Electronic Signatures and Trust Infrastructures (ESI); Specification of interfaces related to Authentic Sources

Note

ETSI technical specification on interfaces with authentic sources, linked to the obligation in Article 45e to verify certain attributes at the user's request (version 1.1.1).

Summary

Purpose

Technical specification ETSI TS 119 478 (version 1.1.1, January 2026) defines the interfaces that allow attributes to be verified against authentic sources ETSI TS 119 478 V1.1.1, § 1 Scope ETSI TS 119 478 V1.1.1, History. An authentic source is a repository or system, held under the responsibility of a public sector body or private entity, that contains and provides attributes about a person Art. 3(47). The specification describes its verification interface as follows:

It also defines a discovery interface (I1), an optional attribute retrieval interface (I3) and an authorisation interface (I4) ETSI TS 119 478 V1.1.1, § 1 Scope ETSI TS 119 478 V1.1.1, § 6.1.3 I4 (Authorize). Its scope refers to Article 9 of Implementing Regulation 2025/1569 ETSI TS 119 478 V1.1.1, § 1 Scope.

Who it applies to

• Member States, which establish mechanisms allowing qualified trust service providers issuing qualified electronic attestations of attributes (QEAA) to have attributes verified, at the request of the user Art. 9(1).
• Public sector bodies responsible for an authentic source and designated intermediaries, which share the result through the verification point Art. 9(2).
• Qualified trust service providers that issue QEAA, on the requesting side Art. 9(2).

Key points

• Two implementations of the verification interface: one based on HTTP and OAuth (clause 6.1), the other on standard ISO 15000 (clause 6.2) ETSI TS 119 478 V1.1.1, § 6.1 Authentic Source Interface based on HTTP / OAuth ETSI TS 119 478 V1.1.1, § 6.2.1 Overview.
• Four possible results for each attribute, in the HTTP implementation: exact match, no match, match with an accepted spelling variant, or unknown result for lack of data ETSI TS 119 478 V1.1.1, § 6.1.1.2 Verify Response.
• Discovery (clause 5): interface I1 gives access to the semantic repository and the data service directory of the once-only technical system (OOTS) ETSI TS 119 478 V1.1.1, § 1 Scope ETSI TS 119 478 V1.1.1, § 5 Discover Interface.
• Authorisation: interface I4 relies on OAuth dynamic client registration and authorization code flow ETSI TS 119 478 V1.1.1, § 6.1.3 I4 (Authorize).
• Schemas: OpenAPI specifications (Annexes A and B) and XML schemas (Annex C) ETSI TS 119 478 V1.1.1, Annex B (normative): OpenAPI Specification for Authentic Source Interface ETSI TS 119 478 V1.1.1, Annex C (normative): XML-Schemata for PID and RIM binding.

What the acts apply, and how

Annex IV to Implementing Regulation 2025/1569, added by Implementing Regulation 2026/1735, provides that the verification mechanisms of Article 9 comply with one of the following two clauses, or with both, subject to adaptations Annex IV Art. 1(6):

• clause 6.1.1 (verification over HTTP and OAuth);
• clause 6.2.3 (verification according to ISO 15000).

Partial reference: the other interfaces (discovery, retrieval, authorisation) are not targeted by the annex Annex IV.

Adaptations: in the specification, a positive response must return the value of the attribute ETSI TS 119 478 V1.1.1, § 6.1.1.2 Verify Response ETSI TS 119 478 V1.1.1, § 6.2.3.2.1 Successful Verify Response; the annex makes this merely optional. For clause 6.1.1, the value may be returned; if it is, it is the value of the request in the case of an exact match, and that of the source in the case of a variant. For clause 6.2.3, the response may contain exactly one child element, of choice Annex IV. Until 31 December 2026, the Regulation provides that the result states exclusively whether the attribute has been verified or not, and the public sector body concerned Art. 9(4).

Dates: the verification mechanisms apply from 19 August 2026 Art. 11. Implementing Regulation 2026/1735 inserts into the article governing them a paragraph 2a, under which the verification mechanism complies with the specifications of Annex IV, and replaces paragraph 4: the new text no longer contains the word exclusively, and the result will have to be signed or sealed by the public sector body or the designated intermediary Art. 1(3). Both amendments apply from 1 January 2027 Art. 2.

Regime: it is a compliance requirement for the mechanisms established by Member States; the article of Regulation 910/2014 that empowers the Commission on the verification of attributes contains no presumption sentence Art. 45e(2).

Important clauses

• ETSI TS 119 478 V1.1.1, § 1 Scope: scope.
• ETSI TS 119 478 V1.1.1, § 6.1.1 I2 (Verify): verification over HTTP and OAuth (targeted).
• ETSI TS 119 478 V1.1.1, § 6.2.3 I2 (Verify): verification according to ISO 15000 (targeted).
• ETSI TS 119 478 V1.1.1, § 5 Discover Interface: discovery (not targeted).

Links

• Requirements for attestation providers: ETSI TS 119 471 ETSI TS 119 471 V1.1.1, whose clause on verification against authentic sources is not applicable under Annex I to the same Regulation Annex I.
• Learning path: step 7, the attestation issuer.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 478 V1.1.1. Written by Asphalia.