Create a wallet attestation signer
Creates a wallet attestation signer for an unmanaged root CA and returns its Certificate Signing Request (CSR).
This endpoint is only available for unmanaged roots — managed root signers are auto-provisioned on demand during the first wallet attestation request and never need to be created explicitly.
The returned signer is created with active: false; use the CSR to obtain a signed certificate externally and upload it via PUT /v1/holder/certificates/wallet-attestation-signers/{certificateId} to activate the signer.
A maximum of five wallet attestation signers can be created per root.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
caId*stringIdentifier of the holder root CA certificate this signer will be issued from.
- Must be an unmanaged root. Managed root signers are auto-provisioned and cannot be created via this endpoint.
uuidWallet attestation signer created.
application/json- response
A wallet attestation signer prior to certificate upload. Includes the Certificate Signing Request (CSR) that must be externally signed.
id*stringUnique identifier for this wallet attestation signer.
uuidcaId*stringIdentifier of the holder root CA certificate this signer is issued from.
uuidcsrPem*stringX.509 Certificate Signing Request in PEM format. Sign this externally with the parent root and upload the resulting certificate via PUT /v1/holder/certificates/wallet-attestation-signers/{certificateId}.
active*falseAlways false prior to certificate upload.
falsecurl -X POST 'https://example.vii.au01.mattr.global/v1/holder/certificates/wallet-attestation-signers' \ -H 'Content-Type: application/json' \ -d '{ "caId": "281d20b3-42a3-40dd-b29a-115ff32b02b7"}'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "caId": "281d20b3-42a3-40dd-b29a-115ff32b02b7", "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIC5zCCAc8CAQAwgaExC...\n-----END CERTIFICATE REQUEST-----", "active": false}How would you rate this page?
Retrieve a holder root CA certificate revocation list GET
Retrieves the Certificate Revocation List (CRL) for a managed holder root CA certificate, as a DER-encoded binary document. This endpoint is only available for managed roots — for unmanaged roots it returns `404 NoCertificateRevocationList`.
Retrieve all wallet attestation signers GET
Retrieves all wallet attestation signers for the tenant across all roots. The response may contain a mix of: - CSR-pending signers (unmanaged, certificate not yet uploaded) - Active signers (managed or unmanaged with an uploaded certificate)