diff --git a/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialConfiguration.scala b/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialConfiguration.scala
index 321665e666..6ffb1aa283 100644
--- a/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialConfiguration.scala
+++ b/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialConfiguration.scala
@@ -4,6 +4,7 @@ import org.hyperledger.identus.pollux.core.model.CredentialFormat
 
 import java.net.URI
 import java.time.Instant
+import java.time.temporal.ChronoUnit
 
 final case class CredentialConfiguration(
     configurationId: String,
@@ -12,4 +13,8 @@ final case class CredentialConfiguration(
     createdAt: Instant
 ) {
   def scope: String = configurationId
+
+  def withTruncatedTimestamp(unit: ChronoUnit = ChronoUnit.MICROS): CredentialConfiguration = copy(
+    createdAt = createdAt.truncatedTo(unit),
+  )
 }
diff --git a/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialIssuer.scala b/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialIssuer.scala
index a66e8b3979..c153700c5d 100644
--- a/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialIssuer.scala
+++ b/pollux/core/src/main/scala/org/hyperledger/identus/pollux/core/model/oid4vci/CredentialIssuer.scala
@@ -3,12 +3,18 @@ package org.hyperledger.identus.pollux.core.model.oid4vci
 import java.net.URL
 import java.time.Instant
 import java.util.UUID
+import java.time.temporal.ChronoUnit
 
-case class CredentialIssuer(id: UUID, authorizationServer: URL, createdAt: Instant, updatedAt: Instant)
+case class CredentialIssuer(id: UUID, authorizationServer: URL, createdAt: Instant, updatedAt: Instant) {
+  def withTruncatedTimestamp(unit: ChronoUnit = ChronoUnit.MICROS): CredentialIssuer = copy(
+    createdAt = createdAt.truncatedTo(unit),
+    updatedAt = updatedAt.truncatedTo(unit),
+  )
+}
 
 object CredentialIssuer {
   def apply(authorizationServer: URL): CredentialIssuer = {
     val now = Instant.now
-    CredentialIssuer(UUID.randomUUID(), authorizationServer, now, now)
+    CredentialIssuer(UUID.randomUUID(), authorizationServer, now, now).withTruncatedTimestamp()
   }
 }
diff --git a/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/repository/OID4VCIIssuerMetadataRepositorySpecSuite.scala b/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/repository/OID4VCIIssuerMetadataRepositorySpecSuite.scala
new file mode 100644
index 0000000000..866e153267
--- /dev/null
+++ b/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/repository/OID4VCIIssuerMetadataRepositorySpecSuite.scala
@@ -0,0 +1,281 @@
+package org.hyperledger.identus.pollux.core.repository
+
+import org.hyperledger.identus.pollux.core.model.CredentialFormat
+import org.hyperledger.identus.pollux.core.model.oid4vci.CredentialConfiguration
+import org.hyperledger.identus.pollux.core.model.oid4vci.CredentialIssuer
+import org.hyperledger.identus.shared.db.Errors.UnexpectedAffectedRow
+import org.hyperledger.identus.shared.models.WalletAccessContext
+import org.hyperledger.identus.shared.models.WalletId
+import zio.test.*
+import zio.test.Assertion.*
+import zio.{ZIO, ZLayer}
+
+import java.net.URI
+import java.time.Instant
+
+object OID4VCIIssuerMetadataRepositorySpecSuite {
+
+  private val credConfig = CredentialConfiguration(
+    configurationId = "DrivingLicense",
+    format = CredentialFormat.JWT,
+    schemaId = URI.create("http://example.com/schema"),
+    createdAt = Instant.now
+  ).withTruncatedTimestamp()
+
+  private def initMultiWalletIssuers = {
+    val walletId1 = WalletId.random
+    val walletId2 = WalletId.random
+    val wallet1 = ZLayer.succeed(WalletAccessContext(walletId1))
+    val wallet2 = ZLayer.succeed(WalletAccessContext(walletId2))
+    for {
+      repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+      authServer1 = URI.create("http://example-1.com").toURL()
+      authServer2 = URI.create("http://example-2.com").toURL()
+      issuer1 = CredentialIssuer(authorizationServer = authServer1)
+      issuer2 = CredentialIssuer(authorizationServer = authServer2)
+      _ <- repo.createIssuer(issuer1).provide(wallet1)
+      _ <- repo.createIssuer(issuer2).provide(wallet2)
+    } yield (issuer1, wallet1, issuer2, wallet2)
+  }
+
+  val testSuite = suite("CRUD operations")(
+    test("find non-existing credential issuers return None") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        maybeIssuer <- repo.findIssuerById(issuerId)
+      } yield assert(maybeIssuer)(isNone)
+    },
+    test("create credential issuers successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        authServer2 = URI.create("http://example-2.com").toURL()
+        issuer1 = CredentialIssuer(authorizationServer = authServer1)
+        issuer2 = CredentialIssuer(authorizationServer = authServer2)
+        _ <- repo.createIssuer(issuer1)
+        _ <- repo.createIssuer(issuer2)
+        maybeIssuer1 <- repo.findIssuerById(issuer1.id)
+        maybeIssuer2 <- repo.findIssuerById(issuer2.id)
+      } yield assert(maybeIssuer1)(isSome(equalTo(issuer1))) &&
+        assert(maybeIssuer2)(isSome(equalTo(issuer2)))
+    },
+    test("create credential issuers with same id should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        issuer1 = CredentialIssuer(authorizationServer = authServer1)
+        _ <- repo.createIssuer(issuer1)
+        exit <- repo.createIssuer(issuer1).exit
+      } yield assert(exit)(dies(anything))
+    },
+    test("delete credential issuer successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.deleteIssuer(issuer.id)
+        maybeIssuer <- repo.findIssuerById(issuer.id)
+      } yield assert(maybeIssuer)(isNone)
+    },
+    test("delete non-existing credential issuer should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        exit <- repo.deleteIssuer(issuer.id).exit
+      } yield assert(exit)(dies(isSubtype[UnexpectedAffectedRow](anything)))
+    },
+    test("update credential issuer successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        authServer2 = URI.create("http://example-2.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer1)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.updateIssuer(issuer.id, authorizationServer = Some(authServer2))
+        updatedIssuer <- repo.findIssuerById(issuer.id).some
+      } yield assert(updatedIssuer.id)(equalTo(issuer.id)) &&
+        assert(updatedIssuer.authorizationServer)(equalTo(authServer2)) &&
+        assert(updatedIssuer.updatedAt)(not(equalTo(issuer.createdAt)))
+    },
+    test("update credential issuer with empty patch successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        authServer2 = URI.create("http://example-2.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer1)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.updateIssuer(issuer.id) // empty patch
+        updatedIssuer <- repo.findIssuerById(issuer.id).some
+      } yield assert(updatedIssuer.id)(equalTo(issuer.id)) &&
+        assert(updatedIssuer.authorizationServer)(equalTo(issuer.authorizationServer)) &&
+        assert(updatedIssuer.createdAt)(equalTo(issuer.createdAt))
+    },
+    test("update non-existing credential issuer should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        authServer = URI.create("http://example-1.com").toURL()
+        exit <- repo.updateIssuer(issuerId, authorizationServer = Some(authServer)).exit
+      } yield assert(exit)(dies(isSubtype[UnexpectedAffectedRow](anything)))
+    },
+    test("create credential configuration successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.createCredentialConfiguration(issuer.id, credConfig)
+        maybeCredConfig <- repo.findCredentialConfigurationById(issuer.id, credConfig.configurationId)
+      } yield assert(maybeCredConfig)(isSome(equalTo(credConfig)))
+    },
+    test("create credential configuration with same id should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer).withTruncatedTimestamp()
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.createCredentialConfiguration(issuer.id, credConfig)
+        exit <- repo.createCredentialConfiguration(issuer.id, credConfig).exit
+      } yield assert(exit)(dies(anything))
+    },
+    test("create credential configuration with same id for different issuer successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        authServer2 = URI.create("http://example-2.com").toURL()
+        issuer1 = CredentialIssuer(authorizationServer = authServer1)
+        issuer2 = CredentialIssuer(authorizationServer = authServer2)
+        _ <- repo.createIssuer(issuer1)
+        _ <- repo.createIssuer(issuer2)
+        _ <- repo.createCredentialConfiguration(issuer1.id, credConfig)
+        _ <- repo.createCredentialConfiguration(issuer2.id, credConfig)
+        maybeCredConfig1 <- repo.findCredentialConfigurationById(issuer1.id, credConfig.configurationId)
+        maybeCredConfig2 <- repo.findCredentialConfigurationById(issuer2.id, credConfig.configurationId)
+      } yield assert(maybeCredConfig1)(isSome(equalTo(credConfig))) &&
+        assert(maybeCredConfig2)(isSome(equalTo(credConfig)))
+    },
+    test("create credential configuration for non-existing issuer should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        exit <- repo.createCredentialConfiguration(issuerId, credConfig).exit
+      } yield assert(exit)(dies(anything))
+    },
+    test("list credential configurations successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        issuer1 = CredentialIssuer(authorizationServer = authServer1)
+        issuer2 = CredentialIssuer(authorizationServer = authServer1)
+        credConfig1 = credConfig.copy(configurationId = "DrivingLicense")
+        credConfig2 = credConfig.copy(configurationId = "UniversityDegree")
+        credConfig3 = credConfig.copy(configurationId = "TrainingCertificate")
+        _ <- repo.createIssuer(issuer1)
+        _ <- repo.createIssuer(issuer2)
+        _ <- repo.createCredentialConfiguration(issuer1.id, credConfig1)
+        _ <- repo.createCredentialConfiguration(issuer1.id, credConfig2)
+        _ <- repo.createCredentialConfiguration(issuer2.id, credConfig3)
+        credConfigs1 <- repo.findCredentialConfigurationsByIssuer(issuer1.id)
+        credConfigs2 <- repo.findCredentialConfigurationsByIssuer(issuer2.id)
+      } yield assert(credConfigs1)(hasSameElements(Seq(credConfig1, credConfig2))) &&
+        assert(credConfigs2)(hasSameElements(Seq(credConfig3)))
+    },
+    test("find and list return empty result for non-existing configurations") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        _ <- repo.createIssuer(issuer)
+        maybeCredConfig <- repo.findCredentialConfigurationById(issuer.id, credConfig.configurationId)
+        credConfigs <- repo.findCredentialConfigurationsByIssuer(issuer.id)
+      } yield assert(maybeCredConfig)(isNone) &&
+        assert(credConfigs)(isEmpty)
+    },
+    test("delete credential configuration successfully") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.createCredentialConfiguration(issuer.id, credConfig)
+        maybeCredConfig1 <- repo.findCredentialConfigurationById(issuer.id, credConfig.configurationId)
+        _ <- repo.deleteCredentialConfiguration(issuer.id, credConfig.configurationId)
+        maybeCredConfig2 <- repo.findCredentialConfigurationById(issuer.id, credConfig.configurationId)
+      } yield assert(maybeCredConfig1)(isSome(equalTo(credConfig))) &&
+        assert(maybeCredConfig2)(isNone)
+    },
+    test("delete non-existing creential configuration should fail") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        randomId <- ZIO.randomWith(_.nextUUID)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.createCredentialConfiguration(issuer.id, credConfig)
+        exit1 <- repo.deleteCredentialConfiguration(issuer.id, "ExampleLicense").exit
+        exit2 <- repo.deleteCredentialConfiguration(randomId, "ExampleLicense").exit
+      } yield assert(exit1)(diesWithA[UnexpectedAffectedRow]) &&
+        assert(exit2)(diesWithA[UnexpectedAffectedRow])
+    },
+    test("delete issuer also delete credential configuration") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer = CredentialIssuer(authorizationServer = authServer)
+        _ <- repo.createIssuer(issuer)
+        _ <- repo.createCredentialConfiguration(issuer.id, credConfig)
+        _ <- repo.deleteIssuer(issuer.id)
+        maybeCredConfig <- repo.findCredentialConfigurationById(issuer.id, credConfig.configurationId)
+      } yield assert(maybeCredConfig)(isNone)
+    }
+  ).provideSomeLayer(ZLayer.succeed(WalletAccessContext(WalletId.random)))
+
+  val multitenantTestSuite = suite("multi-tenant CRUD operation")(
+    test("list only issuers inside wallet") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        init <- initMultiWalletIssuers
+        (issuer1, wallet1, issuer2, wallet2) = init
+        issuers1 <- repo.findWalletIssuers.provide(wallet1)
+        issuers2 <- repo.findWalletIssuers.provide(wallet2)
+      } yield assert(issuers1)(hasSameElements(Seq(issuer1))) &&
+        assert(issuers2)(hasSameElements(Seq(issuer2)))
+    },
+    test("update issuer across wallet is not allowed") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        init <- initMultiWalletIssuers
+        (issuer1, wallet1, issuer2, wallet2) = init
+        exit <- repo.updateIssuer(issuer1.id).provide(wallet2).exit
+      } yield assert(exit)(diesWithA[UnexpectedAffectedRow])
+    },
+    test("delete issuer across wallet is not allowed") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        init <- initMultiWalletIssuers
+        (issuer1, wallet1, issuer2, wallet2) = init
+        exit <- repo.deleteIssuer(issuer1.id).provide(wallet2).exit
+      } yield assert(exit)(diesWithA[UnexpectedAffectedRow])
+    },
+    test("create credential configuration across wallet is not allowed") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        init <- initMultiWalletIssuers
+        (issuer1, wallet1, issuer2, wallet2) = init
+        exit <- repo.createCredentialConfiguration(issuer1.id, credConfig).provide(wallet2).exit
+      } yield assert(exit)(dies(anything))
+    },
+    test("delete credential configuration across wallet is not allowed") {
+      for {
+        repo <- ZIO.service[OID4VCIIssuerMetadataRepository]
+        init <- initMultiWalletIssuers
+        (issuer1, wallet1, issuer2, wallet2) = init
+        exit <- repo.deleteCredentialConfiguration(issuer1.id, credConfig.configurationId).provide(wallet2).exit
+      } yield assert(exit)(diesWithA[UnexpectedAffectedRow])
+    },
+  )
+
+}
diff --git a/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpecSuite.scala b/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpecSuite.scala
new file mode 100644
index 0000000000..2893203b05
--- /dev/null
+++ b/pollux/core/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpecSuite.scala
@@ -0,0 +1,116 @@
+package org.hyperledger.identus.pollux.core.service
+
+import org.hyperledger.identus.pollux.core.model.CredentialFormat
+import org.hyperledger.identus.pollux.core.service.OID4VCIIssuerMetadataServiceError.CredentialConfigurationNotFound
+import org.hyperledger.identus.pollux.core.service.OID4VCIIssuerMetadataServiceError.InvalidSchemaId
+import org.hyperledger.identus.pollux.core.service.OID4VCIIssuerMetadataServiceError.IssuerIdNotFound
+import org.hyperledger.identus.shared.models.WalletAccessContext
+import org.hyperledger.identus.shared.models.WalletId
+import zio.test.*
+import zio.test.Assertion.*
+import zio.{ZIO, ZLayer}
+
+import java.net.URI
+
+object OID4VCIIssuerMetadataServiceSpecSuite {
+
+  val testSuite = suite("OID4VCIssuerMetadataService")(
+    test("get credential issuer successfully") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        authServer1 = URI.create("http://example-1.com").toURL()
+        authServer2 = URI.create("http://example-2.com").toURL()
+        issuer1 <- service.createCredentialIssuer(authServer1)
+        issuer2 <- service.createCredentialIssuer(authServer2)
+        getIssuer1 <- service.getCredentialIssuer(issuer1.id)
+        getIssuer2 <- service.getCredentialIssuer(issuer2.id)
+        getIssuers <- service.getCredentialIssuers
+      } yield assert(getIssuer1)(equalTo(issuer1)) &&
+        assert(getIssuer2)(equalTo(issuer2)) &&
+        assert(getIssuers)(hasSameElements(Seq(issuer1, issuer2)))
+    },
+    test("get non-existing credential issuer should fail") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        issuers <- service.getCredentialIssuers
+        exit <- service.getCredentialIssuer(issuerId).exit
+      } yield assert(exit)(failsWithA[IssuerIdNotFound]) &&
+        assert(issuers)(isEmpty)
+    },
+    test("update credential issuer successfully") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer <- service.createCredentialIssuer(authServer)
+        updatedAuthServer = URI.create("http://example-2.com").toURL()
+        _ <- service.updateCredentialIssuer(issuer.id, authorizationServer = Some(updatedAuthServer))
+        updatedIssuer <- service.getCredentialIssuer(issuer.id)
+      } yield assert(updatedIssuer.authorizationServer)(equalTo(updatedAuthServer))
+    },
+    test("update non-existing credential issuer should fail") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        exit <- service.updateCredentialIssuer(issuerId, Some(URI.create("http://example.com").toURL())).exit
+      } yield assert(exit)(failsWithA[IssuerIdNotFound])
+    },
+    test("create credential configuration successfully") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer <- service.createCredentialIssuer(authServer)
+        _ <- service
+          .createCredentialConfiguration(
+            issuer.id,
+            CredentialFormat.JWT,
+            "UniversityDegree",
+            "resource:///vc-schema-example.json"
+          )
+        credConfig <- service.getCredentialConfigurationById(issuer.id, "UniversityDegree")
+      } yield assert(credConfig.configurationId)(equalTo("UniversityDegree")) &&
+        assert(credConfig.format)(equalTo(CredentialFormat.JWT)) &&
+        assert(credConfig.schemaId)(equalTo(URI.create("resource:///vc-schema-example.json")))
+    },
+    test("create credential configuration check for schemaId validity") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        authServer = URI.create("http://example-1.com").toURL()
+        issuer <- service.createCredentialIssuer(authServer)
+        createCredConfig = (schemaId: String) =>
+          service
+            .createCredentialConfiguration(
+              issuer.id,
+              CredentialFormat.JWT,
+              "UniversityDegree",
+              schemaId
+            )
+        exit1 <- createCredConfig("not a uri").exit
+        exit2 <- createCredConfig("http://localhost/schema").exit
+      } yield assert(exit1)(failsWithA[InvalidSchemaId]) &&
+        assert(exit2)(dies(anything))
+    },
+    test("list credential configurations for non-existing issuer should fail") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        exit <- service.getCredentialConfigurations(issuerId).exit
+      } yield assert(exit)(failsWithA[IssuerIdNotFound])
+    },
+    test("get non-existing credential configuration should fail") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        exit <- service.getCredentialConfigurationById(issuerId, "UniversityDegree").exit
+      } yield assert(exit)(failsWithA[CredentialConfigurationNotFound])
+    },
+    test("delete non-existing credential configuration should fail") {
+      for {
+        service <- ZIO.service[OID4VCIIssuerMetadataService]
+        issuerId <- ZIO.randomWith(_.nextUUID)
+        exit <- service.deleteCredentialConfiguration(issuerId, "UniversityDegree").exit
+      } yield assert(exit)(failsWithA[CredentialConfigurationNotFound])
+    },
+  ).provideSomeLayer(ZLayer.succeed(WalletAccessContext(WalletId.random)))
+
+}
diff --git a/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpec.scala b/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpec.scala
new file mode 100644
index 0000000000..bdae719bd9
--- /dev/null
+++ b/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/core/service/OID4VCIIssuerMetadataServiceSpec.scala
@@ -0,0 +1,33 @@
+package org.hyperledger.identus.pollux.core.service
+
+import org.hyperledger.identus.pollux.sql.repository.JdbcOID4VCIIssuerMetadataRepository
+import org.hyperledger.identus.sharedtest.containers.PostgresTestContainerSupport
+import org.hyperledger.identus.test.container.MigrationAspects
+import zio.*
+import zio.test.*
+
+object OID4VCIIssuerMetadataServiceSpec extends ZIOSpecDefault, PostgresTestContainerSupport {
+
+  private val migration = MigrationAspects.migrateEach(
+    schema = "public",
+    paths = "classpath:sql/pollux"
+  )
+
+  private val testEnvironmentLayer = ZLayer.make[OID4VCIIssuerMetadataService](
+    OID4VCIIssuerMetadataServiceImpl.layer,
+    JdbcOID4VCIIssuerMetadataRepository.layer,
+    ResourceURIDereferencerImpl.layer,
+    contextAwareTransactorLayer,
+    systemTransactorLayer
+  )
+
+  override def spec =
+    (suite("OID4VCIIssuerMetadataService - Jdbc repository")(
+      OID4VCIIssuerMetadataServiceSpecSuite.testSuite
+    ) @@ migration).provide(
+      Runtime.removeDefaultLoggers,
+      testEnvironmentLayer,
+      pgContainerLayer,
+    )
+
+}
diff --git a/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/sql/repository/JdbcOID4VCIIssuerMetadataRepositorySpec.scala b/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/sql/repository/JdbcOID4VCIIssuerMetadataRepositorySpec.scala
new file mode 100644
index 0000000000..db0e9578eb
--- /dev/null
+++ b/pollux/sql-doobie/src/test/scala/org/hyperledger/identus/pollux/sql/repository/JdbcOID4VCIIssuerMetadataRepositorySpec.scala
@@ -0,0 +1,32 @@
+package org.hyperledger.identus.pollux.sql.repository
+
+import org.hyperledger.identus.pollux.core.repository.OID4VCIIssuerMetadataRepository
+import org.hyperledger.identus.pollux.core.repository.OID4VCIIssuerMetadataRepositorySpecSuite
+import org.hyperledger.identus.sharedtest.containers.PostgresTestContainerSupport
+import org.hyperledger.identus.test.container.MigrationAspects
+import zio.*
+import zio.test.*
+
+object JdbcOID4VCIIssuerMetadataRepositorySpec extends ZIOSpecDefault, PostgresTestContainerSupport {
+
+  private val migration = MigrationAspects.migrateEach(
+    schema = "public",
+    paths = "classpath:sql/pollux"
+  )
+
+  private val testEnvironmentLayer = ZLayer.make[OID4VCIIssuerMetadataRepository](
+    JdbcOID4VCIIssuerMetadataRepository.layer,
+    contextAwareTransactorLayer,
+    systemTransactorLayer
+  )
+
+  override def spec =
+    (suite("JdbcOID4VCIIssuerMetadataRepository")(
+      OID4VCIIssuerMetadataRepositorySpecSuite.testSuite,
+      OID4VCIIssuerMetadataRepositorySpecSuite.multitenantTestSuite,
+    ) @@ migration).provide(
+      Runtime.removeDefaultLoggers,
+      testEnvironmentLayer,
+      pgContainerLayer,
+    )
+}