Thoryn

Wallet profiles · Wallet profiles

Employer onboarding — multi-credential

Wallet profile that requests a Diploma, Tax ID, and Address credential in one round-trip. Use it for new-hire onboarding at scale.

Tested against:broker: 1.0.0arf: 1.4

wallet-profiles recipe — shared category architecture: how this pattern composes with Hub, Broker, and the rest of the catalog

Use case

An international consulting firm hiring 500+ junior consultants annually replaces document-upload onboarding with a single multi-credential presentation. The new hire's wallet returns three credentials — diploma, tax ID, address — in one round-trip, each from its authoritative issuer.

Wallet profile (YAML)

id: employer-onboarding
name: "New hire onboarding"
accepted_formats:
  - vc+sd-jwt
trust_registry_url: https://trust.thoryn.org
allowed_issuers:
  - "did:diploma:tu-delft"
  - "did:diploma:uva"
  - "did:diploma:vu-amsterdam"
  - "did:tax:nl-belastingdienst"
  - "did:tax:de-bundeszentralamt"
  - "did:civic:nl-rvig"
session_ttl_seconds: 900
require_holder_binding: true
policy_rule_id: multi-credential-issuer

Presentation definition (multi-credential)

{
  "id": "employer-onboarding-pd",
  "input_descriptors": [
    {
      "id": "diploma",
      "constraints": {
        "fields": [
          { "path": ["$.vct"], "filter": { "const": "DiplomaCredential" } },
          { "path": ["$.programme"] },
          { "path": ["$.degree"] },
          { "path": ["$.graduated_at"] }
        ]
      }
    },
    {
      "id": "tax-id",
      "constraints": {
        "fields": [
          { "path": ["$.vct"], "filter": { "const": "TaxIDCredential" } },
          { "path": ["$.tax_id"] }
        ]
      }
    },
    {
      "id": "address",
      "constraints": {
        "fields": [
          { "path": ["$.vct"], "filter": { "const": "AddressCredential" } },
          { "path": ["$.street"] },
          { "path": ["$.postal_code"] },
          { "path": ["$.locality"] }
        ]
      }
    }
  ]
}

The wallet matches three credentials, each independently verified by Broker (different issuers, different trust chains). The webhook delivers all three sets of claims in one payload.

Pair with the policy rule

This profile pairs with the multi-credential-issuer rule — once Broker delivers the verified claims, Policy Engine confirms each issuer is on the authorised list before passing through to your HR system.

When to use

  • Bulk onboarding flows
  • Regulated employers where each credential type has its own issuer trust chain

When not to use

  • Single-credential flows (KYC, age-gate)
  • Phased onboarding where each credential is collected separately

See also

More wallet profiles