ * Configuration of the UNTP trust framework. The wallet has a self-hosted did:web, and its `walletKeyIdentifier` must be `did`. Every DID it resolves a key of, to verify a credential, a status list or a presentation, must be anchored by a UNTP Digital Identity Anchor chained up to a trusted registrar: those of `untp.dia.trustedRegistrars` and `untp.dia.registryUrl`, and the wallet\'s own `trustedRegistrars`.
+ */
+export interface UntpConfiguration {
+    /**
+     * Whether the wallet holds a DIA of its own.
+     */
+    'isOnboarded': boolean;
+    /**
+     * A `registrar` issues DIAs (to come); a `member` is anchored by one.
+     */
+    'role'?: UntpConfigurationRoleEnum;
+    /**
+     * Registrars this wallet trusts besides the deployment\'s; they take precedence.
+     */
+    'trustedRegistrars'?: Array<UntpRegistrarConfig>;
+    /**
+     * What `/verifier/did` requires of the issuers of a credential type; replaces the deployment\'s.
+     */
+    'issuerPolicy'?: Array<UntpIssuerPolicy>;
+}
+export declare const UntpConfigurationRoleEnum: {
+    readonly Member: "member";
+    readonly Registrar: "registrar";
+};
+export type UntpConfigurationRoleEnum = typeof UntpConfigurationRoleEnum[keyof typeof UntpConfigurationRoleEnum];
+/**
+ * How a UNTP wallet anchored a DID.
+ */
+export interface UntpDia {
+    'registrar'?: UntpRegistrar;
+    /**
+     * The registrations of the DID\'s own DIA.
+     */
+    'registrations'?: Array<UntpRegistration>;
+    /**
+     * The DIAs from the DID\'s own up to the one a trusted registrar issued.
+     */
+    'chain': Array<UntpRecognition>;
+}
+export interface UntpFailure {
+    'linkType': string;
+    'href': string;
+    /**
+     * Why the credential failed: `fetch_failed`, `unsupported_media_type`, `too_large`, `too_many_links`, `format_unsupported`, `signature_invalid`, `issuer_key_unresolvable`, `trust_chain_failed`, `expired`, `not_yet_valid`, `revoked`, `suspended`, `status_check_failed`, `schema_invalid`, `schema_unavailable`, `jsonld_invalid` or `unknown`.
+     */
+    'code': string;
+    'error': string;
+}
+/**
+ * A linked credential, verified (`credential`) or failed (`error` and `errorCode`).
+ */
+export interface UntpFetchedCredential {
+    'linkType': string;
+    'href': string;
+    'credential'?: CredentialWrapper;
+    'error'?: string;
+    'errorCode'?: string;
+}
+export interface UntpIdentifier {
+    /**
+     * The kind of identifier; only `did` is resolved.
+     */
+    'kind': string;
+    'canonical': string;
+}
+/**
+ * What a verifier requires of the issuers of a credential type.
+ */
+export interface UntpIssuerPolicy {
+    'credentialType': string;
+    'requireDia'?: boolean;
+    'allowedRegisterTypes'?: Array<string>;
+    /**
+     * Recognition scope URIs the issuer must hold, at every level of its chain.
+     */
+    'requiredScopes'?: Array<string>;
+    'requireAuthoritativeRegistrar'?: boolean;
+    'requireRegisterMandate'?: boolean;
+}
+/**
+ * A credential published as a UNTP link.
+ */
+export interface UntpLink {
+    /**
+     * The id of the DID document service, `<did>#<fragment>`.
+     */
+    'serviceId': string;
+    /**
+     * The public URL of the credential.
+     */
+    'href': string;
+    'linkType': string;
+    'title'?: string;
+    'credentialId': string;
+}
+/**
+ * How to publish a credential as a UNTP link.
+ */
+export interface UntpLinkOptions {
+    /**
+     * The UNTP link type, e.g. `dpp`.
+     */
+    'linkType': string;
+    'title'?: string;
+    'hreflang'?: Array<string>;
+}
+export interface UntpLinkPublishRequest {
+    'credentialId': string;
+    /**
+     * The UNTP link type: `dpp`, `dcc`, `dfr`, `dte`, `dia` or `dcr`, its UNTP 0.8.0 IRI (`https://test.uncefact.org/vocabulary/link-type/dia`) or its UNTP 0.7 alias (`untp:dia`). The DID service is published with the 0.8.0 value, the IRI for every type but `dpp`.
+     */
+    'linkType': string;
+    /**
+     * The title of the link. Defaults to the link type\'s, e.g. `Digital Product Passport`.
+     */
+    'title'?: string;
+    /**
+     * The languages of the credential. Defaults to `[\"en\"]`.
+     */
+    'hreflang'?: Array<string>;
+}
+/**
+ * One DIA of a recognition chain.
+ */
+export interface UntpRecognition {
+    'subject': string;
+    'issuer': string;
+    /**
+     * Where the DIA was found.
+     */
+    'source'?: string;
+    'credentialId'?: string;
+    'types'?: Array<string>;
+    'validFrom'?: string;
+    'validUntil'?: string;
+    /**
+     * The W3C RecognizedEntity, every property as the DIA has it.
+     */
+    'entity': {
+        [key: string]: any;
+    };
+}
+/**
+ * What a registrar recognizes, as a definition it publishes.
+ */
+export interface UntpRecognitionScope {
+    'id': string;
+    'name'?: string;
+}
+/**
+ * The register that holds a registration.
+ */
+export interface UntpRegister {
+    'id': string;
+    'name'?: string;
+    'registerType': string;
+}
+/**
+ * A registrar trusted to issue Digital Identity Anchors, modelled on the UN GRID entry.
+ */
+export interface UntpRegistrar {
+    'did': string;
+    'name'?: string;
+    'domain'?: string;
+    'registers'?: Array<string>;
+    'registerTypes'?: Array<string>;
+    'jurisdiction'?: string;
+    'authoritative'?: boolean;
+    'gridReference'?: string;
+    'status'?: string;
+}
+/**
+ * A registrar trusted to issue Digital Identity Anchors, modelled on the UN GRID entry.
+ */
+export interface UntpRegistrarConfig {
+    'did': string;
+    'name'?: string;
+    /**
+     * The host a did:web registrar DID must have.
+     */
+    'domain'?: string;
+    /**
+     * The registers it maintains; a DIA it issues must name one.
+     */
+    'registers'?: Array<string>;
+    /**
+     * The register types its DIAs may have.
+     */
+    'registerTypes'?: Array<string>;
+    'jurisdiction'?: string;
+    /**
+     * A GRID-listed sovereign register.
+     */
+    'authoritative'?: boolean;
+    'gridReference'?: string;
+    'status'?: UntpRegistrarConfigStatusEnum;
+    /**
+     * The only JWKs its signatures may be made with.
+     */
+    'publicKeys'?: Array<{
+        [key: string]: any;
+    }>;
+}
+export declare const UntpRegistrarConfigStatusEnum: {
+    readonly Active: "Active";
+    readonly Suspended: "Suspended";
+    readonly KeyCompromised: "KeyCompromised";
+};
+export type UntpRegistrarConfigStatusEnum = typeof UntpRegistrarConfigStatusEnum[keyof typeof UntpRegistrarConfigStatusEnum];
+/**
+ * A UNTP RegisteredIdentity of a DIA.
+ */
+export interface UntpRegistration {
+    'id'?: string;
+    'registeredId': string;
+    'registeredName'?: string;
+    'registeredDate'?: string;
+    'register': UntpRegister;
+    'controlType'?: string;
+    'recognitionScope'?: Array<UntpRecognitionScope>;
+}
+export interface UntpRegistry {
+    'registrars': Array<UntpRegistrar>;
+    'self': UntpRegistrySelf;
+}
+export interface UntpRegistrySelf {
+    'did'?: string;
+    'listed': boolean;
+    'authoritative'?: boolean;
+    'status'?: string;
+}
+export interface UntpResolveResult {
+    'identifier': UntpIdentifier;
+    'anchor': string;
+    /**
+     * The RFC 9264 linkset of the identifier\'s UNTP links.
+     */
+    'linkset': {
+        [key: string]: any;
+    };
+    'verification'?: UntpVerification;
+    'credentials'?: Array<UntpFetchedCredential>;
+    'issuer'?: DidVerification;
+}
+/**
+ * The verdict over every fetched credential, present with `fetch`.
+ */
+export interface UntpVerification {
+    /**
+     * True only when at least one credential was fetched and every fetched credential verified.
+     */
+    'ok': boolean;
+    'fetched': number;
+    'verified': number;
+    'failed': Array<UntpFailure>;
+}
 export interface VPDrivenIssuerConfig {
     /**
      * ID of the verifier used for verification of presented credential.
@@ -1258,13 +1724,6 @@ export declare const VcdmVersion: {
     readonly _20: "2.0";
 };
 export type VcdmVersion = typeof VcdmVersion[keyof typeof VcdmVersion];
-export interface VerifiedLinkedVp {
-    'linkedVpId': string;
-    /**
-     * List of verified credentials. Raw signed credentials (`signedVc`) are not available for this endpoint due to response size.
-     */
-    'credentials': Array<CredentialWrapper>;
-}
 /**
  * Wrapped result of successful verification interaction.
  */
@@ -1279,6 +1738,83 @@ export interface VerifiedWrapper {
      */
     'holder': string;
 }
+export interface VerifierCredentialCheck {
+    /**
+     * `fetch`, `signature`, `validity`, `jsonld`, `status`, `schema` or `issuerTrust`.
+     */
+    'name': string;
+    'ok': boolean;
+    /**
+     * Why it failed, as in `UntpFailure.code`.
+     */
+    'code'?: string;
+    'message'?: string;
+}
+/**
+ * The checks to run besides the signature and validity dates; each is on unless set false.
+ */
+export interface VerifierCredentialChecks {
+    'schema'?: boolean;
+    'jsonld'?: boolean;
+    'status'?: boolean;
+    'issuerTrust'?: boolean;
+}
+/**
+ * The credential to verify, `raw` or `url`.
+ */
+export interface VerifierCredentialRequest {
+    /**
+     * The credential as received, e.g. a JWS.
+     */
+    'raw'?: string;
+    /**
+     * Where to fetch the credential.
+     */
+    'url'?: string;
+    'checks'?: VerifierCredentialChecks;
+}
+export interface VerifierCredentialResult {
+    /**
+     * True when every check passed.
+     */
+    'verified': boolean;
+    /**
+     * The credential format, e.g. `jwt_vc_vcdm`; empty when it did not parse.
+     */
+    'format'?: string;
+    'issuer'?: string;
+    'checks': Array<VerifierCredentialCheck>;
+    /**
+     * The credential document, when it parsed.
+     */
+    'payload'?: {
+        [key: string]: any;
+    };
+}
+/**
+ * A credential to render, `signedVc` or `vc`, and which of its render methods to use.
+ */
+export interface VerifierRenderRequest {
+    /**
+     * A signed credential (compact JWS, SD-JWT), verified before it is rendered.
+     */
+    'signedVc'?: string;
+    /**
+     * A credential document, rendered without verification.
+     */
+    'vc'?: {
+        [key: string]: any;
+    };
+    /**
+     * The index of the render method to use.
+     */
+    'index'?: number;
+    'suite'?: RenderSuite;
+    /**
+     * Use the first render method with exactly this `mediaQuery`.
+     */
+    'mediaQuery'?: string;
+}
 /**
  * Registers a new verification request. When `createUrl` is true, URL used by holder to present credentials to a verifier is created. Otherwise, the holder can use the verifier authorization endpoint with a custom scope to request credentials. In this case `holderEntityId` must be provided.
  */
@@ -1394,12 +1930,14 @@ export interface WalletConfig {
     'EBSI'?: EbsiSpecificWalletData;
     'EUDI'?: EudiConfiguration;
     'IDTL'?: IdtlConfiguration;
+    'UNTP'?: UntpConfiguration;
     'walletKeyIdentifier': SigningKeyIdentifier;
     'vaultType'?: VaultType;
     /**
      * Expiration time in seconds for credential status lists. Used only if the wallet is a credential issuer
      */
     'statusListExpiration'?: number;
+    'tenant'?: TenantConfig;
 }
 /**
  * Payload to create a wallet
@@ -1427,6 +1965,10 @@ export interface WalletListItem {
     'walletId': string;
     'name': string;
     'capabilities': Array<WalletCapability>;
+    /**
+     * The owner of the wallet. Set only when listing the wallets of a tenant.
+     */
+    'ownerId'?: string;
 }
 export interface WalletNotification {
     /**
@@ -1814,6 +2356,16 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     credentialIssuanceInit: (credentialId: string, walletId: string, credentialIssuanceInit?: CredentialIssuanceInit, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Issues a W3C VCDM draft as a credential of the wallet itself, with no holder and no OID4VCI: for a credential that is published rather than handed to anyone, such as a UNTP Digital Product Passport (EN 18246 Annex B.5). The credential gets the wallet\'s status list entry and envelope, and is stored issued on the same record. With `publish`, it is then published as a UNTP link, like `POST /untp/links`; if that fails the response is `502` with the issued `credentialId`, and publishing is retried with `POST /untp/links`.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {CredentialIssueDirectRequest} [credentialIssueDirectRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialIssueDirect: (credentialId: string, walletId: string, idempotencyKey?: string, credentialIssueDirectRequest?: CredentialIssueDirectRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Retrieves a list of credentials.
      * @param {string} walletId
@@ -1866,6 +2418,25 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     credentialRawGet: (credentialId: string, walletId: string, disclosedClaims?: Array<string>, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Renders a W3C VCDM credential of the wallet with one of its `renderMethod` entries, as `POST /verifier/render` does. HTML is served with a `Content-Security-Policy` that sandboxes it.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {number} [index] The index of the render method to use, in the credential\&#39;s &#x60;renderMethod&#x60;.
+     * @param {RenderSuite} [suite] Use the first render method of this suite.
+     * @param {string} [mediaQuery] Use the first render method with exactly this &#x60;mediaQuery&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRender: (credentialId: string, walletId: string, index?: number, suite?: RenderSuite, mediaQuery?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Lists the render methods of a W3C VCDM credential of the wallet, for a client to pick one by its media query: media queries are not evaluated by the wallet.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRenderMethods: (credentialId: string, walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Requests a credential issuance from the issuer and retrieves requirements for holder authorization.
      * @param {string} walletId
@@ -1875,13 +2446,14 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      */
     credentialRequestInit: (walletId: string, credentialRequest?: CredentialRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Revoke a specific Verifiable Credential
+     * Revoke a specific Verifiable Credential. A credential published as a UNTP link stays published: a verifier following its link finds it and verifies it as revoked. `DELETE /untp/links/{service_id}` unpublishes it.
      * @param {string} credentialId Verifiable Credential Identifier
      * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    credentialRevoke: (credentialId: string, walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    credentialRevoke: (credentialId: string, walletId: string, idempotencyKey?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Suspend a Verifiable Credential issued with the `suspension` status purpose (W3C Bitstring Status List v1.0). A suspension can be lifted with `DELETE`.
      * @param {string} credentialId Verifiable Credential Identifier
@@ -1913,6 +2485,21 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     didDocumentGet: (walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Returns the wallet\'s own DID document, as published at `/{wallet_id}/did.json` for a self-hosted did:web.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentLocalGet: (walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Changes the wallet\'s DID document: removes the services in `removeServiceIds`, adds the services in `addServices` (a service with the same id is replaced), and, when `alsoKnownAs` is set, replaces the subject\'s other identifiers (an empty list removes them). UNTP identifies an entity\'s Digital Identity Anchor with a service of type `https://test.uncefact.org/vocabulary/link-type/dia` (`untp:dia` in UNTP 0.7) and registered identifiers with `alsoKnownAs`.  Only a self-hosted did:web document can be changed; services of an EBSI DID are written to the EBSI DID registry, which does not take `alsoKnownAs`.
+     * @param {string} walletId
+     * @param {DidDocumentPatch} didDocumentPatch
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentPatch: (walletId: string, didDocumentPatch: DidDocumentPatch, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Checks the health status of the service and its subsystems (database, storage, etc.). Used by load balancers and monitoring systems.
      * @param {*} [options] Override http request option.
@@ -1944,37 +2531,6 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     holderIdTokenSend: (walletId: string, idTokenSendRequest?: IdTokenSendRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Creates a new public Linked VP of specified credentials and adds it to the wallet\'s DID document
-     * @param {string} walletId
-     * @param {LinkedVpCreateRequest} [linkedVpCreateRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpCreate: (walletId: string, linkedVpCreateRequest?: LinkedVpCreateRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Deletes a linked VP
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpDelete: (walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Returns metadata and content of a specific linked Verifiable Presentation, including the credentials it contains and its DID document service entry URL.
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpGetDetails: (walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Returns all linked Verifiable Presentations published in the wallet\'s DID document,
-     * @param {string} walletId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpList: (walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Processes a credential offer URL (received from an issuer via QR code, deep link, or WMP) and returns what authorization is required to accept it - pin, credential presentation or a redirect to custom authorization flow. holder needs to present to the issuer, along with matching candidates from the wallet. The returned `interactionId` is used in the subsequent `HolderOfferProcessAfterConsent` call.
      * @param {string} walletId
@@ -2014,6 +2570,15 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     issuerCredentialTypesList: (url: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Signs an opaque payload, such as an audit log entry, with the wallet\'s DID key, as a compact detached JWS with an unencoded payload (RFC 7515 Appendix F, RFC 7797: `b64: false`, `crit: [\"b64\"]`): `<protected header>..<signature>`. The signature is verified offline against the key in the wallet\'s DID document, with the payload put back. `typ` must be one the deployment allows, which no credential or presentation verifier accepts, so a signature from here never passes as a credential.
+     * @param {string} walletId
+     * @param {IssuerDetachedJwsSignRequest} issuerDetachedJwsSignRequest
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    issuerDetachedJwsSign: (walletId: string, issuerDetachedJwsSignRequest: IssuerDetachedJwsSignRequest, idempotencyKey?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Generates an authorized credential offer URL for the holder to initiate the credential issuance flow. The resulting offer URL is typically presented as a QR code or deep link. If `wmpEntityId` is provided, the offer is delivered directly via WMP and 204 is returned.
      * @param {string} walletId
@@ -2073,6 +2638,37 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     pdfCredentialTwinUpload: (credentialId: string, walletId: string, pdf?: File, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Creates a wallet for the caller from a pending enrollment, in the tenant. A state can be used once. A caller whose token names another tenant is refused.
+     * @param {string} tenantId
+     * @param {string} state The enrollment state from TenantEnrollmentInit.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentEnroll: (tenantId: string, state: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Prepares a wallet for the tenant and returns a one-time enrollment state. Whoever presents the state to POST /tenant/{tenant_id}/enrollment/{state} gets a wallet created from the payload, in the tenant. Only a Tenant Owner of the tenant may call it. The payload is validated now; a tenantId it carries is ignored. The state is returned only here: the wallet keeps only its hash, which is the enrollment id.
+     * @param {string} tenantId
+     * @param {EnrollmentInitPayload} enrollmentInitPayload
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentInit: (tenantId: string, enrollmentInitPayload: EnrollmentInitPayload, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Lists the tenant\'s pending enrollments, oldest first. Only a Tenant Owner of the tenant may.
+     * @param {string} tenantId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentList: (tenantId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Revokes a pending enrollment, so that its state no longer creates a wallet.
+     * @param {string} tenantId
+     * @param {string} enrollmentId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentRevoke: (tenantId: string, enrollmentId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Accredits a legal entity as RTAO (Root Trust Anchor Organisation), TAO (Trust Anchor Organisation), or TI (Trusted Issuer) within the trust framework hierarchy by issuing the appropriate accreditation credential to their DID.
      * @param {string} walletId
@@ -2173,21 +2769,60 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      */
     trustListsGet: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
+     * Removes a UNTP link from the wallet\'s DID document and stops serving its credential.
      * @param {string} walletId
-     * @param {VerifyInitRequest} [verifyInitRequest]
+     * @param {string} serviceId The service id of the link, in full (&#x60;&lt;did&gt;#&lt;fragment&gt;&#x60;) or as its fragment.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierInitUrlCreate: (walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    untpLinkDelete: (walletId: string, serviceId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * The UNTP links the wallet\'s DID document advertises for its published credentials.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkList: (walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Publishes an issued, valid W3C VCDM credential as a UNTP link: it is served at its public URL (`/api/v1/{wallet_id}/vc/{credential_id}`) and the wallet\'s DID document gets a service of the link type, whose endpoint is a link target to that URL. Publishing a credential again as the same link type returns the existing link. The wallet\'s DID document must be one it hosts (a self-hosted did:web, or an EBSI DID).
+     * @param {string} walletId
+     * @param {UntpLinkPublishRequest} untpLinkPublishRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkPublish: (walletId: string, untpLinkPublishRequest: UntpLinkPublishRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Fetches linked presentations from DID document and verifies them.
+     * Lists the registrars the wallet trusts to issue Digital Identity Anchors, and whether the wallet\'s own DID is one of them.
      * @param {string} walletId
-     * @param {string} did
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierLinkedVpVerify: (walletId: string, did: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    untpRegistryList: (walletId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Verifies a credential, given raw or by URL, with the wallet\'s trust framework, and reports each check: the signature (with the key the issuer\'s identifier resolves to), the validity dates, and, unless turned off, the JSON-LD document (W3C VCDM 2.0), the status, the schema and the issuer\'s trust. A credential that fails is still `200`, with `verified: false`; `code` reuses the error codes of `/verifier/untp/resolve`.  A `url` must be https, and is never fetched from a private, loopback or link-local address, so a localhost URL is refused too. It is fetched within 10 s, 5 MiB and 3 redirects on the same host, and only as a credential media type.
+     * @param {string} walletId
+     * @param {VerifierCredentialRequest} verifierCredentialRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierCredentialVerify: (walletId: string, verifierCredentialRequest: VerifierCredentialRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Verifies whether the wallet\'s trust framework trusts a DID, beyond resolving its key.  A UNTP wallet requires a Digital Identity Anchor (UNTP 0.8.0, a profile of W3C Recognized Entities): the DID\'s DIA, found through its DID document\'s `https://test.uncefact.org/vocabulary/link-type/dia` service (or `untp:dia`), or a W3C `WhoisService`, is verified (signature, validity, status, the UNTP profile) and chained up, DIA by DIA, to a registrar the wallet trusts: its own (`UNTP.trustedRegistrars`), then the deployment\'s (`untp.dia.trustedRegistrars`, `untp.dia.registryUrl`). A registrar is itself trusted without a DIA. The details are in `untp`.  A DID that is not trusted is still `200`, with `trusted: false` and the reasons in `failures`. With `credentialType`, the issuer policy for that credential type is evaluated too. A wallet whose trust framework does not verify DIDs is `422`.
+     * @param {string} walletId
+     * @param {string} did The DID to verify.
+     * @param {string} [credentialType] Evaluate the issuer policy of this credential type, e.g. &#x60;DigitalProductPassport&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierDidVerify: (walletId: string, did: string, credentialType?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
+     * @param {string} walletId
+     * @param {VerifyInitRequest} [verifyInitRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierInitUrlCreate: (walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Verifies the signatures of uploaded PDF and extracts and verifies VP in the PDF document Maximum size of the PDF document is 50 MB.
      * @param {string} walletId
@@ -2200,6 +2835,26 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     verifierPdfVerify: (walletId: string, extractVp: boolean, pdf?: File, trustedCertificates?: Array<string>, trustedListsUrl?: Array<string>, trustedListSigningCertificates?: Array<string>, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Renders a credential for a human with one of its `renderMethod` entries: a UNTP `RenderTemplate2024` (Handlebars, the output in its `mediaType`: `text/html`, the default, or `text/plain`) or a W3C `TemplateRenderMethod` of the `html` suite (a wrapper document to show in an `iframe` with `sandbox=\"allow-scripts\"` and `srcdoc`) or the `card` suite (a JSON card). By default the first method that can be rendered is used.  A `signedVc` is verified (its signature, validity and status) before it is rendered, and `X-Credential-Verified` is `true`; one that fails is `422`. A `vc` is a credential document rendered as it is, with `X-Credential-Verified: false`.  A credential with no render method that matches, or a method that cannot be rendered (`nfc`, a template of another `mediaType`, or an unknown type), is `422` with `no render method` or `render suite unsupported`; an invalid one is `422` with `invalid render method`, a template that cannot be fetched or does not match its digest `render template unavailable`, and one that fails or runs too long `render failed`.  A remote template is fetched over https only, within 5 s and 1 MiB, and must match its `digestMultibase`. Rendering stops after 2 s or 1 MiB of output. A template that runs on past that still counts against the renderings the wallet runs at once (`render.maxConcurrent`); when none is free, the response is `503`.
+     * @param {string} walletId
+     * @param {VerifierRenderRequest} verifierRenderRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierRender: (walletId: string, verifierRenderRequest: VerifierRenderRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Resolves a DID into the RFC 9264 linkset of the UNTP links its DID document advertises and, with `fetch`, fetches the linked credentials and verifies them. A credential that fails is reported in `credentials` and `verification.failed`, with the response still 200: `verification.ok` is the verdict.
+     * @param {string} walletId
+     * @param {string} identifier The DID to resolve.
+     * @param {string} [linkType] The link types to fetch, comma separated (e.g. &#x60;dpp,dcc&#x60;), or &#x60;all&#x60; (the default). The linkset uses the UNTP 0.8.0 relations: &#x60;dpp&#x60;, &#x60;linkset&#x60; for an identity resolver, and &#x60;https://test.uncefact.org/vocabulary/link-type/&lt;type&gt;&#x60; for the others. A DID document\&#39;s UNTP 0.7 service types (&#x60;untp:dia&#x60;, bare &#x60;dcc&#x60;) are read as the same link types.
+     * @param {boolean} [fetch] Fetch and verify the linked credentials.
+     * @param {boolean} [verify] Verify the fetched credentials\&#39; dates, status and schema, besides their signature.
+     * @param {boolean} [verifyIssuer] Also verify whether the wallet\&#39;s trust framework trusts the DID, as &#x60;/verifier/did&#x60; does, and report it as &#x60;issuer&#x60;. A wallet whose trust framework does not verify DIDs reports no &#x60;issuer&#x60;, and is &#x60;422&#x60; when &#x60;verifyIssuer&#x60; is set explicitly. A UNTP wallet enforces the anchor on every signature anyway; this reports it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierUntpResolve: (walletId: string, identifier: string, linkType?: string, fetch?: boolean, verify?: boolean, verifyIssuer?: boolean, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Creates a new wallet for the authenticated client.
      * @param {WalletCreatePayload} [walletCreatePayload]
@@ -2239,10 +2894,11 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * Provides list of wallets owned by the authenticated client, sorted by wallet name in byte order (Unicode code point order of the UTF-8 name, so upper case sorts before lower case). Wallets with the same name are in the order they were created.
      * @param {string} [ownerId]
      * @param {string} [searchName] Wallet name to search using \&quot;begins-with\&quot; filter
+     * @param {string} [tenantId] Lists the wallets of every owner in this tenant instead, each with its ownerId. Only a Tenant Owner of the tenant may set it, and not together with ownerId.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    walletList: (ownerId?: string, searchName?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    walletList: (ownerId?: string, searchName?: string, tenantId?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Gets a specific notification by state
      * @param {string} walletId Wallet ID
@@ -2275,7 +2931,7 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      */
     walletNotifications: (walletId: string, eventType?: string, state?: string, lastEventID?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Update wallet metadata and configuration.
+     * Update wallet metadata and configuration.  The owner of the wallet patches its name, config and metadata; `config.tenant` is ignored for them. A Tenant Owner of the wallet\'s tenant patches `config.tenant.issuerProxyUrl`, also of wallets of other owners, and for those every other field of the body is ignored. `config.tenant.tenantId` never changes.
      * @param {string} walletId
      * @param {WalletPatchPayload} [walletPatchPayload]
      * @param {*} [options] Override http request option.
@@ -2496,6 +3152,16 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     credentialIssuanceInit(credentialId: string, walletId: string, credentialIssuanceInit?: CredentialIssuanceInit, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<CredentialIssuanceInitResult>>;
+    /**
+     * Issues a W3C VCDM draft as a credential of the wallet itself, with no holder and no OID4VCI: for a credential that is published rather than handed to anyone, such as a UNTP Digital Product Passport (EN 18246 Annex B.5). The credential gets the wallet\'s status list entry and envelope, and is stored issued on the same record. With `publish`, it is then published as a UNTP link, like `POST /untp/links`; if that fails the response is `502` with the issued `credentialId`, and publishing is retried with `POST /untp/links`.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {CredentialIssueDirectRequest} [credentialIssueDirectRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialIssueDirect(credentialId: string, walletId: string, idempotencyKey?: string, credentialIssueDirectRequest?: CredentialIssueDirectRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<CredentialIssueDirectResult>>;
     /**
      * Retrieves a list of credentials.
      * @param {string} walletId
@@ -2548,6 +3214,25 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     credentialRawGet(credentialId: string, walletId: string, disclosedClaims?: Array<string>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<string>>;
+    /**
+     * Renders a W3C VCDM credential of the wallet with one of its `renderMethod` entries, as `POST /verifier/render` does. HTML is served with a `Content-Security-Policy` that sandboxes it.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {number} [index] The index of the render method to use, in the credential\&#39;s &#x60;renderMethod&#x60;.
+     * @param {RenderSuite} [suite] Use the first render method of this suite.
+     * @param {string} [mediaQuery] Use the first render method with exactly this &#x60;mediaQuery&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRender(credentialId: string, walletId: string, index?: number, suite?: RenderSuite, mediaQuery?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<File>>;
+    /**
+     * Lists the render methods of a W3C VCDM credential of the wallet, for a client to pick one by its media query: media queries are not evaluated by the wallet.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRenderMethods(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<RenderMethodInfo>>>;
     /**
      * Requests a credential issuance from the issuer and retrieves requirements for holder authorization.
      * @param {string} walletId
@@ -2557,13 +3242,14 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      */
     credentialRequestInit(walletId: string, credentialRequest?: CredentialRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<string>>>;
     /**
-     * Revoke a specific Verifiable Credential
+     * Revoke a specific Verifiable Credential. A credential published as a UNTP link stays published: a verifier following its link finds it and verifies it as revoked. `DELETE /untp/links/{service_id}` unpublishes it.
      * @param {string} credentialId Verifiable Credential Identifier
      * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    credentialRevoke(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    credentialRevoke(credentialId: string, walletId: string, idempotencyKey?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Suspend a Verifiable Credential issued with the `suspension` status purpose (W3C Bitstring Status List v1.0). A suspension can be lifted with `DELETE`.
      * @param {string} credentialId Verifiable Credential Identifier
@@ -2595,6 +3281,25 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     didDocumentGet(walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<object>>;
+    /**
+     * Returns the wallet\'s own DID document, as published at `/{wallet_id}/did.json` for a self-hosted did:web.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentLocalGet(walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Changes the wallet\'s DID document: removes the services in `removeServiceIds`, adds the services in `addServices` (a service with the same id is replaced), and, when `alsoKnownAs` is set, replaces the subject\'s other identifiers (an empty list removes them). UNTP identifies an entity\'s Digital Identity Anchor with a service of type `https://test.uncefact.org/vocabulary/link-type/dia` (`untp:dia` in UNTP 0.7) and registered identifiers with `alsoKnownAs`.  Only a self-hosted did:web document can be changed; services of an EBSI DID are written to the EBSI DID registry, which does not take `alsoKnownAs`.
+     * @param {string} walletId
+     * @param {DidDocumentPatch} didDocumentPatch
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentPatch(walletId: string, didDocumentPatch: DidDocumentPatch, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<{
+        [key: string]: any;
+    }>>;
     /**
      * Checks the health status of the service and its subsystems (database, storage, etc.). Used by load balancers and monitoring systems.
      * @param {*} [options] Override http request option.
@@ -2626,37 +3331,6 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     holderIdTokenSend(walletId: string, idTokenSendRequest?: IdTokenSendRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<PresentationResponse>>;
-    /**
-     * Creates a new public Linked VP of specified credentials and adds it to the wallet\'s DID document
-     * @param {string} walletId
-     * @param {LinkedVpCreateRequest} [linkedVpCreateRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpCreate(walletId: string, linkedVpCreateRequest?: LinkedVpCreateRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LinkedVpMetadata>>;
-    /**
-     * Deletes a linked VP
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpDelete(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Returns metadata and content of a specific linked Verifiable Presentation, including the credentials it contains and its DID document service entry URL.
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpGetDetails(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LinkedVpMetadata>>;
-    /**
-     * Returns all linked Verifiable Presentations published in the wallet\'s DID document,
-     * @param {string} walletId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpList(walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<LinkedVpMetadata>>>;
     /**
      * Processes a credential offer URL (received from an issuer via QR code, deep link, or WMP) and returns what authorization is required to accept it - pin, credential presentation or a redirect to custom authorization flow. holder needs to present to the issuer, along with matching candidates from the wallet. The returned `interactionId` is used in the subsequent `HolderOfferProcessAfterConsent` call.
      * @param {string} walletId
@@ -2696,6 +3370,15 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     issuerCredentialTypesList(url: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<CredentialType>>>;
+    /**
+     * Signs an opaque payload, such as an audit log entry, with the wallet\'s DID key, as a compact detached JWS with an unencoded payload (RFC 7515 Appendix F, RFC 7797: `b64: false`, `crit: [\"b64\"]`): `<protected header>..<signature>`. The signature is verified offline against the key in the wallet\'s DID document, with the payload put back. `typ` must be one the deployment allows, which no credential or presentation verifier accepts, so a signature from here never passes as a credential.
+     * @param {string} walletId
+     * @param {IssuerDetachedJwsSignRequest} issuerDetachedJwsSignRequest
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    issuerDetachedJwsSign(walletId: string, issuerDetachedJwsSignRequest: IssuerDetachedJwsSignRequest, idempotencyKey?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IssuerDetachedJwsSignResult>>;
     /**
      * Generates an authorized credential offer URL for the holder to initiate the credential issuance flow. The resulting offer URL is typically presented as a QR code or deep link. If `wmpEntityId` is provided, the offer is delivered directly via WMP and 204 is returned.
      * @param {string} walletId
@@ -2755,6 +3438,37 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     pdfCredentialTwinUpload(credentialId: string, walletId: string, pdf?: File, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Creates a wallet for the caller from a pending enrollment, in the tenant. A state can be used once. A caller whose token names another tenant is refused.
+     * @param {string} tenantId
+     * @param {string} state The enrollment state from TenantEnrollmentInit.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentEnroll(tenantId: string, state: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<WalletIdObject>>;
+    /**
+     * Prepares a wallet for the tenant and returns a one-time enrollment state. Whoever presents the state to POST /tenant/{tenant_id}/enrollment/{state} gets a wallet created from the payload, in the tenant. Only a Tenant Owner of the tenant may call it. The payload is validated now; a tenantId it carries is ignored. The state is returned only here: the wallet keeps only its hash, which is the enrollment id.
+     * @param {string} tenantId
+     * @param {EnrollmentInitPayload} enrollmentInitPayload
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentInit(tenantId: string, enrollmentInitPayload: EnrollmentInitPayload, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<EnrollmentInitResponse>>;
+    /**
+     * Lists the tenant\'s pending enrollments, oldest first. Only a Tenant Owner of the tenant may.
+     * @param {string} tenantId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentList(tenantId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<EnrollmentListItem>>>;
+    /**
+     * Revokes a pending enrollment, so that its state no longer creates a wallet.
+     * @param {string} tenantId
+     * @param {string} enrollmentId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentRevoke(tenantId: string, enrollmentId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Accredits a legal entity as RTAO (Root Trust Anchor Organisation), TAO (Trust Anchor Organisation), or TI (Trusted Issuer) within the trust framework hierarchy by issuing the appropriate accreditation credential to their DID.
      * @param {string} walletId
@@ -2833,43 +3547,82 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    trustListAdd(trustListAddRequest?: TrustListAddRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    trustListAdd(trustListAddRequest?: TrustListAddRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Stops tracking the trusted list published at the given URL and removes its contents. Removing a List of Trusted Lists removes the lists reached through it as well. Requires the `admin` role and the `trustListProviderPostgres` provider.  A wallet whose configuration still names this list will register it again the next time it verifies against it.
+     * @param {string} url The URL the trusted list is published at.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    trustListDelete(url: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Refetches the tracked trusted list published at the given URL and stores what it fetched, whether or not the publisher has issued a new version of it. This is what separates a forced refresh from the sweep the wallet makes on its own interval, which leaves an unchanged list alone. Requires the `admin` role and the `trustListProviderPostgres` provider.  The refetch is pinned to the certificate already recorded for the list, so a list cannot be moved onto a new signer by refreshing it: one signed by a different certificate is rejected with 409 and the stored copy is kept.
+     * @param {string} url The URL the trusted list is published at.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    trustListRefresh(url: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Lists the trusted lists the wallet tracks. Requires the `admin` role, and a wallet configured with the `trustListProviderPostgres` trust list provider: one that fetches its lists from their publisher as it needs them tracks nothing, and answers 501.  A list reached through a List of Trusted Lists is not a source of its own and is not returned here. It is refreshed and removed along with the list that points at it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    trustListsGet(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<TrustListsResponse>>;
+    /**
+     * Removes a UNTP link from the wallet\'s DID document and stops serving its credential.
+     * @param {string} walletId
+     * @param {string} serviceId The service id of the link, in full (&#x60;&lt;did&gt;#&lt;fragment&gt;&#x60;) or as its fragment.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkDelete(walletId: string, serviceId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * The UNTP links the wallet\'s DID document advertises for its published credentials.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkList(walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<UntpLink>>>;
     /**
-     * Stops tracking the trusted list published at the given URL and removes its contents. Removing a List of Trusted Lists removes the lists reached through it as well. Requires the `admin` role and the `trustListProviderPostgres` provider.  A wallet whose configuration still names this list will register it again the next time it verifies against it.
-     * @param {string} url The URL the trusted list is published at.
+     * Publishes an issued, valid W3C VCDM credential as a UNTP link: it is served at its public URL (`/api/v1/{wallet_id}/vc/{credential_id}`) and the wallet\'s DID document gets a service of the link type, whose endpoint is a link target to that URL. Publishing a credential again as the same link type returns the existing link. The wallet\'s DID document must be one it hosts (a self-hosted did:web, or an EBSI DID).
+     * @param {string} walletId
+     * @param {UntpLinkPublishRequest} untpLinkPublishRequest
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    trustListDelete(url: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    untpLinkPublish(walletId: string, untpLinkPublishRequest: UntpLinkPublishRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<UntpLink>>;
     /**
-     * Refetches the tracked trusted list published at the given URL and stores what it fetched, whether or not the publisher has issued a new version of it. This is what separates a forced refresh from the sweep the wallet makes on its own interval, which leaves an unchanged list alone. Requires the `admin` role and the `trustListProviderPostgres` provider.  The refetch is pinned to the certificate already recorded for the list, so a list cannot be moved onto a new signer by refreshing it: one signed by a different certificate is rejected with 409 and the stored copy is kept.
-     * @param {string} url The URL the trusted list is published at.
+     * Lists the registrars the wallet trusts to issue Digital Identity Anchors, and whether the wallet\'s own DID is one of them.
+     * @param {string} walletId
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    trustListRefresh(url: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    untpRegistryList(walletId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<UntpRegistry>>;
     /**
-     * Lists the trusted lists the wallet tracks. Requires the `admin` role, and a wallet configured with the `trustListProviderPostgres` trust list provider: one that fetches its lists from their publisher as it needs them tracks nothing, and answers 501.  A list reached through a List of Trusted Lists is not a source of its own and is not returned here. It is refreshed and removed along with the list that points at it.
+     * Verifies a credential, given raw or by URL, with the wallet\'s trust framework, and reports each check: the signature (with the key the issuer\'s identifier resolves to), the validity dates, and, unless turned off, the JSON-LD document (W3C VCDM 2.0), the status, the schema and the issuer\'s trust. A credential that fails is still `200`, with `verified: false`; `code` reuses the error codes of `/verifier/untp/resolve`.  A `url` must be https, and is never fetched from a private, loopback or link-local address, so a localhost URL is refused too. It is fetched within 10 s, 5 MiB and 3 redirects on the same host, and only as a credential media type.
+     * @param {string} walletId
+     * @param {VerifierCredentialRequest} verifierCredentialRequest
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    trustListsGet(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<TrustListsResponse>>;
+    verifierCredentialVerify(walletId: string, verifierCredentialRequest: VerifierCredentialRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<VerifierCredentialResult>>;
     /**
-     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
+     * Verifies whether the wallet\'s trust framework trusts a DID, beyond resolving its key.  A UNTP wallet requires a Digital Identity Anchor (UNTP 0.8.0, a profile of W3C Recognized Entities): the DID\'s DIA, found through its DID document\'s `https://test.uncefact.org/vocabulary/link-type/dia` service (or `untp:dia`), or a W3C `WhoisService`, is verified (signature, validity, status, the UNTP profile) and chained up, DIA by DIA, to a registrar the wallet trusts: its own (`UNTP.trustedRegistrars`), then the deployment\'s (`untp.dia.trustedRegistrars`, `untp.dia.registryUrl`). A registrar is itself trusted without a DIA. The details are in `untp`.  A DID that is not trusted is still `200`, with `trusted: false` and the reasons in `failures`. With `credentialType`, the issuer policy for that credential type is evaluated too. A wallet whose trust framework does not verify DIDs is `422`.
      * @param {string} walletId
-     * @param {VerifyInitRequest} [verifyInitRequest]
+     * @param {string} did The DID to verify.
+     * @param {string} [credentialType] Evaluate the issuer policy of this credential type, e.g. &#x60;DigitalProductPassport&#x60;.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<VerifyInitResponse>>;
+    verifierDidVerify(walletId: string, did: string, credentialType?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<DidVerification>>;
     /**
-     * Fetches linked presentations from DID document and verifies them.
+     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
      * @param {string} walletId
-     * @param {string} did
+     * @param {VerifyInitRequest} [verifyInitRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierLinkedVpVerify(walletId: string, did: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<VerifiedLinkedVp>>>;
+    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<VerifyInitResponse>>;
     /**
      * Verifies the signatures of uploaded PDF and extracts and verifies VP in the PDF document Maximum size of the PDF document is 50 MB.
      * @param {string} walletId
@@ -2882,6 +3635,26 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     verifierPdfVerify(walletId: string, extractVp: boolean, pdf?: File, trustedCertificates?: Array<string>, trustedListsUrl?: Array<string>, trustedListSigningCertificates?: Array<string>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<PdfVerificationResponse>>;
+    /**
+     * Renders a credential for a human with one of its `renderMethod` entries: a UNTP `RenderTemplate2024` (Handlebars, the output in its `mediaType`: `text/html`, the default, or `text/plain`) or a W3C `TemplateRenderMethod` of the `html` suite (a wrapper document to show in an `iframe` with `sandbox=\"allow-scripts\"` and `srcdoc`) or the `card` suite (a JSON card). By default the first method that can be rendered is used.  A `signedVc` is verified (its signature, validity and status) before it is rendered, and `X-Credential-Verified` is `true`; one that fails is `422`. A `vc` is a credential document rendered as it is, with `X-Credential-Verified: false`.  A credential with no render method that matches, or a method that cannot be rendered (`nfc`, a template of another `mediaType`, or an unknown type), is `422` with `no render method` or `render suite unsupported`; an invalid one is `422` with `invalid render method`, a template that cannot be fetched or does not match its digest `render template unavailable`, and one that fails or runs too long `render failed`.  A remote template is fetched over https only, within 5 s and 1 MiB, and must match its `digestMultibase`. Rendering stops after 2 s or 1 MiB of output. A template that runs on past that still counts against the renderings the wallet runs at once (`render.maxConcurrent`); when none is free, the response is `503`.
+     * @param {string} walletId
+     * @param {VerifierRenderRequest} verifierRenderRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierRender(walletId: string, verifierRenderRequest: VerifierRenderRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<File>>;
+    /**
+     * Resolves a DID into the RFC 9264 linkset of the UNTP links its DID document advertises and, with `fetch`, fetches the linked credentials and verifies them. A credential that fails is reported in `credentials` and `verification.failed`, with the response still 200: `verification.ok` is the verdict.
+     * @param {string} walletId
+     * @param {string} identifier The DID to resolve.
+     * @param {string} [linkType] The link types to fetch, comma separated (e.g. &#x60;dpp,dcc&#x60;), or &#x60;all&#x60; (the default). The linkset uses the UNTP 0.8.0 relations: &#x60;dpp&#x60;, &#x60;linkset&#x60; for an identity resolver, and &#x60;https://test.uncefact.org/vocabulary/link-type/&lt;type&gt;&#x60; for the others. A DID document\&#39;s UNTP 0.7 service types (&#x60;untp:dia&#x60;, bare &#x60;dcc&#x60;) are read as the same link types.
+     * @param {boolean} [fetch] Fetch and verify the linked credentials.
+     * @param {boolean} [verify] Verify the fetched credentials\&#39; dates, status and schema, besides their signature.
+     * @param {boolean} [verifyIssuer] Also verify whether the wallet\&#39;s trust framework trusts the DID, as &#x60;/verifier/did&#x60; does, and report it as &#x60;issuer&#x60;. A wallet whose trust framework does not verify DIDs reports no &#x60;issuer&#x60;, and is &#x60;422&#x60; when &#x60;verifyIssuer&#x60; is set explicitly. A UNTP wallet enforces the anchor on every signature anyway; this reports it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierUntpResolve(walletId: string, identifier: string, linkType?: string, fetch?: boolean, verify?: boolean, verifyIssuer?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<UntpResolveResult>>;
     /**
      * Creates a new wallet for the authenticated client.
      * @param {WalletCreatePayload} [walletCreatePayload]
@@ -2923,10 +3696,11 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * Provides list of wallets owned by the authenticated client, sorted by wallet name in byte order (Unicode code point order of the UTF-8 name, so upper case sorts before lower case). Wallets with the same name are in the order they were created.
      * @param {string} [ownerId]
      * @param {string} [searchName] Wallet name to search using \&quot;begins-with\&quot; filter
+     * @param {string} [tenantId] Lists the wallets of every owner in this tenant instead, each with its ownerId. Only a Tenant Owner of the tenant may set it, and not together with ownerId.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    walletList(ownerId?: string, searchName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<WalletListItem>>>;
+    walletList(ownerId?: string, searchName?: string, tenantId?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<WalletListItem>>>;
     /**
      * Gets a specific notification by state
      * @param {string} walletId Wallet ID
@@ -2959,7 +3733,7 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      */
     walletNotifications(walletId: string, eventType?: string, state?: string, lastEventID?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<File>>;
     /**
-     * Update wallet metadata and configuration.
+     * Update wallet metadata and configuration.  The owner of the wallet patches its name, config and metadata; `config.tenant` is ignored for them. A Tenant Owner of the wallet\'s tenant patches `config.tenant.issuerProxyUrl`, also of wallets of other owners, and for those every other field of the body is ignored. `config.tenant.tenantId` never changes.
      * @param {string} walletId
      * @param {WalletPatchPayload} [walletPatchPayload]
      * @param {*} [options] Override http request option.
@@ -3180,6 +3954,16 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     credentialIssuanceInit(credentialId: string, walletId: string, credentialIssuanceInit?: CredentialIssuanceInit, options?: RawAxiosRequestConfig): AxiosPromise<CredentialIssuanceInitResult>;
+    /**
+     * Issues a W3C VCDM draft as a credential of the wallet itself, with no holder and no OID4VCI: for a credential that is published rather than handed to anyone, such as a UNTP Digital Product Passport (EN 18246 Annex B.5). The credential gets the wallet\'s status list entry and envelope, and is stored issued on the same record. With `publish`, it is then published as a UNTP link, like `POST /untp/links`; if that fails the response is `502` with the issued `credentialId`, and publishing is retried with `POST /untp/links`.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {CredentialIssueDirectRequest} [credentialIssueDirectRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialIssueDirect(credentialId: string, walletId: string, idempotencyKey?: string, credentialIssueDirectRequest?: CredentialIssueDirectRequest, options?: RawAxiosRequestConfig): AxiosPromise<CredentialIssueDirectResult>;
     /**
      * Retrieves a list of credentials.
      * @param {string} walletId
@@ -3232,6 +4016,25 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     credentialRawGet(credentialId: string, walletId: string, disclosedClaims?: Array<string>, options?: RawAxiosRequestConfig): AxiosPromise<string>;
+    /**
+     * Renders a W3C VCDM credential of the wallet with one of its `renderMethod` entries, as `POST /verifier/render` does. HTML is served with a `Content-Security-Policy` that sandboxes it.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {number} [index] The index of the render method to use, in the credential\&#39;s &#x60;renderMethod&#x60;.
+     * @param {RenderSuite} [suite] Use the first render method of this suite.
+     * @param {string} [mediaQuery] Use the first render method with exactly this &#x60;mediaQuery&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRender(credentialId: string, walletId: string, index?: number, suite?: RenderSuite, mediaQuery?: string, options?: RawAxiosRequestConfig): AxiosPromise<File>;
+    /**
+     * Lists the render methods of a W3C VCDM credential of the wallet, for a client to pick one by its media query: media queries are not evaluated by the wallet.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRenderMethods(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<RenderMethodInfo>>;
     /**
      * Requests a credential issuance from the issuer and retrieves requirements for holder authorization.
      * @param {string} walletId
@@ -3241,13 +4044,14 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      */
     credentialRequestInit(walletId: string, credentialRequest?: CredentialRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<string>>;
     /**
-     * Revoke a specific Verifiable Credential
+     * Revoke a specific Verifiable Credential. A credential published as a UNTP link stays published: a verifier following its link finds it and verifies it as revoked. `DELETE /untp/links/{service_id}` unpublishes it.
      * @param {string} credentialId Verifiable Credential Identifier
      * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    credentialRevoke(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    credentialRevoke(credentialId: string, walletId: string, idempotencyKey?: string, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Suspend a Verifiable Credential issued with the `suspension` status purpose (W3C Bitstring Status List v1.0). A suspension can be lifted with `DELETE`.
      * @param {string} credentialId Verifiable Credential Identifier
@@ -3279,6 +4083,25 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     didDocumentGet(walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<object>;
+    /**
+     * Returns the wallet\'s own DID document, as published at `/{wallet_id}/did.json` for a self-hosted did:web.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentLocalGet(walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<{
+        [key: string]: any;
+    }>;
+    /**
+     * Changes the wallet\'s DID document: removes the services in `removeServiceIds`, adds the services in `addServices` (a service with the same id is replaced), and, when `alsoKnownAs` is set, replaces the subject\'s other identifiers (an empty list removes them). UNTP identifies an entity\'s Digital Identity Anchor with a service of type `https://test.uncefact.org/vocabulary/link-type/dia` (`untp:dia` in UNTP 0.7) and registered identifiers with `alsoKnownAs`.  Only a self-hosted did:web document can be changed; services of an EBSI DID are written to the EBSI DID registry, which does not take `alsoKnownAs`.
+     * @param {string} walletId
+     * @param {DidDocumentPatch} didDocumentPatch
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentPatch(walletId: string, didDocumentPatch: DidDocumentPatch, options?: RawAxiosRequestConfig): AxiosPromise<{
+        [key: string]: any;
+    }>;
     /**
      * Checks the health status of the service and its subsystems (database, storage, etc.). Used by load balancers and monitoring systems.
      * @param {*} [options] Override http request option.
@@ -3310,37 +4133,6 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     holderIdTokenSend(walletId: string, idTokenSendRequest?: IdTokenSendRequest, options?: RawAxiosRequestConfig): AxiosPromise<PresentationResponse>;
-    /**
-     * Creates a new public Linked VP of specified credentials and adds it to the wallet\'s DID document
-     * @param {string} walletId
-     * @param {LinkedVpCreateRequest} [linkedVpCreateRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpCreate(walletId: string, linkedVpCreateRequest?: LinkedVpCreateRequest, options?: RawAxiosRequestConfig): AxiosPromise<LinkedVpMetadata>;
-    /**
-     * Deletes a linked VP
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpDelete(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Returns metadata and content of a specific linked Verifiable Presentation, including the credentials it contains and its DID document service entry URL.
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpGetDetails(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): AxiosPromise<LinkedVpMetadata>;
-    /**
-     * Returns all linked Verifiable Presentations published in the wallet\'s DID document,
-     * @param {string} walletId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpList(walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<LinkedVpMetadata>>;
     /**
      * Processes a credential offer URL (received from an issuer via QR code, deep link, or WMP) and returns what authorization is required to accept it - pin, credential presentation or a redirect to custom authorization flow. holder needs to present to the issuer, along with matching candidates from the wallet. The returned `interactionId` is used in the subsequent `HolderOfferProcessAfterConsent` call.
      * @param {string} walletId
@@ -3380,6 +4172,15 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     issuerCredentialTypesList(url: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<CredentialType>>;
+    /**
+     * Signs an opaque payload, such as an audit log entry, with the wallet\'s DID key, as a compact detached JWS with an unencoded payload (RFC 7515 Appendix F, RFC 7797: `b64: false`, `crit: [\"b64\"]`): `<protected header>..<signature>`. The signature is verified offline against the key in the wallet\'s DID document, with the payload put back. `typ` must be one the deployment allows, which no credential or presentation verifier accepts, so a signature from here never passes as a credential.
+     * @param {string} walletId
+     * @param {IssuerDetachedJwsSignRequest} issuerDetachedJwsSignRequest
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    issuerDetachedJwsSign(walletId: string, issuerDetachedJwsSignRequest: IssuerDetachedJwsSignRequest, idempotencyKey?: string, options?: RawAxiosRequestConfig): AxiosPromise<IssuerDetachedJwsSignResult>;
     /**
      * Generates an authorized credential offer URL for the holder to initiate the credential issuance flow. The resulting offer URL is typically presented as a QR code or deep link. If `wmpEntityId` is provided, the offer is delivered directly via WMP and 204 is returned.
      * @param {string} walletId
@@ -3439,6 +4240,37 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     pdfCredentialTwinUpload(credentialId: string, walletId: string, pdf?: File, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Creates a wallet for the caller from a pending enrollment, in the tenant. A state can be used once. A caller whose token names another tenant is refused.
+     * @param {string} tenantId
+     * @param {string} state The enrollment state from TenantEnrollmentInit.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentEnroll(tenantId: string, state: string, options?: RawAxiosRequestConfig): AxiosPromise<WalletIdObject>;
+    /**
+     * Prepares a wallet for the tenant and returns a one-time enrollment state. Whoever presents the state to POST /tenant/{tenant_id}/enrollment/{state} gets a wallet created from the payload, in the tenant. Only a Tenant Owner of the tenant may call it. The payload is validated now; a tenantId it carries is ignored. The state is returned only here: the wallet keeps only its hash, which is the enrollment id.
+     * @param {string} tenantId
+     * @param {EnrollmentInitPayload} enrollmentInitPayload
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentInit(tenantId: string, enrollmentInitPayload: EnrollmentInitPayload, options?: RawAxiosRequestConfig): AxiosPromise<EnrollmentInitResponse>;
+    /**
+     * Lists the tenant\'s pending enrollments, oldest first. Only a Tenant Owner of the tenant may.
+     * @param {string} tenantId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentList(tenantId: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<EnrollmentListItem>>;
+    /**
+     * Revokes a pending enrollment, so that its state no longer creates a wallet.
+     * @param {string} tenantId
+     * @param {string} enrollmentId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentRevoke(tenantId: string, enrollmentId: string, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Accredits a legal entity as RTAO (Root Trust Anchor Organisation), TAO (Trust Anchor Organisation), or TI (Trusted Issuer) within the trust framework hierarchy by issuing the appropriate accreditation credential to their DID.
      * @param {string} walletId
@@ -3539,21 +4371,60 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      */
     trustListsGet(options?: RawAxiosRequestConfig): AxiosPromise<TrustListsResponse>;
     /**
-     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
+     * Removes a UNTP link from the wallet\'s DID document and stops serving its credential.
      * @param {string} walletId
-     * @param {VerifyInitRequest} [verifyInitRequest]
+     * @param {string} serviceId The service id of the link, in full (&#x60;&lt;did&gt;#&lt;fragment&gt;&#x60;) or as its fragment.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): AxiosPromise<VerifyInitResponse>;
+    untpLinkDelete(walletId: string, serviceId: string, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * The UNTP links the wallet\'s DID document advertises for its published credentials.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkList(walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<UntpLink>>;
+    /**
+     * Publishes an issued, valid W3C VCDM credential as a UNTP link: it is served at its public URL (`/api/v1/{wallet_id}/vc/{credential_id}`) and the wallet\'s DID document gets a service of the link type, whose endpoint is a link target to that URL. Publishing a credential again as the same link type returns the existing link. The wallet\'s DID document must be one it hosts (a self-hosted did:web, or an EBSI DID).
+     * @param {string} walletId
+     * @param {UntpLinkPublishRequest} untpLinkPublishRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkPublish(walletId: string, untpLinkPublishRequest: UntpLinkPublishRequest, options?: RawAxiosRequestConfig): AxiosPromise<UntpLink>;
+    /**
+     * Lists the registrars the wallet trusts to issue Digital Identity Anchors, and whether the wallet\'s own DID is one of them.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpRegistryList(walletId: string, options?: RawAxiosRequestConfig): AxiosPromise<UntpRegistry>;
+    /**
+     * Verifies a credential, given raw or by URL, with the wallet\'s trust framework, and reports each check: the signature (with the key the issuer\'s identifier resolves to), the validity dates, and, unless turned off, the JSON-LD document (W3C VCDM 2.0), the status, the schema and the issuer\'s trust. A credential that fails is still `200`, with `verified: false`; `code` reuses the error codes of `/verifier/untp/resolve`.  A `url` must be https, and is never fetched from a private, loopback or link-local address, so a localhost URL is refused too. It is fetched within 10 s, 5 MiB and 3 redirects on the same host, and only as a credential media type.
+     * @param {string} walletId
+     * @param {VerifierCredentialRequest} verifierCredentialRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierCredentialVerify(walletId: string, verifierCredentialRequest: VerifierCredentialRequest, options?: RawAxiosRequestConfig): AxiosPromise<VerifierCredentialResult>;
+    /**
+     * Verifies whether the wallet\'s trust framework trusts a DID, beyond resolving its key.  A UNTP wallet requires a Digital Identity Anchor (UNTP 0.8.0, a profile of W3C Recognized Entities): the DID\'s DIA, found through its DID document\'s `https://test.uncefact.org/vocabulary/link-type/dia` service (or `untp:dia`), or a W3C `WhoisService`, is verified (signature, validity, status, the UNTP profile) and chained up, DIA by DIA, to a registrar the wallet trusts: its own (`UNTP.trustedRegistrars`), then the deployment\'s (`untp.dia.trustedRegistrars`, `untp.dia.registryUrl`). A registrar is itself trusted without a DIA. The details are in `untp`.  A DID that is not trusted is still `200`, with `trusted: false` and the reasons in `failures`. With `credentialType`, the issuer policy for that credential type is evaluated too. A wallet whose trust framework does not verify DIDs is `422`.
+     * @param {string} walletId
+     * @param {string} did The DID to verify.
+     * @param {string} [credentialType] Evaluate the issuer policy of this credential type, e.g. &#x60;DigitalProductPassport&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierDidVerify(walletId: string, did: string, credentialType?: string, options?: RawAxiosRequestConfig): AxiosPromise<DidVerification>;
     /**
-     * Fetches linked presentations from DID document and verifies them.
+     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
      * @param {string} walletId
-     * @param {string} did
+     * @param {VerifyInitRequest} [verifyInitRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierLinkedVpVerify(walletId: string, did: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<VerifiedLinkedVp>>;
+    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): AxiosPromise<VerifyInitResponse>;
     /**
      * Verifies the signatures of uploaded PDF and extracts and verifies VP in the PDF document Maximum size of the PDF document is 50 MB.
      * @param {string} walletId
@@ -3566,6 +4437,26 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     verifierPdfVerify(walletId: string, extractVp: boolean, pdf?: File, trustedCertificates?: Array<string>, trustedListsUrl?: Array<string>, trustedListSigningCertificates?: Array<string>, options?: RawAxiosRequestConfig): AxiosPromise<PdfVerificationResponse>;
+    /**
+     * Renders a credential for a human with one of its `renderMethod` entries: a UNTP `RenderTemplate2024` (Handlebars, the output in its `mediaType`: `text/html`, the default, or `text/plain`) or a W3C `TemplateRenderMethod` of the `html` suite (a wrapper document to show in an `iframe` with `sandbox=\"allow-scripts\"` and `srcdoc`) or the `card` suite (a JSON card). By default the first method that can be rendered is used.  A `signedVc` is verified (its signature, validity and status) before it is rendered, and `X-Credential-Verified` is `true`; one that fails is `422`. A `vc` is a credential document rendered as it is, with `X-Credential-Verified: false`.  A credential with no render method that matches, or a method that cannot be rendered (`nfc`, a template of another `mediaType`, or an unknown type), is `422` with `no render method` or `render suite unsupported`; an invalid one is `422` with `invalid render method`, a template that cannot be fetched or does not match its digest `render template unavailable`, and one that fails or runs too long `render failed`.  A remote template is fetched over https only, within 5 s and 1 MiB, and must match its `digestMultibase`. Rendering stops after 2 s or 1 MiB of output. A template that runs on past that still counts against the renderings the wallet runs at once (`render.maxConcurrent`); when none is free, the response is `503`.
+     * @param {string} walletId
+     * @param {VerifierRenderRequest} verifierRenderRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierRender(walletId: string, verifierRenderRequest: VerifierRenderRequest, options?: RawAxiosRequestConfig): AxiosPromise<File>;
+    /**
+     * Resolves a DID into the RFC 9264 linkset of the UNTP links its DID document advertises and, with `fetch`, fetches the linked credentials and verifies them. A credential that fails is reported in `credentials` and `verification.failed`, with the response still 200: `verification.ok` is the verdict.
+     * @param {string} walletId
+     * @param {string} identifier The DID to resolve.
+     * @param {string} [linkType] The link types to fetch, comma separated (e.g. &#x60;dpp,dcc&#x60;), or &#x60;all&#x60; (the default). The linkset uses the UNTP 0.8.0 relations: &#x60;dpp&#x60;, &#x60;linkset&#x60; for an identity resolver, and &#x60;https://test.uncefact.org/vocabulary/link-type/&lt;type&gt;&#x60; for the others. A DID document\&#39;s UNTP 0.7 service types (&#x60;untp:dia&#x60;, bare &#x60;dcc&#x60;) are read as the same link types.
+     * @param {boolean} [fetch] Fetch and verify the linked credentials.
+     * @param {boolean} [verify] Verify the fetched credentials\&#39; dates, status and schema, besides their signature.
+     * @param {boolean} [verifyIssuer] Also verify whether the wallet\&#39;s trust framework trusts the DID, as &#x60;/verifier/did&#x60; does, and report it as &#x60;issuer&#x60;. A wallet whose trust framework does not verify DIDs reports no &#x60;issuer&#x60;, and is &#x60;422&#x60; when &#x60;verifyIssuer&#x60; is set explicitly. A UNTP wallet enforces the anchor on every signature anyway; this reports it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierUntpResolve(walletId: string, identifier: string, linkType?: string, fetch?: boolean, verify?: boolean, verifyIssuer?: boolean, options?: RawAxiosRequestConfig): AxiosPromise<UntpResolveResult>;
     /**
      * Creates a new wallet for the authenticated client.
      * @param {WalletCreatePayload} [walletCreatePayload]
@@ -3607,10 +4498,11 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * Provides list of wallets owned by the authenticated client, sorted by wallet name in byte order (Unicode code point order of the UTF-8 name, so upper case sorts before lower case). Wallets with the same name are in the order they were created.
      * @param {string} [ownerId]
      * @param {string} [searchName] Wallet name to search using \&quot;begins-with\&quot; filter
+     * @param {string} [tenantId] Lists the wallets of every owner in this tenant instead, each with its ownerId. Only a Tenant Owner of the tenant may set it, and not together with ownerId.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    walletList(ownerId?: string, searchName?: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<WalletListItem>>;
+    walletList(ownerId?: string, searchName?: string, tenantId?: string, options?: RawAxiosRequestConfig): AxiosPromise<Array<WalletListItem>>;
     /**
      * Gets a specific notification by state
      * @param {string} walletId Wallet ID
@@ -3643,7 +4535,7 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      */
     walletNotifications(walletId: string, eventType?: string, state?: string, lastEventID?: string, options?: RawAxiosRequestConfig): AxiosPromise<File>;
     /**
-     * Update wallet metadata and configuration.
+     * Update wallet metadata and configuration.  The owner of the wallet patches its name, config and metadata; `config.tenant` is ignored for them. A Tenant Owner of the wallet\'s tenant patches `config.tenant.issuerProxyUrl`, also of wallets of other owners, and for those every other field of the body is ignored. `config.tenant.tenantId` never changes.
      * @param {string} walletId
      * @param {WalletPatchPayload} [walletPatchPayload]
      * @param {*} [options] Override http request option.
@@ -3864,6 +4756,16 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     credentialIssuanceInit(credentialId: string, walletId: string, credentialIssuanceInit?: CredentialIssuanceInit, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<CredentialIssuanceInitResult, any, {}>>;
+    /**
+     * Issues a W3C VCDM draft as a credential of the wallet itself, with no holder and no OID4VCI: for a credential that is published rather than handed to anyone, such as a UNTP Digital Product Passport (EN 18246 Annex B.5). The credential gets the wallet\'s status list entry and envelope, and is stored issued on the same record. With `publish`, it is then published as a UNTP link, like `POST /untp/links`; if that fails the response is `502` with the issued `credentialId`, and publishing is retried with `POST /untp/links`.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {CredentialIssueDirectRequest} [credentialIssueDirectRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialIssueDirect(credentialId: string, walletId: string, idempotencyKey?: string, credentialIssueDirectRequest?: CredentialIssueDirectRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<CredentialIssueDirectResult, any, {}>>;
     /**
      * Retrieves a list of credentials.
      * @param {string} walletId
@@ -3916,6 +4818,25 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     credentialRawGet(credentialId: string, walletId: string, disclosedClaims?: Array<string>, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<string, any, {}>>;
+    /**
+     * Renders a W3C VCDM credential of the wallet with one of its `renderMethod` entries, as `POST /verifier/render` does. HTML is served with a `Content-Security-Policy` that sandboxes it.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {number} [index] The index of the render method to use, in the credential\&#39;s &#x60;renderMethod&#x60;.
+     * @param {RenderSuite} [suite] Use the first render method of this suite.
+     * @param {string} [mediaQuery] Use the first render method with exactly this &#x60;mediaQuery&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRender(credentialId: string, walletId: string, index?: number, suite?: RenderSuite, mediaQuery?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<File, any, {}>>;
+    /**
+     * Lists the render methods of a W3C VCDM credential of the wallet, for a client to pick one by its media query: media queries are not evaluated by the wallet.
+     * @param {string} credentialId Verifiable Credential Identifier
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    credentialRenderMethods(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<RenderMethodInfo[], any, {}>>;
     /**
      * Requests a credential issuance from the issuer and retrieves requirements for holder authorization.
      * @param {string} walletId
@@ -3925,13 +4846,14 @@ export declare class DefaultApi extends BaseAPI {
      */
     credentialRequestInit(walletId: string, credentialRequest?: CredentialRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<string[], any, {}>>;
     /**
-     * Revoke a specific Verifiable Credential
+     * Revoke a specific Verifiable Credential. A credential published as a UNTP link stays published: a verifier following its link finds it and verifies it as revoked. `DELETE /untp/links/{service_id}` unpublishes it.
      * @param {string} credentialId Verifiable Credential Identifier
      * @param {string} walletId
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    credentialRevoke(credentialId: string, walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    credentialRevoke(credentialId: string, walletId: string, idempotencyKey?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * Suspend a Verifiable Credential issued with the `suspension` status purpose (W3C Bitstring Status List v1.0). A suspension can be lifted with `DELETE`.
      * @param {string} credentialId Verifiable Credential Identifier
@@ -3963,6 +4885,25 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     didDocumentGet(walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<object, any, {}>>;
+    /**
+     * Returns the wallet\'s own DID document, as published at `/{wallet_id}/did.json` for a self-hosted did:web.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentLocalGet(walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<{
+        [key: string]: any;
+    }, any, {}>>;
+    /**
+     * Changes the wallet\'s DID document: removes the services in `removeServiceIds`, adds the services in `addServices` (a service with the same id is replaced), and, when `alsoKnownAs` is set, replaces the subject\'s other identifiers (an empty list removes them). UNTP identifies an entity\'s Digital Identity Anchor with a service of type `https://test.uncefact.org/vocabulary/link-type/dia` (`untp:dia` in UNTP 0.7) and registered identifiers with `alsoKnownAs`.  Only a self-hosted did:web document can be changed; services of an EBSI DID are written to the EBSI DID registry, which does not take `alsoKnownAs`.
+     * @param {string} walletId
+     * @param {DidDocumentPatch} didDocumentPatch
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    didDocumentPatch(walletId: string, didDocumentPatch: DidDocumentPatch, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<{
+        [key: string]: any;
+    }, any, {}>>;
     /**
      * Checks the health status of the service and its subsystems (database, storage, etc.). Used by load balancers and monitoring systems.
      * @param {*} [options] Override http request option.
@@ -3994,37 +4935,6 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     holderIdTokenSend(walletId: string, idTokenSendRequest?: IdTokenSendRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<PresentationResponse, any, {}>>;
-    /**
-     * Creates a new public Linked VP of specified credentials and adds it to the wallet\'s DID document
-     * @param {string} walletId
-     * @param {LinkedVpCreateRequest} [linkedVpCreateRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpCreate(walletId: string, linkedVpCreateRequest?: LinkedVpCreateRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<LinkedVpMetadata, any, {}>>;
-    /**
-     * Deletes a linked VP
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpDelete(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
-    /**
-     * Returns metadata and content of a specific linked Verifiable Presentation, including the credentials it contains and its DID document service entry URL.
-     * @param {string} walletId
-     * @param {string} linkedVpId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpGetDetails(walletId: string, linkedVpId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<LinkedVpMetadata, any, {}>>;
-    /**
-     * Returns all linked Verifiable Presentations published in the wallet\'s DID document,
-     * @param {string} walletId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    holderLinkedVpList(walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<LinkedVpMetadata[], any, {}>>;
     /**
      * Processes a credential offer URL (received from an issuer via QR code, deep link, or WMP) and returns what authorization is required to accept it - pin, credential presentation or a redirect to custom authorization flow. holder needs to present to the issuer, along with matching candidates from the wallet. The returned `interactionId` is used in the subsequent `HolderOfferProcessAfterConsent` call.
      * @param {string} walletId
@@ -4064,6 +4974,15 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     issuerCredentialTypesList(url: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<CredentialType[], any, {}>>;
+    /**
+     * Signs an opaque payload, such as an audit log entry, with the wallet\'s DID key, as a compact detached JWS with an unencoded payload (RFC 7515 Appendix F, RFC 7797: `b64: false`, `crit: [\"b64\"]`): `<protected header>..<signature>`. The signature is verified offline against the key in the wallet\'s DID document, with the payload put back. `typ` must be one the deployment allows, which no credential or presentation verifier accepts, so a signature from here never passes as a credential.
+     * @param {string} walletId
+     * @param {IssuerDetachedJwsSignRequest} issuerDetachedJwsSignRequest
+     * @param {string} [idempotencyKey] Makes a retry safe: a repeat with the same key, for the same wallet, gets the first response (with &#x60;Idempotent-Replayed: true&#x60;) for 24 hours. The same key with a different request is &#x60;422&#x60;. A &#x60;5xx&#x60; response is not kept: a retry runs the request again. A repeat while the first request runs, or after it completed without its response being kept, is &#x60;409&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    issuerDetachedJwsSign(walletId: string, issuerDetachedJwsSignRequest: IssuerDetachedJwsSignRequest, idempotencyKey?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IssuerDetachedJwsSignResult, any, {}>>;
     /**
      * Generates an authorized credential offer URL for the holder to initiate the credential issuance flow. The resulting offer URL is typically presented as a QR code or deep link. If `wmpEntityId` is provided, the offer is delivered directly via WMP and 204 is returned.
      * @param {string} walletId
@@ -4123,6 +5042,37 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     pdfCredentialTwinUpload(credentialId: string, walletId: string, pdf?: File, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Creates a wallet for the caller from a pending enrollment, in the tenant. A state can be used once. A caller whose token names another tenant is refused.
+     * @param {string} tenantId
+     * @param {string} state The enrollment state from TenantEnrollmentInit.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentEnroll(tenantId: string, state: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<WalletIdObject, any, {}>>;
+    /**
+     * Prepares a wallet for the tenant and returns a one-time enrollment state. Whoever presents the state to POST /tenant/{tenant_id}/enrollment/{state} gets a wallet created from the payload, in the tenant. Only a Tenant Owner of the tenant may call it. The payload is validated now; a tenantId it carries is ignored. The state is returned only here: the wallet keeps only its hash, which is the enrollment id.
+     * @param {string} tenantId
+     * @param {EnrollmentInitPayload} enrollmentInitPayload
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentInit(tenantId: string, enrollmentInitPayload: EnrollmentInitPayload, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<EnrollmentInitResponse, any, {}>>;
+    /**
+     * Lists the tenant\'s pending enrollments, oldest first. Only a Tenant Owner of the tenant may.
+     * @param {string} tenantId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentList(tenantId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<EnrollmentListItem[], any, {}>>;
+    /**
+     * Revokes a pending enrollment, so that its state no longer creates a wallet.
+     * @param {string} tenantId
+     * @param {string} enrollmentId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    tenantEnrollmentRevoke(tenantId: string, enrollmentId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * Accredits a legal entity as RTAO (Root Trust Anchor Organisation), TAO (Trust Anchor Organisation), or TI (Trusted Issuer) within the trust framework hierarchy by issuing the appropriate accreditation credential to their DID.
      * @param {string} walletId
@@ -4223,21 +5173,60 @@ export declare class DefaultApi extends BaseAPI {
      */
     trustListsGet(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<TrustListsResponse, any, {}>>;
     /**
-     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
+     * Removes a UNTP link from the wallet\'s DID document and stops serving its credential.
      * @param {string} walletId
-     * @param {VerifyInitRequest} [verifyInitRequest]
+     * @param {string} serviceId The service id of the link, in full (&#x60;&lt;did&gt;#&lt;fragment&gt;&#x60;) or as its fragment.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<VerifyInitResponse, any, {}>>;
+    untpLinkDelete(walletId: string, serviceId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * The UNTP links the wallet\'s DID document advertises for its published credentials.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkList(walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<UntpLink[], any, {}>>;
+    /**
+     * Publishes an issued, valid W3C VCDM credential as a UNTP link: it is served at its public URL (`/api/v1/{wallet_id}/vc/{credential_id}`) and the wallet\'s DID document gets a service of the link type, whose endpoint is a link target to that URL. Publishing a credential again as the same link type returns the existing link. The wallet\'s DID document must be one it hosts (a self-hosted did:web, or an EBSI DID).
+     * @param {string} walletId
+     * @param {UntpLinkPublishRequest} untpLinkPublishRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpLinkPublish(walletId: string, untpLinkPublishRequest: UntpLinkPublishRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<UntpLink, any, {}>>;
+    /**
+     * Lists the registrars the wallet trusts to issue Digital Identity Anchors, and whether the wallet\'s own DID is one of them.
+     * @param {string} walletId
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    untpRegistryList(walletId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<UntpRegistry, any, {}>>;
+    /**
+     * Verifies a credential, given raw or by URL, with the wallet\'s trust framework, and reports each check: the signature (with the key the issuer\'s identifier resolves to), the validity dates, and, unless turned off, the JSON-LD document (W3C VCDM 2.0), the status, the schema and the issuer\'s trust. A credential that fails is still `200`, with `verified: false`; `code` reuses the error codes of `/verifier/untp/resolve`.  A `url` must be https, and is never fetched from a private, loopback or link-local address, so a localhost URL is refused too. It is fetched within 10 s, 5 MiB and 3 redirects on the same host, and only as a credential media type.
+     * @param {string} walletId
+     * @param {VerifierCredentialRequest} verifierCredentialRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierCredentialVerify(walletId: string, verifierCredentialRequest: VerifierCredentialRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<VerifierCredentialResult, any, {}>>;
+    /**
+     * Verifies whether the wallet\'s trust framework trusts a DID, beyond resolving its key.  A UNTP wallet requires a Digital Identity Anchor (UNTP 0.8.0, a profile of W3C Recognized Entities): the DID\'s DIA, found through its DID document\'s `https://test.uncefact.org/vocabulary/link-type/dia` service (or `untp:dia`), or a W3C `WhoisService`, is verified (signature, validity, status, the UNTP profile) and chained up, DIA by DIA, to a registrar the wallet trusts: its own (`UNTP.trustedRegistrars`), then the deployment\'s (`untp.dia.trustedRegistrars`, `untp.dia.registryUrl`). A registrar is itself trusted without a DIA. The details are in `untp`.  A DID that is not trusted is still `200`, with `trusted: false` and the reasons in `failures`. With `credentialType`, the issuer policy for that credential type is evaluated too. A wallet whose trust framework does not verify DIDs is `422`.
+     * @param {string} walletId
+     * @param {string} did The DID to verify.
+     * @param {string} [credentialType] Evaluate the issuer policy of this credential type, e.g. &#x60;DigitalProductPassport&#x60;.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierDidVerify(walletId: string, did: string, credentialType?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<DidVerification, any, {}>>;
     /**
-     * Fetches linked presentations from DID document and verifies them.
+     * Creates a verification session and returns a URL where the verifier accepts credential presentations from a holder. The URL is typically shared as a QR code or deep link. After the holder presents credentials, use `WalletVerifiedCredentialsByState` with the returned `state` to retrieve the verification result.
      * @param {string} walletId
-     * @param {string} did
+     * @param {VerifyInitRequest} [verifyInitRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    verifierLinkedVpVerify(walletId: string, did: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<VerifiedLinkedVp[], any, {}>>;
+    verifierInitUrlCreate(walletId: string, verifyInitRequest?: VerifyInitRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<VerifyInitResponse, any, {}>>;
     /**
      * Verifies the signatures of uploaded PDF and extracts and verifies VP in the PDF document Maximum size of the PDF document is 50 MB.
      * @param {string} walletId
@@ -4250,6 +5239,26 @@ export declare class DefaultApi extends BaseAPI {
      * @throws {RequiredError}
      */
     verifierPdfVerify(walletId: string, extractVp: boolean, pdf?: File, trustedCertificates?: Array<string>, trustedListsUrl?: Array<string>, trustedListSigningCertificates?: Array<string>, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<PdfVerificationResponse, any, {}>>;
+    /**
+     * Renders a credential for a human with one of its `renderMethod` entries: a UNTP `RenderTemplate2024` (Handlebars, the output in its `mediaType`: `text/html`, the default, or `text/plain`) or a W3C `TemplateRenderMethod` of the `html` suite (a wrapper document to show in an `iframe` with `sandbox=\"allow-scripts\"` and `srcdoc`) or the `card` suite (a JSON card). By default the first method that can be rendered is used.  A `signedVc` is verified (its signature, validity and status) before it is rendered, and `X-Credential-Verified` is `true`; one that fails is `422`. A `vc` is a credential document rendered as it is, with `X-Credential-Verified: false`.  A credential with no render method that matches, or a method that cannot be rendered (`nfc`, a template of another `mediaType`, or an unknown type), is `422` with `no render method` or `render suite unsupported`; an invalid one is `422` with `invalid render method`, a template that cannot be fetched or does not match its digest `render template unavailable`, and one that fails or runs too long `render failed`.  A remote template is fetched over https only, within 5 s and 1 MiB, and must match its `digestMultibase`. Rendering stops after 2 s or 1 MiB of output. A template that runs on past that still counts against the renderings the wallet runs at once (`render.maxConcurrent`); when none is free, the response is `503`.
+     * @param {string} walletId
+     * @param {VerifierRenderRequest} verifierRenderRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierRender(walletId: string, verifierRenderRequest: VerifierRenderRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<File, any, {}>>;
+    /**
+     * Resolves a DID into the RFC 9264 linkset of the UNTP links its DID document advertises and, with `fetch`, fetches the linked credentials and verifies them. A credential that fails is reported in `credentials` and `verification.failed`, with the response still 200: `verification.ok` is the verdict.
+     * @param {string} walletId
+     * @param {string} identifier The DID to resolve.
+     * @param {string} [linkType] The link types to fetch, comma separated (e.g. &#x60;dpp,dcc&#x60;), or &#x60;all&#x60; (the default). The linkset uses the UNTP 0.8.0 relations: &#x60;dpp&#x60;, &#x60;linkset&#x60; for an identity resolver, and &#x60;https://test.uncefact.org/vocabulary/link-type/&lt;type&gt;&#x60; for the others. A DID document\&#39;s UNTP 0.7 service types (&#x60;untp:dia&#x60;, bare &#x60;dcc&#x60;) are read as the same link types.
+     * @param {boolean} [fetch] Fetch and verify the linked credentials.
+     * @param {boolean} [verify] Verify the fetched credentials\&#39; dates, status and schema, besides their signature.
+     * @param {boolean} [verifyIssuer] Also verify whether the wallet\&#39;s trust framework trusts the DID, as &#x60;/verifier/did&#x60; does, and report it as &#x60;issuer&#x60;. A wallet whose trust framework does not verify DIDs reports no &#x60;issuer&#x60;, and is &#x60;422&#x60; when &#x60;verifyIssuer&#x60; is set explicitly. A UNTP wallet enforces the anchor on every signature anyway; this reports it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    verifierUntpResolve(walletId: string, identifier: string, linkType?: string, fetch?: boolean, verify?: boolean, verifyIssuer?: boolean, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<UntpResolveResult, any, {}>>;
     /**
      * Creates a new wallet for the authenticated client.
      * @param {WalletCreatePayload} [walletCreatePayload]
@@ -4291,10 +5300,11 @@ export declare class DefaultApi extends BaseAPI {
      * Provides list of wallets owned by the authenticated client, sorted by wallet name in byte order (Unicode code point order of the UTF-8 name, so upper case sorts before lower case). Wallets with the same name are in the order they were created.
      * @param {string} [ownerId]
      * @param {string} [searchName] Wallet name to search using \&quot;begins-with\&quot; filter
+     * @param {string} [tenantId] Lists the wallets of every owner in this tenant instead, each with its ownerId. Only a Tenant Owner of the tenant may set it, and not together with ownerId.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    walletList(ownerId?: string, searchName?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<WalletListItem[], any, {}>>;
+    walletList(ownerId?: string, searchName?: string, tenantId?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<WalletListItem[], any, {}>>;
     /**
      * Gets a specific notification by state
      * @param {string} walletId Wallet ID
@@ -4327,7 +5337,7 @@ export declare class DefaultApi extends BaseAPI {
      */
     walletNotifications(walletId: string, eventType?: string, state?: string, lastEventID?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<File, any, {}>>;
     /**
-     * Update wallet metadata and configuration.
+     * Update wallet metadata and configuration.  The owner of the wallet patches its name, config and metadata; `config.tenant` is ignored for them. A Tenant Owner of the wallet\'s tenant patches `config.tenant.issuerProxyUrl`, also of wallets of other owners, and for those every other field of the body is ignored. `config.tenant.tenantId` never changes.
      * @param {string} walletId
      * @param {WalletPatchPayload} [walletPatchPayload]
      * @param {*} [options] Override http request option.