# Masked Name API

## Overview

The Masked Name API returns a masked representation of the citizen's name and surname.

This API is intended for verification scenarios where the relying party needs to confirm identity information without receiving the full name.

The API follows the TRIDENT VDG data minimization principles.

## Authorization

A valid OAuth 2.0 Access Token issued by TRIDENT IDP is required.

### Required Scope

`ebc.masked-name`

## Endpoint

GET /facade-vdg/api/v1/ebc/masked-name

## Request Headers

Authorization: Bearer <access_token>

## Successful Response

```json
{
  "maskedFirstName": "J***",
  "maskedLastName": "M*********"
}
```

## Response Fields

| Field 			| Description 
|-------------------|-----------------------------
| maskedFirstName 	| Masked first name 
| maskedLastName 	| Masked surname 

## Masking Rules

| Original Value | Returned Value |
|----------------|---------------|
| John | J*** |
| Michael | M****** |
| Smith | S**** |

Only the first character is disclosed.

## Error Responses

### 401 Unauthorized

```json
{
  "error": "invalid_token",
  "message": "The access token is invalid or inactive"
}
```

### 403 Forbidden

```json
{
  "error": "insufficient_scope",
  "message": "Required scopes: ebc.masked-name"
}
```

### 404 Not Found

```json
{
  "error": "data_not_found",
  "message": "Data was not found for the user"
}
```

## Security Model

- Validates the Access Token issued by TRIDENT IDP.
- Verifies required scopes.
- Retrieves identity information from the authoritative source.
- Applies masking rules.
- Returns only approved information.

This API is an example of a masked response.
