Create a holder root CA certificate

Creates a holder root CA certificate that is used to issue wallet attestation signer certificates.

Two flows are supported:

• Managed — MATTR VII generates the root certificate and manages the private key on the customer's behalf. Supply no certificatePem in the request body; commonName and country are optional.
• Unmanaged — the customer supplies their own externally-managed root CA in PEM format. commonName and country are extracted from the certificate and must not be provided in the request.

A maximum of three holder root CA certificates can be created per tenant. Only one can be active at a time.

The newly-created root is always inactive. Activate it by issuing PUT /v1/holder/certificates/ca/{certificateId} with { "active": true }, which also deactivates any previously active root for the tenant (single-active constraint).

Analytic events

• CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_START
• CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_SUCCESS
• CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_FAIL

Response Body

curl -X POST "https://example.vii.au01.mattr.global/v1/holder/certificates/ca" \  -H "Content-Type: application/json" \  -d '{}'

{
  "id": "281d20b3-42a3-40dd-b29a-115ff32b02b7",
  "active": true,
  "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",
  "certificateFingerprint": "a3b2c1d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890",
  "certificateData": {
    "commonName": "Example Tenant Wallet Attestation Root",
    "country": "NZ",
    "notBefore": "2026-04-06T00:00:00.000Z",
    "notAfter": "2036-04-06T00:00:00.000Z"
  },
  "isManaged": true
}

{
  "code": "string",
  "message": "string",
  "details": [
    {
      "value": "string",
      "msg": "Invalid value",
      "param": "id",
      "location": "body"
    }
  ]
}

{
  "code": "string",
  "message": "string",
  "details": [
    {
      "value": "string",
      "msg": "Invalid value",
      "param": "id",
      "location": "body"
    }
  ]
}