The Operational Credentials cluster (0x003E) is a Matter cluster that Manages the device's operational certificates for secure fabric communication.. It defines 15 commands and 7 attributes and is mandatory for 1 device type.

Last updated 19 Oct 2026

Operational Credentials 0x003E

Global Cluster

Utility

Introduced in: Matter 1.0

Devices: 770

Manages the device's operational certificates for secure fabric communication.

Spec History

This cluster's ClusterRevision across the Matter releases it has shipped in. Click a version to inspect the cluster as it existed in that release.

Matter 1.0 Matter 1.1 Matter 1.2 Matter 1.3 Matter 1.4 rev 2 Matter 1.5 rev 2 Matter 1.6 rev 2 Matter master rev 3

Attributes 7

Commands 15

Features 1

Code	Name	Type	Flags
0x0000	NOCs	array	read: administer
0x0001	Fabrics	array
0x0002	SupportedFabrics 5..254	int8u
0x0003	CommissionedFabrics max 254	int8u
0x0004	TrustedRootCertificates	array
0x0005	CurrentFabricIndex default 0	int8u
0x0006	PQCDeviceAttestationProfile	PQCDeviceAttestationProfileStruct	Optional Provisional

Code	Name	Direction	Parameters
0x00	AttestationRequest invoke: administer This command is used to perform an attestation request.	client→server	`AttestationNonce`: octet_string
0x01	AttestationResponse This command is used to report the results of the AttestationRequest command.	server→client	`AttestationElements`: long_octet_string, `AttestationSignature`: octet_string
0x02	CertificateChainRequest invoke: administer This command is used to request a certificate from the device attestation certificate chain.	client→server	`CertificateType`: CertificateChainTypeEnum, `CryptoProfile`: AttestationCryptoProfileEnum, `SegmentID`: int16u, `MaxSegmentSize`: int16u
0x03	CertificateChainResponse This command is used to report the results of the CertificateChainRequest command.	server→client	`Certificate`: octet_string, `TotalDocumentSize`: int16u, `NextSegmentID`: int16u
0x04	CSRRequest invoke: administer This command is used to perform a CSR request.	client→server	`CSRNonce`: octet_string, `IsForUpdateNOC`: boolean
0x05	CSRResponse This command is used to report the results of the CSRRequest command.	server→client	`NOCSRElements`: long_octet_string, `AttestationSignature`: octet_string
0x06	AddNOC invoke: administer This command is used to add a new NOC to the device.	client→server	`NOCValue`: long_octet_string, `ICACValue`: long_octet_string, `IPKValue`: octet_string, `CaseAdminSubject`: int64u, `AdminVendorId`: vendor_id
0x07	UpdateNOC invoke: administer This command is used to update an existing NOC on the device.	client→server	`NOCValue`: long_octet_string, `ICACValue`: long_octet_string
0x08	NOCResponse This command is used to report the results of the AddNOC, UpdateNOC, UpdateFabricLabel and RemoveFabric commands.	server→client	`StatusCode`: NodeOperationalCertStatusEnum, `FabricIndex`: fabric_idx, `DebugText`: char_string
0x09	UpdateFabricLabel invoke: administer This command is used to set the user-visible fabric label for a given Fabric.	client→server	`Label`: char_string
0x0A	RemoveFabric invoke: administer This command is used to remove a Fabric from the device.	client→server	`FabricIndex`: fabric_idx
0x0B	AddTrustedRootCertificate invoke: administer This command is used to add a trusted root certificate to the device.	client→server	`RootCACertificate`: long_octet_string
0x0C	SetVIDVerificationStatement invoke: administer This command is used to manage the VendorID and VIDVerificationStatement fields of the Fabrics attribute, and the VVSC field of an entry in the NOCs attribute.	client→server	`VendorID`: vendor_id, `VIDVerificationStatement`: octet_string, `VVSC`: long_octet_string
0x0D	SignVIDVerificationRequest invoke: administer This command is used to authenticate the fabric associated with the FabricIndex.	client→server	`FabricIndex`: fabric_idx, `ClientChallenge`: octet_string
0x0E	SignVIDVerificationResponse This command is used to report the results of the SignVIDVerificationRequest command.	server→client	`FabricIndex`: fabric_idx, `FabricBindingVersion`: int8u, `Signature`: octet_string