Create an IACA
Creates a new IACA that can be used to sign certificates for Document and Status List signers.
- IACAs are always created as inactive. You must manually update the IACA to
active: truebefore it can be used to sign mDocs. - A maximum of three IACAs can be created per tenant.
- Multiple active IACAs are supported to enable IACA rotation. When signing an mDoc, MATTR VII uses only one active IACA, chosen based on the IACA selection criteria. Selection does not take the credential configuration or
docTypeinto account, so an IACA cannot be assigned to a specific credential configuration.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
commonName?stringThis optional parameter indicates the common name of the IACA certificate. When specified, the value must be a valid PrintableString and cannot be an empty string. If not provided and a custom domain is configured and verified, the custom domain is used followed by the word IACA. If no custom domain is configured, the tenant subdomain is used instead.
"{tenantDomain} IACA"country?stringThis optional parameter indicates the issuer country. If not provided, a country is selected based on the region of the tenant subdomain cloud host. When specified, the value must be a valid Alpha 2 country code as per ISO 3166-1.
notBefore?stringThis optional parameter is used to set the date and time when the IACA becomes valid and can be used to sign mDocs. This can be used alongside the active field to support IACA rotation by creating inactive IACAs and distributing them to relying parties in advance. * Must not be in the past. * Must be before notAfter.
notAfter?stringThis optional parameter is used to set the date and time when the IACA expires. - If not provided, calculated as notBefore + 10 years. - If not provided and notBefore is not provided, calculated as time of creation + 10 years. - Maximum value is 20 years from creation. - Must be after notBefore, if provided.
stateOrProvinceName?stringThis optional parameter indicates the issuer state or province. When specified, the value must be uppercase and a valid state/province code as per ISO 3166-2.
IACA created
application/json- response
id*stringUnique identifier of the created IACA.
uuidactive*booleanIndicates whether the IACA is active or not. Only active IACAs can be used to sign mDocs.
certificatePem*stringCertificate PEM format.
certificateData*certificateFingerprint*stringHash that includes all certificate data and its signature.
isManaged?booleanIndicates whether the private key for this certificate is managed by MATTR (true) or out of band by the customer as an external IACA (false).
curl -X POST "https://example.com/v2/credentials/mobile/iacas" \ -H "Content-Type: application/json" \ -d '{}'IACAs are always created inactive. Update the IACA to active: true before using it to sign mDocs.
{ "id": "2e89c156-31d5-4783-bd59-9055b5f8e7d2", "active": false, "certificatePem": "-----BEGIN CERTIFICATE-----\r\nMIICDjCCAbSgAwIBAgIKdeZsA5NPKimuAzAKBggqhkjOPQQDAjAiMSAwCQYDVQQG\r\nEwJOWjATBgNVBAMTDEV4YW1wbGUgSUFDQTAeFw0yMzA5MTEyMzM0MjJaFw0zMzA5\r\nMDgyMzM0MjJaMCIxIDAJBgNVBAYTAk5aMBMGA1UEAxMMRXhhbXBsZSBJQUNBMFkw\r\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBbK7JKKFMWuu8kHQK2qaML+MQ0Ykk3Qg\r\n/p3TC6lQKvYJozPSpLXbJQIzMPq9u/dG+j4vq1iX/G/jFIwfiEiKEqOB0TCBzjAS\r\nBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIABjAdBgNVHQ4EFgQU9zTh\r\nKsqFxAgRJDDGW1au+ewJK6owHgYDVR0SBBcwFYYTaHR0cHM6Ly9leGFtcGxlLmNv\r\nbTBpBgNVHR8EYjBgMF6gXKBahlhodHRwczovL2V4YW1wbGUuY29tL3YyL2NyZWRl\r\nbnRpYWxzL21vYmlsZS9pYWNhcy8yZTg5YzE1Ni0zMWQ1LTQ3ODMtYmQ1OS05MDU1\r\nYjVmOGU3ZDIvY3JsMAoGCCqGSM49BAMCA0gAMEUCIQDD+eU8iOsYYC0v41L94fhF\r\nZ0brPo4gx2aRxrhE3NLFpwIgIgHCPBXJ+JICJg3K7dEsr153So4SEZzAA1rRn4eF\r\nvkM=\r\n-----END CERTIFICATE-----\r\n", "certificateData": { "notBefore": "2023-09-11T23:34:22.000Z", "notAfter": "2033-09-08T23:34:22.000Z", "country": "NZ", "commonName": "Example IACA" }, "certificateFingerprint": "3c06145a53e6c252091a71540f870d4d521dede9f176a681a74e38ddc47bb311", "isManaged": true}How would you rate this page?