---
# System prepended metadata

title: Resident Collects Permanent Resident Card

---

# Resident Collects Permanent Resident Card

This use case concerns the resident receiving the mailer from USCIS, going to the digital PRC pickup website, and using their digital wallet to pick up the USCIS PRC.


## Prerequisites

1. Resident has received a Permanent Resident Card in the mail, with an associated Digital Permanent Resident Card insert with a custom AIID / QR code.
2. The Resident has setup up their qualified Digital Wallet.
    a. This step can be explained on the insert, or once the user visits the USCIS website; but the assumption is the Resident can complete this step independently of this flow.


## Steps


## Sequence Diagram (OIDC CP Flow)

```mermaid
sequenceDiagram
    participant H as Holder
    participant WA as Wallet APP
    participant CP as Credential Provider (A part of the Issuer Web Service)
    participant CGS as Credential Generation service (A part of the Issuer Web Service)
    participant CI as IDP
    participant PRC as PRC Data Interface 
    autonumber
    note over H,WA: "There are many more possible options here around how the offer gets to the wallet"
    alt Credential Offer supplied out of band via QR code
    H ->> WA: Scan Credential Offer QR Code
    else Credential Offer present in Wallets market place
    H ->> WA: Click on credential offer in Wallets Marketplace
    end
    WA ->> CP: Resolves the CP "Credential Providers" .well-known endpoint
    CP ->> WA: Returns the .well-known OpenID document
    note right of WA: Process discovery document looking for "credential" related metadata elements, <br/> render credentials offered by the provider to the End-User
    WA ->> WA: 
    H ->> WA: End user selects the credential they would like to obtain

    alt Wallet not registered as a client for the Credential Provider (Performs Dynamic Client registration)
    WA ->> CP: OpenID Connect Registration Request (request to /register endpoint)
    CP ->> WA: OpenID Connect Registration response including valid client_id (response from /register endpoint)
    end
    
    WA ->> CP: OpenID Connect Request(redirect to /authorize endpoint)
    CP ->> CI: Authorization request forwarded to the Credential Issuer
    CI ->> H: Authenticate
    CI ->> H: Request Authorisation / consent for credential provisioning
    alt  (TBC) The IDP asks the Resident to enter their One Time Code (AIID - Application Invitation Identifier) from the mailer 
    CI ->> H: Request AIID from the user
    H ->> CI: Submit AIID
    CI ->> PRC: Query for a record matching sub and AIID combo 
    PRC ->> CI: Query Response (potentially inform user if no match found and error) 
    CI ->> CP: OpenID Connect Response (id_token)
    else  (TBC) The CP asks the Resident to enter their One Time Code (AIID - Application Invitation Identifier) from the mailer
    CI ->> CP: OpenID Connect Response (id_token)
    CP ->> H: Request AIID from the user
    H ->> CP: Submit AIID 
    CP ->> PRC: Query for a record matching sub and AIID combo
    PRC ->> CP: Query Response (potentially inform user if no match found and error) 
    end
    CP ->> WA: OpenID Connect Response (authorization code) (redirect back to client via registered redirect_uri)
    note right of CP: May also combine with additional security mechanisms here like PKCE
    WA ->> CP: Request Authorization token using authorization code obtained in OpenID Connect flow (request to /token endpoint)
    note right of CP: May also be combine with additional security mechanisms like DPoP
    CP ->> WA: access_token granting access to credential endpoint (response from /token endpoint)
 
    par User Queries Credential using the access token
        WA ->> CP: Request PRC Credential (using access_token to prove authorization) (request to /credential endpoint)
        CP ->> PRC: Query for a record matching sub and AIID combo from access_token
        PRC ->> CP: Query Response (containing PRC user claims)
        CP -->> CGS: Generate PRC Credential request (using claims retreived from PRC database)
        CGS -->> CP: Generate PRC Credential
        CP ->> WA: "Issued Credential" (response from /credential endpoint)
    end

```