Final place for vocabularies and contexts once we publish VC 2.0

[iherman]

We have, at the moment, a number of vocabulary and context files residing on various GitHub repositories, either explicitly or generated via GitHub actions. When we go to Proposed Recommendations, it is probably cleaner and safer to copy all these as static files to the W3C server, i.e., not making them dependent on GitHub once all our documents are standards.

The public URLs for the context and vocabulary files have been already defined (some were done several years ago) and partially deployed; those should remain as they are. At this moment, these URLs are all redirected, either by an .htaccess file or via w3id.org to github.io. The proposal therefore is to copy all files into the W3C Date Space, and systematically change the redirections. The structure of the target date space structure could be:

• https://www.w3.org/2025/credentials
  • /vcdm
    • /examples
    • /undefined-terms
  • /json-schema/
  • /vcdi
    • /multikey
    • /jwk
  • /sl
  • /cid

(An alternative might be to move /cid to the top, i.e., use https://www.w3.org/2025/cid. However, taking into account that these URLs are never really visible to the outside world, it makes the management of all these marginally easier to keep everything at one place.)

Here is a complete list of what we have now, and where they should be. (I hope it is complete, please check!)

1 VDCM

• Core context file:
  • URL: https://www.w3.org/ns/credentials/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/context.jsonld
• Core vocabulary:
  • URL: https://www.w3.org/2018/credentials/
  • Redirected via https://www.w3.org/2018/credentials/.htaccess to https://w3c.github.io/vc-data-model/vocab/credentials/v2/vocabulary.html (and .ttl, .jsonld, .svg via content negotiation).
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)
• Example context file:
  • URL https://www.w3.org/ns/credentials/examples/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/examples/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/examples/context.jsonld
• Undefined context file:
  • URL: https://www.w3.org/ns/credentials/undefined-terms/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/undefined-terms/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/undefined-terms/context.jsonld
• Undefined vocabulary:
  • URL: https://www.w3.org/ns/credentials/undefined-term#
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/vocab/credentials/v2/undefined-term.html
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/undefined-term/vocabulary.html

2 JSON Schema

• Core schema:
  • URL: https://www.w3.org/ns/credentials/json-schema/v2.json (or simply v2)
  • Redirected via https://www.w3.org/2018/credentials/json-schema/.htaccess to https://w3c.github.io/vc-json-schema/schema/json-schema-credential-schema.json
  • To be redirected to: https://www.w3.org/2025/credentials/json-schema/v2.json

3 Data Integrity

• Context file:
  • URL: https://w3id.org/security/data-integrity/v2
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/contexts/data-integrity/v2.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/context.jsonld
• Vocabulary files:
  • URL: https://w3id.org/security#
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/vocab/security/vocabulary.html (and .ttl and .jsonld via content negotiation)
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)
• Multikey context file:
  • URL: https://w3id.org/security/multikey/v1
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/contexts/multikey/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/multikey/context.jsonld
• JWK context file:
  • URL: https://w3id.org/security/jwk/v1
  • Redirected via w3id to: https://w3c.github.io/vc-data-integrity/contexts/jwk/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/jwk/context.jsonld

4 Status Lists

• Context file:
  • URL: https://www.w3.org/ns/credentials/status/v1
  • Redirected, via https://www.w3.org/ns/credentials/status/.htaccess to https://w3c.github.io/vc-bitstring-status-list/contexts/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/sl/context.jsonld
• Vocabulary files:
  • URL: https://www.w3.org/ns/credentials/status#
  • Redirected, via https://www.w3.org/2018/credentials/status/.htaccess to https://w3c.github.io/vc-bitstring-status-list/vocab/vocabulary.html (and .ttl and .jsonld via content negotiation)
  • To be redirected to: https://www.w3.org/2025/credentials/sl/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)

5 Controlled Identity

• Context file:
  • URL: https://www.w3.org/ns/cid/v1
  • Redirected, via https://www.w3.org/ns/cid/.htaccess to https://w3c.github.io/cid/context/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/cid/context.jsonld
    (There is no separate vocabulary file for CID, the terms are part of the security vocabulary.)

@brentzundel @msporny @w3c/vc-contributors

[iherman]

The issue was discussed in a meeting on 2025-02-19

• no resolutions were taken

View the transcript

1.7. Final place for vocabularies and contexts once we publish VC 2.0 (issue verifiable-credentials#61)

See github issue verifiable-credentials#61.

Brent Zundel: there are a number of vocabs and contexts here, and they should have W3C URLs.

Ivan Herman: currently they exist but merely redirect to github. They need moving from there to W3C storage.
… after transition request is submitted we will have 2 weeks to move these files.
… then we can change the redirection to their new home.
… dont forget that next week we have to formal resolutions.

---

[iherman]

I have received no comments on this issue, which I take as agreement. I plan to implement all this next week (ie, the week of the 10th of March). Speak up now, or forever hold your peace 🙏🏻

[dlongley]

https://www.w3.org/2025/credentials/vcdi/multikey/context.jsonld

While it might be very unlikely that we'd have another context version come out in the year 2025, it might be prudent to include the version number in the context redirect targets: context-v1.jsonld (or context-v2.jsonld for any v2, etc. things) or similar.

This comment applies to all the proposed context files (redirect targets) above.

[iherman]

Here is the alternative set of target URLS:

1 VDCM

• Core context file:
  • URL: https://www.w3.org/ns/credentials/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/context/v2.jsonld
• Core vocabulary:
  • URL: https://www.w3.org/2018/credentials/
  • Redirected via https://www.w3.org/2018/credentials/.htaccess to https://w3c.github.io/vc-data-model/vocab/credentials/v2/vocabulary.html (and .ttl, .jsonld, .svg via content negotiation).
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)
• Example context file:
  • URL https://www.w3.org/ns/credentials/examples/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/examples/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/examples/context/v2.jsonld
• Undefined context file:
  • URL: https://www.w3.org/ns/credentials/undefined-terms/v2
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/contexts/credentials/undefined-terms/v2
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/undefined-terms/context/v2.jsonld
• Undefined vocabulary:
  • URL: https://www.w3.org/ns/credentials/undefined-terms#
  • Redirected via https://www.w3.org/ns/credentials/.htaccess to https://w3c.github.io/vc-data-model/vocab/credentials/v2/undefined-term.html
  • To be redirected to: https://www.w3.org/2025/credentials/vcdm/undefined-terms/vocab/v2/vocabulary.html

2 JSON Schema

• Core schema:
  • URL: https://www.w3.org/ns/credentials/json-schema/v2.json (or simply v2)
  • Redirected via https://www.w3.org/2018/credentials/json-schema/.htaccess to https://w3c.github.io/vc-json-schema/schema/json-schema-credential-schema.json
  • To be redirected to: https://www.w3.org/2025/credentials/json-schema/v2.json

3 Data Integrity

• Context file:
  • URL: https://w3id.org/security/data-integrity/v2
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/contexts/data-integrity/v2.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/context/v2.jsonld
• Vocabulary files:
  • URL: https://w3id.org/security#
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/vocab/security/vocabulary.html (and .ttl and .jsonld via content negotiation)
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)
• Multikey context file:
  • URL: https://w3id.org/security/multikey/v1
  • Redirected via w3id.org to: https://w3c.github.io/vc-data-integrity/contexts/multikey/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/multikey/context/v1.jsonld
• JWK context file:
  • URL: https://w3id.org/security/jwk/v1
  • Redirected via w3id to: https://w3c.github.io/vc-data-integrity/contexts/jwk/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/vcdi/jwk/context/v1.jsonld

4 Status Lists

• Context file:
  • URL: https://www.w3.org/ns/credentials/status/v1
  • Redirected, via https://www.w3.org/ns/credentials/status/.htaccess to https://w3c.github.io/vc-bitstring-status-list/contexts/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/sl/context/v1.jsonld
• Vocabulary files:
  • URL: https://www.w3.org/ns/credentials/status#
  • Redirected, via https://www.w3.org/2018/credentials/status/.htaccess to https://w3c.github.io/vc-bitstring-status-list/vocab/vocabulary.html (and .ttl and .jsonld via content negotiation)
  • To be redirected to: https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.{html,jsonld,ttl,svg} (with content negotiation)

5 Controlled Identity

• Context file:
  • URL: https://www.w3.org/ns/cid/v1
  • Redirected, via https://www.w3.org/ns/cid/.htaccess to https://w3c.github.io/cid/context/v1.jsonld
  • To be redirected to: https://www.w3.org/2025/credentials/cid/context/v1.jsonld

@dlongley is that o.k.?

[dlongley]

Yes, those look ok to me. Thanks, @iherman!

[iherman]

@msporny @dlongley

I have installed the files on /2025/credentials. Please find, below, a simplified view of the transition, which shows the redirections that must be set up. The DI redirections should be done by you (I do not have access to w3id.org), the rest by me.

However, before this is done, two things (to avoid creating mayhem for existing implementations):

1. I would welcome if you went through each line and check whether they are o.k. and whether the targets are also o.k. With such a set of manual actions it is easy to make a mistake.

2. I wonder when this transition should happen. My problem is the follows. The PR-s are now on /TR and I would prefer not to touch them. However, if we do the transitions now, the hash values for the various files may go wrong. Actually, the do go wrong at one point: the vocabulary.html files, as on github, are all respec files, but I have dumped them as static files in date space. That means the files are not identical, so the hash is wrong. This means that setting up the redirections would invalidate the hash values, and we do not want that during review.

   I therefore propose to postpone the redirection setups to when we will produce the final rec versions of the documents. (Afaik, the hash values are automatically calculated.)

WIth that, here are the redirections:

VDCM

• https://www.w3.org/ns/credentials/v2 -> https://www.w3.org/2025/credentials/vcdm/context/v2.jsonld
• https://www.w3.org/2018/credentials/ -> (with conneg) https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.html, https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.jsonld, https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.ttl, https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.svg
• https://www.w3.org/ns/credentials/examples/v2 -> https://www.w3.org/2025/credentials/vcdm/examples/context/v2.jsonld
• https://www.w3.org/ns/credentials/examples# -> https://www.w3.org/2025/credentials/vcdm/examples/vocab/v2/vocabulary.html
• https://www.w3.org/ns/credentials/undefined-terms/v2 -> https://www.w3.org/2025/credentials/vcdm/undefined-terms/context/v2.jsonld
• https://www.w3.org/ns/credentials/undefined-terms# -> https://www.w3.org/2025/credentials/vcdm/undefined-terms/vocab/v2/vocabulary.html

JSON Schema

• https://www.w3.org/ns/credentials/json-schema/v2.json -> https://www.w3.org/2022/credentials/v2/json-schema-credential-schema.json
• https://www.w3.org/ns/credentials/json-schema/v2 -> https://www.w3.org/2022/credentials/v2/json-schema-credential-schema.json

Data Integrity

• https://w3id.org/security/data-integrity/v2 -> https://www.w3.org/2025/credentials/vcdi/context/v2.jsonld
• https://w3id.org/security# -> (with conneg) https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.html, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.ttl, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.svg
• https://w3id.org/security/multikey/v1 -> https://www.w3.org/2025/credentials/vcdi/multikey/context/v1.jsonld
• https://w3id.org/security/jwk/v1 ->https://www.w3.org/2025/credentials/vcdi/jwk/context/v1.jsonld

Status Lists

• https://www.w3.org/ns/credentials/status/v1 -> https://www.w3.org/2025/credentials/sl/context/v1.jsonld
• https://www.w3.org/ns/credentials/status# -> (with conneg) https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.html, https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.jsonld, https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.ttl, https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.svg

Controlled Identity

• https://www.w3.org/ns/cid/v1 -> https://www.w3.org/2025/credentials/cid/context/v1.jsonld

---

Changed 2025-03-19: updated the json schema target, see #61 (comment)

[davidlehn]

@msporny @dlongley

I have installed the files on /2025/credentials. Please find, below, a simplified view of the transition, which shows the redirections that must be set up. The DI redirections should be done by you (I do not have access to w3id.org), the rest by me.

Anyone can make a PR to w3id.org and appropriate maintainers can be asked to approve:
https://github.com/perma-id/w3id.org/pulls
https://github.com/perma-id/w3id.org/tree/master/security

(That readme is out of date too.)

Data Integrity

• https://w3id.org/security# -> (with conneg) https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.html, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.ttl, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.svg

I was going to do a quick first pass on a PR. While doing so, I wondered if it might be better to let w3.org handle the conneg particulars for the w3id.org vocab redirect? So it would be:
https://w3id.org/security# -> https://www.w3.org/2025/credentials/vcdi/vocab/v2/

And that v2/ dir would handle conneg switching.

I see that's a directory listing now. Perhaps some other endpoint might be better. The idea would be that the related vocab conneg particulars are handled the same way by w3.org. We can put RewriteCond/RewriteRule on w3id.org to handle the conneg, but it might not align exactly with the rules w3.org uses. If we do want that on w3id.org, are there specific type check patterns that should be used? The drawback for this would be an extra redirect, which may be reason enough to put the conneg on w3id.org.

[iherman]

@msporny @dlongley
I have installed the files on /2025/credentials. Please find, below, a simplified view of the transition, which shows the redirections that must be set up. The DI redirections should be done by you (I do not have access to w3id.org), the rest by me.

Anyone can make a PR to w3id.org and appropriate maintainers can be asked to approve: https://github.com/perma-id/w3id.org/pulls https://github.com/perma-id/w3id.org/tree/master/security

(That readme is out of date too.)

Honestly, I would really prefer if one of guys did it. I am never really sure whether I do these .htaccess things right; as long as I am on a w3c site, I can always rely on our system people to help me out, but that is not the case for w3id.org.

Data Integrity

• https://w3id.org/security# -> (with conneg) https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.html, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.ttl, https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.svg

I was going to do a quick first pass on a PR. While doing so, I wondered if it might be better to let w3.org handle the conneg particulars for the w3id.org vocab redirect? So it would be: https://w3id.org/security# -> https://www.w3.org/2025/credentials/vcdi/vocab/v2/

And that v2/ dir would handle conneg switching.

I see that's a directory listing now. Perhaps some other endpoint might be better. The idea would be that the related vocab conneg particulars are handled the same way by w3.org. We can put RewriteCond/RewriteRule on w3id.org to handle the conneg, but it might not align exactly with the rules w3.org uses. If we do want that on w3id.org, are there specific type check patterns that should be used? The drawback for this would be an extra redirect, which may be reason enough to put the conneg on w3id.org.

I actually suspect you already do this for https://w3id.org/security#: isn't there a conneg set up, just redirecting the alternatives to github.io?

At the moment, all conneg on the W3C side for vocabularies are done on /ns and not at the end point. I.e., to take the vcdm vocabulary case, everything is done in the .htaccess file of /2018/credentials, combined with a local index.var file. Ie, /2025/credentials/vcdm/vocabs/v2/ "just" stores the files themselves. Like github.io does. By the sake of consistency, if it is changed at one place, it should be changed everywhere, ie, for the other vocabularies as well.

Following the well known rule "ain't broken, don't fix it" I would prefer to just change the URLs for the redirection and not change anything on the mechanism itself.

[iherman]

@davidlehn a different issue: can you check with the current files whether there are CORS problems? AFAIK, date space is set up in a way that no problems should occur, but I am never sure. Thx.

[davidlehn]

[...]
Honestly, I would really prefer if one of guys did it. I am never really sure whether I do these .htaccess things right; as long as I am on a w3c site, I can always rely on our system people to help me out, but that is not the case for w3id.org.

I made a PR. Can merge it whenever appropriate.
perma-id/w3id.org#4800

[...]
I actually suspect you already do this for https://w3id.org/security#: isn't there a conneg set up, just redirecting the alternatives to github.io?

Nope. It was not doing content negotiation for the main URL. Only directing to the HTML. I'm not sure if other files are available. No one complained.

At the moment, all conneg on the W3C side for vocabularies are done on /ns and not at the end point. I.e., to take the vcdm vocabulary case, everything is done in the .htaccess file of /2018/credentials, combined with a local index.var file. [...]

Following the well known rule "ain't broken, don't fix it" I would prefer to just change the URLs for the redirection and not change anything on the mechanism itself.

Looks like no one at all is using apache content negotiation on w3id (ie, with type-map .var files). Everyone is using mod_rewrite to be close enough. Or deferring to the target server to do proper negotiation. I guess that works in practice. I think it get tricky when mixing wildcards and replacement patterns in the URLs.

The PR I made is using the mod_rewrite solution. It has the normal problems of doing blind Accept string matching and not handling q properly. If that's a problem we can explore a more correct solution. (Patches welcome.)

[davidlehn]

@davidlehn a different issue: can you check with the current files whether there are CORS problems? AFAIK, date space is set up in a way that no problems should occur, but I am never sure. Thx.

It looks like the newer date space does not have the CORS headers. The current v2 context does, and older contexts do. But not newer jsonld contexts or jsonld vocabs. I have some vague recollection that the current v2 context was served via an internal redirection? So maybe CORS headers for that would exist after the updates? But it does look like the date space URLs direct would not.

Also it looks like the new undefined-terms URLs are 404.

You can test manually, with or without an Accept header:

$ curl -sI https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld | grep -i access-control
$ curl -sI https://www.w3.org/2025/credentials/vcdm/context/v2.jsonld | grep -i access-control
$ curl -sI -H "Accept: application/ld+json" https://www.w3.org/2025/credentials/vcdm/context/v2.jsonld | grep -i access-control
$ curl -sI https://www.w3.org/ns/credentials/v2 | grep -i access-control
access-control-allow-origin: *
$ curl -sI https://www.w3.org/2018/credentials/v1 | grep -i access-control
access-control-allow-origin: *

Or you can abuse https://json-ld.org/playground/, open the network console, paste the following in, and watch the failures. Need to delete lines one by one since it stops on first error. I think this silly data should load everything in CORS mode (unless it hits some max context limit, in which case start deleting lines). The w3id URLs might not do the right thing before the related VC 2.0 update PR is merged.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/2025/credentials/vcdm/context/v2.jsonld",
    "https://www.w3.org/2018/credentials/",
    "https://www.w3.org/2025/credentials/vcdm/vocab/v2/vocabulary.jsonld",
    "https://www.w3.org/ns/credentials/examples/v2",
    "https://www.w3.org/2025/credentials/vcdm/examples/context/v2.jsonld",
    "https://www.w3.org/ns/credentials/undefined-terms/v2",
    "https://www.w3.org/2025/credentials/vcdm/undefined-terms/context/v2.jsonld",
    "https://www.w3.org/ns/credentials/undefined-terms",
    "https://www.w3.org/ns/credentials/json-schema/v2.json",
    "https://www.w3.org/2025/credentials/json-schema/v2.json",
    "https://www.w3.org/ns/credentials/json-schema/v2",
    "https://www.w3.org/2025/credentials/json-schema/v2.json",
    "https://w3id.org/security/data-integrity/v2",
    "https://www.w3.org/2025/credentials/vcdi/context/v2.jsonld",
    "https://w3id.org/security",
    "https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld",
    "https://w3id.org/security/multikey/v1",
    "https://www.w3.org/2025/credentials/vcdi/multikey/context/v1.jsonld",
    "https://w3id.org/security/jwk/v1",
    "https://www.w3.org/2025/credentials/vcdi/jwk/context/v1.jsonld",
    "https://www.w3.org/ns/credentials/status/v1",
    "https://www.w3.org/2025/credentials/sl/context/v1.jsonld",
    "https://www.w3.org/ns/credentials/status",
    "https://www.w3.org/2025/credentials/sl/vocab/v1/vocabulary.jsonld",
    "https://www.w3.org/ns/cid/v1",
    "https://www.w3.org/2025/credentials/cid/context/v1.jsonld"
  ]
}

[iherman]

@davidlehn thanks. The current setup serves the files from github.io, and I presume it adds the CORS headers. The redirection itself does not. I have set the cors headers to the .htaccess of /2025/credentials, so here is what we get:

curl -sI https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.jsonld | grep -i access-control
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
access-control-allow-headers: Content-Type, Authorization

I guess that should do.

B.t.w., I am not sure why you got a 404 for the undefined terms:

16:23 Temp> curl -sI https://www.w3.org/2025/credentials/vcdm/undefined-terms/context/v2.jsonld                         
HTTP/2 200 
date: Tue, 18 Mar 2025 15:23:27 GMT
content-type: application/ld+json
content-length: 90
last-modified: Tue, 11 Mar 2025 15:06:05 GMT
...
16:23 Temp> curl -sI https://www.w3.org/2025/credentials/vcdm/undefined-terms/vocab/v2/vocabulary.html
HTTP/2 200 
date: Tue, 18 Mar 2025 15:23:56 GMT
content-type: text/html; charset=utf-8
last-modified: Tue, 11 Mar 2025 15:04:03 GMT
...