Document signers
Create a Document signer
Creates a new Document Signer that can be used to sign new mDocs.
- Only available in implementations using unmanaged (external) IACAs.
- A maximum of five Document Signers can be created per tenant.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
iacaId*stringInternal identifier of the IACA used to sign this document signer:
- Must be an unmanaged (external) IACA.
uuidDocument Signer created
application/json- response
Document signer before a certificate has been uploaded. Includes a Certificate Signing Request (CSR).
id*stringEach Document Signer created on MATTR VII will have a unique identifier which must be provided when using this Document Signer to sign an mDoc.
uuidiacaId*stringUnique identifier of the IACA used to sign the Document Signer.
uuidactive*booleanIndicates the Document Signer status. Only active Document Signers (true) can be used to sign mDocs.
csrPem*stringThe X.509 Certificate Signing Request (CSR) in PEM format, base64 encoded. Use this CSR to generate a valid certificate, then update the document signer with the resulting certificate.
curl -X POST "https://example.com/v2/credentials/mobile/document-signers" \ -H "Content-Type: application/json" \ -d '{ "iacaId": "080c670a-2e90-4023-b79f-b706e55e9bc6" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "iacaId": "080c670a-2e90-4023-b79f-b706e55e9bc6", "active": true, "csrPem": "-----BEGIN CERTIFICATE REQUEST-----...-----END CERTIFICATE REQUEST-----"}Revoke a Document signer
Revokes an existing Document Signer, making it unusable for signing new mDocs.
If the verifier checks the CRL referenced in the IACA certificate, it must treat revoked Document Signers and any mDocs they signed as untrusted.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>documentSignerId*stringDocument Signer identifier
uuidapplication/json- body
Empty request body for document signer revocation
Document Signer revoked
application/json- response
revoked*booleanIndicates whether this document signer has been revoked
revocationDate*stringISO 8601 timestamp indicating when the Document Signer was revoked
curl -X POST "https://example.com/v2/credentials/mobile/document-signers/497f6eca-6276-4993-bfeb-53cbbbba6f08/revoke" \ -H "Content-Type: application/json" \ -d '{}'{ "revoked": true, "revocationDate": "2025-10-31T23:59:59Z"}Retrieve all Document signers
Retrieves all existing Document Signers from the tenant.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>Document Signers retrieved
application/json- response
data*array<|>nextCursor?stringcurl -X GET "https://example.com/v2/credentials/mobile/document-signers"{ "data": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "iacaId": "080c670a-2e90-4023-b79f-b706e55e9bc6", "active": true, "csrPem": "-----BEGIN CERTIFICATE REQUEST-----...-----END CERTIFICATE REQUEST-----" } ], "nextCursor": "string"}Retrieve a Document signer
Retrieves an existing Document Signer by providing its ID.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>documentSignerId*stringDocument Signer ID
uuidDocument Signer retrieved
application/json- response
Document signer before a certificate has been uploaded. Includes a Certificate Signing Request (CSR).
id*stringEach Document Signer created on MATTR VII will have a unique identifier which must be provided when using this Document Signer to sign an mDoc.
uuidiacaId*stringUnique identifier of the IACA used to sign the Document Signer.
uuidactive*booleanIndicates the Document Signer status. Only active Document Signers (true) can be used to sign mDocs.
csrPem*stringThe X.509 Certificate Signing Request (CSR) in PEM format, base64 encoded. Use this CSR to generate a valid certificate, then update the document signer with the resulting certificate.
curl -X GET "https://example.com/v2/credentials/mobile/document-signers/d2c9f2aa-fc69-4fbc-9b85-0c00591d72f6"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "iacaId": "080c670a-2e90-4023-b79f-b706e55e9bc6", "active": true, "csrPem": "-----BEGIN CERTIFICATE REQUEST-----...-----END CERTIFICATE REQUEST-----"}Update a Document signer
Updates an existing Document Signer by providing its ID and active parameter.
Only available in implementations using unmanaged (external) IACAs.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>documentSignerId*stringDocument Signer ID
uuidapplication/json- body
active*booleanThis required parameter defines the status of the created Document Signer. Only active Document Signers can be used to sign mDocs.
certificatePem?stringDocument Signer Certificate (DSC) in PEM format. The certificate must be:
- Valid
- Not expired
- Compliant with the details provided in the Certificate Signing Request returned when the Document Signer was created Refer to Certificate requirements in the external certificates documentation for a full list of requirements detailed in the CSR.
Document Signer updated
application/json- response
Document signer after a certificate has been uploaded. Includes the uploaded certificate in PEM format, as well as the certificate's fingerprint and data.
id*stringEach Document Signer created on MATTR VII will have a unique identifier which must be provided when using this Document Signer to sign an mDoc.
uuidiacaId*stringUnique identifier of the IACA used to sign the Document Signer.
uuidactive*booleanIndicates the Document Signer status. Only active Document Signers (true) can be used to sign mDocs.
certificatePem*stringDocument Signer Certificate (DSC) in PEM format.
certificateFingerprint*stringDocument Signer Certificate (DSC) Hash that includes all certificate data and its signature.
certificateData*curl -X PUT "https://example.com/v2/credentials/mobile/document-signers/d2c9f2aa-fc69-4fbc-9b85-0c00591d72f6" \ -H "Content-Type: application/json" \ -d '{ "active": true }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "iacaId": "080c670a-2e90-4023-b79f-b706e55e9bc6", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\\r\\nMIICbzCCAhSgAwIBAgIKfS7sskyJEh+DOzAKBggqhkjOPQQDAjAiMSAwCQYDVQQG\\r\\nEwJOWjATBgNVBAMTDEV4YW1wbGUgSUFDQTAeFw0yMzA5MTEyMzM0MjJaFw0yNDA5\\r\\nMTAyMzM0MjJaMDExLzAJBgNVBAYTAk5aMCIGA1UEAxMbZXhhbXBsZS5jb20gRG9j\\r\\ndW1lbnQgU2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7fa+jv9zCtHQ\\r\\nmKn7o1dS6lBHD5thlhPqjlx7qEfqy8Im9AcQJDal2sr/fUxhHwf/G4ublS7AL04U\\r\\n73dzr/ozxaOCASEwggEdMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLdNNPTmPxt0\\r\\nLqvlZnV/QL86MXOxMB8GA1UdIwQYMBaAFPc04SrKhcQIESQwxltWrvnsCSuqMA4G\\r\\nA1UdDwEB/wQEAwIAgDAeBgNVHREEFzAVhhNodHRwczovL2V4YW1wbGUuY29tMB4G\\r\\nA1UdEgQXMBWGE2h0dHBzOi8vZXhhbXBsZS5jb20waQYDVR0fBGIwYDBeoFygWoZY\\r\\naHR0cHM6Ly9leGFtcGxlLmNvbS92Mi9jcmVkZW50aWFscy9tb2JpbGUvaWFjYXMv\\r\\nMmU4OWMxNTYtMzFkNS00NzgzLWJkNTktOTA1NWI1ZjhlN2QyL2NybDASBgNVHSUE\\r\\nCzAJBgcogYxdBQECMAoGCCqGSM49BAMCA0kAMEYCIQCfgn6+QoNfDVelJANl+Jp9\\r\\ncq7X9paZylfnI6UGr1FM6gIhAIzhiyclDa8+/ZSRfu7KfgGrNRaJ8YQ6vevskJls\\r\\nIavC\\r\\n-----END CERTIFICATE-----\\r\\n", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "notAfter": "2034-09-26T00:00:00.000Z", "notBefore": "2023-09-30T00:00:00.000Z", "country": "US", "stateOrProvinceName": "US-AL", "commonName": "{tenant-subdomain}.vii.mattr.global Document Signer" }}Delete a Document signer
Deletes an existing Document Signer by providing its ID.
Only available in implementations using unmanaged (external) IACAs.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>documentSignerId*stringDocument Signer ID
uuidDocument Signer deleted
curl -X DELETE "https://example.com/v2/credentials/mobile/document-signers/d2c9f2aa-fc69-4fbc-9b85-0c00591d72f6"How would you rate this page?
Last updated on