Skip to main content

Features

Specifies which features are enabled for this API instance.

type Features {
  demoEnabled: Boolean!
  devToolsEnabled: Boolean!
  faceCheckEnabled: Boolean!
  findTenantIdentities: Boolean!
  mdocPresentationFlowEnabled: Boolean!
  oidcEnabled: Boolean!
  passkeysActive: Boolean!
  passkeysEnabled: Boolean!
  serviceFirstAddressingActive: Boolean!
  trinsicIdvEnabled: Boolean!
}

Fields​

Features.demoEnabled ● Boolean! non-null scalar​

Indicates whether the demo features (presentation demo page, authn demo page, .etc) are available.

Features.devToolsEnabled ● Boolean! non-null scalar​

Indicates whether additional API dev tools (PKCE, cookie session) are available.

Features.faceCheckEnabled ● Boolean! non-null scalar​

Indicates whether the face check features (i.e. issuing credentials with face check photo, .etc) are available

Features.findTenantIdentities ● Boolean! non-null scalar​

Indicates whether the API instance is configured to support finding home tenant identities via the findTenantIdentities query.

Features.mdocPresentationFlowEnabled ● Boolean! non-null scalar​

Indicates whether the mDoc/Google Wallet ID presentation flow feature is available.

Features.oidcEnabled ● Boolean! non-null scalar​

Indicates whether the OIDC provider is available.

Features.passkeysActive ● Boolean! non-null scalar​

Indicates whether passkey (WebAuthn) registration and login are active AND usable right now. This is the effective state: the deploy-level master switch (passkeysEnabled) AND the per-instance setting toggled on by an admin AND the effective holder-facing host (urls.effectiveConciergeUrl) being registrable under the WebAuthn RP ID. It is false while that host cannot complete a ceremony — e.g. the legacy portal host before the service-first cutover — so clients never surface a passkey action that would only fail.

Features.passkeysEnabled ● Boolean! non-null scalar​

Indicates whether the deploy-level passkey master switch is on, i.e. whether this deployment is cleared to use passkeys (production hostname/RP-ID work complete). When true, the per-instance passkey setting may be toggled; passkeys are only active once that setting is also enabled. Mirrors the PASSKEYS_ENABLED deploy config flag.

Features.serviceFirstAddressingActive ● Boolean! non-null scalar​

Indicates whether the instance has switched over to service-first addressing. What this gates: the OIDC issuer/authority (urls.effectiveOidcAuthorityUrl, api.<root>/oidc when true), the set of issuers accepted by token validation, the effective API host (urls.effectiveApiUrl) and the effective holder-facing Concierge host (urls.effectiveConciergeUrl).

What it does NOT gate: the WebAuthn RP ID, which is the apex instance root regardless. Passkey ceremonies therefore must always run on a root subdomain (e.g. concierge.<root>), so a client served elsewhere should redirect to urls.conciergeUrl before starting a ceremony whenever that URL is advertised — do not condition that redirect on this flag. See passkeysActive for whether a passkey action should be offered at all.

Features.trinsicIdvEnabled ● Boolean! non-null scalar​

Indicates whether Trinsic IDV is available as a verification method on remote issuances.

Member Of​

Discovery object