Create a holder root CA certificate
Creates a holder root CA certificate that is used to issue wallet attestation signer certificates.
Two flows are supported:
- Managed — MATTR VII generates the root certificate and manages the private key on the customer's behalf. Supply no
certificatePemin the request body;commonNameandcountryare optional. - Unmanaged — the customer supplies their own externally-managed root CA in PEM format.
commonNameandcountryare extracted from the certificate and must not be provided in the request.
A maximum of three holder root CA certificates can be created per tenant. Only one can be active at a time.
The newly-created root is always inactive. Activate it by issuing PUT /v1/holder/certificates/ca/{certificateId} with { "active": true }, which also deactivates any previously active root for the tenant (single-active constraint).
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
Payload for creating a managed holder root CA certificate. MATTR VII generates the P-256 key pair and self-signed certificate on the customer's behalf. The root is always created inactive — activate it via PUT /v1/holder/certificates/ca/{certificateId}.
commonName?stringCommon name of the holder root CA certificate. Must be a valid PrintableString and cannot be an empty string if provided. If omitted, defaults to "{tenantDomain} Wallet Attestation" — the tenant's custom domain is used if configured and verified, otherwise the tenant subdomain.
country?stringISO 3166-1 alpha-2 country code for the root certificate's subject. If omitted, a tenant-level default is used.
Holder root CA certificate created.
application/json- response
A holder root CA certificate.
id*stringUnique identifier for this holder root CA certificate.
uuidactive*booleanWhether this root is currently active. Only one root can be active per tenant at a time.
certificatePem*stringThe root CA certificate in PEM format.
certificateFingerprint*stringSHA-256 fingerprint (hex) of the root certificate.
certificateData*Parsed metadata extracted from the certificate.
isManaged*booleanWhether the private key for this root certificate is managed by MATTR VII (true) or externally by the customer (false).
curl -X POST 'https://example.vii.au01.mattr.global/v1/holder/certificates/ca' \ -H 'Content-Type: application/json' \ -d '{}'{ "id": "281d20b3-42a3-40dd-b29a-115ff32b02b7", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "a3b2c1d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890", "certificateData": { "commonName": "Example Tenant Wallet Attestation Root", "country": "NZ", "notBefore": "2026-04-06T00:00:00.000Z", "notAfter": "2036-04-06T00:00:00.000Z" }, "isManaged": true}How would you rate this page?
Delete a registered holder application instance DELETE
Deletes a registered instance of a holder application. Deleted instances will no longer be able to interact with the platform or receive tokens, and any existing tokens will be revoked. Application owners can use this endpoint to remove individual instances that are no longer needed or were registered by mistake, without affecting the entire holder application or its other instances. This is useful for cleaning up test instances or managing specific devices, rather than deleting the whole application and all its associated instances.
Retrieve all holder root CA certificates GET
Retrieves all holder root CA certificates for the tenant.