openapi: 3.0.3 info: title: Infisical Admin PKI Certificates API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: PKI Certificates paths: /api/v1/projects/{projectId}/certificates/search: post: operationId: searchProjectCertificates tags: - PKI Certificates description: Search and filter certificates within a project. requestBody: required: true content: application/json: schema: type: object properties: friendlyName: type: string description: The friendly name of the certificate to filter by. commonName: type: string description: The common name of the certificate to filter by. offset: type: number minimum: 0 default: 0 description: The offset to start from. If you enter 10, it will start from the 10th certificate. limit: type: number minimum: 1 maximum: 100 default: 25 description: The number of certificates to return. forPkiSync: type: boolean default: false description: Retrieve only certificates available for PKI sync. search: type: string description: Search by SAN, CN, certificate ID, or serial number. status: type: string description: Filter by certificate status. profileIds: type: array items: type: string format: uuid description: Filter by certificate profile IDs. fromDate: type: string format: date-time description: Filter certificates created from this date. toDate: type: string format: date-time description: Filter certificates created until this date. metadata: type: array items: type: object properties: key: type: string minLength: 1 maxLength: 255 value: type: string maxLength: 1020 required: - key additionalProperties: false description: Filter by metadata key-value pairs. Each entry should have a key (required) and optionally a value to match against. extendedKeyUsage: type: string description: Filter by extended key usage. Only certificates containing this EKU will be returned (e.g. 'codeSigning', 'serverAuth'). keyAlgorithm: anyOf: - type: string - type: array items: type: string description: Filter by key algorithm (e.g. 'RSA_2048', 'EC_prime256v1'). signatureAlgorithm: type: string description: Filter by signature algorithm (e.g. 'RSA-SHA256', 'ECDSA-SHA256'). keySizes: type: array items: type: number description: Filter by key sizes in bits (e.g. [2048, 4096]). caIds: type: array items: type: string format: uuid description: Filter by certificate authority IDs. enrollmentTypes: type: array items: type: string description: Filter by enrollment types (e.g. 'api', 'est', 'acme', 'scep'). source: anyOf: - type: string - type: array items: type: string description: Filter by certificate source ('issued', 'discovered', 'imported'). notAfterFrom: type: string format: date-time description: Filter certificates expiring on or after this date. notAfterTo: type: string format: date-time description: Filter certificates expiring on or before this date. notBeforeFrom: type: string format: date-time description: Filter certificates issued on or after this date. notBeforeTo: type: string format: date-time description: Filter certificates issued on or before this date. applicationId: type: string format: uuid description: Filter to certificates issued through a specific Application. applicationIds: type: array items: type: string format: uuid description: Filter to certificates issued through any of the supplied Applications. sortBy: type: string enum: - notAfter - notBefore - createdAt - commonName - keyAlgorithm - status description: Column to sort by (e.g. 'notAfter', 'notBefore', 'commonName'). sortOrder: type: string enum: - asc - desc description: 'Sort direction: ''asc'' or ''desc''.' additionalProperties: false parameters: - schema: type: string in: path name: projectId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificates: type: array items: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true projectId: type: string pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true hasPrivateKey: type: boolean caName: type: string nullable: true profileName: type: string nullable: true enrollmentType: type: string nullable: true applicationName: type: string nullable: true required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter - projectId - hasPrivateKey additionalProperties: false totalCount: type: number required: - certificates - totalCount additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates: post: operationId: createCertificate tags: - PKI Certificates requestBody: required: true content: application/json: schema: type: object properties: profileId: type: string format: uuid applicationId: type: string format: uuid csr: type: string minLength: 1 maxLength: 4096 attributes: type: object properties: commonName: type: string minLength: 1 maxLength: 100 nullable: true organization: type: string minLength: 1 maxLength: 100 nullable: true organizationalUnit: type: string minLength: 1 maxLength: 100 nullable: true country: type: string minLength: 1 maxLength: 100 nullable: true state: type: string minLength: 1 maxLength: 100 nullable: true locality: type: string minLength: 1 maxLength: 100 nullable: true keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping altNames: type: array items: type: object properties: type: type: string enum: - dns_name - ip_address - email - uri value: type: string minLength: 1 required: - type - value additionalProperties: false signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s ttl: type: string notBefore: type: string notAfter: type: string basicConstraints: type: object properties: isCA: type: boolean pathLength: type: integer minimum: 0 required: - isCA additionalProperties: false additionalProperties: false removeRootsFromChain: anyOf: - type: boolean - type: string default: false metadata: type: array items: type: object properties: key: type: string minLength: 1 maxLength: 255 value: type: string maxLength: 1020 default: '' required: - key additionalProperties: false required: - profileId additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: certificate: type: string issuingCaCertificate: type: string certificateChain: type: string privateKey: type: string serialNumber: type: string certificateId: type: string required: - certificate - issuingCaCertificate - certificateChain - serialNumber - certificateId additionalProperties: false nullable: true certificateRequestId: type: string status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected message: type: string required: - certificate - certificateRequestId additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/certificate-requests/{requestId}: get: operationId: getCertificateRequest tags: - PKI Certificates parameters: - schema: type: string format: uuid in: path name: requestId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected certificate: type: string nullable: true certificateId: type: string nullable: true privateKey: type: string nullable: true serialNumber: type: string nullable: true errorMessage: type: string nullable: true pendingMessage: type: string nullable: true commonName: type: string nullable: true organization: type: string nullable: true organizationalUnit: type: string nullable: true country: type: string nullable: true state: type: string nullable: true locality: type: string nullable: true basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false nullable: true metadata: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - status - certificate - certificateId - privateKey - serialNumber - errorMessage - createdAt - updatedAt additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/certificate-requests/{requestId}/trigger-validation: post: operationId: triggerCertificateRequestValidation tags: - PKI Certificates description: Manually ask the issuing CA to re-check validation for a pending certificate request parameters: - schema: type: string format: uuid in: path name: requestId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected orderStatus: type: string required: - status additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/certificate-requests/search: post: operationId: searchCertificateRequests tags: - PKI Certificates description: Search and filter certificate requests. requestBody: required: true content: application/json: schema: type: object properties: offset: type: number minimum: 0 default: 0 limit: type: number minimum: 1 maximum: 100 default: 20 search: type: string status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected fromDate: type: string format: date-time toDate: type: string format: date-time profileIds: type: array items: type: string format: uuid applicationId: type: string format: uuid description: Filter to certificate requests for profiles attached to a specific Application. sortBy: type: string sortOrder: type: string enum: - asc - desc metadata: type: array items: type: object properties: key: type: string minLength: 1 maxLength: 255 value: type: string maxLength: 1020 required: - key additionalProperties: false additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateRequests: type: array items: type: object properties: id: type: string status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected commonName: type: string nullable: true altNames: type: string nullable: true profileId: type: string nullable: true profileName: type: string nullable: true caId: type: string nullable: true certificateId: type: string nullable: true approvalRequestId: type: string nullable: true errorMessage: type: string nullable: true pendingMessage: type: string nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time certificate: type: object properties: id: type: string serialNumber: type: string status: type: string required: - id - serialNumber - status additionalProperties: false nullable: true required: - id - status - commonName - altNames - profileId - profileName - caId - certificateId - approvalRequestId - errorMessage - pendingMessage - createdAt - updatedAt - certificate additionalProperties: false totalCount: type: number required: - certificateRequests - totalCount additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/certificate-requests/{requestId}/cancel: post: operationId: cancelCertificateRequest tags: - PKI Certificates description: Cancel a pending certificate request. parameters: - schema: type: string format: uuid in: path name: requestId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: status: type: string enum: - pending_approval - pending - pending_validation - issued - failed - rejected cancelled: type: boolean errorMessage: type: string nullable: true required: - status - cancelled - errorMessage additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/renew: post: operationId: renewCertificate tags: - PKI Certificates requestBody: required: true content: application/json: schema: anyOf: - not: {} - type: object properties: removeRootsFromChain: anyOf: - type: boolean - type: string default: false additionalProperties: false parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string issuingCaCertificate: type: string certificateChain: type: string privateKey: type: string serialNumber: type: string certificateId: type: string certificateRequestId: type: string required: - certificate - issuingCaCertificate - certificateChain - serialNumber - certificateId - certificateRequestId additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/config: patch: operationId: updateCertificateRenewalConfig tags: - PKI Certificates requestBody: required: true content: application/json: schema: type: object properties: renewBeforeDays: type: integer minimum: 1 maximum: 30 enableAutoRenewal: type: boolean additionalProperties: false parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: message: type: string renewBeforeDays: type: number required: - message additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}: get: operationId: getCertificate tags: - PKI Certificates description: Get certificate parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to get. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true subject: type: object properties: commonName: type: string organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false fingerprints: type: object properties: sha256: type: string sha1: type: string required: - sha256 additionalProperties: false basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false caName: type: string nullable: true caType: type: string enum: - internal - external nullable: true profileName: type: string nullable: true applicationName: type: string nullable: true metadata: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter additionalProperties: false required: - certificate additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false patch: operationId: updateCertificate tags: - PKI Certificates description: Update certificate requestBody: required: true content: application/json: schema: type: object properties: metadata: type: array items: type: object properties: key: type: string minLength: 1 maxLength: 255 value: type: string maxLength: 1020 default: '' required: - key additionalProperties: false additionalProperties: false parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to get. responses: '200': description: Default Response content: application/json: schema: type: object properties: metadata: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false required: - metadata additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: operationId: deleteCertificate tags: - PKI Certificates description: Delete certificate parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to delete. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter additionalProperties: false required: - certificate additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/private-key: get: operationId: getCertificatePrivateKey tags: - PKI Certificates description: Get certificate private key parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to get. responses: '200': description: Default Response content: application/json: schema: type: string '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/bundle: get: operationId: getCertificateBundle tags: - PKI Certificates description: Get certificate bundle including the certificate, chain, and private key. parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to get the certificate body and certificate chain for. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The certificate body of the certificate. certificateChain: type: string nullable: true description: The certificate chain of the certificate. privateKey: type: string nullable: true description: The private key of the certificate. serialNumber: type: string description: The serial number of the certificate. required: - certificate - certificateChain - privateKey - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/import-certificate: post: operationId: importCertificate tags: - PKI Certificates description: Import certificate requestBody: required: true content: application/json: schema: type: object properties: certificatePem: type: string minLength: 1 description: The PEM-encoded leaf certificate. privateKeyPem: type: string minLength: 1 description: Optional PEM-encoded private key associated with the certificate. chainPem: type: string minLength: 1 description: Optional PEM-encoded chain of intermediate certificates. friendlyName: type: string description: A friendly name for the certificate. pkiCollectionId: type: string description: The ID of the PKI collection to add the certificate to. applicationId: type: string format: uuid required: - certificatePem additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The imported certificate. certificateChain: type: string description: The certificate chain associated with the imported certificate. Returned only when a chain was supplied at import. privateKey: type: string description: The PEM-encoded private key associated with the imported certificate. Returned only when a private key was supplied at import. serialNumber: type: string description: The serial number of the imported certificate. required: - certificate - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/revoke: post: operationId: revokeCertificate tags: - PKI Certificates description: Revoke requestBody: required: true content: application/json: schema: type: object properties: revocationReason: type: string enum: - UNSPECIFIED - KEY_COMPROMISE - CA_COMPROMISE - AFFILIATION_CHANGED - SUPERSEDED - CESSATION_OF_OPERATION - CERTIFICATE_HOLD - PRIVILEGE_WITHDRAWN - A_A_COMPROMISE description: The reason for revoking the certificate. required: - revocationReason additionalProperties: false parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to revoke. responses: '200': description: Default Response content: application/json: schema: type: object properties: message: type: string serialNumber: type: string description: The serial number of the revoked certificate. revokedAt: type: string format: date-time description: The date and time when the certificate was revoked. required: - message - serialNumber - revokedAt additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/application: post: operationId: assignCertificateToApplication tags: - PKI Certificates description: Assign a certificate to an Application. Only certificates that aren't already attached to an Application can be assigned; once attached the binding cannot be moved. requestBody: required: true content: application/json: schema: type: object properties: applicationId: type: string format: uuid required: - applicationId additionalProperties: false parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter additionalProperties: false required: - certificate additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificates/{id}/certificate: get: operationId: getCertificateBody tags: - PKI Certificates description: Get certificate body of certificate parameters: - schema: type: string in: path name: id required: true description: The ID of the certificate to get the certificate body and certificate chain for. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The certificate body of the certificate. certificateChain: type: string nullable: true description: The certificate chain of the certificate. serialNumber: type: string description: The serial number of the certificate. required: - certificate - certificateChain - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-cleanup: get: operationId: getCertificateCleanupConfig tags: - PKI Certificates description: Get certificate cleanup configuration for a project responses: '200': description: Default Response content: application/json: schema: type: object properties: config: type: object properties: isEnabled: type: boolean default: false postExpiryRetentionDays: type: number default: 3 skipCertsWithActiveSyncs: type: boolean default: true lastRunStatus: type: string nullable: true lastRunAt: type: string format: date-time nullable: true lastRunCertsDeleted: type: number default: 0 lastRunMessage: type: string nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - createdAt - updatedAt additionalProperties: false nullable: true required: - config additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false put: operationId: updateCertificateCleanupConfig tags: - PKI Certificates description: Create or update certificate cleanup configuration for a project requestBody: required: true content: application/json: schema: type: object properties: isEnabled: type: boolean description: Enable cleanup postExpiryRetentionDays: type: integer minimum: 1 maximum: 30 description: Days after expiration before deletion skipCertsWithActiveSyncs: type: boolean description: Skip certificates with active syncs additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: config: type: object properties: isEnabled: type: boolean default: false postExpiryRetentionDays: type: number default: 3 skipCertsWithActiveSyncs: type: boolean default: true lastRunStatus: type: string nullable: true lastRunAt: type: string format: date-time nullable: true lastRunCertsDeleted: type: number default: 0 lastRunMessage: type: string nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - createdAt - updatedAt additionalProperties: false required: - config additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/{serialNumber}: get: tags: - PKI Certificates description: Get certificate parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to get. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true projectId: type: string pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter - projectId additionalProperties: false required: - certificate additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: tags: - PKI Certificates description: Delete certificate parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to delete. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: object properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time caId: type: string format: uuid nullable: true status: type: string serialNumber: type: string friendlyName: type: string commonName: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true revocationReason: type: number nullable: true altNames: type: string nullable: true caCertId: type: string format: uuid nullable: true certificateTemplateId: type: string format: uuid nullable: true keyUsages: type: array items: type: string nullable: true extendedKeyUsages: type: array items: type: string nullable: true projectId: type: string pkiSubscriberId: type: string format: uuid nullable: true profileId: type: string format: uuid nullable: true renewBeforeDays: type: number nullable: true renewedFromCertificateId: type: string format: uuid nullable: true renewedByCertificateId: type: string format: uuid nullable: true renewalError: type: string nullable: true keyAlgorithm: type: string nullable: true signatureAlgorithm: type: string nullable: true subjectOrganization: type: string nullable: true subjectOrganizationalUnit: type: string nullable: true subjectCountry: type: string nullable: true subjectState: type: string nullable: true subjectLocality: type: string nullable: true fingerprintSha256: type: string nullable: true fingerprintSha1: type: string nullable: true isCA: type: boolean nullable: true pathLength: type: number nullable: true source: type: string nullable: true discoveryMetadata: nullable: true externalMetadata: nullable: true applicationId: type: string format: uuid nullable: true required: - id - createdAt - updatedAt - status - serialNumber - friendlyName - commonName - notBefore - notAfter - projectId additionalProperties: false required: - certificate additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/{serialNumber}/private-key: get: tags: - PKI Certificates description: Get certificate private key parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to get. responses: '200': description: Default Response content: application/json: schema: type: string '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/{serialNumber}/bundle: get: tags: - PKI Certificates description: Get certificate bundle including the certificate, chain, and private key. parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to get the certificate body and certificate chain for. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The certificate body of the certificate. certificateChain: type: string nullable: true description: The certificate chain of the certificate. privateKey: type: string nullable: true description: The private key of the certificate. serialNumber: type: string description: The serial number of the certificate. required: - certificate - certificateChain - privateKey - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/issue-certificate: post: tags: - PKI Certificates description: Issue certificate requestBody: required: true content: application/json: schema: type: object properties: caId: type: string description: The ID of the CA to issue the certificate from. certificateTemplateId: type: string description: The ID of the certificate template to issue the certificate from. pkiCollectionId: type: string description: The ID of the PKI collection to add the certificate to. friendlyName: type: string description: A friendly name for the certificate. commonName: type: string minLength: 1 description: The common name (CN) for the certificate. altNames: type: string default: '' description: A comma-delimited list of Subject Alternative Names (SANs) for the certificate; these can be host names or email addresses. ttl: type: string description: The time to live for the certificate such as 1m, 1h, 1d, 1y, ... notBefore: type: string description: The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format. notAfter: type: string description: The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format. keyUsages: type: array items: type: string enum: - digitalSignature - keyEncipherment - nonRepudiation - dataEncipherment - keyAgreement - keyCertSign - cRLSign - encipherOnly - decipherOnly description: The key usage extension of the certificate. extendedKeyUsages: type: array items: type: string enum: - clientAuth - serverAuth - codeSigning - emailProtection - timeStamping - ocspSigning description: The extended key usage extension of the certificate. required: - commonName - ttl additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The issued certificate. issuingCaCertificate: type: string description: The certificate of the issuing CA. certificateChain: type: string description: The certificate chain of the issued certificate. privateKey: type: string description: The private key of the issued certificate. serialNumber: type: string description: The serial number of the issued certificate. required: - certificate - issuingCaCertificate - certificateChain - privateKey - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/import-certificate: post: tags: - PKI Certificates description: Import certificate requestBody: required: true content: application/json: schema: type: object properties: projectSlug: type: string minLength: 1 description: Slug of the project to import the certificate into. certificatePem: type: string minLength: 1 description: The PEM-encoded leaf certificate. privateKeyPem: type: string minLength: 1 description: Optional PEM-encoded private key associated with the certificate. chainPem: type: string minLength: 1 description: Optional PEM-encoded chain of intermediate certificates. friendlyName: type: string description: A friendly name for the certificate. pkiCollectionId: type: string description: The ID of the PKI collection to add the certificate to. required: - projectSlug - certificatePem additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The imported certificate. certificateChain: type: string description: The certificate chain associated with the imported certificate. Returned only when a chain was supplied at import. privateKey: type: string description: The PEM-encoded private key associated with the imported certificate. Returned only when a private key was supplied at import. serialNumber: type: string description: The serial number of the imported certificate. required: - certificate - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/sign-certificate: post: tags: - PKI Certificates description: Sign certificate requestBody: required: true content: application/json: schema: type: object properties: caId: type: string description: The ID of the CA to issue the certificate from. certificateTemplateId: type: string description: The ID of the certificate template to issue the certificate from. pkiCollectionId: type: string description: The ID of the PKI collection to add the certificate to. csr: type: string minLength: 1 description: The pem-encoded CSR to sign with the CA to be used for certificate issuance. friendlyName: type: string description: A friendly name for the certificate. commonName: type: string minLength: 1 description: The common name (CN) for the certificate. altNames: type: string default: '' description: A comma-delimited list of Subject Alternative Names (SANs) for the certificate; these can be host names or email addresses. ttl: type: string description: The time to live for the certificate such as 1m, 1h, 1d, 1y, ... notBefore: type: string description: The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format. notAfter: type: string description: The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format. keyUsages: type: array items: type: string enum: - digitalSignature - keyEncipherment - nonRepudiation - dataEncipherment - keyAgreement - keyCertSign - cRLSign - encipherOnly - decipherOnly description: The key usage extension of the certificate. extendedKeyUsages: type: array items: type: string enum: - clientAuth - serverAuth - codeSigning - emailProtection - timeStamping - ocspSigning description: The extended key usage extension of the certificate. required: - csr - ttl additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The issued certificate. issuingCaCertificate: type: string description: The certificate of the issuing CA. certificateChain: type: string description: The certificate chain of the issued certificate. serialNumber: type: string description: The serial number of the issued certificate. required: - certificate - issuingCaCertificate - certificateChain - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/{serialNumber}/revoke: post: tags: - PKI Certificates description: Revoke requestBody: required: true content: application/json: schema: type: object properties: revocationReason: type: string enum: - UNSPECIFIED - KEY_COMPROMISE - CA_COMPROMISE - AFFILIATION_CHANGED - SUPERSEDED - CESSATION_OF_OPERATION - CERTIFICATE_HOLD - PRIVILEGE_WITHDRAWN - A_A_COMPROMISE description: The reason for revoking the certificate. required: - revocationReason additionalProperties: false parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to revoke. The revoked certificate will be added to the certificate revocation list (CRL) of the CA. responses: '200': description: Default Response content: application/json: schema: type: object properties: message: type: string serialNumber: type: string description: The serial number of the revoked certificate. revokedAt: type: string format: date-time description: The date and time when the certificate was revoked. required: - message - serialNumber - revokedAt additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificates/{serialNumber}/certificate: get: tags: - PKI Certificates description: Get certificate body of certificate parameters: - schema: type: string in: path name: serialNumber required: true description: The serial number of the certificate to get the certificate body and certificate chain for. responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string description: The certificate body of the certificate. certificateChain: type: string nullable: true description: The certificate chain of the certificate. serialNumber: type: string description: The serial number of the certificate. required: - certificate - certificateChain - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v3/pki/certificates/{certificateId}/renew: post: tags: - PKI Certificates requestBody: required: true content: application/json: schema: anyOf: - not: {} - type: object properties: removeRootsFromChain: anyOf: - type: boolean - type: string default: false additionalProperties: false parameters: - schema: type: string format: uuid in: path name: certificateId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string issuingCaCertificate: type: string certificateChain: type: string privateKey: type: string serialNumber: type: string certificateId: type: string certificateRequestId: type: string required: - certificate - issuingCaCertificate - certificateChain - serialNumber - certificateId - certificateRequestId additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v3/pki/certificates/{certificateId}/config: patch: tags: - PKI Certificates requestBody: required: true content: application/json: schema: type: object properties: renewBeforeDays: type: integer minimum: 1 maximum: 30 enableAutoRenewal: type: boolean additionalProperties: false parameters: - schema: type: string format: uuid in: path name: certificateId required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: message: type: string renewBeforeDays: type: number required: - message additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical