---
title: "Issue a device-bound mDL for the current interview"
url: "https://developer.incode.com/api-reference/credentials-mdl/"
section: "api-reference"
group: "Onboarding"
version: "v1.1"
status: "live"
endpoint: "POST /omni/credentials/mdl"
---
# Issue a device-bound mDL for the current interview

`POST /omni/credentials/mdl`

Base URL: `https://demo-api.incodesmile.com` — Incode demo environment

Builds credential claims from the interview identified by the access token and issues a device-bound ISO/IEC 18013-5 mDL bound to the supplied device public key.

## Path & query parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `api-version` | header | string | yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `devicePublicKey` | string |  | Holder device public key as Base64 (standard) X.509 SubjectPublicKeyInfo DER, EC P-256. |

## Responses

### 200

OK

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `docType` | string |  | mdoc docType, e.g. org.iso.18013.5.1.mDL. |
| `issuerSigned` | string |  | Base64 (standard) of the CBOR-encoded IssuerSigned (nameSpaces + issuerAuth). |
| `expiresAt` | string (date-time) |  | When the mDL stops being valid (MSO validityInfo.validUntil). |

### 400

Bad Request

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `timestamp` | integer (int64) |  | UTC timestamp in milliseconds |
| `status` | integer (int32) |  | Custom error code or HTTP status code |
| `error` | string |  | HTTP status error |
| `message` | string |  | Custom error message |
| `path` | string |  | Endpoint path |
| `details` | object |  | Custom error details |

## Code samples

Generated from this endpoint's method, path, and the conventional Incode headers. The base URL is the Incode demo environment; replace `<YOUR_API_KEY>` with a key for your region.

### cURL

```bash
curl -X POST https://demo-api.incodesmile.com/omni/credentials/mdl \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "api-version: 1.0" \
  -H "Content-Type: application/json" \
  -d '{
    "devicePublicKey": ""
  }'
```

### Node

```js
const res = await fetch("https://demo-api.incodesmile.com/omni/credentials/mdl", {
  method: "POST",
  headers: {
      "x-api-key": "<YOUR_API_KEY>",
      "api-version": "1.0",
      "Content-Type": "application/json",
  },
    body: JSON.stringify({
      "devicePublicKey": ""
    }),
});
const data = await res.json();
```

### Python

```python
import requests

headers = {
    "x-api-key": "<YOUR_API_KEY>",
    "api-version": "1.0",
    "Content-Type": "application/json",
}
res = requests.post("https://demo-api.incodesmile.com/omni/credentials/mdl", headers=headers, json={
  "devicePublicKey": ""
})
data = res.json()
```

### Java

```java
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://demo-api.incodesmile.com/omni/credentials/mdl"))
    .header("x-api-key", "<YOUR_API_KEY>")
    .header("api-version", "1.0")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"devicePublicKey\": \"\"\n}"))
    .build();
HttpResponse<String> res = HttpClient.newHttpClient()
    .send(req, HttpResponse.BodyHandlers.ofString());
```

### Example response

```json
{
  "success": true,
  "status": "OK"
}
```