TS11 explained: the EUDI catalogue of Attestation Rulebooks and attributes

TS11 is the European Commission technical specification, current version v1.0.1 (2026-01), that fixes the data models and the HTTP interfaces for two Commission-run catalogues: the catalogue of attributes and the catalogue of Attestation Rulebooks. No further preamble: what those two catalogues contain, how the API works, and what TS11 means for an issuer or verifier is below.

El problema que resuelve TS11

Una relying party recibe una credencial y debe decidir si la acepta. Eso empieza por saber qué es el tipo de credencial: qué claims contiene, cómo están codificados, qué formato usa y qué trust anchors determinan quién puede emitirlo. Sin un registro común, ese conocimiento queda repartido en documentos dispersos y registros sectoriales, de modo que un nuevo tipo de credencial suele convertirse en una integración aparte, acordada parte por parte.

TS11 responde a esto con dos registros que la Comisión Europea está obligada a crear y gestionar. El catálogo de Attestation Rulebooks contiene una entrada legible por máquina por cada tipo de credencial, y TS11 especifica la API HTTP pública para leerlo: una relying party extrae la URI del esquema de una credencial recién recibida, consulta el catálogo y obtiene el esquema que necesita para validar los claims y el rulebook que rige ese tipo. El catálogo de atributos hace lo mismo un nivel más abajo, registrando qué significa un identificador de atributo y qué fuentes auténticas guardan el valor autorizado. Un issuer se registra una vez y cualquier wallet o relying party de la UE puede resolver el tipo sin contactarlo.

The two catalogues

Catalogue of attributes

An EU-wide registry of attribute definitions. Each entry records the attribute name, its identifier (a URI), a description, the legal basis for collecting it, the authentic sources that hold the authoritative value, and the namespaces and distributions through which it is published. Member states and authentic sources register entries.

Catalogue of Attestation Rulebooks

A machine-readable index of credential schema metadata. Each entry (a SchemaMeta object) points to the rulebook document and the schemas for a given credential type. Issuers register SchemaMeta entries so that verifiers can discover the rulebookURI and the schemaURIs they need to validate a credential they have received.

These are distinct registries with distinct purposes. Conflating them is the most common mistake when reading TS11 for the first time.

Attribute data model

Each entry in the catalogue of attributes is an object with the following fields. Fields marked M are mandatory.

Field	Type	Mandatory
name	multilingual array	M
identifier	URI	M
description	multilingual text	M
semanticDataSpecification	URI
distributions	array of SchemaDistribution	M
nameSpace	string
contactInfo	string	M
legalBasis	string
authenticSources	array of DataService	M

Sub-classes: DataService (country, nationalSubID, endpointDescription, endpointURL) and SchemaDistribution (accessURL, mediaType).

Worked example: urn:eudi:pid:1:family_name

{
  "identifier": "urn:eudi:pid:1:family_name",
  "name": [
    { "lang": "en", "value": "Family name" },
    { "lang": "nl", "value": "Achternaam" }
  ],
  "authenticSources": [
    { "country": "NL", "endpointDescription": "National civil registry" }
  ]
}

Attestation Rulebook data model (SchemaMeta)

Each entry in the catalogue of Attestation Rulebooks is a SchemaMeta object. Fields marked M are mandatory.

Field	Type	Mandatory
id	UUID	M
version	SemVer	M
rulebookURI	URI	M
trustedAuthorities	array of TrustAuthority
attestationLoS	enum: iso_18045_basic \| iso_18045_enhanced-basic \| iso_18045_moderate \| iso_18045_high	M
bindingType	enum: claim \| key \| biometric \| none	M
supportedFormats	array: dc+sd-jwt \| mso_mdoc \| jwt_vc_json \| jwt_vc_json-ld \| ldp_vc	M
schemaURIs	array of Schema	M

Sub-classes: Schema (formatIdentifier, uri), TrustAuthority (frameworkType, value, isLoTE). frameworkType enum: aki | etsi_tl | openid_federation.

Worked example: PID v1.8.0

{
  "id": "9f1c2a7e-5d38-4b0e-8c61-2a7d4e9b3f05",
  "version": "1.8.0",
  "rulebookURI": "https://github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog/...",
  "trustedAuthorities": [
    { "frameworkType": "etsi_tl", "value": "...", "isLoTE": true }
  ],
  "attestationLoS": "iso_18045_high",
  "bindingType": "key",
  "supportedFormats": ["dc+sd-jwt", "mso_mdoc"],
  "schemaURIs": [
    { "formatIdentifier": "dc+sd-jwt", "uri": "https://..." }
  ]
}

Human-readable rulebook vs machine-readable catalogue entry

The Attestation Rulebook itself is a Markdown document published in a public GitHub repository, written from the template the repository provides. The catalogue of Attestation Rulebooks holds the machine-readable SchemaMeta entry that points to that document via rulebookURI. Verifiers query the catalogue to discover the pointer; they then fetch the rulebook document from GitHub if they need the full specification.

Attestation Rulebooks on GitHub

The catalogue API

TS11 defines a normative OpenAPI 3.1 definition (an annex to the spec) with the following endpoints:

Public (no authentication)

GET /schemas -- list entries, supports filtering and pagination
GET /schemas/{schemaId} -- retrieve a single SchemaMeta entry

Restricted (owner only)

PUT /schemas/{schemaId} -- update your SchemaMeta entry
DELETE /schemas/{schemaId} -- remove your SchemaMeta entry

TS11 specifies the interface, not a deployment: the servers block in the normative OpenAPI file is still a placeholder, so the Commission has not yet published a base URL for the catalogue. Read and update responses are JWS-signed and served as application/jwt, with an x-jku-url header pointing at the JWKS that verifies them. URIs in entries may carry W3C Subresource Integrity metadata. Schemas are provided in JSON: a VCT for dc+sd-jwt and a DocType per ISO 23220-2 for mso_mdoc.

Una implementación real: la SIROS Foundation gestiona un registro público que publica Attestation Rulebooks y sus entradas SchemaMeta en formato TS11, una referencia útil al desarrollar conforme a la especificación. registry.siros.org

WE BUILD, el piloto europeo a gran escala para el sector de la construcción, publica sus tipos de credencial en ese registro bajo su propio namespace. registry.siros.org/webuild-consortium

Estado actual (2026-09)

El catálogo legible por personas está en marcha. La Comisión lo gestiona como un repositorio de GitHub, que por ahora contiene dos rulebooks, mdl y pid, junto a la plantilla para redactar otros nuevos.
github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog
El catálogo de atributos todavía no existe como registro TS11. Está pensado para alojarse en infraestructura de la Comisión que ya funciona, la Single Digital Gateway y el OOTS Semantic Repository, pero lo que ese repositorio publica hoy son EvidenceTypes y Data Services de OOTS, no entradas Attribute de TS11.
sr.oots.tech.ec.europa.eu
El catálogo legible por máquina de Attestation Rulebooks está especificado pero no desplegado. El bloque servers del archivo OpenAPI normativo es un marcador de posición, no se ha publicado ninguna URL base y el mecanismo de autorización para los métodos PUT y DELETE queda para una versión futura de la especificación.

Versioning

TS11 uses Semantic Versioning (SemVer) for both rulebook references and schema references. The version field in a SchemaMeta entry carries the SemVer string for that credential type. A newly published rulebook and its schema start at version 1.0. The schemas behind schemaURIs are provided in JSON, one per supported format.

TS11 in the wider EUDI stack

TS11 connects to several adjacent specifications:

OOTS Data Service Directory and Semantic Repository -- the Once-Only Technical System registers data services that overlap with the authentic sources tracked in the attribute catalogue
DCAT-AP 3.0 -- the EU application profile for data catalogue metadata; the attribute catalogue follows DCAT-AP conventions for dataset and distribution descriptions
ETSI TS 119 478 -- defines the authentic source interfaces that authentic sources must expose so that the attribute catalogue can point to them
ETSI TS 119 612 / 119 602 -- the trusted list format (119 612) and the List of Trusted Entities (LoTE, 119 602) that TrustAuthority entries with frameworkType etsi_tl reference

Dimension	Catalogue of attributes	Catalogue of Attestation Rulebooks
What it describes	Attribute definitions: name, identifier, semantics, authentic sources	Credential schema metadata: schemas, formats, trust authorities, LoS
Who registers	Member states and authentic sources	Issuers (via Commission-mediated authorisation)
Format	JSON with multilingual name arrays	SchemaMeta JSON, JSON schemas per format, responses JWS-signed
Public API	No API in TS11; hosted via the Single Digital Gateway, authentic source interfaces per ETSI TS 119 478	GET /schemas and GET /schemas/{schemaId} (no auth required)
Source of truth	Commission catalogue backed by national authentic source registrations	Commission catalogue + GitHub rulebook repository for human-readable docs

ETSI succession: EN 319 482-3

ETSI is developing EN 319 482-3 on the basis of EC TS11. The expected publication date is 2027-10-31. When published, EN 319 482-3 becomes the permanent European standard for the catalogue of Attestation Rulebooks and attributes. TS11 as written is an interim Commission specification, not the final form of the normative text. Implementers building on TS11 now should track the ETSI work item to identify any divergences when EN 319 482-3 is finalised.

Frequently asked questions

What is the difference between the two catalogues?

The catalogue of attributes defines what an attribute identifier means, its data type, its legal basis, and which authentic sources report it. The catalogue of Attestation Rulebooks defines what a credential type contains: which schemas it uses, which formats it supports, which trust authorities it relies on, and what level of security (attestationLoS) it is issued at. They are distinct registries with distinct purposes; an issuer registers in the Attestation Rulebook catalogue, not in the attribute catalogue.

Do I have to register my credential type?

Registration in the catalogue of Attestation Rulebooks is required to be discoverable within the EUDI Wallet ecosystem. Without a SchemaMeta entry, verifiers that encounter your credential type have no machine-readable pointer to the rulebookURI or schemaURIs they need to validate it. Registration is mediated through the European Commission infrastructure and is not self-service.

Is the catalogue API public?

Read operations (GET /schemas and GET /schemas/{schemaId}) are public and require no authentication. Write operations (PUT and DELETE on a schema entry) are restricted to the owner of that entry and require authorisation through the Commission infrastructure.

What replaces TS11?

ETSI is developing EN 319 482-3 on the basis of EC TS11, with an expected publication date of 2027-10-31. When that standard is published it becomes the permanent European standard. TS11 as written is an interim Commission specification, not the final form of the normative text.

How do I find the rulebook for a credential type I received?

Take the schema URI out of the credential, then filter the catalogue on it: GET /schemas?schemaUri=... returns the matching entry. Use GET /schemas/{schemaId} only when you already have the catalogue UUID, which the catalogue assigns and which is not the credential type identifier. Either way the entry carries a rulebookURI pointing at the rulebook document and schemaURIs pointing at the schemas you need to validate the claims.

Sources

This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and ETSI directly.

Talk to us about EUDI Wallet integration