TS11 explained: the EUDI catalogue of Attestation Rulebooks and attributes

TS11 is the European Commission technical specification, current version v1.0.1 (2026-01), that fixes the data models and the HTTP interfaces for two Commission-run catalogues: the catalogue of attributes and the catalogue of Attestation Rulebooks. No further preamble: what those two catalogues contain, how the API works, and what TS11 means for an issuer or verifier is below.

Problem, ki ga rešuje TS11

Relying party prejme credential in se mora odločiti, ali ga sprejme. To se začne z vednostjo, kaj tip credentiala je: katere claime vsebuje, kako so kodirani, kateri format uporablja in kateri trust anchorji določajo, kdo ga sme izdati. Brez skupnega registra to znanje ostaja razpršeno po posameznih dokumentih in panožnih registrih, zato nov tip credentiala običajno postane ločena integracija, dogovorjena s posamezno stranjo.

TS11 na to odgovarja z dvema registroma, ki ju mora Evropska komisija vzpostaviti in voditi. Katalog Attestation Rulebooks ima za vsak tip credentiala en strojno berljiv zapis, TS11 pa določa javni vmesnik HTTP za branje: relying party iz pravkar prejetega credentiala vzame URI sheme, poizve v katalogu in dobi shemo, ki jo potrebuje za validacijo claimov, ter rulebook, ki ureja ta tip. Katalog atributov opravlja isto nalogo eno raven nižje in beleži, kaj identifikator atributa pomeni in kateri avtentični viri hranijo verodostojno vrednost. Issuer se registrira enkrat, vsak wallet in vsaka relying party v EU pa lahko tip razreši brez stika z njim.

The two catalogues

Catalogue of attributes

An EU-wide registry of attribute definitions. Each entry records the attribute name, its identifier (a URI), a description, the legal basis for collecting it, the authentic sources that hold the authoritative value, and the namespaces and distributions through which it is published. Member states and authentic sources register entries.

Catalogue of Attestation Rulebooks

A machine-readable index of credential schema metadata. Each entry (a SchemaMeta object) points to the rulebook document and the schemas for a given credential type. Issuers register SchemaMeta entries so that verifiers can discover the rulebookURI and the schemaURIs they need to validate a credential they have received.

These are distinct registries with distinct purposes. Conflating them is the most common mistake when reading TS11 for the first time.

Attribute data model

Each entry in the catalogue of attributes is an object with the following fields. Fields marked M are mandatory.

Field	Type	Mandatory
name	multilingual array	M
identifier	URI	M
description	multilingual text	M
semanticDataSpecification	URI
distributions	array of SchemaDistribution	M
nameSpace	string
contactInfo	string	M
legalBasis	string
authenticSources	array of DataService	M

Sub-classes: DataService (country, nationalSubID, endpointDescription, endpointURL) and SchemaDistribution (accessURL, mediaType).

Worked example: urn:eudi:pid:1:family_name

{
  "identifier": "urn:eudi:pid:1:family_name",
  "name": [
    { "lang": "en", "value": "Family name" },
    { "lang": "nl", "value": "Achternaam" }
  ],
  "authenticSources": [
    { "country": "NL", "endpointDescription": "National civil registry" }
  ]
}

Attestation Rulebook data model (SchemaMeta)

Each entry in the catalogue of Attestation Rulebooks is a SchemaMeta object. Fields marked M are mandatory.

Field	Type	Mandatory
id	UUID	M
version	SemVer	M
rulebookURI	URI	M
trustedAuthorities	array of TrustAuthority
attestationLoS	enum: iso_18045_basic \| iso_18045_enhanced-basic \| iso_18045_moderate \| iso_18045_high	M
bindingType	enum: claim \| key \| biometric \| none	M
supportedFormats	array: dc+sd-jwt \| mso_mdoc \| jwt_vc_json \| jwt_vc_json-ld \| ldp_vc	M
schemaURIs	array of Schema	M

Sub-classes: Schema (formatIdentifier, uri), TrustAuthority (frameworkType, value, isLoTE). frameworkType enum: aki | etsi_tl | openid_federation.

Worked example: PID v1.8.0

{
  "id": "9f1c2a7e-5d38-4b0e-8c61-2a7d4e9b3f05",
  "version": "1.8.0",
  "rulebookURI": "https://github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog/...",
  "trustedAuthorities": [
    { "frameworkType": "etsi_tl", "value": "...", "isLoTE": true }
  ],
  "attestationLoS": "iso_18045_high",
  "bindingType": "key",
  "supportedFormats": ["dc+sd-jwt", "mso_mdoc"],
  "schemaURIs": [
    { "formatIdentifier": "dc+sd-jwt", "uri": "https://..." }
  ]
}

Human-readable rulebook vs machine-readable catalogue entry

The Attestation Rulebook itself is a Markdown document published in a public GitHub repository, written from the template the repository provides. The catalogue of Attestation Rulebooks holds the machine-readable SchemaMeta entry that points to that document via rulebookURI. Verifiers query the catalogue to discover the pointer; they then fetch the rulebook document from GitHub if they need the full specification.

Attestation Rulebooks on GitHub

The catalogue API

TS11 defines a normative OpenAPI 3.1 definition (an annex to the spec) with the following endpoints:

Public (no authentication)

GET /schemas -- list entries, supports filtering and pagination
GET /schemas/{schemaId} -- retrieve a single SchemaMeta entry

Restricted (owner only)

PUT /schemas/{schemaId} -- update your SchemaMeta entry
DELETE /schemas/{schemaId} -- remove your SchemaMeta entry

TS11 specifies the interface, not a deployment: the servers block in the normative OpenAPI file is still a placeholder, so the Commission has not yet published a base URL for the catalogue. Read and update responses are JWS-signed and served as application/jwt, with an x-jku-url header pointing at the JWKS that verifies them. URIs in entries may carry W3C Subresource Integrity metadata. Schemas are provided in JSON: a VCT for dc+sd-jwt and a DocType per ISO 23220-2 for mso_mdoc.

Implementacija v praksi: SIROS Foundation upravlja javni register, ki objavlja Attestation Rulebooks in njihove zapise SchemaMeta v obliki TS11, kar je uporabna referenca pri razvoju v skladu s specifikacijo. registry.siros.org

WE BUILD, obsežni pilotni projekt EU za gradbeni sektor, svoje tipe credentialov objavlja v tem registru pod lastnim imenskim prostorom. registry.siros.org/webuild-consortium

Trenutno stanje (2026-09)

Človeku berljivi katalog deluje. Komisija ga vodi kot repozitorij na GitHubu, ki trenutno vsebuje dva rulebooka, mdl in pid, poleg predloge za pisanje novih.
github.com/eu-digital-identity-wallet/eudi-doc-attestation-rulebooks-catalog
Katalog atributov kot register po TS11 še ne obstaja. Zasnovan je tako, da bo gostoval na infrastrukturi Komisije, ki že deluje, na Single Digital Gateway in OOTS Semantic Repository, vendar to, kar ta repozitorij danes objavlja, so OOTS EvidenceTypes in Data Services, ne pa zapisi Attribute po TS11.
sr.oots.tech.ec.europa.eu
Strojno berljivi katalog Attestation Rulebooks je določen, a ni vzpostavljen. Blok servers v normativni datoteki OpenAPI je označba mesta, osnovni URL ni objavljen, mehanizem avtorizacije za metodi PUT in DELETE pa je prepuščen prihodnji različici specifikacije.

Versioning

TS11 uses Semantic Versioning (SemVer) for both rulebook references and schema references. The version field in a SchemaMeta entry carries the SemVer string for that credential type. A newly published rulebook and its schema start at version 1.0. The schemas behind schemaURIs are provided in JSON, one per supported format.

TS11 in the wider EUDI stack

TS11 connects to several adjacent specifications:

OOTS Data Service Directory and Semantic Repository -- the Once-Only Technical System registers data services that overlap with the authentic sources tracked in the attribute catalogue
DCAT-AP 3.0 -- the EU application profile for data catalogue metadata; the attribute catalogue follows DCAT-AP conventions for dataset and distribution descriptions
ETSI TS 119 478 -- defines the authentic source interfaces that authentic sources must expose so that the attribute catalogue can point to them
ETSI TS 119 612 / 119 602 -- the trusted list format (119 612) and the List of Trusted Entities (LoTE, 119 602) that TrustAuthority entries with frameworkType etsi_tl reference

Dimension	Catalogue of attributes	Catalogue of Attestation Rulebooks
What it describes	Attribute definitions: name, identifier, semantics, authentic sources	Credential schema metadata: schemas, formats, trust authorities, LoS
Who registers	Member states and authentic sources	Issuers (via Commission-mediated authorisation)
Format	JSON with multilingual name arrays	SchemaMeta JSON, JSON schemas per format, responses JWS-signed
Public API	No API in TS11; hosted via the Single Digital Gateway, authentic source interfaces per ETSI TS 119 478	GET /schemas and GET /schemas/{schemaId} (no auth required)
Source of truth	Commission catalogue backed by national authentic source registrations	Commission catalogue + GitHub rulebook repository for human-readable docs

ETSI succession: EN 319 482-3

ETSI is developing EN 319 482-3 on the basis of EC TS11. The expected publication date is 2027-10-31. When published, EN 319 482-3 becomes the permanent European standard for the catalogue of Attestation Rulebooks and attributes. TS11 as written is an interim Commission specification, not the final form of the normative text. Implementers building on TS11 now should track the ETSI work item to identify any divergences when EN 319 482-3 is finalised.

Frequently asked questions

What is the difference between the two catalogues?

The catalogue of attributes defines what an attribute identifier means, its data type, its legal basis, and which authentic sources report it. The catalogue of Attestation Rulebooks defines what a credential type contains: which schemas it uses, which formats it supports, which trust authorities it relies on, and what level of security (attestationLoS) it is issued at. They are distinct registries with distinct purposes; an issuer registers in the Attestation Rulebook catalogue, not in the attribute catalogue.

Do I have to register my credential type?

Registration in the catalogue of Attestation Rulebooks is required to be discoverable within the EUDI Wallet ecosystem. Without a SchemaMeta entry, verifiers that encounter your credential type have no machine-readable pointer to the rulebookURI or schemaURIs they need to validate it. Registration is mediated through the European Commission infrastructure and is not self-service.

Is the catalogue API public?

Read operations (GET /schemas and GET /schemas/{schemaId}) are public and require no authentication. Write operations (PUT and DELETE on a schema entry) are restricted to the owner of that entry and require authorisation through the Commission infrastructure.

What replaces TS11?

ETSI is developing EN 319 482-3 on the basis of EC TS11, with an expected publication date of 2027-10-31. When that standard is published it becomes the permanent European standard. TS11 as written is an interim Commission specification, not the final form of the normative text.

How do I find the rulebook for a credential type I received?

Take the schema URI out of the credential, then filter the catalogue on it: GET /schemas?schemaUri=... returns the matching entry. Use GET /schemas/{schemaId} only when you already have the catalogue UUID, which the catalogue assigns and which is not the credential type identifier. Either way the entry carries a rulebookURI pointing at the rulebook document and schemaURIs pointing at the schemas you need to validate the claims.

Sources

This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and ETSI directly.

Talk to us about EUDI Wallet integration