APIs

Updated on 30 August 2025.

The server base URL is https://talao.co.

POST /api/analyze-qrcode

Analyze a base64-encoded QR code representing an authorization request and/or presentation definition within the OIDC4VC ecosystem. The service evaluates structure, protocol compliance (OIDC4VCI / OIDC4VP), and semantic correctness using an AI agent, then returns either a base64-encoded Markdown report or a structured JSON summary.

This API powers: https://talao.co/ai/qrcode

Authentication

Note: API key validation may be disabled in some deployments. If enabled, include the header below.

Request (JSON)

{
  "qrcode": "c29tZS1hc3NpZ24tdGV4dA==", // required, base64-encoded QR content 
  "oidc4vciDraft": "12",                 // optional, OIDC4VCI draft version, Final 1.0 is "18"
  "oidc4vpDraft": "18",                  // optional, OIDC4VP draft version, Final 1.0 is "30"
  "profile": "EBSI",                     // optional, default "custom"
  "format": "text",                       // optional, "text" | "json" (default "text")
  "model": "flash"                        // optional, "flash" | "escalation" | "pro" (default "flash")
}

Notes - qrcode must be base64-encoded to safely transmit non‑UTF‑8/binary payloads. - When format = json, the service converts the AI report into a structured JSON object.

Successful Responses

When format = text (default):

{
  "report_base64": "<base64-encoded UTF-8 markdown report>"
}

When format = json:

{
  // Structure produced from the AI report (keys may vary by input)
}

To decode the Markdown report in Python:

import base64
print(base64.b64decode(response["report_base64"]).decode())

Profiles

If profile is custom (default), OIDC4VC draft parameters apply directly. Other ecosystem profiles may adapt validation rules.

Error Responses

Example cURL

curl -X POST https://talao.co/api/analyze-qrcode   -H "Content-Type: application/json"   -H "Api-Key: your-api-key"   -d '{
        "qrcode": "c29tZS1hc3NpZ24tdGV4dA==",
        "oidc4vciDraft": "12",
        "oidc4vpDraft": "18",
        "profile": "EBSI",
        "format": "text",
        "model": "flash"
      }'

POST /api/analyze-vc

Analyze a base64-encoded Verifiable Credential (VC). The service detects SD‑JWT VC, JWT VC (compact), or JSON‑LD VC format, evaluates compliance and structure using an AI agent, and returns either a base64-encoded Markdown report or a structured JSON summary.

This API powers: https://talao.co/ai/vc

Authentication

Note: API key validation may be disabled in some deployments. If enabled, include the header below.

Request (JSON)

{
  "vc": "BASE64_ENCODED_VC_STRING", // required
  "sdjwtvc_draft": "8",             // optional (SD-JWT VC related) from "8" to "10"
  "vcdm_draft": "1.1",              // optional (W3C VCDM related) "1.1" | "2.0"
  "format": "text",                  // optional, "text" | "json" (default "text")
  "model": "flash"                   // optional, "flash" | "escalation" | "pro" (default "flash")
}

Successful Responses

When format = text (default):

{
  "report_base64": "<base64-encoded UTF-8 markdown report>"
}

When format = json:

{
  // Structure produced from the AI report (keys may vary by input)
}

To decode the Markdown report in Python:

import base64
print(base64.b64decode(response["report_base64"]).decode())

Error Responses

Example cURL

curl -X POST https://talao.co/api/analyze-vc   -H "Content-Type: application/json"   -H "Api-Key: your-api-key"   -d '{
        "vc": "BASE64_ENCODED_VC_STRING",
        "sdjwtvc_draft": "8",
        "vcdm_draft": "1.1",
        "format": "text",
        "model": "flash"
      }'

JSON Rule Catalogs

This section documents the rule codes that can appear in the structured JSON outputs of the endpoints when format is set to "json".

Why these rule catalogs matter

• Deterministic integrations: Clients can build logic on top of stable code values, independent of natural-language wording.
• Severity-aware UX: FAIL vs WARN vs INFO lets apps decide whether to block flows, warn users, or log telemetry.
• Compliance mapping: Components (auth_request, issuer_metadata, vc, etc.) make it easy to highlight exactly where a problem originates.
• Profile portability: The same rule codes apply across profiles (EBSI, INJI, DIIP, etc.), simplifying multi-ecosystem support.
• Testing & monitoring: Codes are ideal for regression tests, dashboards, and alerting without brittle text matching.

Rule Catalog — /api/analyze-qrcode (OIDC4VC)

Each JSON response in format: "json" mode uses the following machine-readable rule codes.

Rule Catalog — /api/analyze-vc (VC formats: SD‑JWT VC, JWT VC, JSON‑LD VC)

Each JSON response in format: "json" mode uses the following machine-readable rule codes.

Note: Additional rule codes may be introduced over time. Clients should treat unknown codes as non-fatal unless marked with severity: FAIL.