openapi: 3.2.0 info: title: 'GTM API public contract: gtm.service.id Ssl Certificates API' description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.' version: '1.0' contact: name: GTM API url: https://gtm-api.com email: support@gtm-api.com license: name: Proprietary url: https://gtm-api.com/license servers: - url: https://app.gtm-api.com/id/v4 description: Production, through the app.gtm-api.com gateway security: - BearerJwt: [] TeamSid: [] tags: - name: ssl_certificates description: Registry package `mcp.id/ssl_certificates`, served on MCP mount `id.platform`. paths: /api/ssl-certificates: post: operationId: create_ssl_certificate summary: Register SSL certificate description: 'Register a custom domain as a certificate row in status=''pending''. Does NOT start ACME; call issue_ssl_certificate next to begin the HTTP-01 flow. Idempotent on the domain natural key, and already_exists says whether the row was left as found. true: the team''s row is returned as it stands (pending, active, or an attempt in flight whatever the status), nothing was written. false: a new row, or a failed/expired row with nothing in flight or a soft-deleted row recreated in place (same sid, reset to pending, challenge and last_error cleared; read last_error with get_ssl_certificate first if the reason matters). A domain whose certificate is active in another team returns 409 conflict (domain_active_in_another_team). A domain another team has only registered is not refused: the first certificate to go active holds it. Contract: - MCP tool `create_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `create`, response envelope `create`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - ssl_certificates requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateSslCertificateRequest' responses: '200': description: '`create` success envelope.' content: application/json: schema: $ref: '#/components/schemas/CreateSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: create_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: create x-gtm-envelope: create x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/ssl-certificates/search: post: operationId: search_ssl_certificates summary: Search SSL certificates description: 'List the team''s TLS certificates for custom email domains: which domains are registered, each status, issuer, issued_at, expires_at, and the redacted last_error for failures. Filter by status for live vs failed, by expires_at:{lte} for certificates expiring soon, or by domain for a specific FQDN. The certificate body and private key are never returned. Returns a counts block of predicate tallies; page_size:0 returns counts only. Contract: - MCP tool `search_ssl_certificates`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `search`, response envelope `search`. - Flags: read only.' tags: - ssl_certificates requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/SearchSslCertificatesRequest' responses: '200': description: '`search` success envelope.' content: application/json: schema: $ref: '#/components/schemas/SearchSslCertificatesResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: search_ssl_certificates x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: search x-gtm-envelope: search x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/ssl-certificates/{sid}: get: operationId: get_ssl_certificate summary: Get SSL certificate description: 'Fetch a single certificate by sid: status, issuer, validity window, redacted last_error, and the HTTP-01 challenge data while an attempt is in flight (status=''challenge'' on a first issuance, ''active'' during a renewal). Poll this after issue/renew until challenge is null: a first issuance ends ''active'' or ''failed'' with last_error; a renewal stays ''active'', with last_error null when the new certificate is live and set when it failed (the current one keeps serving). The cert body and key are never returned. Contract: - MCP tool `get_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `get`, response envelope `get`. - Flags: read only.' tags: - ssl_certificates parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^id_sc_ - name: include[] in: query required: false description: Query parameter `include`. style: form explode: true schema: type: array items: type: string responses: '200': description: '`get` success envelope.' content: application/json: schema: $ref: '#/components/schemas/GetSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: get_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: get x-gtm-envelope: get x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: trivial patch: operationId: update_ssl_certificate summary: Update SSL certificate description: 'Metadata-only partial update. No certificate-affecting field is mutable here: domain, status, challenge, issuer and validity are driven by the ACME actions and jobs, never by update. v1 has no client-mutable field, so any body returns 422 nothing_to_update; the endpoint exists for surface symmetry. Contract: - MCP tool `update_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `update`, response envelope `update`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - ssl_certificates parameters: - name: sid in: path required: true description: SSL certificate sid (id_sc_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^id_sc_ description: SSL certificate sid (id_sc_…). responses: '200': description: '`update` success envelope.' content: application/json: schema: $ref: '#/components/schemas/UpdateSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: update_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: update x-gtm-envelope: update x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical delete: operationId: delete_ssl_certificate summary: Delete SSL certificate description: 'Remove a custom domain''s certificate. DESTRUCTIVE. Revokes the certificate at the CA (best-effort), removes the on-disk serving files, and soft-deletes the row. The CA-revoke and file-removal are external side effects, not a DB cascade, so this is a simple delete. No recovery: re-create + re-issue to restore. Contract: - MCP tool `delete_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `delete`, response envelope `delete_simple`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - ssl_certificates parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^id_sc_ responses: '200': description: '`delete_simple` success envelope.' content: application/json: schema: $ref: '#/components/schemas/DeleteSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: delete_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: delete x-gtm-envelope: delete_simple x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/ssl-certificates/{sid}/issue: post: operationId: issue_ssl_certificate summary: Issue SSL certificate description: 'Start the ACME HTTP-01 flow for a registered domain. ASYNC: synchronously requests authorization from Let''s Encrypt, stores the token + key-authorization, flips status→challenge, and returns the challenge data + a pending ref; the platform then self-checks, validates, finalizes and flips status→active in the background (poll get_ssl_certificate, or await the ssl-certificates.issued / .failed webhook). Use after create. Not idempotent: each call requests a fresh authorization. 409 conflict if the domain is already active (use renew), while an attempt is in flight (issuance_already_in_progress), or while another team''s certificate for the domain is active (domain_active_in_another_team: nothing was started and retrying cannot help). An attempt already in flight when that happens ends failed, with last_error opening with the same reason. Contract: - MCP tool `issue_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `action`, response envelope `action_async`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - ssl_certificates parameters: - name: sid in: path required: true description: SSL certificate sid (id_sc_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^id_sc_ description: SSL certificate sid (id_sc_…). responses: '200': description: '`action_async` success envelope.' content: application/json: schema: $ref: '#/components/schemas/IssueSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: issue_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: action x-gtm-envelope: action_async x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: complex /api/ssl-certificates/{sid}/renew: post: operationId: renew_ssl_certificate summary: Renew SSL certificate description: 'Force a re-issue of an existing certificate, ignoring the 30-day expiry window (operator-forced). ASYNC: same HTTP-01 path as issue and the auto-renew job, on the same row. On an active certificate the row STAYS active (it keeps serving and routing) while challenge carries the attempt: on success the persisted leaf / full chain / key are replaced and issued_at / expires_at re-stamped, on failure last_error is set and the current certificate keeps serving. On a pending/failed/expired row nothing is serving, so it flips status→challenge and ends active or failed like issue. Poll get_ssl_certificate until challenge is null, or await ssl-certificates.renewed / .failed. Use after a CA chain fix, to retry a failing renewal once its cause is fixed, or to recover a failed/expired certificate. 409 conflict while an attempt is in flight (issuance_already_in_progress, e.g. the renew job''s) or while another team''s certificate for the domain is active (domain_active_in_another_team, retrying cannot help). Contract: - MCP tool `renew_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.platform`. - Operation `action`, response envelope `action_async`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - ssl_certificates parameters: - name: sid in: path required: true description: SSL certificate sid (id_sc_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^id_sc_ description: SSL certificate sid (id_sc_…). responses: '200': description: '`action_async` success envelope.' content: application/json: schema: $ref: '#/components/schemas/RenewSslCertificateResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: renew_ssl_certificate x-gtm-mcp-mount: id.platform x-gtm-entity: ssl_certificates x-gtm-operation: action x-gtm-envelope: action_async x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: complex components: schemas: McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: - string - 'null' count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error UpdateSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - update item: type: object properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at updated_fields: type: array items: type: string previous_values: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - updated_fields - previous_values - meta DeleteSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - delete item: type: object additionalProperties: {} already_deleted: type: boolean soft_deleted: type: boolean retained: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_deleted - soft_deleted - retained - meta SearchSslCertificatesResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - search items: type: array items: type: object properties: item: type: object properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at included: type: object additionalProperties: {} required: - item - included pagination: type: object properties: next_cursor: type: - string - 'null' has_more: type: boolean total_count: type: - integer - 'null' required: - next_cursor - has_more - total_count applied_filters: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms counts: type: object properties: {} required: - success - operation - items - pagination - applied_filters - includes - meta CreateSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - create item: type: object properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at already_exists: type: boolean meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_exists - meta CreateSslCertificateRequest: type: object description: Request body of `create_ssl_certificate`. properties: domain: type: string maxLength: 253 description: FQDN, e.g. "track.client.com"; lowercased server-side; unique among live rows. required: - domain SearchSslCertificatesRequest: type: object description: Request body of `search_ssl_certificates`. properties: filter: type: object properties: sid: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false domain: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false description: Exact FQDN match (lowercased server-side); no full-text. status: type: object properties: eq: type: string enum: - pending - challenge - active - failed - expired ne: type: string enum: - pending - challenge - active - failed - expired in: type: array items: type: string enum: - pending - challenge - active - failed - expired nin: type: array items: type: string enum: - pending - challenge - active - failed - expired additionalProperties: false expires_at: type: object properties: gte: type: string lte: type: string gt: type: string lt: type: string is_null: type: boolean additionalProperties: false description: '"Expiring soon" view = { lte: <+30d> }.' created_at: type: object properties: gte: type: string lte: type: string gt: type: string lt: type: string additionalProperties: false deleted_at: type: object properties: gte: type: string lte: type: string is_null: type: boolean additionalProperties: false description: 'Default scope is { is_null: true } (live rows).' sort: type: object properties: field: type: string enum: - created_at - expires_at - status direction: type: string enum: - asc - desc description: Default desc. required: - field page_size: type: integer minimum: 0 maximum: 500 description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst. cursor: type: - string - 'null' description: Opaque forward cursor from a previous response pagination.next_cursor. RenewSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string async: type: boolean enum: - true item: type: - object - 'null' properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at pending: type: array items: type: object properties: activity_log_sid: type: string expected_completion_seconds: type: integer minimum: 0 webhook_events: type: array items: type: string required: - expected_completion_seconds - webhook_events result: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - async - item - pending - result - meta IssueSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string async: type: boolean enum: - true item: type: - object - 'null' properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at pending: type: array items: type: object properties: activity_log_sid: type: string expected_completion_seconds: type: integer minimum: 0 webhook_events: type: array items: type: string required: - expected_completion_seconds - webhook_events result: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - async - item - pending - result - meta GetSslCertificateResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - get item: type: object properties: sid: type: string team_sid: type: string domain: type: string status: type: string enum: - pending - challenge - active - failed - expired challenge: type: - object - 'null' properties: type: type: string enum: - http-01 token: type: string key_authorization: type: string well_known_path: type: string cname_target: type: string expires_at: type: - string - 'null' required: - type - token - key_authorization - well_known_path - cname_target - expires_at issuer: type: - string - 'null' issued_at: type: - string - 'null' expires_at: type: - string - 'null' last_error: type: - string - 'null' created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string team_sid: type: string permissions: type: object additionalProperties: {} request_sid: type: - string - 'null' reason: type: - string - 'null' required: - actor_type - actor_sid - team_sid - permissions - reason created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - domain - status - challenge - issuer - issued_at - expires_at - last_error - created_by - created_at - updated_at - deleted_at included: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - included - includes - meta responses: McpServerError: description: MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' McpClientError: description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: Team scope for tokens that do not carry one. Ignored when the token already names a team.