Update a holder root CA certificate
Updates a holder root CA certificate. The only mutable field is active.
Setting active: true deactivates all other roots for the tenant (single-active constraint).
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>certificateId*stringUnique identifier of the holder root CA certificate.
uuidapplication/json- body
active*booleanWhether the holder root CA certificate is active. Setting true deactivates all other roots for the tenant (single-active constraint).
Holder root CA certificate updated.
application/json- response
A holder root CA certificate.
id*stringUnique identifier for this holder root CA certificate.
uuidactive*booleanWhether this root is currently active. Only one root can be active per tenant at a time.
certificatePem*stringThe root CA certificate in PEM format.
certificateFingerprint*stringSHA-256 fingerprint (hex) of the root certificate.
certificateData*Parsed metadata extracted from the certificate.
isManaged*booleanWhether the private key for this root certificate is managed by MATTR VII (true) or externally by the customer (false).
curl -X PUT 'https://example.vii.au01.mattr.global/v1/holder/certificates/ca/281d20b3-42a3-40dd-b29a-115ff32b02b7' \ -H 'Content-Type: application/json' \ -d '{ "active": true}'{ "id": "281d20b3-42a3-40dd-b29a-115ff32b02b7", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "a3b2c1d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890", "certificateData": { "commonName": "Example Tenant Wallet Attestation Root", "country": "NZ", "notBefore": "2026-04-06T00:00:00.000Z", "notAfter": "2036-04-06T00:00:00.000Z" }, "isManaged": true}How would you rate this page?
Retrieve a holder root CA certificate GET
Retrieves a holder root CA certificate by ID.
Delete a holder root CA certificate DELETE
Deletes a holder root CA certificate and cascade-deletes all associated signer certificates. For managed roots and signers, MATTR VII also removes the private key material it was holding on the customer's behalf. Deletion does not invalidate any wallet attestation JWTs that were issued under this root. Those JWTs remain cryptographically valid until their natural expiry — verifiers that have already cached the signer's public key may continue to accept them. CRL-based revocation of issued attestations is not supported in this release.