The TigerTrust REST API exposes every capability of the platform — certificate discovery, issuance, renewal, revocation, workflow orchestration, TPM attestation, and webhook delivery — as programmable HTTP endpoints. It’s the same surface the built-in React dashboard uses, so anything you can do in the UI can be scripted.

​
Base URL

All API requests are made against the backend host you deploy. In local development this is http://localhost:3000; in production it’s whatever hostname you expose the Node backend behind (typically https://api.<your-domain>). 
https://api.tigertrust.example.com
Every documented endpoint in this reference is relative to that base and prefixed with /api/. Agent-facing endpoints served by the Go Collector live under a separate host — usually https://collector.<your-domain> — and are documented in Agents.

​
Conventions

All responses are JSON, all timestamps are ISO 8601 in UTC, and every request/response body uses camelCase field names.
Content types
  • Request bodies for POST, PUT, PATCH: application/json (unless documented otherwise, e.g. certificate downloads return application/x-pem-file).
  • Response bodies: application/json.
Response envelope The backend wraps successful responses in a stable envelope so clients can rely on the shape. 
{
  "data": {
    "id": 42,
    "commonName": "api.example.com",
    "status": "active"
  }
}
A handful of legacy endpoints (notably the agent-facing collector routes and the older /api/iot/* endpoints) return raw objects without the data wrapper. Those are called out inline on each page.

​
Workspace context

TigerTrust is multi-tenant. Every resource — certificates, CAs, agents, workflows — belongs to a workspace. When you authenticate with a session cookie, your active workspace is inferred from the session user’s currentWorkspaceId. You can override it per-request with the X-Workspace-Id header, provided the user is a member of the target workspace. 
curl https://api.tigertrust.example.com/api/certificates \
  -H "Cookie: connect.sid=..." \
  -H "X-Workspace-Id: ws_2p9x8f4tigertrust"
API keys are always scoped to a single workspace at creation time and do not honor X-Workspace-Id.

​
Authentication

Three mechanisms are supported. See Authentication for the full flow.

Session cookies

Browser-based login via /api/auth/login (email + password) or Google OAuth. Sets a connect.sid cookie.

API keys

Long-lived ck_... (public) or ak_... (agent) tokens. Sent via the X-API-Key header or Authorization: Bearer.

OAuth 2.0

Google identity federation for interactive sign-in via /api/auth/google.

​
Rate limiting and pagination

List endpoints default to 50 items per page with a hard cap of 100. Use ?page= and ?limit= (or ?offset= and ?limit=) — see Pagination and errors.

​
Client examples

curl https://api.tigertrust.example.com/api/certificates/stats \
  -H "X-API-Key: ck_a1b2c3d4e5f6..."

​
See also