The /api/certificates resource is the operational core of TigerTrust — every certificate the platform manages, whether discovered from the field, imported from an external CA, or issued through the internal PKI, is represented here. All endpoints require an authenticated session or an API key with a scope containing certificates:read (for reads) or certificates:write (for mutations). Every mutation is written to the audit log.

​
Statistics

Aggregated counts of the workspace’s certificate inventory. Useful for dashboards and health checks. 
curl https://api.tigertrust.example.com/api/certificates/stats \
  -H "X-API-Key: ck_9f2a...7c4e"

{
  "data": {
    "total": 1247,
    "active": 1180,
    "expiring": 43,
    "expired": 12,
    "revoked": 12,
    "byType": { "TLS": 1150, "Code Signing": 61, "Client Auth": 36 },
    "autoRenewalEnabled": 894
  }
}

​
List certificates

GET /api/certificates
​
page
integer
default:"1"
​
limit
integer
default:"50"
​
status
string
One of active, expiring, expired, revoked.
​
search
string
Case-insensitive substring match on commonName and issuer.
​
data[].id
integer
​
data[].commonName
string
​
data[].issuer
string
​
data[].serialNumber
string
​
data[].fingerprint
string
​
data[].keySize
integer
​
data[].algorithm
string
e.g. SHA-256, RSA, ECDSA, ED25519.
​
data[].type
string
TLS, S/MIME, Code Signing, or Client Auth. Always populated.
​
data[].status
string
​
data[].issuedAt
string (ISO 8601)
​
data[].expiresAt
string (ISO 8601)
​
data[].autoRenewal
boolean
​
data[].issuanceSource
string
internal (private key downloadable), agent, vault, or external.
curl "https://api.tigertrust.example.com/api/certificates?status=expiring&limit=10" \
  -H "X-API-Key: ck_9f2a...7c4e"

​
Get a single certificate

GET /api/certificates/:id
​
id
integer
required
Numeric certificate ID.
Returns the same field set as list, plus the PEM certificate string when available. Returns 404 NOT_FOUND if the ID does not exist.

​
Create (register) a certificate

POST /api/certificates Records an already-existing certificate in the inventory. Use this for imports from external sources when discovery is not desired. Fields are validated against insertCertificateSchema from @shared/schema.
​
commonName
string
required
​
issuer
string
required
​
serialNumber
string
required
​
expiresAt
string (ISO 8601)
required
​
issuedAt
string (ISO 8601)
required
​
subjectAlternativeNames
string[]
​
certificate
string
PEM-encoded certificate body.
​
autoRenewal
boolean
default:"true"
Returns 201 Created with the persisted resource in the standard data envelope.

​
Issue a new certificate

POST /api/certificates/issue Unified endpoint that routes to either the internal PKI Core or an external CA (Let’s Encrypt, DigiCert, Sectigo, Vault, AWS PCA, ADCS, EST/SCEP, etc.). If no csr is supplied, TigerTrust generates a key pair server-side.
​
caId
integer | string
required
ID of the target CA. Combine with caType to disambiguate.
​
caType
'internal' | 'external' | 'pki'
required
​
csr
string
PEM-encoded CSR. Required if commonName is omitted.
​
commonName
string
Required if csr is omitted.
​
subjectAlternativeNames
string[]
DNS names and/or IP addresses. Auto-classified by format.
​
keyAlgorithm
'RSA' | 'ECDSA' | 'ED25519'
default:"RSA"
​
keySize
integer
default:"2048"
​
validityDays
integer
default:"365"
​
templateId
string
PKI Core template, e.g. web_server, code_signing.
​
subject
object
{ organization, organizationalUnit, country, state, locality }.
{
  "success": true,
  "data": {
    "id": 5182,
    "certificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
    "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
    "chain": ["-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"],
    "serialNumber": "0A:1B:2C:3D:4E:5F",
    "validFrom": "2026-08-25T00:00:00.000Z",
    "validTo": "2027-08-25T00:00:00.000Z",
    "privateKeyDownloadable": true
  }
}
The privateKey field is only returned once, at issuance time. For internally-issued certs it can be re-downloaded later via GET /api/certificates/:id/private-key (encrypted at rest). External-CA certs return null here.
Returns 503 SERVICE_UNAVAILABLE when PKI Core is offline, or 400 UNSUPPORTED_CA when the CA type has no matching renewal method.

​
Update a certificate

PUT /api/certificates/:id Accepts any subset of the create fields. Common uses: toggling autoRenewal, updating metadata, or annotating location.

​
Delete a certificate

DELETE /api/certificates/:id Removes the certificate record from the inventory. Returns 204 No Content. This does not revoke the certificate — call /revoke for that.

​
Toggle auto-renewal

PUT /api/certificates/:id/auto-renew
​
enabled
boolean
required

​
Revoke

POST /api/certificates/:id/revoke
​
reason
string
Free-form reason for the audit log. Defaults to unspecified.
Sets status to revoked. Returns 400 VALIDATION_ERROR if the certificate is already revoked.

​
Download

GET /api/certificates/:id/download?format=pem|der Returns the raw certificate bytes with Content-Disposition: attachment. Default format is PEM.

​
Download private key

GET /api/certificates/:id/private-key Only works for certificates where issuanceSource === "internal". Returns 403 PRIVATE_KEY_NOT_AVAILABLE otherwise. Every successful download is audit-logged.

​
Private-key status probe

GET /api/certificates/:id/private-key-status Cheap check that tells the UI whether the download button should be enabled — returns { downloadable, issuanceSource, reason }.

​
Assign an identity

POST /api/certificates/:id/assign-identity
​
identityId
integer
required
Attach the certificate to a machine identity record.
  • GET /api/certificates/revocation-requests — pending revocation approvals
  • GET /api/certificates/crl — CRL entries for internal CAs
  • GET|POST|PUT|DELETE /api/certificate-templates — reusable issuance profiles
  • GET|POST /api/certificate-usage — track where a certificate is deployed
  • GET|POST /api/certificate-requests + /approve + /reject — approval-gated CSR workflow

​
See also