DCQL is the query language a verifier uses inside an OpenID4VP request to say which credentials and which individual claims it needs. OpenID4VP 1.0 dropped Presentation Exchange in favour of it, and the ARF picks that up by pointing at OpenID4VP and HAIP rather than defining a query language of its own.
A DCQL query names credential sets and the specific claims required within each. It can express alternatives, like accepting either a PID or an mDL for an age check, and it can constrain acceptable issuers or types, which is how a verifier limits itself to credentials it is willing to rely on.
The precision has a privacy payoff. Because the query works at claim level, a verifier that only needs age_over_18 asks for exactly that, and the wallet consent screen shows the holder that single claim rather than a whole credential.
Presentation Exchange, the older JSON format, is already gone. OpenID4VP reached Final 1.0 in July 2025 and removed it. Anything still emitting it is speaking a version of the protocol EU wallets do not implement.
Defined in
OpenID4VP 1.0 (Final, 9 July 2025), Digital Credentials Query Language section
The query you write is the privacy notice your user reads. Over-asking is visible to every holder at the consent screen, and it is a fast way to lose a conversion you had already won.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
