TS11 explained: the EUDI catalogue of Attestation Rulebooks and attributes

TS11 is the European Commission technical specification, current version v1.0.1 (2026-01), that fixes the data models and the HTTP interfaces for two Commission-run catalogues: the catalogue of attributes and the catalogue of Attestation Rulebooks. No further preamble: what those two catalogues contain, how the API works, and what TS11 means for an issuer or verifier is below.

Problemet, som TS11 løser

En relying party modtager en credential og skal afgøre, om den skal accepteres. Det starter med at vide, hvad credential-typen er: hvilke claims den indeholder, hvordan de er kodet, hvilket format den bruger, og hvilke trust anchors der afgør, hvem der må udstede den. Uden et fælles register ligger den viden spredt i løse dokumenter og brancheregistre, så en ny credential-type typisk bliver en separat integration, der aftales part for part.

TS11 svarer på det med to registre, som Europa-Kommissionen er forpligtet til at oprette og drive. Kataloget over Attestation Rulebooks har én maskinlæsbar post pr. credential-type, og TS11 specificerer det offentlige HTTP-API til at læse den: en relying party tager skema-URI'en ud af en credential, den lige har modtaget, forespørger i kataloget og får det skema tilbage, den skal bruge til at validere claims, samt den rulebook, der styrer typen. Attributkataloget gør det samme et niveau nede og registrerer, hvad en attributidentifikator betyder, og hvilke autentiske kilder der har den autoritative værdi. En issuer registrerer sig én gang, og enhver wallet og relying party i EU kan slå typen op uden at kontakte den.

The two catalogues

Catalogue of attributes

An EU-wide registry of attribute definitions. Each entry records the attribute name, its identifier (a URI), a description, the legal basis for collecting it, the authentic sources that hold the authoritative value, and the namespaces and distributions through which it is published. Member states and authentic sources register entries.

Catalogue of Attestation Rulebooks

A machine-readable index of credential schema metadata. Each entry (a SchemaMeta object) points to the rulebook document and the schemas for a given credential type. Issuers register SchemaMeta entries so that verifiers can discover the rulebookURI and the schemaURIs they need to validate a credential they have received.

These are distinct registries with distinct purposes. Conflating them is the most common mistake when reading TS11 for the first time.

Attribute data model

Each entry in the catalogue of attributes is an object with the following fields. Fields marked M are mandatory.

Field	Type	Mandatory
name	multilingual array	M
identifier	URI	M
description	multilingual text	M
semanticDataSpecification	URI
distributions	array of SchemaDistribution	M
nameSpace	string
contactInfo	string	M
legalBasis	string
authenticSources	array of DataService	M

Sub-classes: DataService (country, nationalSubID, endpointDescription, endpointURL) and SchemaDistribution (accessURL, mediaType).

Worked example: urn:eudi:pid:1:family_name

{
  "identifier": "urn:eudi:pid:1:family_name",
  "name": [
    { "lang": "en", "value": "Family name" },
    { "lang": "nl", "value": "Achternaam" }
  ],
  "authenticSources": [
    { "country": "NL", "endpointDescription": "National civil registry" }
  ]
}

Attestation Rulebook data model (SchemaMeta)

Each entry in the catalogue of Attestation Rulebooks is a SchemaMeta object. Fields marked M are mandatory.

Field	Type	Mandatory
id	UUID	M
version	SemVer	M
rulebookURI	URI	M
trustedAuthorities	array of TrustAuthority
attestationLoS	enum: iso_18045_basic \| iso_18045_enhanced-basic \| iso_18045_moderate \| iso_18045_high	M
bindingType	enum: claim \| key \| biometric \| none	M
supportedFormats	array: dc+sd-jwt \| mso_mdoc \| jwt_vc_json \| jwt_vc_json-ld \| ldp_vc	M
schemaURIs	array of Schema	M

Sub-classes: Schema (formatIdentifier, uri), TrustAuthority (frameworkType, value, isLoTE). frameworkType enum: aki | etsi_tl | openid_federation.

Worked example: PID v1.8.0

{
  "id": "9f1c2a7e-5d38-4b0e-8c61-2a7d4e9b3f05",
  "version": "1.8.0",
  "rulebookURI": "https://github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog/...",
  "trustedAuthorities": [
    { "frameworkType": "etsi_tl", "value": "...", "isLoTE": true }
  ],
  "attestationLoS": "iso_18045_high",
  "bindingType": "key",
  "supportedFormats": ["dc+sd-jwt", "mso_mdoc"],
  "schemaURIs": [
    { "formatIdentifier": "dc+sd-jwt", "uri": "https://..." }
  ]
}

Human-readable rulebook vs machine-readable catalogue entry

The Attestation Rulebook itself is a Markdown document published in a public GitHub repository, written from the template the repository provides. The catalogue of Attestation Rulebooks holds the machine-readable SchemaMeta entry that points to that document via rulebookURI. Verifiers query the catalogue to discover the pointer; they then fetch the rulebook document from GitHub if they need the full specification.

Attestation Rulebooks on GitHub

The catalogue API

TS11 defines a normative OpenAPI 3.1 definition (an annex to the spec) with the following endpoints:

Public (no authentication)

GET /schemas -- list entries, supports filtering and pagination
GET /schemas/{schemaId} -- retrieve a single SchemaMeta entry

Restricted (owner only)

PUT /schemas/{schemaId} -- update your SchemaMeta entry
DELETE /schemas/{schemaId} -- remove your SchemaMeta entry

TS11 specifies the interface, not a deployment: the servers block in the normative OpenAPI file is still a placeholder, so the Commission has not yet published a base URL for the catalogue. Read and update responses are JWS-signed and served as application/jwt, with an x-jku-url header pointing at the JWKS that verifies them. URIs in entries may carry W3C Subresource Integrity metadata. Schemas are provided in JSON: a VCT for dc+sd-jwt and a DocType per ISO 23220-2 for mso_mdoc.

En implementering i praksis: SIROS Foundation driver et offentligt register, der udgiver Attestation Rulebooks og deres SchemaMeta-poster i TS11-formatet, en nyttig reference, når du bygger efter specifikationen. registry.siros.org

WE BUILD, EU's storskalapilot for byggebranchen, udgiver sine credential-typer i det register under sit eget namespace. registry.siros.org/webuild-consortium

Aktuel status (2026-09)

Det menneskelæsbare katalog er i drift. Kommissionen driver det som et GitHub-repositorium, der i øjeblikket indeholder to rulebooks, mdl og pid, ved siden af skabelonen til at skrive nye.
github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog
Attributkataloget findes endnu ikke som et TS11-register. Det er tænkt at ligge på infrastruktur i Kommissionen, der allerede kører, Single Digital Gateway og OOTS Semantic Repository, men det, dette repositorium udgiver i dag, er OOTS EvidenceTypes og Data Services, ikke TS11 Attribute-poster.
sr.oots.tech.ec.europa.eu
Det maskinlæsbare katalog over Attestation Rulebooks er specificeret, men ikke sat i drift. Servers-blokken i den normative OpenAPI-fil er en pladsholder, der er ikke offentliggjort nogen basis-URL, og autorisationsmekanismen for PUT- og DELETE-metoderne overlades til en fremtidig version af specifikationen.

Versioning

TS11 uses Semantic Versioning (SemVer) for both rulebook references and schema references. The version field in a SchemaMeta entry carries the SemVer string for that credential type. A newly published rulebook and its schema start at version 1.0. The schemas behind schemaURIs are provided in JSON, one per supported format.

TS11 in the wider EUDI stack

TS11 connects to several adjacent specifications:

OOTS Data Service Directory and Semantic Repository -- the Once-Only Technical System registers data services that overlap with the authentic sources tracked in the attribute catalogue
DCAT-AP 3.0 -- the EU application profile for data catalogue metadata; the attribute catalogue follows DCAT-AP conventions for dataset and distribution descriptions
ETSI TS 119 478 -- defines the authentic source interfaces that authentic sources must expose so that the attribute catalogue can point to them
ETSI TS 119 612 / 119 602 -- the trusted list format (119 612) and the List of Trusted Entities (LoTE, 119 602) that TrustAuthority entries with frameworkType etsi_tl reference

Dimension	Catalogue of attributes	Catalogue of Attestation Rulebooks
What it describes	Attribute definitions: name, identifier, semantics, authentic sources	Credential schema metadata: schemas, formats, trust authorities, LoS
Who registers	Member states and authentic sources	Issuers (via Commission-mediated authorisation)
Format	JSON with multilingual name arrays	SchemaMeta JSON, JSON schemas per format, responses JWS-signed
Public API	No API in TS11; hosted via the Single Digital Gateway, authentic source interfaces per ETSI TS 119 478	GET /schemas and GET /schemas/{schemaId} (no auth required)
Source of truth	Commission catalogue backed by national authentic source registrations	Commission catalogue + GitHub rulebook repository for human-readable docs

ETSI succession: EN 319 482-3

ETSI is developing EN 319 482-3 on the basis of EC TS11. The expected publication date is 2027-10-31. When published, EN 319 482-3 becomes the permanent European standard for the catalogue of Attestation Rulebooks and attributes. TS11 as written is an interim Commission specification, not the final form of the normative text. Implementers building on TS11 now should track the ETSI work item to identify any divergences when EN 319 482-3 is finalised.

Frequently asked questions

What is the difference between the two catalogues?

The catalogue of attributes defines what an attribute identifier means, its data type, its legal basis, and which authentic sources report it. The catalogue of Attestation Rulebooks defines what a credential type contains: which schemas it uses, which formats it supports, which trust authorities it relies on, and what level of security (attestationLoS) it is issued at. They are distinct registries with distinct purposes; an issuer registers in the Attestation Rulebook catalogue, not in the attribute catalogue.

Do I have to register my credential type?

Registration in the catalogue of Attestation Rulebooks is required to be discoverable within the EUDI Wallet ecosystem. Without a SchemaMeta entry, verifiers that encounter your credential type have no machine-readable pointer to the rulebookURI or schemaURIs they need to validate it. Registration is mediated through the European Commission infrastructure and is not self-service.

Is the catalogue API public?

Read operations (GET /schemas and GET /schemas/{schemaId}) are public and require no authentication. Write operations (PUT and DELETE on a schema entry) are restricted to the owner of that entry and require authorisation through the Commission infrastructure.

What replaces TS11?

ETSI is developing EN 319 482-3 on the basis of EC TS11, with an expected publication date of 2027-10-31. When that standard is published it becomes the permanent European standard. TS11 as written is an interim Commission specification, not the final form of the normative text.

How do I find the rulebook for a credential type I received?

Take the schema URI out of the credential, then filter the catalogue on it: GET /schemas?schemaUri=... returns the matching entry. Use GET /schemas/{schemaId} only when you already have the catalogue UUID, which the catalogue assigns and which is not the credential type identifier. Either way the entry carries a rulebookURI pointing at the rulebook document and schemaURIs pointing at the schemas you need to validate the claims.

Sources

This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and ETSI directly.

Talk to us about EUDI Wallet integration