Matter Cluster 62 — Operational Credentials Cluster

Cluster Identity

Revision history

Shadow Path Format

Cluster 62 values in the device shadow use this format:

endpoint_id / 62 / attribute_id

Example:

{
  "0/62/2": 5
}

Data Types

CertificateChainTypeEnum

This enumeration is used by the CertificateChainRequest command to convey which certificate from the device attestation certificate chain to transmit back to the client.

NodeOperationalCertStatusEnum

This enumeration is used by the NOCResponse common response command to convey detailed outcome of several of this cluster's operations.

FabricDescriptorStruct (struct) — fabric-scoped

This structure encodes a Fabric Reference for a fabric within which a given Node is currently commissioned.

NOCStruct (struct) — fabric-scoped

This encodes a NOC chain, underpinning a commissioned Operational Identity for a given Node. The VVSC field is mutually exclusive with the ICAC field.

Cluster 62 Attributes

Cluster 62 defines 6 attributes plus the global attributes. Conformance: M mandatory, O optional, a feature code means "mandatory when that feature is present", square brackets mean "optional when …".

Global attributes

Attribute Details

Attribute 0 / 0x0000 — NOCs

Path example:

0/62/0

No condensed specification text is available for NOCs; use the type, conformance and constraint below together with the cluster description above.

Each entry is a NOCStruct (see Data Types).

Example:

{
  "0/62/0": []
}

Attribute 1 / 0x0001 — Fabrics

Path example:

0/62/1

Indicates all fabrics to which this Node is commissioned, encoded as a read-only list of FabricDescriptorStruct. This information may be computed directly from the NOCs attribute. The Fabrics attribute is also known as "the fabric table". Upon Factory Data Reset, this attribute is set to a default value of an empty list.

Each entry is a FabricDescriptorStruct (see Data Types).

Example:

{
  "0/62/1": []
}

Attribute 2 / 0x0002 — SupportedFabrics

Path example:

0/62/2

Indicates the number of Fabrics that are supported by the device. This value is fixed for a particular device.

Example:

{
  "0/62/2": 5
}

Attribute 3 / 0x0003 — CommissionedFabrics

Path example:

0/62/3

Indicates the number of Fabrics to which the device is currently commissioned. This attribute is equal to the following: - The number of entries in the NOCs attribute. - The number of entries in the Fabrics attribute. Upon Factory Data Reset, this attribute is set to a default value of 0.

Example:

{
  "0/62/3": 1
}

Attribute 4 / 0x0004 — TrustedRootCertificates

Path example:

0/62/4

This attribute contains the list of Trusted Root CA Certificates (RCAC) installed on the Node, as octet strings containing their Matter Certificate Encoding representation. These certificates are installed through the AddTrustedRootCertificate command. Depending on the method of storage employed by the server, either shared storage for identical root certificates shared by many fabrics, or individually stored root certificate per fabric, multiple identical root certificates may legally appear within the list.

Example:

{
  "0/62/4": []
}

Attribute 5 / 0x0005 — CurrentFabricIndex

Path example:

0/62/5

Indicates the accessing fabric index. This attribute is useful to contextualize Fabric-Scoped entries obtained from response commands or attribute reads, since a given Fabric may be referenced by a different Fabric Index locally on a remote Node.

Example:

{
  "0/62/5": 1
}

Cluster 62 Commands

Cluster 62 has 10 client-to-server commands and 5 responses.

AcceptedCommandList

The AcceptedCommandList attribute lists the command IDs the endpoint actually implements:

endpoint_id / 62 / 65529

{
  "0/62/65529": [
    0,
    2,
    4,
    6,
    7,
    9,
    10,
    11,
    12,
    13
  ]
}

Bridge Command Payload Format

The bridge accepts Matter commands in this structure:

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "AttestationRequest",
    "payload": {},
    "timed_request_timeout_ms": 1000
  }
}

For Cluster 62, always use "cluster_id": 62. Payload keys are the command field names in lowerCamelCase. Octet-string fields are base64-encoded. timed_request_timeout_ms is required for timed commands and ignored otherwise.

Command: AttestationRequest

Purpose

This command is used to perform an attestation request. This command is generated to request the Attestation Information, in the form of an AttestationResponse Command. If the AttestationNonce that is provided in the command is malformed, a recipient must fail the command with a Status Code of INVALID_COMMAND. The AttestationNonce field is used in the computation of the Attestation Information.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "AttestationRequest",
    "payload": {
      "attestationNonce": "AQID"
    }
  }
}

The device answers with AttestationResponse (see below).

Command: AttestationResponse

Purpose

This command is used to report the results of the AttestationRequest command.

Command Identity

Response Fields

Command: CertificateChainRequest

Purpose

This command is used to request a certificate from the device attestation certificate chain. If the CertificateType is not a valid value per CertificateChainTypeEnum then the command must fail with a Status Code of INVALID_COMMAND.

Command Identity

Payload Fields

CertificateType values (CertificateChainTypeEnum): 1 = DACCertificate, 2 = PAICertificate

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "CertificateChainRequest",
    "payload": {
      "certificateType": 1
    }
  }
}

The device answers with CertificateChainResponse (see below).

Command: CertificateChainResponse

Purpose

This command is used to report the results of the CertificateChainRequest command. This command is generated in response to a CertificateChainRequest command.

Command Identity

Response Fields

Command: CSRRequest

Purpose

CSRRequest is a client-to-server command of the Operational Credentials cluster.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "CSRRequest",
    "payload": {
      "csrNonce": "AQID"
    }
  }
}

The device answers with CSRResponse (see below).

Command: CSRResponse

Purpose

CSRResponse is a server response of the Operational Credentials cluster.

Command Identity

Response Fields

Command: AddNOC

Purpose

AddNOC is a client-to-server command of the Operational Credentials cluster.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "AddNOC",
    "payload": {
      "nocValue": "AQID",
      "ipkValue": "AQID",
      "caseAdminSubject": 1,
      "adminVendorId": 1
    }
  }
}

The device answers with NOCResponse (see below).

Command: UpdateNOC

Purpose

UpdateNOC is a client-to-server command of the Operational Credentials cluster.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "UpdateNOC",
    "payload": {
      "nocValue": "AQID"
    }
  }
}

The device answers with NOCResponse (see below).

Command: NOCResponse

Purpose

NOCResponse is a server response of the Operational Credentials cluster.

Command Identity

Response Fields

StatusCode values (NodeOperationalCertStatusEnum): 0 = OK, 1 = InvalidPublicKey, 2 = InvalidNodeOpId, 3 = InvalidNOC, 4 = MissingCsr, 5 = TableFull, 6 = InvalidAdminSubject, 9 = FabricConflict, 10 = LabelConflict, 11 = InvalidFabricIndex

Command: UpdateFabricLabel

Purpose

This command is used to set the user-visible fabric label for a given Fabric. This command is used by an Administrator to set the user-visible Label field for a given Fabric, as reflected by entries in the Fabrics attribute. An Administrator must use this command to set the Label to a string (possibly selected by the user themselves) that the user can recognize and relate to this Administrator - during the commissioning process, and - whenever the user chooses to update this string.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "UpdateFabricLabel",
    "payload": {
      "label": "example"
    }
  }
}

The device answers with NOCResponse (see below).

Command: RemoveFabric

Purpose

This command is used to remove a Fabric from the device. This command is used by Administrators to remove a given Fabric and delete all associated fabric-scoped data. If the given Fabric being removed is the last one to reference a given Trusted Root CA Certificate stored in the Trusted Root Certificates list, then that Trusted Root Certificate is removed. This command, if referring to an already existing Fabric not under the control of the invoking Administrator, must ONLY be invoked after obtaining some form of explicit user consent through some method executed by the Administrator or Commissioner.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "RemoveFabric",
    "payload": {
      "fabricIndex": 1
    }
  }
}

The device answers with NOCResponse (see below).

Command: AddTrustedRootCertificate

Purpose

This command is used to add a trusted root certificate to the device. This command must add a Trusted Root CA Certificate, provided as its Matter Certificate Encoding representation, to the TrustedRootCertificates Attribute list and must ensure the next AddNOC command executed uses the provided certificate as its root of trust. If the certificate from the RootCACertificate field is already installed, based on exact byte-for-byte equality, then this command must succeed with no change to the list. If this command is received without an armed fail-safe context, then this command must fail with a FAILSAFE_REQUIRED status code sent back to the initiator.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "AddTrustedRootCertificate",
    "payload": {
      "rootCACertificate": "AQID"
    }
  }
}

Command: SetVIDVerificationStatement

Purpose

SetVIDVerificationStatement is a client-to-server command of the Operational Credentials cluster.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "SetVIDVerificationStatement",
    "payload": {
      "vendorID": 1,
      "vidVerificationStatement": "AQID"
    }
  }
}

Command: SignVIDVerificationRequest

Purpose

SignVIDVerificationRequest is a client-to-server command of the Operational Credentials cluster.

Command Identity

Payload Fields

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 62,
    "command_name": "SignVIDVerificationRequest",
    "payload": {
      "fabricIndex": 1,
      "clientChallenge": "AQID"
    }
  }
}

The device answers with SignVIDVerificationResponse (see below).

Command: SignVIDVerificationResponse

Purpose

SignVIDVerificationResponse is a server response of the Operational Credentials cluster.

Command Identity

Response Fields

Cluster 62 Events

Cluster 62 defines no events.

SmartphoneKey Notes

• Operational Credentials (NOC certificates, ~1.3 KB) is excluded from the state shadow by the bridge, like Thread Network Diagnostics (53).
• Shadow paths follow endpoint/62/attribute; attribute values that the device reports as unreadable are written as n/a.
• Attribute IDs, command IDs and enum values on this page come from the CSA Matter 1.6.1 data model; descriptions are condensed from the specification text.