light-mode-image
Learn
API ReferenceHolder root CA certificates

Retrieve all holder root CA certificates

Roles

adminholder

Analytics Events

CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_STARTCREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_SUCCESSCREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_FAIL
GET/v1/holder/certificates/ca

Retrieves all holder root CA certificates for the tenant.

Analytic events

  • CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_START
  • CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_SUCCESS
  • CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_LIST_FAIL

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Query Parameters

limit?number

Range size of returned list.

Range1 <= value <= 1000
Default100
cursor?string

Starting point for the list of entries.

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/holder/certificates/ca"
{  "data": [    {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "active": true,      "certificatePem": "string",      "certificateFingerprint": "string",      "certificateData": {        "commonName": "string",        "country": "string",        "notBefore": "2019-08-24T14:15:22Z",        "notAfter": "2019-08-24T14:15:22Z"      },      "isManaged": true    }  ],  "nextCursor": "string"}

How would you rate this page?

Create a holder root CA certificate POST

Creates a holder root CA certificate that is used to issue wallet attestation signer certificates. Two flows are supported: - **Managed** — MATTR VII generates the root certificate and manages the private key on the customer's behalf. Supply no `certificatePem` in the request body; `commonName` and `country` are optional. - **Unmanaged** — the customer supplies their own externally-managed root CA in PEM format. `commonName` and `country` are extracted from the certificate and must not be provided in the request. A maximum of three holder root CA certificates can be created per tenant. Only one can be active at a time. The newly-created root is always inactive. Activate it by issuing `PUT /v1/holder/certificates/ca/{certificateId}` with `{ "active": true }`, which also deactivates any previously active root for the tenant (single-active constraint). ### **Analytic events** * CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_START * CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_SUCCESS * CREDENTIAL_HOLDER_CA_CERTIFICATE_CREATE_FAIL

Retrieve a holder root CA certificate GET

Retrieves a holder root CA certificate by ID. ### **Analytic events** * CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_START * CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_SUCCESS * CREDENTIAL_HOLDER_CA_CERTIFICATE_RETRIEVE_FAIL