Update a wallet attestation signer
Updates a wallet attestation signer by:
- Uploading a signed certificate PEM that matches the signer's CSR (first-time upload for CSR-pending signers only).
- Activating or deactivating the signer. Only signers with a valid PEM certificate can be activated.
certificatePem is immutable after the first upload — subsequent PUT requests may only toggle active.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>certificateId*stringUnique identifier of the wallet attestation signer.
uuidapplication/json- body
Payload for updating a wallet attestation signer. Can be used to upload the signed certificate PEM (first-time upload only) and/or toggle the active flag.
active?booleanWhether the wallet attestation signer is active. Only signers with an uploaded certificate PEM can be activated.
Multiple active signers may exist for the same root (e.g. during a rotation where a new signer has been created but the old one is still trusted by relying parties). When more than one active signer exists for the active root, attestation signing always selects the most recently created one.
certificatePem?stringSigned certificate PEM for an unmanaged signer whose CSR has been externally signed. Must match the signer's CSR public key and be signed by the parent root certificate. Other certificate properties (key usage, extensions, validity period) are inherited from the CSR or set by the issuing CA.
This field is immutable after the first upload — subsequent requests with certificatePem will return 400 CannotOverrideCertificatePem.
Wallet attestation signer updated.
application/json- response
A wallet attestation signer with a signed certificate. For managed signers, the certificate is auto-provisioned. For unmanaged signers, the certificate was uploaded via PUT.
id*stringUnique identifier for this wallet attestation signer.
uuidcaId*stringIdentifier of the holder root CA certificate this signer is issued from.
uuidactive*booleanWhether this signer is currently active. Only active signers with a valid certificate are used to sign wallet attestation JWTs.
certificatePem*stringThe signer certificate in PEM format.
certificateFingerprint*stringSHA-256 fingerprint (hex) of the signer certificate.
certificateData*Parsed metadata extracted from the signer certificate.
curl -X PUT 'https://example.vii.au01.mattr.global/v1/holder/certificates/wallet-attestation-signers/782f1885-c7c2-4459-8426-b6d7c111b0b1' \ -H 'Content-Type: application/json' \ -d '{}'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "caId": "281d20b3-42a3-40dd-b29a-115ff32b02b7", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com Wallet Attestation Signer", "country": "NZ", "notBefore": "2026-04-06T00:00:00.000Z", "notAfter": "2027-04-06T00:00:00.000Z" }}How would you rate this page?
Retrieve a wallet attestation signer GET
Retrieves a wallet attestation signer by ID. The response shape depends on the signer's state — CSR-pending signers return a CSR, signers with a signed certificate return the full certificate details.
Delete a wallet attestation signer DELETE
Deletes a wallet attestation signer. For managed signers, MATTR VII also removes the private key material it was holding on the customer's behalf.