TS11 explained: the EUDI catalogue of Attestation Rulebooks and attributes

TS11 is the European Commission technical specification, current version v1.0.1 (2026-01), that fixes the data models and the HTTP interfaces for two Commission-run catalogues: the catalogue of attributes and the catalogue of Attestation Rulebooks. No further preamble: what those two catalogues contain, how the API works, and what TS11 means for an issuer or verifier is below.

Problém, ktorý rieši TS11

Relying party dostane credential a musí sa rozhodnúť, či ho prijme. Začína to znalosťou toho, čo daný typ credentialu je: aké claimy obsahuje, ako sú zakódované, aký formát používa a ktoré trust anchors určujú, kto ho smie vydávať. Bez spoločného registra zostávajú tieto informácie roztrúsené v jednotlivých dokumentoch a odvetvových registroch, takže nový typ credentialu sa zvyčajne stáva samostatnou integráciou dojednávanou so stranou po strane.

TS11 na to odpovedá dvoma registrami, ktoré je Európska komisia povinná zriadiť a prevádzkovať. Katalóg Attestation Rulebooks obsahuje pre každý typ credentialu jeden strojovo čitateľný záznam a TS11 špecifikuje verejné HTTP API na jeho čítanie: relying party vezme z práve prijatého credentialu URI schémy, dopytuje sa katalógu a získa schému potrebnú na validáciu claimov aj rulebook upravujúci daný typ. Katalóg atribútov robí to isté o úroveň nižšie a zaznamenáva, čo identifikátor atribútu znamená a ktoré autentické zdroje držia autoritatívnu hodnotu. Issuer sa zaregistruje raz a každý wallet aj relying party v EÚ si typ dohľadá bez toho, aby ho kontaktoval.

The two catalogues

Catalogue of attributes

An EU-wide registry of attribute definitions. Each entry records the attribute name, its identifier (a URI), a description, the legal basis for collecting it, the authentic sources that hold the authoritative value, and the namespaces and distributions through which it is published. Member states and authentic sources register entries.

Catalogue of Attestation Rulebooks

A machine-readable index of credential schema metadata. Each entry (a SchemaMeta object) points to the rulebook document and the schemas for a given credential type. Issuers register SchemaMeta entries so that verifiers can discover the rulebookURI and the schemaURIs they need to validate a credential they have received.

These are distinct registries with distinct purposes. Conflating them is the most common mistake when reading TS11 for the first time.

Attribute data model

Each entry in the catalogue of attributes is an object with the following fields. Fields marked M are mandatory.

Field	Type	Mandatory
name	multilingual array	M
identifier	URI	M
description	multilingual text	M
semanticDataSpecification	URI
distributions	array of SchemaDistribution	M
nameSpace	string
contactInfo	string	M
legalBasis	string
authenticSources	array of DataService	M

Sub-classes: DataService (country, nationalSubID, endpointDescription, endpointURL) and SchemaDistribution (accessURL, mediaType).

Worked example: urn:eudi:pid:1:family_name

{
  "identifier": "urn:eudi:pid:1:family_name",
  "name": [
    { "lang": "en", "value": "Family name" },
    { "lang": "nl", "value": "Achternaam" }
  ],
  "authenticSources": [
    { "country": "NL", "endpointDescription": "National civil registry" }
  ]
}

Attestation Rulebook data model (SchemaMeta)

Each entry in the catalogue of Attestation Rulebooks is a SchemaMeta object. Fields marked M are mandatory.

Field	Type	Mandatory
id	UUID	M
version	SemVer	M
rulebookURI	URI	M
trustedAuthorities	array of TrustAuthority
attestationLoS	enum: iso_18045_basic \| iso_18045_enhanced-basic \| iso_18045_moderate \| iso_18045_high	M
bindingType	enum: claim \| key \| biometric \| none	M
supportedFormats	array: dc+sd-jwt \| mso_mdoc \| jwt_vc_json \| jwt_vc_json-ld \| ldp_vc	M
schemaURIs	array of Schema	M

Sub-classes: Schema (formatIdentifier, uri), TrustAuthority (frameworkType, value, isLoTE). frameworkType enum: aki | etsi_tl | openid_federation.

Worked example: PID v1.8.0

{
  "id": "9f1c2a7e-5d38-4b0e-8c61-2a7d4e9b3f05",
  "version": "1.8.0",
  "rulebookURI": "https://github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog/...",
  "trustedAuthorities": [
    { "frameworkType": "etsi_tl", "value": "...", "isLoTE": true }
  ],
  "attestationLoS": "iso_18045_high",
  "bindingType": "key",
  "supportedFormats": ["dc+sd-jwt", "mso_mdoc"],
  "schemaURIs": [
    { "formatIdentifier": "dc+sd-jwt", "uri": "https://..." }
  ]
}

Human-readable rulebook vs machine-readable catalogue entry

The Attestation Rulebook itself is a Markdown document published in a public GitHub repository, written from the template the repository provides. The catalogue of Attestation Rulebooks holds the machine-readable SchemaMeta entry that points to that document via rulebookURI. Verifiers query the catalogue to discover the pointer; they then fetch the rulebook document from GitHub if they need the full specification.

Attestation Rulebooks on GitHub

The catalogue API

TS11 defines a normative OpenAPI 3.1 definition (an annex to the spec) with the following endpoints:

Public (no authentication)

GET /schemas -- list entries, supports filtering and pagination
GET /schemas/{schemaId} -- retrieve a single SchemaMeta entry

Restricted (owner only)

PUT /schemas/{schemaId} -- update your SchemaMeta entry
DELETE /schemas/{schemaId} -- remove your SchemaMeta entry

TS11 specifies the interface, not a deployment: the servers block in the normative OpenAPI file is still a placeholder, so the Commission has not yet published a base URL for the catalogue. Read and update responses are JWS-signed and served as application/jwt, with an x-jku-url header pointing at the JWKS that verifies them. URIs in entries may carry W3C Subresource Integrity metadata. Schemas are provided in JSON: a VCT for dc+sd-jwt and a DocType per ISO 23220-2 for mso_mdoc.

Implementácia v praxi: SIROS Foundation prevádzkuje verejný register, ktorý zverejňuje Attestation Rulebooks a ich záznamy SchemaMeta vo formáte TS11. Je to užitočná referencia pri vývoji podľa špecifikácie. registry.siros.org

WE BUILD, rozsiahly pilotný projekt EÚ pre stavebníctvo, zverejňuje svoje typy credentialov v tomto registri pod vlastným menným priestorom. registry.siros.org/webuild-consortium

Súčasný stav (2026-09)

Ľudsky čitateľný katalóg je v prevádzke. Komisia ho prevádzkuje ako repozitár na GitHube, ktorý zatiaľ obsahuje dva rulebooky, mdl a pid, popri šablóne na písanie ďalších.
github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog
Katalóg atribútov zatiaľ ako register podľa TS11 neexistuje. Má bežať na infraštruktúre Komisie, ktorá už funguje, teda Single Digital Gateway a OOTS Semantic Repository, ale to, čo tento repozitár dnes zverejňuje, sú EvidenceTypes a Data Services z OOTS, nie záznamy Attribute podľa TS11.
sr.oots.tech.ec.europa.eu
Strojovo čitateľný katalóg Attestation Rulebooks je špecifikovaný, ale nenasadený. Blok servers v normatívnom súbore OpenAPI je zástupný, nebola zverejnená žiadna základná URL a autorizačný mechanizmus pre metódy PUT a DELETE je ponechaný budúcej verzii špecifikácie.

Versioning

TS11 uses Semantic Versioning (SemVer) for both rulebook references and schema references. The version field in a SchemaMeta entry carries the SemVer string for that credential type. A newly published rulebook and its schema start at version 1.0. The schemas behind schemaURIs are provided in JSON, one per supported format.

TS11 in the wider EUDI stack

TS11 connects to several adjacent specifications:

OOTS Data Service Directory and Semantic Repository -- the Once-Only Technical System registers data services that overlap with the authentic sources tracked in the attribute catalogue
DCAT-AP 3.0 -- the EU application profile for data catalogue metadata; the attribute catalogue follows DCAT-AP conventions for dataset and distribution descriptions
ETSI TS 119 478 -- defines the authentic source interfaces that authentic sources must expose so that the attribute catalogue can point to them
ETSI TS 119 612 / 119 602 -- the trusted list format (119 612) and the List of Trusted Entities (LoTE, 119 602) that TrustAuthority entries with frameworkType etsi_tl reference

Dimension	Catalogue of attributes	Catalogue of Attestation Rulebooks
What it describes	Attribute definitions: name, identifier, semantics, authentic sources	Credential schema metadata: schemas, formats, trust authorities, LoS
Who registers	Member states and authentic sources	Issuers (via Commission-mediated authorisation)
Format	JSON with multilingual name arrays	SchemaMeta JSON, JSON schemas per format, responses JWS-signed
Public API	No API in TS11; hosted via the Single Digital Gateway, authentic source interfaces per ETSI TS 119 478	GET /schemas and GET /schemas/{schemaId} (no auth required)
Source of truth	Commission catalogue backed by national authentic source registrations	Commission catalogue + GitHub rulebook repository for human-readable docs

ETSI succession: EN 319 482-3

ETSI is developing EN 319 482-3 on the basis of EC TS11. The expected publication date is 2027-10-31. When published, EN 319 482-3 becomes the permanent European standard for the catalogue of Attestation Rulebooks and attributes. TS11 as written is an interim Commission specification, not the final form of the normative text. Implementers building on TS11 now should track the ETSI work item to identify any divergences when EN 319 482-3 is finalised.

Frequently asked questions

What is the difference between the two catalogues?

The catalogue of attributes defines what an attribute identifier means, its data type, its legal basis, and which authentic sources report it. The catalogue of Attestation Rulebooks defines what a credential type contains: which schemas it uses, which formats it supports, which trust authorities it relies on, and what level of security (attestationLoS) it is issued at. They are distinct registries with distinct purposes; an issuer registers in the Attestation Rulebook catalogue, not in the attribute catalogue.

Do I have to register my credential type?

Registration in the catalogue of Attestation Rulebooks is required to be discoverable within the EUDI Wallet ecosystem. Without a SchemaMeta entry, verifiers that encounter your credential type have no machine-readable pointer to the rulebookURI or schemaURIs they need to validate it. Registration is mediated through the European Commission infrastructure and is not self-service.

Is the catalogue API public?

Read operations (GET /schemas and GET /schemas/{schemaId}) are public and require no authentication. Write operations (PUT and DELETE on a schema entry) are restricted to the owner of that entry and require authorisation through the Commission infrastructure.

What replaces TS11?

ETSI is developing EN 319 482-3 on the basis of EC TS11, with an expected publication date of 2027-10-31. When that standard is published it becomes the permanent European standard. TS11 as written is an interim Commission specification, not the final form of the normative text.

How do I find the rulebook for a credential type I received?

Take the schema URI out of the credential, then filter the catalogue on it: GET /schemas?schemaUri=... returns the matching entry. Use GET /schemas/{schemaId} only when you already have the catalogue UUID, which the catalogue assigns and which is not the credential type identifier. Either way the entry carries a rulebookURI pointing at the rulebook document and schemaURIs pointing at the schemas you need to validate the claims.

Sources

This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and ETSI directly.

Talk to us about EUDI Wallet integration