DCQL is the query language a verifier uses inside an OpenID4VP request to say which credentials and which individual claims it needs. OpenID4VP 1.0 dropped Presentation Exchange in favour of it, and the ARF picks that up by pointing at OpenID4VP and HAIP rather than defining a query language of its own.
Technical standardReviewed 7 October 2026
Between the wallet and the relying party, when the user shares data.
Issuer
Signs credentials: a member state, university, bank or employer
Issuance
EUDI Wallet
Belongs to the user, who decides what to share
Presentation
Relying party
The service that requests and checks the data
Trust layer: who is allowed to sign, and is it still valid?
Rules: the law and technical framework behind it all
A DCQL query names credential sets and the specific claims required within each. It can express alternatives, like accepting either a PID or an mDL for an age check, and it can constrain acceptable issuers or types, which is how a verifier limits itself to credentials it is willing to rely on.
The precision has a privacy payoff. Because the query works at claim level, a verifier that only needs age_over_18 asks for exactly that, and the wallet consent screen shows the holder that single claim rather than a whole credential.
Presentation Exchange, the older JSON format, is already gone. OpenID4VP reached Final 1.0 in July 2025 and removed it. Anything still emitting it is speaking a version of the protocol EU wallets do not implement.
Defined in
OpenID4VP 1.0 (Final, 9 July 2025), Digital Credentials Query Language section
The query you write is the privacy notice your user reads. Over-asking is visible to every holder at the consent screen, and it is a fast way to lose a conversion you had already won.
Where you meet it
