igrantio-holder-backendlisted

# iGrant.io holder backend (wallet side: receive, hold, present) ## When to use Build or extend the server that a **holder** (wallet) frontend talks to - the organisation is the wallet that receives and presents credentials, e.g. a European Business Wallet. It composes `igrantio-backend-proxy` (holder allow-list) + the `igrantio-holder-notifications` SSE relay. For the other two roles use `igrantio-issuer-backend` / `igrantio-verifier-backend`. Read `igrantio-ows-overview` first; the exact holder endpoint contract lives in [`references/holder-api-reference.md`](./references/holder-api-reference.md). **Before you build**: run the integrator intake in `igrantio-ows-overview` - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each. (Webhooks: not needed for the holder role - notifications replace them.) ## What it does - **Proxy** `GET|POST|PUT|DELETE ${PROXY_PREFIX}/{tenant}/...` → OWS, injecting the tenant's `ApiKey`. Allow-lists only OWS **holder** endpoints; RegExp rules keep the issuer's `credential/issue|history` and the verifier's `verification/send|history` out (least privilege). - **Relay** `GET ${PROXY_PREFIX}/{tenant}/v2/config/digital-wallet/openid/notifications/sse` streams OWS holder notifications, injecting the auth as the `authorization` query parameter (EventSource cannot send headers). - **No webhooks**: holder events arrive on the notifications stream. ## Reference implementation