Trust-Lab by espuni · Flows by espuni

The EUDI trust framework,
before it exists.

The lists, certificates and issuers an EUDI wallet needs in order to work do not exist in production yet. Trust-Lab by espuni issues them in the same formats as the Commission, and Flows by espuni puts them to work on your espuni account.

Previewinvitation only
Request an invitationSee age verification

Two tools, one store

Trust-Lab by espuni

Make the trust material

  • Every trust list in the ecosystem, signed and published (listed one by one below)
  • Your own certificate authorities, with CRL and OCSP
  • A relying party register that issues their access and registration certificates
  • Status lists to revoke what you issue

Flows by espuni

Put it to work on espuni

  • Issuance and verification configurations from templates: PID in mDoc, age over 18, company representative certificate
  • Every trust list travels with its pinned signer: without it, verification checks nothing
  • Import your Trust-Lab by espuni keys and certificates into your tenant
  • Start the session and scan the QR with a wallet
  • Several environments of one account, one per tab

Every list

Trust-Lab by espuni generates every list the EUDI ecosystem defines, in its normative format, signed and published at a stable URL.

LoTE JSON · ETSI TS 119 602

  • PID providersEUPIDProvidersList
  • Wallet providersEUWalletProvidersList
  • Access certificate providers (WRPAC)EUWRPACProvidersList
  • Registration certificate providers (WRPRC)EUWRPRCProvidersList
  • Public body attestation providers (PubEAA)EUPubEAAProvidersList
  • Electronic attestation of attributes providers (EAA)EUEAAProvidersList · not yet normative in TS 119 602 v1.1.1

Trusted List XML · ETSI TS 119 612

  • Age verification attestation providers (AV)the profile of the Commission's AV list

Revocation

  • Token Status Liststhe status of every WRPRC and attestation you issue
  • CRL and OCSPthe status of every certificate from your CAs

Relying party register

The registration process, from the request to both certificates

A test Registrar with the TS5 data model and the TS6 minimum attributes (CIR (EU) 2025/848). Register a relying party the way a Member State would, and test everything that follows with its data.

  • Guided registration: draft, submission, review and approval, with what is missing shown before submitting
  • Approval assigns what belongs to the Registrar: the registryURI and revocation
  • Services and intended uses: one registration certificate (WRPRC) per declared use
  • The access certificate (WRPAC) is derived from the same register, with no data copied by hand
  • Changes that respect what was already assigned, and revocation with its status list

Who it is for

Wallet teams

Test how your wallet validates lists, access and registration certificates without waiting for a Member State to publish them.

Issuers and providers

Issue test PIDs and attestations with a trust chain that closes, instead of loose self-signed material.

Relying parties

Build today the verification you will run on the PID: the day the real authorities exist, what is left is loading certificates, not writing the flow.

QA and certification

Revoke, expire and rotate material at will to rehearse the cases you cannot trigger in production.

End to end

Age over 18 from a PID, without a single real certificate

  1. 01

    Set up the framework

    In Trust-Lab by espuni, a CA and your lab's list of PID providers.

  2. 02

    Issue a PID

    In Flows by espuni, the «PID in mDoc» template issues a test PID to your wallet.

  3. 03

    Ask only for age

    The «Age over 18» template asks for exactly age_over_18 and checks the issuer against your list.

  4. 04

    Verify

    Scan the QR: the wallet presents a single attribute and espuni validates signature, chain and list.

You need a wallet that trusts your lab's lists, such as the espuni test wallet.

What it is not

  • It is not production material. No real wallet trusts a lab, and none should.
  • Trust-Lab by espuni's lists are not the Commission's: they share its formats, not its authority.
  • It certifies nothing. It lets you rehearse what someone else will certify.

Plan

A single plan that opens everything, on your account's tenant. Granted by invitation.

Labs

By invitation

  • Trust-Lab by espuni: CAs, lists, register and certificates
  • Flows by espuni: issuance and verification configurations
  • One espuni tenant: your account's
  • No limits on CAs, lists or retention

Request your invitation

Leave your email. Once you confirm it, we will write to give you access.