Set up your technology and systems
On this page
Preparing your systems for the Digital Licence app
We'll work with you, using a standards-based approach, to make your agency's credentials available in the Queensland Digital Wallet.
Focus your preparation on:
- credential data quality
- API maturity, security controls
- interoperability
- lifecycle management.
This will expose data and support the secure delivery, update and presentation of a digital credential in a way that is consistent, supportable and fit for government use.
Standards and frameworks
The Queensland Digital Licence app aligns with ISO/IEC 18013-5 and ISO/IEC 23220-4. This is the core international standard for:
- mobile driver licences
- non-mDL digital credentials
- related privacy and security expectations for use on a mobile device.
This standard informs delivery patterns, data handling and credential behaviours.
Interface design
For interface design and system compatibility, align to web and API standards, including:
- HTTP semantics for predictable request and response behaviour
- JSON for structured data interchange
- OpenAPI specification for interface definition, documentation and consumer onboarding.
What to expect with your integration
Your agency’s system must provide defined, governed data services that support credential issuance, update, validation or status change events as required by the business process. At a minimum, your agency should be prepared to:
- expose stable, documented interfaces
- provide authoritative data for the credential being delivered
- support versioned payloads and schema governance
- manage change in a controlled way so downstream consumers are not disrupted
- maintain traceability for transactions and business events.
For public API design, use resource-oriented URIs, standard HTTP methods and consistent response structures. Use OpenAPI as a delivery artefact rather than optional documentation, because it enables implementation, testing, review and conformance assessment across parties.
Security and assurance
Design your services on the basis that digital credential delivery is a security-sensitive integration. Public-facing material won’t prescribe the detailed security pattern for each implementation but there are security controls.
You should expect security controls to cover:
- authentication
- authorisation
- encryption in transit
- least-privilege access
- audit logging
- monitoring
- vulnerability management.
Assess your API design and implementation against recognised API security risks such as broken object level authorisation, broken authentication and excessive data exposure, as described by the OWASP API security project.
For this reason, your agency should come prepared to demonstrate:
- how client and service identities are established
- how access to credential data is restricted
- how sensitive attributes are protected in transit and at rest
- how events and transactions can be audited
- how security incidents, defects and changes are managed.
Data, recordkeeping and lifecycle
Credential data made available to the app must be accurate, authoritative and governed for the full lifecycle of the credential. Agencies should define:
- the source of truth for each attribute
- when a credential is created, updated, suspended or revoked
- the retention and disposal obligations that apply to related records
- what evidence must be retained for audit, dispute handling and operational support.
Queensland recordkeeping obligations sit within the Public Records Act 2023, which provides the framework for making, managing and accessing public records. Ensure you manage your credential-related records, integration artefacts and transaction evidence in line with governance requirements.
Technical readiness in your agency
Before you start detailed design, check your agency’s technical readiness.
Readiness area | What your agency should be able to demonstrate |
|---|---|
Data model | Credential attributes are defined, governed and mapped to an authoritative source |
API maturity | Interfaces are stable, documented, versioned and suitable for integration |
Security | Authentication, authorisation, encryption and audit controls are designed and reviewable |
Event and status handling | The system can notify or expose credential state changes in a controlled manner |
Operational support | Logging, monitoring, incident handling and change management are established |
Compliance | Relevant legal, privacy, records and assurance obligations have been identified |
Use this readiness assessment to confirm that your agency can support a credential as a governed digital product, not just as a one-off system integration.
What this means in practice
In practical terms, an agency preparing to add credentials to the app should expect to supply:
- a clearly defined credential data set
- interface specifications and sample payloads
- business rules for credential eligibility and status
- security and assurance inputs for design review
- lifecycle rules for update, suspension, revocation and audit.
Early engagement should focus on standards alignment, interface maturity and data governance before implementation planning begins. This lowers delivery risk and helps ensure the credential can be supported consistently across onboarding, update, support and assurance processes.