"nationalities" claim in PID (SD-JWT VC) is always returned as an empty array after processing

[jaumegras-entrust]

When processing a PID credential of type SD-JWT VC issued by https://issuer-backend.eudiw.dev for the FormEU country profile in the EUDI Wallet, the "nationalities" claim is not being correctly resolved. Although the original credential contains a non-empty nationalities array (e.g. ["US", "NL"]), the processed SD-JWT VC payload returned by the Verifier utility endpoint (POST /utilities/process/sdJwtVc) always contains nationalities as an empty array.

This results in the effective loss of information for that claim, even though it is present and disclosed in the presentation returned by the wallet.

This is the "dcql_query" used:
{ "credentials": [ { "id": "pid_identity", "format": "dc+sd-jwt", "meta": { "vct_values": [ "urn:eudi:pid:1" ] }, "claims": [ {"path": ["nationalities"]} ] } ] }

[babisRoutis]

Dear @jaumegras-entrust

Thank you for reporting this and apologies for the delayed response.

Please note that the PID uses the following type definition (found here). According to this, nationalities is defined as follows :

   {
      "path": ["nationalities"],
      "display": [ {"locale": "en","label": "Nationality"}],
      "sd": "always"
    },
    {
      "path": ["nationalities",null],
      "sd": "always"
    }

Those two elements actually define that:

• nationalities is an array that is always selectively disclosable
• nationalities array contains elements that all of them are selectively disclosable

Your DCQL queries for a single claim path pointing to nationalities. This is the array. Yet, you don't query for the contents of the array. This explains why you are getting an empty array.

To query for the contents of the array you have to provide a claim path pointing to the elements. For instance

• ["nationalities", null] to get all the nationalities, or
• ["nationalities", 0] to get the 1st

For more details you can check here

[jaumegras-entrust]

Dear @babisRoutis,

Thank you for your response. I have been testing what you described using the following value in the dcql_query parameter:

"credentials": [
  {
    "id": "pid_identity",
    "format": "dc+sd-jwt",
    "meta": {
      "vct_values": ["urn:eudi:pid:1"]
    },
    "claims": [
      {"path": ["given_name"]},
      {"path": ["birthdate"]},
      {"path": ["document_number"]},
      {"path": ["nationalities"]}
    ]
  }
]

In this case, the wallet does allow me to select the nationalities attribute when processing the authorization request. However, as I mentioned in my previous comment, when the SD‑JWT VC is processed afterwards, the nationalities claim is always an empty array. As you correctly pointed out, querying nationalities in this way is incorrect because it targets the array itself rather than its contents. Still, this is the only scenario in which the wallet actually offers the user the option to select the attribute.

To clarify the behavior I am observing:
When I specify {"path": ["nationalities"]}, the wallet does present the option to select the nationalities attribute during the authorization flow.
However, when I specify {"path": ["nationalities", null]} or {"path": ["nationalities", 0]}, the wallet does not offer the option to select nationalities at all, even though all the other attributes requested in the dcql_query are shown and can be selected normally.

For testing, I am using the Swagger UI provided by the EUDI Verifier Endpoint server (eudi-srv-verifier-endpoint). First, I initialize the transaction using the /ui/presentations/v2 endpoint:

{
  "dcql_query": {
    "credentials": [
      {
        "id": "pid_identity",
        "format": "dc+sd-jwt",
        "meta": {
          "vct_values": ["urn:eudi:pid:1"]
        },
        "claims": [
          {"path": ["given_name"]},
          {"path": ["birthdate"]},
          {"path": ["document_number"]},
          {"path": ["nationalities", null]}
        ]
      }
    ]
  },
  "jar_mode": "by_reference",
  "nonce": "88c615a2-b7ca-4329-b673-3f4c4146ad33",
  "profile": "openid4vp"
}

I then generate the QR code using the authorization_request_uri returned in the response. When scanning the QR with the wallet, I observe the behaviors described above.

For reference, I am using the 2025.12.34-Demo version of the EUDI Wallet.

Thank you very much, and I hope my explanation is clear.

[babisRoutis]

Dear @jaumegras-entrust

I believe that this is a wallet issue, since it fails to correctly process ["nationalities", null] claim path.
Indeed, I can confirm your observation(s):

Wallet doesn't process a DCQL that contains ["nationalities", null], which is the correct way to query for the contents of nationalities.

I will transfer the issue to the related repository.

cc: @vkanellopoulos