Update an mDocs configuration

Used to differentiate between different mDocs configurations on your tenant. Thus, its value must:

• Be unique across all mDocs configurations on your tenant.
• Not be VerifiableCredential.
• When set to org.iso.18013.5.*.mDL (where * is a positive integer), MATTR VII recognizes that this is attempt to create an mDL credential configuration and will fail if the validity period is set to 427 days or more.

This is where you specify how to map claims (user attributes) into issued credentials.

References the unique identifier of a claims source that can be used to retrieve claims and include them in the issued credential.

Used to determine when issued credentials will expire, relative to issuance date:

• Ignored if a valid validUntil date/time is provided.
• Cannot be before the validFrom date/time.
• If expiresIn is used to determine the credential's expiry date and validFrom is provided, the expiration date will still be calculated based on the issuance date, not the validFrom value.
• Can include any combination of years, months, weeks, days, hours, minutes and seconds.
• If type is set to org.iso.18013.5.*.mDL (for issuing an mDL), the maximum validity is 427 days.
• For any other type, the maximum validity is 3620 days.

Credential expiry can never exceed the validity period of the IACA used as the root certificate when signing the credential. However, all validity checks (including those for IACA and credential validity periods) only occur when an individual credential is being signed, not when the generic credential configuration template is created (Refer to IACA selection for more information on how an IACA is selected when signing an mDoc). As a result, issuance will fail if the expiresIn value exceeds the validity of all currently active IACAs at the time of issuance.

Specifies an explicit date and time from which the credential becomes valid, mapped from the user's claims. Use it when the start date differs for each issued credential.

• mapFrom is the path to the claim that holds the date and time (for example, claims.validFrom), not the date itself. It uses the same syntax as mapFrom in claimMappings.
• At issuance, the value of the mapped claim must be a valid ISO 8601 date/time string (for example, 2026-11-01T00:00:00Z), otherwise issuance fails.
• If not provided, or if the mapped claim is not present at issuance, defaults to using the issuance date as the starting point for the credential's validity.
• Cannot be after the credential's expiration date/time.
• Cannot be before the credential's issuance date/time.

Credential expiry can never exceed the validity period of the IACA used as the root certificate when signing the credential. However, all validity checks (including those for IACA and credential validity periods) only occur when an individual credential is being signed, not when the generic credential configuration template is created (Refer to IACA selection for more information on how an IACA is selected when signing an mDoc). As a result, issuance will fail if the validFrom value exceeds the validity of all currently active IACAs at the time of issuance.

Specifies an explicit date and time at which the credential expires, mapped from the user's claims. Use it when the expiry date differs for each issued credential, such as a credential derived from another document that must not outlive it.

• mapFrom is the path to the claim that holds the date and time (for example, claims.validUntil), not the date itself. It uses the same syntax as mapFrom in claimMappings.
• At issuance, the value of the mapped claim must be a valid ISO 8601 date/time string (for example, 2027-11-01T00:00:00Z), otherwise issuance fails.
• If not provided, or if the mapped claim is not present at issuance, the expiration date will be determined based on the expiresIn value provided in the credential configuration.
• Cannot be before the validFrom date/time.
• If type is set to org.iso.18013.5.*.mDL (for issuing an mDL), the maximum validity is 427 days.
• For any other type, the maximum validity is 3620 days.

Credential expiry can never exceed the validity period of the IACA used as the root certificate when signing the credential. However, all validity checks (including those for IACA and credential validity periods) only occur when an individual credential is being signed, not when the generic credential configuration template is created (Refer to IACA selection for more information on how an IACA is selected when signing an mDoc). As a result, issuance will fail if the validUntil value exceeds the validity of all currently active IACAs at the time of issuance.

Used to apply branding to issued credentials.

Branding is written into each issued credential, in a private _branding field of the Mobile Security Object (MSO) that is covered by the issuer's signature. It is therefore available to the holder offline, and it travels with the credential when it is presented. It is also fixed at issuance, so updating branding here does not change credentials that have already been issued.

_branding is a custom extension element to ISO/IEC 18013-5 rather than a standardized feature, so holder and verifier applications need to be built to read it. MATTR SDKs and MATTR GO handle this out of the box. If you are working with other solutions, confirm that they read _branding before you rely on it for display. Applications that do not recognize the field ignore it.

When set to true, issued mDocs are revocable. They include a status object, which refers a Status list where the mDoc status is indicated. Revocable mDocs are issued as valid by default, but this status can later be changed to invalid.