Client Operations API (2.19.0)

Download OpenAPI specification:Download

ILM: ilm@omnitrust.com URL: https://www.otilm.com License: MIT License

REST API for Client Operations

Client Operations v2

Certificate lifecycle operations through an RA profile: issue, renew, rekey, register, revoke, finalize, confirm-revoke, and cancel.

The issue, renew, rekey, and revoke operations are asynchronous: the request is validated, persisted, and queued; the authority-connector call runs afterwards, and an approval step may first move the certificate to PENDING_APPROVAL. The HTTP response therefore does not carry the outcome — a 2xx means the request was accepted, not that it completed — and the issue/renew/rekey responses never carry the signed certificate. Follow an operation by reading the certificate's state, and retrieve the signed certificate from the certificate detail once it reaches ISSUED.

register runs inline against the connector: it reaches REGISTERED synchronously (and may return certificate data), or PENDING_REGISTRATION when the connector defers completion.

A certificate left in PENDING_ISSUE or PENDING_REVOKE is completed either by platform status-polling (when the authority advertises it) or by an operator action — issue/finalize, revoke/confirm, or cancel. Query availableOperations first to learn whether asynchronous completion and cancellation apply to a given authority / RA profile.

Certificate states driven by this API:

Issuance (issueCertificate, renewCertificate, rekeyCertificate,
          issueExistingCertificate on a REQUESTED cert):
  REQUESTED --> PENDING_ISSUE --> ISSUED       connector completes (synchronously or via polling);
                     |                         manuallyIssueCertificate finalizes it the same way
                     +-- cancel ------------> FAILED
                     +-- connector failure --> FAILED

Registration (registerCertificate, then issueExistingCertificate on a REGISTERED cert):
  PENDING_REGISTRATION --> REGISTERED --> PENDING_ISSUE --> ISSUED
           |               (connector 2xx or platform-level; then the issuance flow above)
           +-- setup failure --> FAILED

Revocation (revokeCertificate):
  ISSUED --> REVOKED                     authority completes the revocation immediately
  ISSUED --> PENDING_REVOKE --> REVOKED  deferred, then manuallyConfirmRevoke
  PENDING_REVOKE --> ISSUED              cancelPendingCertificateOperation

Approvals: issue / renew / rekey / revoke may pass through PENDING_APPROVAL first;
           a rejected issuance ends REJECTED (a pre-registered certificate is restored to REGISTERED),
           a rejected revocation restores the prior state.
Terminal (no further transition via this API): REVOKED, REJECTED, FAILED.

Issue certificate

Submit a new certificate signing request and request issuance through this RA profile. The request is validated, persisted, and queued; issuance runs asynchronously and an approval step may run first. This response returns only the new certificate's UUID — it never carries the signed certificate and does not indicate completion. Track the operation through the certificate's state.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Request Body schema: application/json
required

	Array of objects (RequestAttribute) List of attributes to create CSR. Required if CSR is not provided
	Array of objects (RequestAttribute) List of attributes to sign the CSR
	Array of objects (RequestAttribute) List of attributes to sign the alternative private key
request required	string Certificate signing request encoded as Base64 string
format	string (CertificateRequestFormat) Default: "pkcs10" Enum: "pkcs10" "crmf" Certificate signing request format
tokenProfileUuid	string <uuid> Token Profile UUID. Required if CSR is not uploaded
keyUuid	string <uuid> Key UUID. Required if CSR is not uploaded
altTokenProfileUuid	string <uuid> Token Profile UUID for the alternative key.
altKeyUuid	string <uuid> Alternative Key UUID.
required	Array of objects (RequestAttribute) List of RA Profile related Attributes to issue Certificate
	Array of objects (RequestAttribute) List of Custom Attributes
authorizationSecret	string One-time authorization secret proving the caller may complete a pre-registered certificate. Write-only; ignored for certificates without an active registration.

Responses

Request samples

Payload

Content type

application/json

{"csrAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"signatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"altSignatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"request": "string",
"format": "pkcs10",
"tokenProfileUuid": "66f2e24c-4f07-496b-b5c4-6fe8a5e8361a",
"keyUuid": "a0e39a6c-fae3-43d6-99c3-a3620775a368",
"altTokenProfileUuid": "487a31a3-090d-4b19-9b24-0ff6d52ff0e9",
"altKeyUuid": "ae57c41d-5798-439d-bc96-b05c70b20ac1",
"attributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"customAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"authorizationSecret": "string"
}

Response samples

Content type

application/json

{"certificateData": "string",
"uuid": "string"
}

Revoke certificate

Revoke a certificate currently in state ISSUED. The request is accepted and queued; revocation runs through the authority and an approval step may run first. This response is returned before the authority call completes, so it does not indicate completion — the certificate ends in REVOKED if the authority completes the revocation immediately, or PENDING_REVOKE if completion is deferred and later confirmed. Track the result through its state.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json
required

reason	string (CertificateRevocationReason) Default: "UNSPECIFIED" Enum: "unspecified" "keyCompromise" "cACompromise" "affiliationChanged" "superseded" "cessationOfOperation" "certificateHold" "privilegeWithdrawn" "aACompromise" Reason for revocation
required	Array of objects (RequestAttribute) List of Attributes to revoke Certificate
destroyKey	boolean Default: false Destroy Key upon successful revocation

Responses

Request samples

Payload

Content type

application/json

{"reason": "unspecified",
"attributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"destroyKey": false
}

Response samples

Content type

application/json

{"message": "Error message"
}

Confirm an asynchronous certificate revocation

Confirm that a revoked certificate has been revoked. The certificate must be in state PENDING_REVOKE. The platform applies the destroy-key flag and revoke attributes from the original revoke request, transitions the certificate to REVOKED, and clears the data carried over from the original request.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Responses

Response samples

422

Content type

*/*

[
  "Certificate is not in PENDING_REVOKE state"
]

Renew certificate

Renew a certificate using its existing key pair. The original certificate stays in state ISSUED; a new certificate is created, queued, and issued asynchronously. This response returns only the new certificate's UUID — track the result through its state.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json
required

replaceInLocations	boolean Default: false True to replace renewed certificate in the associated locations
request	string Certificate signing request encoded as Base64 string. If not provided, Existing CSR will be used
format	string (CertificateRequestFormat) Default: "pkcs10" Enum: "pkcs10" "crmf" Certificate signing request format

Responses

Request samples

Payload

Content type

application/json

{"replaceInLocations": false,
"request": "string",
"format": "pkcs10"
}

Response samples

Content type

application/json

{"certificateData": "string",
"uuid": "string"
}

Rekey Certificate

Request a replacement certificate with a new key pair but the same subject and attributes as the original. Provide a new CSR with a new key pair, or select a platform-managed key pair; reusing the same key pair, or changing the subject, is rejected. Queued and issued asynchronously — track the result through the new certificate's state.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json
required

replaceInLocations	boolean Default: false True to replace renewed certificate in the associated locations
request	string Certificate signing request encoded as Base64 string. If not provided, CSR attributes will be used
format	string (CertificateRequestFormat) Default: "pkcs10" Enum: "pkcs10" "crmf" Certificate signing request format
keyUuid	string <uuid> Key UUID
tokenProfileUuid	string <uuid> Token Profile UUID
altKeyUuid	string <uuid> Alternative Key UUID
altTokenProfileUuid	string <uuid> Token Profile UUID for the alternative key
	Array of objects (RequestAttribute) Signature Attributes. If not provided, existing attributes will be used to generate the new CSR
	Array of objects (RequestAttribute) Alternative Signature Attributes. If not provided, existing alternative attributes will be used to generate the new CSR

Responses

Request samples

Payload

Content type

application/json

{"replaceInLocations": false,
"request": "string",
"format": "pkcs10",
"keyUuid": "a0e39a6c-fae3-43d6-99c3-a3620775a368",
"tokenProfileUuid": "66f2e24c-4f07-496b-b5c4-6fe8a5e8361a",
"altKeyUuid": "ae57c41d-5798-439d-bc96-b05c70b20ac1",
"altTokenProfileUuid": "487a31a3-090d-4b19-9b24-0ff6d52ff0e9",
"signatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"altSignatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}

Response samples

Content type

application/json

{"certificateData": "string",
"uuid": "string"
}

Issue an existing certificate (REQUESTED or REGISTERED)

Trigger issuance for an existing certificate; behaviour depends on its state:

REQUESTED (no body): the certificate already carries a CSR (e.g. from an ACME/SCEP/CMP protocol layer, or after an approval/compliance cycle); issuance runs against that CSR.
REGISTERED (body required): a pre-registered certificate is finalized with the operator's CSR (sign attributes as the RA profile requires, and the authorization secret only for challenge-protected registrations); its registered identity (subject DN, SAN, extensions) and connector metadata are preserved.

Queued and issued asynchronously like issueCertificate — track the result through the certificate's state.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json

Issue request body. Required when cert state is REGISTERED (carries the operator's CSR, sign attributes as the RA profile requires, and — for challenge-protected registrations — the authorization secret); must be omitted when cert state is REQUESTED.

	Array of objects (RequestAttribute) List of attributes to create CSR. Required if CSR is not provided
	Array of objects (RequestAttribute) List of attributes to sign the CSR
	Array of objects (RequestAttribute) List of attributes to sign the alternative private key
request required	string Certificate signing request encoded as Base64 string
format	string (CertificateRequestFormat) Default: "pkcs10" Enum: "pkcs10" "crmf" Certificate signing request format
tokenProfileUuid	string <uuid> Token Profile UUID. Required if CSR is not uploaded
keyUuid	string <uuid> Key UUID. Required if CSR is not uploaded
altTokenProfileUuid	string <uuid> Token Profile UUID for the alternative key.
altKeyUuid	string <uuid> Alternative Key UUID.
required	Array of objects (RequestAttribute) List of RA Profile related Attributes to issue Certificate
	Array of objects (RequestAttribute) List of Custom Attributes
authorizationSecret	string One-time authorization secret proving the caller may complete a pre-registered certificate. Write-only; ignored for certificates without an active registration.

Responses

Request samples

Payload

Content type

application/json

{"csrAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"signatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"altSignatureAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"request": "string",
"format": "pkcs10",
"tokenProfileUuid": "66f2e24c-4f07-496b-b5c4-6fe8a5e8361a",
"keyUuid": "a0e39a6c-fae3-43d6-99c3-a3620775a368",
"altTokenProfileUuid": "487a31a3-090d-4b19-9b24-0ff6d52ff0e9",
"altKeyUuid": "ae57c41d-5798-439d-bc96-b05c70b20ac1",
"attributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"customAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"authorizationSecret": "string"
}

Response samples

Content type

application/json

{"certificateData": "string",
"uuid": "string"
}

Finalize an asynchronous certificate issuance

Finalize a certificate in state PENDING_ISSUE by uploading the issued certificate. On success it transitions to ISSUED and is pushed to any pre-associated locations.

Validation: the certificate request's public key must match the uploaded certificate (mandatory); the subject DN should match (warning only — some CAs canonicalise it); and the uploaded certificate must verify against the RA profile's authority (mandatory).

The body carries a Base64-encoded single certificate and optional certificate-level custom attributes.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json
required

certificate required	string Base64 Content of the Certificate
required	Array of objects (RequestAttribute) Custom Attributes for the Certificate

Responses

Request samples

Payload

Content type

application/json

{"certificate": "string",
"customAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}

Response samples

Content type

application/json

{"uuid": "string",
"commonName": "string",
"serialNumber": "string",
"issuerCommonName": "string",
"issuerDn": "string",
"subjectDn": "string",
"notBefore": "2019-08-24T14:15:22Z",
"notAfter": "2019-08-24T14:15:22Z",
"publicKeyAlgorithm": "string",
"altPublicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"hybridCertificate": true,
"keySize": 0,
"altKeySize": 0,
"state": "requested",
"validationStatus": "not_checked",
"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"enabled": true,
"authorityInstanceUuid": "string"
},
"fingerprint": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"owner": "string",
"ownerUuid": "string",
"certificateType": "X.509",
"issuerSerialNumber": "string",
"complianceStatus": "not_checked",
"issuerCertificateUuid": "string",
"privateKeyAvailability": true,
"trustedCa": true,
"archived": false,
"extendedKeyUsage": ["string"
],
"keyUsage": ["digitalSignature"
],
"subjectType": "endEntity",
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name"
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}
],
"certificateContent": "string",
"subjectAlternativeNames": {"property1": ["string"
],
"property2": ["string"
]
},
"locations": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"entityInstanceUuid": "string",
"entityInstanceName": "string",
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"enabled": true,
"supportMultipleEntries": false,
"supportKeyManagement": false,
"certificates": [{"certificateUuid": "string",
"state": "requested",
"validationStatus": "not_checked",
"commonName": "string",
"serialNumber": "string",
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [null
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [null
],
"version": "v2"
}
]
}
],
"pushAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"csrAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"withKey": false
}
],
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name"
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}
]
}
],
"registration": {"state": "active",
"expiresAt": "2019-08-24T14:15:22Z",
"failedAttempts": 0
},
"nonCompliantRules": [{"connectorName": "Provider1",
"ruleName": "RuleName",
"ruleDescription": "Description sample",
"status": "ok",
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"key": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"items": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"keyWrapperUuid": "string",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": null,
"data": null
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"associations": 0,
"keyReferenceUuid": "string",
"type": "Secret",
"keyAlgorithm": "RSA",
"format": "Raw",
"length": 0,
"usage": ["sign"
],
"enabled": true,
"state": "pre-active",
"complianceStatus": "not_checked"
}
],
"associations": 0,
"complianceStatus": "not_checked"
},
"altKey": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"items": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"keyWrapperUuid": "string",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": null,
"data": null
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"associations": 0,
"keyReferenceUuid": "string",
"type": "Secret",
"keyAlgorithm": "RSA",
"format": "Raw",
"length": 0,
"usage": ["sign"
],
"enabled": true,
"state": "pre-active",
"complianceStatus": "not_checked"
}
],
"associations": 0,
"complianceStatus": "not_checked"
},
"certificateRequest": {"uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
"certificateType": "X.509",
"certificateRequestFormat": "pkcs10",
"publicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"content": "string",
"commonName": "string",
"subjectDn": "string",
"subjectAlternativeNames": {"property1": ["string"
],
"property2": ["string"
]
},
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"signatureAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"altSignatureAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"keyUuid": "string",
"altKeyUuid": "string",
"complianceStatus": "not_checked"
},
"sourceCertificateUuid": "cef92ac9-d5a2-44b4-8d0a-6ae2f850acf7",
"issueAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"revokeAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"registerAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"registrationRequestAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"relatedCertificates": [{"uuid": "string",
"commonName": "string",
"serialNumber": "string",
"issuerCommonName": "string",
"issuerDn": "string",
"subjectDn": "string",
"notBefore": "2019-08-24T14:15:22Z",
"notAfter": "2019-08-24T14:15:22Z",
"publicKeyAlgorithm": "string",
"altPublicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"hybridCertificate": true,
"keySize": 0,
"altKeySize": 0,
"state": "requested",
"validationStatus": "not_checked",
"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"enabled": true,
"authorityInstanceUuid": "string"
},
"fingerprint": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"owner": "string",
"ownerUuid": "string",
"certificateType": "X.509",
"issuerSerialNumber": "string",
"complianceStatus": "not_checked",
"issuerCertificateUuid": "string",
"privateKeyAvailability": true,
"trustedCa": true,
"archived": false
}
],
"protocolInfo": {"protocol": "acme",
"protocolProfileUuid": "a286b9c7-97ed-44c6-a837-e8415ab11bf4",
"additionalProtocolUuid": "bcf08956-ad5e-4c4a-863d-293464f7e308"
},
"qcStatements": {"qcCompliance": true,
"qcSscd": true,
"qcType": ["esign"
],
"qcCcLegislation": ["string"
]
}
}

Cancel a pending certificate operation

State-aware cancel for a certificate in PENDING_ISSUE or PENDING_REVOKE:

PENDING_ISSUE → FAILED
PENDING_REVOKE → ISSUED

The optional reason is recorded in the certificate event history. If the underlying operation can no longer be aborted, the response is 422 and the certificate stays in its pending state; it can then be resolved by letting it complete and finalizing/confirming, or by retrying the cancel later.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID
certificateUuid required	string Certificate UUID

Request Body schema: application/json

reason

string [ 0 .. 1000 ] characters

Optional free-text reason from the user explaining why the pending operation is being cancelled. Recorded in the certificate event history.

Responses

Request samples

Payload

Content type

application/json

{"reason": "string"
}

Response samples

Content type

application/json

{"uuid": "string",
"commonName": "string",
"serialNumber": "string",
"issuerCommonName": "string",
"issuerDn": "string",
"subjectDn": "string",
"notBefore": "2019-08-24T14:15:22Z",
"notAfter": "2019-08-24T14:15:22Z",
"publicKeyAlgorithm": "string",
"altPublicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"hybridCertificate": true,
"keySize": 0,
"altKeySize": 0,
"state": "requested",
"validationStatus": "not_checked",
"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"enabled": true,
"authorityInstanceUuid": "string"
},
"fingerprint": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"owner": "string",
"ownerUuid": "string",
"certificateType": "X.509",
"issuerSerialNumber": "string",
"complianceStatus": "not_checked",
"issuerCertificateUuid": "string",
"privateKeyAvailability": true,
"trustedCa": true,
"archived": false,
"extendedKeyUsage": ["string"
],
"keyUsage": ["digitalSignature"
],
"subjectType": "endEntity",
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name"
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}
],
"certificateContent": "string",
"subjectAlternativeNames": {"property1": ["string"
],
"property2": ["string"
]
},
"locations": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"entityInstanceUuid": "string",
"entityInstanceName": "string",
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"enabled": true,
"supportMultipleEntries": false,
"supportKeyManagement": false,
"certificates": [{"certificateUuid": "string",
"state": "requested",
"validationStatus": "not_checked",
"commonName": "string",
"serialNumber": "string",
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [null
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [null
],
"version": "v2"
}
]
}
],
"pushAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"csrAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"withKey": false
}
],
"metadata": [{"connectorUuid": "string",
"connectorName": "string",
"sourceObjectType": "NONE",
"items": [{"sourceObjects": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name"
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]
}
]
}
],
"registration": {"state": "active",
"expiresAt": "2019-08-24T14:15:22Z",
"failedAttempts": 0
},
"nonCompliantRules": [{"connectorName": "Provider1",
"ruleName": "RuleName",
"ruleDescription": "Description sample",
"status": "ok",
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"key": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"items": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"keyWrapperUuid": "string",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": null,
"data": null
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"associations": 0,
"keyReferenceUuid": "string",
"type": "Secret",
"keyAlgorithm": "RSA",
"format": "Raw",
"length": 0,
"usage": ["sign"
],
"enabled": true,
"state": "pre-active",
"complianceStatus": "not_checked"
}
],
"associations": 0,
"complianceStatus": "not_checked"
},
"altKey": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"items": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"creationTime": "2019-08-24T14:15:22Z",
"keyWrapperUuid": "string",
"tokenProfileUuid": "string",
"tokenProfileName": "string",
"tokenInstanceUuid": "string",
"tokenInstanceName": "string",
"owner": "string",
"ownerUuid": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": null,
"data": null
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"associations": 0,
"keyReferenceUuid": "string",
"type": "Secret",
"keyAlgorithm": "RSA",
"format": "Raw",
"length": 0,
"usage": ["sign"
],
"enabled": true,
"state": "pre-active",
"complianceStatus": "not_checked"
}
],
"associations": 0,
"complianceStatus": "not_checked"
},
"certificateRequest": {"uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
"certificateType": "X.509",
"certificateRequestFormat": "pkcs10",
"publicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"content": "string",
"commonName": "string",
"subjectDn": "string",
"subjectAlternativeNames": {"property1": ["string"
],
"property2": ["string"
]
},
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"signatureAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"altSignatureAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"keyUuid": "string",
"altKeyUuid": "string",
"complianceStatus": "not_checked"
},
"sourceCertificateUuid": "cef92ac9-d5a2-44b4-8d0a-6ae2f850acf7",
"issueAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"revokeAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"registerAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"registrationRequestAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"relatedCertificates": [{"uuid": "string",
"commonName": "string",
"serialNumber": "string",
"issuerCommonName": "string",
"issuerDn": "string",
"subjectDn": "string",
"notBefore": "2019-08-24T14:15:22Z",
"notAfter": "2019-08-24T14:15:22Z",
"publicKeyAlgorithm": "string",
"altPublicKeyAlgorithm": "string",
"signatureAlgorithm": "string",
"altSignatureAlgorithm": "string",
"hybridCertificate": true,
"keySize": 0,
"altKeySize": 0,
"state": "requested",
"validationStatus": "not_checked",
"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"enabled": true,
"authorityInstanceUuid": "string"
},
"fingerprint": "string",
"groups": [{"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"email": "string",
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
]
}
],
"owner": "string",
"ownerUuid": "string",
"certificateType": "X.509",
"issuerSerialNumber": "string",
"complianceStatus": "not_checked",
"issuerCertificateUuid": "string",
"privateKeyAvailability": true,
"trustedCa": true,
"archived": false
}
],
"protocolInfo": {"protocol": "acme",
"protocolProfileUuid": "a286b9c7-97ed-44c6-a837-e8415ab11bf4",
"additionalProtocolUuid": "bcf08956-ad5e-4c4a-863d-293464f7e308"
},
"qcStatements": {"qcCompliance": true,
"qcSscd": true,
"qcType": ["esign"
],
"qcCcLegislation": ["string"
]
}
}

Pre-register a certificate

Pre-register a certificate to be issued later; the response carries the pre-registered certificate's UUID and completion runs through the standard issue flow.

When the authority's connector supports registration (a v3 connector advertising CERTIFICATE_REGISTRATION), the registration is made with the upstream CA; otherwise the certificate is pre-registered at the platform level with no connector call, which does not imply a CA-side end-entity exists. Connector-side completion may be asynchronous and is tracked server-side.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Request Body schema: application/json
required

subjectDn	string Subject DN. Optional per RFC 5280 §4.1.2.6: an empty subject is permitted when subject naming information is carried entirely in the Subject Alternative Name extension (in which case the subjectAltName extension MUST be marked critical at issuance). At least one of subjectDn, subjectAltName, or csrAttributes must provide subject identity — enforced by the cross-field {@code subjectIdentificationProvided} constraint.
subjectAltName	string Subject Alternative Name in RFC 5280 textual form (e.g. DNS:foo,IP:1.2.3.4,email:x@y). SAN MUST be carried here ONLY — do not also include it as OID 2.5.29.17 in extensions[]. Connectors reject duplicate-source requests with VALIDATION_FAILED. Provides subject identity when subjectDn is empty (see RFC 5280 §4.1.2.6); csrAttributes is a further alternative.
	Array of objects (CertificateExtension) Structured certificate extensions (OID + critical + base64 value). All extensions OTHER than SAN go here.
	Array of objects (RequestAttribute) Structured request-attribute identity content (subject RDNs, SANs, extensions) — the typed alternative to the flat subjectDn/subjectAltName/extensions above, mirroring the issue path. When provided, the platform projects it into the registration identity; the flat subjectDn/subjectAltName/extensions are the simple alternative. Provide the identity via csrAttributes OR the flat fields, not both.
	Array of objects (RequestAttribute) Authority-defined registration attributes (e.g., subject DN template, validity hints).
	Array of objects (RequestAttribute) RA-profile-scoped override attributes for the registration.
	Array of objects (RequestAttribute) List of Custom Attributes
ownerUuid	string Optional UUID of the user to set as the certificate owner at registration. When omitted, the registering user becomes the owner. The value set here is preserved when the pre-registered certificate is later issued.
groupUuids	Array of strings <uuid> unique [ items <uuid > ] Optional set of group UUIDs to associate with the certificate at registration. When provided, it replaces any existing group set. The groups set here are preserved when the pre-registered certificate is later issued.
authorizationSecret	string [ 12 .. 255 ] characters [\x20-\x7E]+ Authorization secret (challenge) that gates completion of this pre-registered certificate. Write-only and optional — the operator supplies it to opt the registration into challenge-gated issuance; the platform never generates one. Issuing a pre-registered certificate is currently the only challenge-verified completion path; renewal and rekey requests for a certificate with an active registration are rejected (fail-closed) until challenge-gated successor handling is added.
expiresAt	string <date-time> Optional absolute deadline by which the completion request must be presented — a valid challenge must be supplied before this instant. It gates the completion request, not the final issuance: when the request is approved or otherwise processed asynchronously, issuance may finalize shortly after the deadline. When omitted, the platform applies the default registration issuance window.

Responses

Request samples

Payload

Content type

application/json

{"subjectDn": "CN=device-7,O=Acme",
"subjectAltName": "string",
"extensions": [{"oid": "2.5.29.37",
"critical": true,
"valueBase64": "string"
}
],
"csrAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"attributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"raProfileAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"customAttributes": [{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
],
"ownerUuid": "string",
"groupUuids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"
],
"authorizationSecret": "stringstring",
"expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type

application/json

{"certificateData": "string",
"uuid": "string"
}

Validate revocation attributes

Validate a candidate set of revocation attributes against this RA profile's schema before submitting a revocation request.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Request Body schema: application/json
required

Array

uuid required	string <uuid> UUID of the Attribute
name required	string Name of the Attribute
contentType required	string (AttributeContentType) Enum: "string" "text" "integer" "boolean" "float" "date" "time" "datetime" "secret" "file" "credential" "codeblock" "object" "resource" Content Type of the Attribute
	Array of BooleanAttributeContentV2 (object) or CodeBlockAttributeContentV2 (object) or CredentialAttributeContentV2 (object) or DateAttributeContentV2 (object) or DateTimeAttributeContentV2 (object) or FileAttributeContentV2 (object) or FloatAttributeContentV2 (object) or IntegerAttributeContentV2 (object) or ObjectAttributeContentV2 (object) or SecretAttributeContentV2 (object) or StringAttributeContentV2 (object) or TextAttributeContentV2 (object) or TimeAttributeContentV2 (object) (BaseAttributeContentDtoV2)
version required	string (AttributeVersion) Version of the Attribute v2

Responses

Request samples

Payload

Content type

application/json

[{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]

Response samples

Content type

application/json

{"message": "Error message"
}

Validate issue certificate attributes

Validate a candidate set of issuance attributes against this RA profile's schema before submitting an issuance request. Returns 422 with a list of error messages when the attributes are not acceptable.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Request Body schema: application/json
required

Array

uuid required	string <uuid> UUID of the Attribute
name required	string Name of the Attribute
contentType required	string (AttributeContentType) Enum: "string" "text" "integer" "boolean" "float" "date" "time" "datetime" "secret" "file" "credential" "codeblock" "object" "resource" Content Type of the Attribute
	Array of BooleanAttributeContentV2 (object) or CodeBlockAttributeContentV2 (object) or CredentialAttributeContentV2 (object) or DateAttributeContentV2 (object) or DateTimeAttributeContentV2 (object) or FileAttributeContentV2 (object) or FloatAttributeContentV2 (object) or IntegerAttributeContentV2 (object) or ObjectAttributeContentV2 (object) or SecretAttributeContentV2 (object) or StringAttributeContentV2 (object) or TextAttributeContentV2 (object) or TimeAttributeContentV2 (object) (BaseAttributeContentDtoV2)
version required	string (AttributeVersion) Version of the Attribute v2

Responses

Request samples

Payload

Content type

application/json

[{"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"contentType": "string",
"content": [{"reference": "string",
"data": true,
"contentType": "string"
}
],
"version": "v2"
}
]

Response samples

Content type

application/json

{"message": "Error message"
}

List operations supported by this authority/RA profile

Returns per-operation support flags (issue/renew/revoke/register) including whether the platform polls for its asynchronous completion and whether each can be cancelled mid-flight. Operators use this to drive UI affordances and validate flows before invoking them.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Responses

Response samples

Content type

application/json

{"operations": [{"operation": "ISSUE",
"supported": true,
"asyncSupported": true,
"cancelSupported": true
}
]
}

Get revocation attributes

Return the list of attributes the client must populate when revoking a certificate through this RA profile.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Responses

Response samples

Content type

application/json

[{"name": "Attribute",
"type": "data",
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"description": "string",
"version": 0,
"content": [{"reference": "string",
"data": true
}
],
"contentType": "string",
"properties": {"label": "Attribute Name",
"visible": true,
"group": "requiredAttributes",
"required": false,
"readOnly": false,
"list": false,
"multiSelect": false,
"protectionLevel": "none",
"resource": "certificates",
"extensibleList": false
},
"constraints": [{"type": "regExp",
"errorMessage": "string",
"description": "string",
"data": "string"
}
],
"attributeCallback": {"callbackContext": "string",
"callbackMethod": "string",
"mappings": [{"from": "string",
"attributeType": "data",
"attributeContentType": "string",
"to": "string",
"targets": ["pathVariable"
],
"value": null
}
],
"dependsOn": ["string"
]
}
}
]

Get registration attributes

Return the list of attributes the client must populate when pre-registering a certificate through this RA profile. The list reflects the certificate authority's register-operation attribute schema.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Responses

Response samples

Content type

application/json

[{"name": "Attribute",
"type": "data",
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"description": "string",
"version": 0,
"content": [{"reference": "string",
"data": true
}
],
"contentType": "string",
"properties": {"label": "Attribute Name",
"visible": true,
"group": "requiredAttributes",
"required": false,
"readOnly": false,
"list": false,
"multiSelect": false,
"protectionLevel": "none",
"resource": "certificates",
"extensibleList": false
},
"constraints": [{"type": "regExp",
"errorMessage": "string",
"description": "string",
"data": "string"
}
],
"attributeCallback": {"callbackContext": "string",
"callbackMethod": "string",
"mappings": [{"from": "string",
"attributeType": "data",
"attributeContentType": "string",
"to": "string",
"targets": ["pathVariable"
],
"value": null
}
],
"dependsOn": ["string"
]
}
}
]

Get issue certificate attributes

Return the list of attributes the client must populate when requesting an issuance through this RA profile. The list reflects the certificate authority's current attribute schema.

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

authorityUuid required	string Authority Instance UUID
raProfileUuid required	string RA Profile UUID

Responses

Response samples

Content type

application/json

[{"name": "Attribute",
"type": "data",
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"description": "string",
"version": 0,
"content": [{"reference": "string",
"data": true
}
],
"contentType": "string",
"properties": {"label": "Attribute Name",
"visible": true,
"group": "requiredAttributes",
"required": false,
"readOnly": false,
"list": false,
"multiSelect": false,
"protectionLevel": "none",
"resource": "certificates",
"extensibleList": false
},
"constraints": [{"type": "regExp",
"errorMessage": "string",
"description": "string",
"data": "string"
}
],
"attributeCallback": {"callbackContext": "string",
"callbackMethod": "string",
"mappings": [{"from": "string",
"attributeType": "data",
"attributeContentType": "string",
"to": "string",
"targets": ["pathVariable"
],
"value": null
}
],
"dependsOn": ["string"
]
}
}
]

Legacy Client Operations

Client API for managing End Entities and Certificates

Reset password for End Entity

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName required	string RA Profile name
username required	string Username

Responses

Response samples

400
403
404
502
503

Content type

application/json

{"message": "Error message"
}

List all End Entities

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName

required

string

RA Profile name

Responses

Response samples

Content type

application/json

[{"subjectDN": "string",
"email": "string",
"extensionData": [{"name": "string",
"value": "string"
}
],
"subjectAltName": "string",
"status": "NEW",
"username": "string"
}
]

Add End Entity

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName

required

string

RA Profile name

Request Body schema: application/json
required

required	object (RaProfileDto) RA profile related to End Entity
email	string End Entity email
	Array of objects (EndEntityExtendedInfoDto) End Entity extension data
password required	string End Entity password
subjectAltName	string End Entity Subject alternative name
subjectDN required	string End Entity subject domain name
username required	string End Entity name

Responses

Request samples

Payload

Content type

application/json

{"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"authorityInstanceUuid": "string",
"authorityInstanceName": "string",
"legacyAuthority": true,
"enabled": true,
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"enabledProtocols": ["string"
],
"certificateValidationSettings": {"enabled": true,
"frequency": 1,
"expiringThreshold": 1
},
"certificateRequestAttributes": {"requestAttributes": [{"name": "Attribute",
"type": "data",
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"description": "string",
"version": 0,
"content": [{"reference": "string",
"data": true
}
],
"contentType": "string",
"properties": {"label": "Attribute Name",
"visible": true,
"group": "requiredAttributes",
"required": false,
"readOnly": false,
"list": false,
"multiSelect": false,
"protectionLevel": "none",
"resource": "certificates",
"extensibleList": false
},
"constraints": [{"type": "regExp",
"errorMessage": "string",
"description": "string",
"data": "string"
}
],
"attributeCallback": {"callbackContext": "string",
"callbackMethod": "string",
"mappings": [{"from": "string",
"attributeType": "data",
"attributeContentType": "string",
"to": "string",
"targets": ["pathVariable"
],
"value": null
}
],
"dependsOn": ["string"
]
}
}
],
"mergeMode": "staticOnly",
"externalCsrValidationStrict": true
}
},
"email": "string",
"extensionData": [{"name": "string",
"value": "string"
}
],
"password": "string",
"subjectAltName": "string",
"subjectDN": "string",
"username": "string"
}

Response samples

400
403
404
502
503

Content type

application/json

{"message": "Error message"
}

Get End Entity information

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName required	string RA Profile name
username required	string Username

Responses

Response samples

Content type

application/json

{"subjectDN": "string",
"email": "string",
"extensionData": [{"name": "string",
"value": "string"
}
],
"subjectAltName": "string",
"status": "NEW",
"username": "string"
}

Edit End Entity

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName required	string RA Profile name
username required	string Username

Request Body schema: application/json
required

required	object (RaProfileDto) RA profile related to End Entity
email	string End Entity email
	Array of objects (EndEntityExtendedInfoDto) End Entity extension data
password required	string End Entity password
subjectAltName	string End Entity Subject alternative name
subjectDN required	string End Entity subject domain name
status required	string Enum: "NEW" "FAILED" "INITIALIZED" "IN_PROCESS" "GENERATED" "REVOKED" "HISTORICAL" "KEY_RECOVERY" "WAITING_FOR_ADD_APPROVAL" End Entity Subject domain name

Responses

Request samples

Payload

Content type

application/json

{"raProfile": {"uuid": "7b55ge1c-844f-11dc-a8a3-0242ac120002",
"name": "Name",
"description": "string",
"authorityInstanceUuid": "string",
"authorityInstanceName": "string",
"legacyAuthority": true,
"enabled": true,
"attributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"customAttributes": [{"content": [{"reference": "string",
"data": true
}
],
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"name": "Attribute",
"label": "Attribute Name",
"type": "data",
"contentType": "string",
"version": "v2"
}
],
"enabledProtocols": ["string"
],
"certificateValidationSettings": {"enabled": true,
"frequency": 1,
"expiringThreshold": 1
},
"certificateRequestAttributes": {"requestAttributes": [{"name": "Attribute",
"type": "data",
"uuid": "b11c9be1-b619-4ef5-be1b-a1cd9ef265b7",
"description": "string",
"version": 0,
"content": [{"reference": "string",
"data": true
}
],
"contentType": "string",
"properties": {"label": "Attribute Name",
"visible": true,
"group": "requiredAttributes",
"required": false,
"readOnly": false,
"list": false,
"multiSelect": false,
"protectionLevel": "none",
"resource": "certificates",
"extensibleList": false
},
"constraints": [{"type": "regExp",
"errorMessage": "string",
"description": "string",
"data": "string"
}
],
"attributeCallback": {"callbackContext": "string",
"callbackMethod": "string",
"mappings": [{"from": "string",
"attributeType": "data",
"attributeContentType": "string",
"to": "string",
"targets": ["pathVariable"
],
"value": null
}
],
"dependsOn": ["string"
]
}
}
],
"mergeMode": "staticOnly",
"externalCsrValidationStrict": true
}
},
"email": "string",
"extensionData": [{"name": "string",
"value": "string"
}
],
"password": "string",
"subjectAltName": "string",
"subjectDN": "string",
"status": "NEW"
}

Response samples

400
403
404
502
503

Content type

application/json

{"message": "Error message"
}

Revoke all Certificates and delete End Entity

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName required	string RA Profile name
username required	string Username

Responses

Response samples

400
403
404
502
503

Content type

application/json

{"message": "Error message"
}

Revoke Certificate

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName

required

string

RA Profile name

Request Body schema: application/json
required

certificateSN required	string Certificate serial number
issuerDN required	string Issuer domain name
reason required	string (CertificateRevocationReason) Enum: "unspecified" "keyCompromise" "cACompromise" "affiliationChanged" "superseded" "cessationOfOperation" "certificateHold" "privilegeWithdrawn" "aACompromise" Revocation reason

Responses

Request samples

Payload

Content type

application/json

{"certificateSN": "string",
"issuerDN": "string",
"reason": "unspecified"
}

Response samples

400
403
404
502
503

Content type

application/json

{"message": "Error message"
}

Issue Certificate

Authorizations:

SessionAuthCertificateAuthBearerJWTAuth

path Parameters

raProfileName

required

string

RA Profile name

Request Body schema: application/json
required

password required	string End Entity password
pkcs10 required	string Certificate sign request (PKCS#10) encoded as Base64 string
username required	string End Entity username

Responses

Request samples

Payload

Content type

application/json

{"password": "string",
"pkcs10": "string",
"username": "string"
}

Response samples

Content type

application/json

{"certificateData": "string"
}

Client Operations API (2.19.0)

Client Operations v2

Issue certificate

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Revoke certificate

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Confirm an asynchronous certificate revocation

Authorizations:

path Parameters

Responses

Response samples

Renew certificate

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Rekey Certificate

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Issue an existing certificate (REQUESTED or REGISTERED)

Authorizations:

path Parameters

Request Body schema: application/json

Responses

Request samples

Response samples

Finalize an asynchronous certificate issuance

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Cancel a pending certificate operation

Authorizations:

path Parameters

Request Body schema: application/json

Responses

Request samples

Response samples

Pre-register a certificate

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Validate revocation attributes

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Validate issue certificate attributes

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

List operations supported by this authority/RA profile

Authorizations:

path Parameters

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required