| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/certificate-orders | List certificate orders | 登录会话 |
| POST | /v1/certificate-orders | Queue a pending certificate order | 登录会话 |
契约文件：api/openapi/v1/dns-acme.yaml
/v1/certificate-ordersList certificate orders
| 状态码 | 说明 |
|---|---|
200 | Orders visible in the authenticated scope. 字段： |
401 | Authentication is required. |
403 | The active role lacks the required permission. |
401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。/v1/certificate-ordersQueue a pending certificate order
Wildcards require dns-01 and a provider in the same tenant scope. A 202 response only persists a tenant-scoped pending intent and its audit event; it does not claim CA acceptance. Reusing an Idempotency-Key with a different scope, domain set, challenge, provider, or auto-renew value returns a conflict. HTTP-01 forbids dns_provider_id; DNS-01 requires a verified same-tenant provider. Entitlement authorization is a separate fail-closed server composition requirement and is not implied by RBAC.
| 名称 | 位置 | 类型 | 必填 | 说明 |
|---|---|---|---|---|
Idempotency-Key | header | string | 是 | — |
application/json · 必填：是
| 名称 | 类型 | 必填 | 说明 |
|---|---|---|---|
target_scope_id | string(uuid) | 否 | — |
dns_provider_id | string(uuid) | 否 | — |
domains | array<string> | 是 | — |
challenge_type | string: http-01 / dns-01 | 是 | — |
auto_renew | boolean | 是 | — |
issuer | string: lets_encrypt / zerossl / google_trust | 否 | The CA. Omitted uses the requesting user's default issuer, then the platform default. The resolved CA is frozen on the order and its renewals; a CA without platform EAB credentials is refused with 409 certificate_issuer_unavailable. An order for the same domain set that is still pending, validating or issuing refuses the new order with 409 certificate_order_in_flight. |
name | string | 否 | Names the order and the certificate it issues; trimmed. |
remark | string | 否 | Copied to the issued certificate; trimmed |
| 状态码 | 说明 |
|---|---|
202 | Pending intent stored without external side effects. 字段： |
400 | Invalid request or structurally invalid DNS/certificate data. |
401 | Authentication is required. |
403 | The active role lacks the required permission. |
404 | Resource absent or hidden by tenant isolation. |
409 | Duplicate, referenced, stale, or conflicting idempotent request. |
400 按字段说明修正参数或请求体再发；不要原样重试。401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。404 资源不存在或不属于当前租户。409 先回读资源当前状态；同一操作重试保持原 Idempotency-Key 和原请求内容。