---
# System prepended metadata

title: rest api

---

# rest api

```plantuml

actor User as U
participant "Wallet" as W
participant "Bad Reader" as bad
participant "Good Reader" as good
hide footbox

bad --> good: interaction
note over good: creates a session for Attacker
good -> good: generates a good request

good -> bad: Good Reader's reader engagement\nwith referrerURL of a good Reader
return device engagement with\ngood reader's referrerURL
bad -> bad: generates a bad request
U --> bad: interaction
bad -> W: Bad Reader's reader engagement\nwith referrerURL of a bad Reader
return deviceEngagement with a bad reader's referrerURL
bad -> W: deviceRequest
W -> bad: deviceResponse with mDL
good -> bad: deviceRequest 
return deviceResponse with user's mDL
note over good: Attacker's session tied to good user's mDL

```

// there is no MITM between wallet and bad reader but what's the point if bad reader got mDL?
// referrerURL does not really matter


