# Age Verification API (18+)

## Overview

Return whether the user is 18 years old or older.

## Authorization

A valid OAuth 2.0 Access Token issued by TRIDENT IDP is required.

### Required Scope

`ebc.age.over.18`

## Endpoint

GET /facade-vdg/api/v1/ebc/age-over-18

## Request Headers

Authorization: Bearer <access_token>

## Successful Response

```json
{
  "over18": true
}
```

## Response Fields

| Field 	| Description 
|-----------|-------------
| over18 	| Indicates whether the citizen is 18 years old or older 

## Error Responses

### 401 Unauthorized

```json
{
  "error": "invalid_token",
  "message": "The access token is invalid or inactive"
}
```

### 403 Forbidden

```json
{
  "error": "insufficient_scope",
  "message": "Required scopes: ebc.age.over.18"
}
```

### 404 Not Found

```json
{
  "error": "data_not_found",
  "message": "Birth date data was not found for the user"
}
```

## Security Model

- Validates Access Tokens.
- Verifies required scopes.
- Retrieves date of birth from authoritative source.
- Returns only a derived yes/no response.

## Data Minimization

The citizen's date of birth is never exposed.

## Related Documentation

Refer to the TRIDENT IDP Integration Guide.
