In
`@apps/api-gateway/src/oid4vc-verification/dtos/verify-authorization-response.dto.ts`:
- Around line 29-34: The optional origin field in the
VerifyAuthorizationResponseDto is decorated with `@IsString`() but missing
`@IsOptional`(), causing validation to fail when origin is omitted; update the
origin property by adding `@IsOptional`() immediately above `@IsString`() (i.e.,
annotate the origin field in VerifyAuthorizationResponseDto with `@IsOptional`()
then `@IsString`()) so class-validator allows requests that don't include origin.
In `@apps/api-gateway/src/oid4vc-verification/oid4vc-verification.controller.ts`:
- Line 723: The POST route decorator currently defined as
`@Post`('/orgs/:orgId/verify-authorization-response') in
oid4vc-verification.controller.ts should be renamed to
`@Post`('/orgs/:orgId/oid4vp/verify-authorization-response') so it matches the
existing OID4VP endpoint prefix; update the route string on the same controller
method (the method handling the authorization response) and adjust any tests or
internal references that call the old path to the new
'/orgs/:orgId/oid4vp/verify-authorization-response' URL.
- Around line 758-763: Change the verification endpoint to return HTTP 200 OK
and use the shared message constant instead of a hardcoded string: replace
HttpStatus.CREATED with HttpStatus.OK in the finalResponse object and the
res.status(...) call, and swap the 'Authorization response verified
successfully' literal for the appropriate ResponseMessages constant (use the
same ResponseMessages pattern used by other endpoints). Ensure the variable
finalResponse and the response returned by res.status(...) are updated
accordingly.
In `@apps/api-gateway/src/oid4vc-verification/oid4vc-verification.service.ts`:
- Around line 184-186: The debug log in verifyAuthorizationResponse currently
serializes the full verifyAuthorizationResponse (risking leaking id_token and
other sensitive fields); change the logger.debug call in
oid4vc-verification.service (the verifyAuthorizationResponse handler) to omit
the full payload and log only non-sensitive identifiers such as
verifyAuthorizationResponse.verificationSessionId (keep orgId and user?.id),
removing JSON.stringify(verifyAuthorizationResponse) and any other full-object
prints.
In `@apps/oid4vc-verification/src/oid4vc-verification.controller.ts`:
- Around line 183-194: Change the handler to avoid logging the full
VerifyAuthorizationResponse and to use the same parameter name as other
handlers: rename the destructured `user` parameter to `userDetails` (to avoid
shadowing the `user` type) and in the logger.debug call remove
JSON.stringify(verifyAuthorizationResponse) — log only safe identifiers such as
`verificationSessionId` (from the VerifyAuthorizationResponse) plus `orgId` and
`userDetails.id`; then pass `verifyAuthorizationResponse` and `userDetails`
unchanged into `oid4vpVerificationService.verifyAuthorizationResponse`.
In `@apps/oid4vc-verification/src/oid4vc-verification.service.ts`:
- Around line 692-721: In verifyAuthorizationResponse, avoid logging full
payloads: stop JSON.stringifying verifyAuthorizationResponse and
verificationResult; instead extract and log a non-sensitive identifier (e.g.,
verificationSessionId or a correlation id) from the verifyAuthorizationResponse
object and log only that plus minimal outcome info (e.g.,
verificationResult.status or a success/failure flag). Update the logger.debug
calls in verifyAuthorizationResponse to reference the identifier variable (not
the whole object) and to redact or summarize verificationResult before logging
to prevent sensitive tokens/credentials from being written to logs.

In `@apps/api-gateway/src/oid4vc-verification/oid4vc-verification.controller.ts`:
- Line 749: The debug log in the verifyAuthorizationResponse flow contains a
typo: the template literal in the logger.debug call within the method
verifyAuthorizationResponse (or the Oid4vcVerificationController) has an extra
closing brace `orgId=${orgId}}`; remove the stray `}` so it reads
`orgId=${orgId}` to fix the malformed log output.

In
`@apps/api-gateway/src/oid4vc-verification/dtos/verify-authorization-response.dto.ts`:
- Around line 16-23: Replace the real-looking example JWT in the Swagger example
payload with a clearly fake placeholder to avoid secret-detection false
positives: locate the example object in verify-authorization-response.dto.ts
(the example -> id_token -> Passport value) and change the token string to an
obvious placeholder like 'eyJ...example-token...' or 'REDACTED_EXAMPLE_TOKEN' so
the docs remain illustrative but won’t trigger Gitleaks.