> ## Documentation Index
> Fetch the complete documentation index at: https://docs.go.gbgplc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NFC Chip Authentication

> Validate the authenticity of NFC-enabled identity documents in GBG GO using cryptographic chip checks against passive, active, and chip cloning attacks.

The **NFC Chip Authentication** module validates the authenticity of identity documents that contain an embedded NFC (Near Field Communication) chip.

## NFC Chip Authentication

Validates the authenticity of identity documents that contain an embedded NFC (Near Field Communication) chip. The module performs cryptographic checks against the embedded chip, each targeting a different threat vector, and aggregates them into an overall result that fails if any single check fails.

### Capabilities

The module returns the NFC Chip Authentication capability.

#### NFC Chip Authentication

This capability provides the aggregate outcome of all NFC chip authentication checks. It fails if any of the three individual authentication checks (passive, active, or chip) fails. This is the primary capability used in evaluation and routing logic.

| Value    | Description                                                                                                                               |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `PASSED` | All individual authentication checks passed. The chip is genuine, the data is authentic and unmodified, and the chip has not been cloned. |
| `FAILED` | One or more individual authentication checks failed. The document's NFC chip could not be fully validated.                                |
| `ERROR`  | The overall authentication could not be completed due to a technical issue.                                                               |

#### Overall Authentication Result

The aggregate outcome of all NFC chip authentication checks. It fails if any of the three individual authentication checks (passive, active, or chip) fails, and is the primary capability used in evaluation and routing logic.

| Value    | Description |
| -------- | ----------- |
| `PASSED` | Passed      |
| `FAILED` | Failed      |
| `ERROR`  | Error       |

#### Active Authentication Result

Returns the result of Active Authentication.

| Value    | Description |
| -------- | ----------- |
| `PASSED` | Passed      |
| `FAILED` | Failed      |
| `ERROR`  | Error       |

#### Passive Authentication Result

Returns the result of Passive Authentication.

| Value    | Description |
| -------- | ----------- |
| `PASSED` | Passed      |
| `FAILED` | Failed      |
| `ERROR`  | Error       |

#### Chip Authentication Result

Returns the result of Chip Authentication.

| Value    | Description |
| -------- | ----------- |
| `PASSED` | Passed      |
| `FAILED` | Failed      |
| `ERROR`  | Error       |

## Input payload

The following is a sample payload used to submit NFC chip data to the **NFC Chip Authentication** module for processing.

```json JSON theme={null}
{
  "resourceId": "<resourceId>",
  "context": {
    "config": {
      "delivery": "api"
    },
    "subject": {
      "documents": [
        {
          "mrz": "<string>",
          "chip": {
            "lds": [
              {
                "name": "<string>",
                "data": "<base64-encoded string>"
              }
            ],
            "auth": [
              {
                "type": "<string>",
                "result": "<string>"
              }
            ]
          }
        }
      ]
    }
  }
}
```

| Field       | Required | Description                                                                                                                                                                   |
| ----------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `mrz`       | Yes      | The machine-readable zone string extracted from the document. Used to establish a secure communication channel with the chip.                                                 |
| `chip.lds`  | Yes      | An array of Logical Data Structure (LDS) entries read from the chip. Each entry contains a `name` identifying the data group and a base64-encoded `data` payload.             |
| `chip.auth` | Yes      | An array of authentication check results performed during the chip reading process. Each entry contains a `type` identifying the check and a `result` indicating its outcome. |

## Sample response

The following is a sample response for a successfully authenticated NFC chip.

```json JSON theme={null}
{
  "response": {
    "advice": {
      "authenticationResult": "PASSED",
      "activeAuthenticationResult": "PASSED",
      "passiveAuthenticationResult": "PASSED",
      "chipAuthenticationResult": "PASSED"
    },
    "outcome": "Passed"
  }
}
```