TS11 explained: the EUDI catalogue of Attestation Rulebooks and attributes

TS11 is the European Commission technical specification, current version v1.0.1 (2026-01), that fixes the data models and the HTTP interfaces for two Commission-run catalogues: the catalogue of attributes and the catalogue of Attestation Rulebooks. No further preamble: what those two catalogues contain, how the API works, and what TS11 means for an issuer or verifier is below.

Problem, który rozwiązuje TS11

Relying party otrzymuje credential i musi zdecydować, czy go zaakceptować. Zaczyna się to od wiedzy o tym, czym jest dany typ credentiala: jakie zawiera claimy, jak są zakodowane, jakiego formatu używa i które trust anchors określają, kto może go wydać. Bez wspólnego rejestru wiedza ta pozostaje rozproszona w oddzielnych dokumentach i rejestrach branżowych, więc nowy typ credentiala zwykle staje się osobną integracją uzgadnianą z każdą stroną z osobna.

TS11 odpowiada na to dwoma rejestrami, które Komisja Europejska ma obowiązek utworzyć i prowadzić. Katalog Attestation Rulebooks zawiera jeden wpis w formacie maszynowym na każdy typ credentiala, a TS11 określa publiczne API HTTP do jego odczytu: relying party pobiera URI schematu z właśnie otrzymanego credentiala, odpytuje katalog i otrzymuje schemat potrzebny do walidacji claimów oraz rulebook opisujący ten typ. Katalog atrybutów robi to samo poziom niżej, zapisując, co oznacza identyfikator atrybutu i które źródła autentyczne przechowują wartość wiążącą. Issuer rejestruje się raz, a każdy wallet i każda relying party w UE może rozwiązać ten typ bez kontaktowania się z nim.

The two catalogues

Catalogue of attributes

An EU-wide registry of attribute definitions. Each entry records the attribute name, its identifier (a URI), a description, the legal basis for collecting it, the authentic sources that hold the authoritative value, and the namespaces and distributions through which it is published. Member states and authentic sources register entries.

Catalogue of Attestation Rulebooks

A machine-readable index of credential schema metadata. Each entry (a SchemaMeta object) points to the rulebook document and the schemas for a given credential type. Issuers register SchemaMeta entries so that verifiers can discover the rulebookURI and the schemaURIs they need to validate a credential they have received.

These are distinct registries with distinct purposes. Conflating them is the most common mistake when reading TS11 for the first time.

Attribute data model

Each entry in the catalogue of attributes is an object with the following fields. Fields marked M are mandatory.

Field	Type	Mandatory
name	multilingual array	M
identifier	URI	M
description	multilingual text	M
semanticDataSpecification	URI
distributions	array of SchemaDistribution	M
nameSpace	string
contactInfo	string	M
legalBasis	string
authenticSources	array of DataService	M

Sub-classes: DataService (country, nationalSubID, endpointDescription, endpointURL) and SchemaDistribution (accessURL, mediaType).

Worked example: urn:eudi:pid:1:family_name

{
  "identifier": "urn:eudi:pid:1:family_name",
  "name": [
    { "lang": "en", "value": "Family name" },
    { "lang": "nl", "value": "Achternaam" }
  ],
  "authenticSources": [
    { "country": "NL", "endpointDescription": "National civil registry" }
  ]
}

Attestation Rulebook data model (SchemaMeta)

Each entry in the catalogue of Attestation Rulebooks is a SchemaMeta object. Fields marked M are mandatory.

Field	Type	Mandatory
id	UUID	M
version	SemVer	M
rulebookURI	URI	M
trustedAuthorities	array of TrustAuthority
attestationLoS	enum: iso_18045_basic \| iso_18045_enhanced-basic \| iso_18045_moderate \| iso_18045_high	M
bindingType	enum: claim \| key \| biometric \| none	M
supportedFormats	array: dc+sd-jwt \| mso_mdoc \| jwt_vc_json \| jwt_vc_json-ld \| ldp_vc	M
schemaURIs	array of Schema	M

Sub-classes: Schema (formatIdentifier, uri), TrustAuthority (frameworkType, value, isLoTE). frameworkType enum: aki | etsi_tl | openid_federation.

Worked example: PID v1.8.0

{
  "id": "9f1c2a7e-5d38-4b0e-8c61-2a7d4e9b3f05",
  "version": "1.8.0",
  "rulebookURI": "https://github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog/...",
  "trustedAuthorities": [
    { "frameworkType": "etsi_tl", "value": "...", "isLoTE": true }
  ],
  "attestationLoS": "iso_18045_high",
  "bindingType": "key",
  "supportedFormats": ["dc+sd-jwt", "mso_mdoc"],
  "schemaURIs": [
    { "formatIdentifier": "dc+sd-jwt", "uri": "https://..." }
  ]
}

Human-readable rulebook vs machine-readable catalogue entry

The Attestation Rulebook itself is a Markdown document published in a public GitHub repository, written from the template the repository provides. The catalogue of Attestation Rulebooks holds the machine-readable SchemaMeta entry that points to that document via rulebookURI. Verifiers query the catalogue to discover the pointer; they then fetch the rulebook document from GitHub if they need the full specification.

Attestation Rulebooks on GitHub

The catalogue API

TS11 defines a normative OpenAPI 3.1 definition (an annex to the spec) with the following endpoints:

Public (no authentication)

GET /schemas -- list entries, supports filtering and pagination
GET /schemas/{schemaId} -- retrieve a single SchemaMeta entry

Restricted (owner only)

PUT /schemas/{schemaId} -- update your SchemaMeta entry
DELETE /schemas/{schemaId} -- remove your SchemaMeta entry

TS11 specifies the interface, not a deployment: the servers block in the normative OpenAPI file is still a placeholder, so the Commission has not yet published a base URL for the catalogue. Read and update responses are JWS-signed and served as application/jwt, with an x-jku-url header pointing at the JWKS that verifies them. URIs in entries may carry W3C Subresource Integrity metadata. Schemas are provided in JSON: a VCT for dc+sd-jwt and a DocType per ISO 23220-2 for mso_mdoc.

Wdrożenie w praktyce: SIROS Foundation prowadzi publiczny rejestr, w którym publikuje Attestation Rulebooks i powiązane wpisy SchemaMeta w formacie TS11, co stanowi przydatny punkt odniesienia przy pracy ze specyfikacją. registry.siros.org

WE BUILD, unijny pilotaż na dużą skalę dla sektora budowlanego, publikuje swoje typy credentiali w tym rejestrze we własnej przestrzeni nazw. registry.siros.org/webuild-consortium

Stan obecny (2026-09)

Katalog czytelny dla ludzi już działa. Komisja prowadzi go jako repozytorium GitHub, które obecnie zawiera dwa rulebooki, mdl i pid, obok szablonu do pisania kolejnych.
github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog
Katalog atrybutów jeszcze nie istnieje jako rejestr TS11. Ma być prowadzony na infrastrukturze Komisji, która już działa, czyli Single Digital Gateway i OOTS Semantic Repository, ale to, co repozytorium publikuje dzisiaj, to EvidenceTypes i Data Services z OOTS, a nie wpisy Attribute według TS11.
sr.oots.tech.ec.europa.eu
Katalog Attestation Rulebooks czytelny maszynowo jest opisany, ale nie wdrożony. Blok servers w normatywnym pliku OpenAPI to symbol zastępczy, nie opublikowano żadnego adresu bazowego, a mechanizm autoryzacji metod PUT i DELETE pozostawiono przyszłej wersji specyfikacji.

Versioning

TS11 uses Semantic Versioning (SemVer) for both rulebook references and schema references. The version field in a SchemaMeta entry carries the SemVer string for that credential type. A newly published rulebook and its schema start at version 1.0. The schemas behind schemaURIs are provided in JSON, one per supported format.

TS11 in the wider EUDI stack

TS11 connects to several adjacent specifications:

OOTS Data Service Directory and Semantic Repository -- the Once-Only Technical System registers data services that overlap with the authentic sources tracked in the attribute catalogue
DCAT-AP 3.0 -- the EU application profile for data catalogue metadata; the attribute catalogue follows DCAT-AP conventions for dataset and distribution descriptions
ETSI TS 119 478 -- defines the authentic source interfaces that authentic sources must expose so that the attribute catalogue can point to them
ETSI TS 119 612 / 119 602 -- the trusted list format (119 612) and the List of Trusted Entities (LoTE, 119 602) that TrustAuthority entries with frameworkType etsi_tl reference

Dimension	Catalogue of attributes	Catalogue of Attestation Rulebooks
What it describes	Attribute definitions: name, identifier, semantics, authentic sources	Credential schema metadata: schemas, formats, trust authorities, LoS
Who registers	Member states and authentic sources	Issuers (via Commission-mediated authorisation)
Format	JSON with multilingual name arrays	SchemaMeta JSON, JSON schemas per format, responses JWS-signed
Public API	No API in TS11; hosted via the Single Digital Gateway, authentic source interfaces per ETSI TS 119 478	GET /schemas and GET /schemas/{schemaId} (no auth required)
Source of truth	Commission catalogue backed by national authentic source registrations	Commission catalogue + GitHub rulebook repository for human-readable docs

ETSI succession: EN 319 482-3

ETSI is developing EN 319 482-3 on the basis of EC TS11. The expected publication date is 2027-10-31. When published, EN 319 482-3 becomes the permanent European standard for the catalogue of Attestation Rulebooks and attributes. TS11 as written is an interim Commission specification, not the final form of the normative text. Implementers building on TS11 now should track the ETSI work item to identify any divergences when EN 319 482-3 is finalised.

Frequently asked questions

What is the difference between the two catalogues?

The catalogue of attributes defines what an attribute identifier means, its data type, its legal basis, and which authentic sources report it. The catalogue of Attestation Rulebooks defines what a credential type contains: which schemas it uses, which formats it supports, which trust authorities it relies on, and what level of security (attestationLoS) it is issued at. They are distinct registries with distinct purposes; an issuer registers in the Attestation Rulebook catalogue, not in the attribute catalogue.

Do I have to register my credential type?

Registration in the catalogue of Attestation Rulebooks is required to be discoverable within the EUDI Wallet ecosystem. Without a SchemaMeta entry, verifiers that encounter your credential type have no machine-readable pointer to the rulebookURI or schemaURIs they need to validate it. Registration is mediated through the European Commission infrastructure and is not self-service.

Is the catalogue API public?

Read operations (GET /schemas and GET /schemas/{schemaId}) are public and require no authentication. Write operations (PUT and DELETE on a schema entry) are restricted to the owner of that entry and require authorisation through the Commission infrastructure.

What replaces TS11?

ETSI is developing EN 319 482-3 on the basis of EC TS11, with an expected publication date of 2027-10-31. When that standard is published it becomes the permanent European standard. TS11 as written is an interim Commission specification, not the final form of the normative text.

How do I find the rulebook for a credential type I received?

Take the schema URI out of the credential, then filter the catalogue on it: GET /schemas?schemaUri=... returns the matching entry. Use GET /schemas/{schemaId} only when you already have the catalogue UUID, which the catalogue assigns and which is not the credential type identifier. Either way the entry carries a rulebookURI pointing at the rulebook document and schemaURIs pointing at the schemas you need to validate the claims.

Sources

This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and ETSI directly.

Talk to us about EUDI Wallet integration