Operation details
GET /v1/certificate-assets
List active certificate assets
- operationId
listCertificateAssets- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.read
Description (from the contract)
Tenant sessions target their own scope. Platform sessions retain their platform actor scope. Only this collection GET may omit target_scope_id to list assets across active tenants, with live certificates.read authorization. An explicit target limits the collection to that tenant. Detail and write operations still require an explicit platform target.
Parameters
listCertificateAssets Parameters| Name | In | Type | Required | Description |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
page | query | integer | No | — |
|---|
limit | query | integer | No | — |
|---|
search | query | string | No | — |
|---|
status | query | string: normal / expiring / expired / auto_renew / manual_renew | No | normal/expiring/expired by the latest version (expiring: active or default and expiring within 30 days; expired: not_after passed); auto_renew/manual_renew by whether an auto-renewing order issued the asset. |
|---|
domain | query | string | No | Advanced search (CERT-05); every advanced filter narrows items, total and counts alike. A SAN of any version contains it, case-insensitive. |
|---|
domains | query | string | No | Comma-separated domains; the latest version's SANs contain every one exactly (case-insensitive). At most 100. |
|---|
user | query | string | No | The recorded owner's display ID, username, email or phone contains it. |
|---|
certificate_id | query | string | No | The asset display ID contains it. |
|---|
name | query | string | No | — |
|---|
remark | query | string | No | — |
|---|
source | query | string: uploaded / acme | No | — |
|---|
dns_provider_id | query | string(uuid) | No | The DNS provider of the order that issued the asset. |
|---|
expiry | query | string: within30 / within90 / expired | No | within30/within90 are latest versions in force (active or default, not expired) expiring within 30/90 days; expired is a passed not_after. Expired assets are never within30/within90. |
|---|
auto_renew | query | string: true / false | No | Whether an auto-renewing order issued the asset. |
|---|
issue | query | string: issued / failed | No | issued is an asset issued by an order; failed is an asset whose issuing order or one of its renewal orders failed. |
|---|
sync | query | string: complete / pending / failed | No | Publication of the asset's current site bindings; failed when one permanently failed, complete when every one succeeded and its apply rollout has every node deployment healthy, pending otherwise. An unbound asset matches none. |
|---|
X-Request-ID | header | string | No | — |
|---|
Responses
listCertificateAssets Responses| Status | Description |
|---|
200 | Certificate assets Fields：items: array<CertificateAsset> total: integer(int64) counts: object |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
405 | Method not allowed |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
POST /v1/certificate-assets
Upload a certificate and private key
- operationId
uploadCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Description (from the contract)
Requires certificates.manage. The private key crosses this request boundary once, is encrypted by the certificate store, and is never returned in a response. Exact replay uses the same request body, X-Request-ID and Idempotency-Key without adding facts. owner_user_id records an active member of the target tenant and is immutable. Tenant uploads default to the actor and cannot assign another user. For compatibility, platform clients may omit owner_user_id; these assets remain legacy_unknown. The admin UI requires explicit ownership. Omitted-owner legacy requests retain their original idempotency digest and receipt ownership.
Parameters
uploadCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
uploadCertificateAsset Request body| Name | Type | Required | Description |
|---|
owner_user_id | string(uuid) | No | Active target-tenant member. Immutable after creation. Tenant actors may only select themselves; omitted platform ownership stays unknown for legacy clients. |
|---|
name | string | Yes | — |
|---|
remark | string | No | Optional; trimmed, no control characters. Part of the idempotency digest. |
|---|
certificate_pem | string | Yes | — |
|---|
private_key_pem | string | Yes | Never returned by this API. |
|---|
Responses
uploadCertificateAsset Responses| Status | Description |
|---|
201 | Certificate asset created or exactly replayed Fields：asset: CertificateAsset versions: array<CertificateAssetVersion> |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
503 | Certificate private-key envelope service unavailable |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
GET /v1/certificate-assets/{asset_id}
Get a certificate asset and its public versions
- operationId
getCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.read
Description (from the contract)
Private-key plaintext, ciphertext and envelope metadata are never returned.
Parameters
getCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | No | — |
|---|
Responses
getCertificateAsset Responses| Status | Description |
|---|
200 | Certificate asset detail Fields：asset: CertificateAsset versions: array<CertificateAssetVersion> |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
DELETE /v1/certificate-assets/{asset_id}
Soft-delete an unreferenced certificate asset
- operationId
deleteCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Parameters
deleteCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
deleteCertificateAsset Request body| Name | Type | Required | Description |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
Responses
deleteCertificateAsset Responses| Status | Description |
|---|
200 | Certificate asset Fields：id: string(uuid) display_id: string tenant_scope_id: string(uuid) tenant: CertificateAssetTenant owner: CertificateAssetOwner | null owner_status: string: recorded / legacy_unknown name: string remark?: string source: string: uploaded / acme auto_renew: boolean disabled: boolean revision: integer(int64) created_by: string(uuid) created_by_display_id: string updated_by: string(uuid) updated_by_display_id: string created_at: string(date-time) updated_at: string(date-time) deleted_at?: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
PATCH /v1/certificate-assets/{asset_id}/auto-renew
Turn automatic renewal of an ACME certificate on or off
- operationId
setCertificateAssetAutoRenew- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Description (from the contract)
Renewal intent lives on the certificate asset; the issuing order's auto_renew stays an immutable snapshot. Uploaded certificates return 409 certificate_asset_auto_renew_unsupported. Audited as certificate.auto_renew.update.
Parameters
setCertificateAssetAutoRenew Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
setCertificateAssetAutoRenew Request body| Name | Type | Required | Description |
|---|
enabled | boolean | Yes | — |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
Responses
setCertificateAssetAutoRenew Responses| Status | Description |
|---|
200 | Certificate asset Fields：id: string(uuid) display_id: string tenant_scope_id: string(uuid) tenant: CertificateAssetTenant owner: CertificateAssetOwner | null owner_status: string: recorded / legacy_unknown name: string remark?: string source: string: uploaded / acme auto_renew: boolean disabled: boolean revision: integer(int64) created_by: string(uuid) created_by_display_id: string updated_by: string(uuid) updated_by_display_id: string created_at: string(date-time) updated_at: string(date-time) deleted_at?: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
GET /v1/certificate-assets/{asset_id}/bindings
List current site bindings for one certificate asset
- operationId
listCertificateAssetBindings- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.read
Parameters
listCertificateAssetBindings Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | No | — |
|---|
Responses
listCertificateAssetBindings Responses| Status | Description |
|---|
200 | Current certificate asset bindings Fields：items: array<CertificateAssetBinding> |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
POST /v1/certificate-assets/{asset_id}/bindings
Bind an active version to a tenant site
- operationId
bindCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Parameters
bindCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
bindCertificateAsset Request body| Name | Type | Required | Description |
|---|
site_id | string(uuid) | Yes | — |
|---|
version_id | string(uuid) | Yes | — |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
default | boolean | Yes | — |
|---|
Responses
bindCertificateAsset Responses| Status | Description |
|---|
200 | Current binding fact Fields：tenant_scope_id: string(uuid) site_id: string(uuid) asset_id: string(uuid) version_id: string(uuid) revision: integer(int64) default: boolean bound: boolean changed_by: string(uuid) changed_at: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
DELETE /v1/certificate-assets/{asset_id}/bindings/{site_id}
Append an immutable site unbind fact
- operationId
unbindCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Parameters
unbindCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
unbindCertificateAsset Request body| Name | Type | Required | Description |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
Responses
unbindCertificateAsset Responses| Status | Description |
|---|
200 | Current binding fact Fields：tenant_scope_id: string(uuid) site_id: string(uuid) asset_id: string(uuid) version_id: string(uuid) revision: integer(int64) default: boolean bound: boolean changed_by: string(uuid) changed_at: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
PATCH /v1/certificate-assets/{asset_id}/disabled
Disable or re-enable a certificate
- operationId
setCertificateAssetDisabled- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Description (from the contract)
fix-certops. A disabled certificate cannot be bound to a site and is not auto-renewed. A certificate still bound to a site returns 409 certificate_asset_referenced; binding a disabled one returns 409 certificate_asset_disabled. Audited as certificate.asset.disable / certificate.asset.enable.
Parameters
setCertificateAssetDisabled Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
setCertificateAssetDisabled Request body| Name | Type | Required | Description |
|---|
disabled | boolean | Yes | — |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
Responses
setCertificateAssetDisabled Responses| Status | Description |
|---|
200 | Certificate asset Fields：id: string(uuid) display_id: string tenant_scope_id: string(uuid) tenant: CertificateAssetTenant owner: CertificateAssetOwner | null owner_status: string: recorded / legacy_unknown name: string remark?: string source: string: uploaded / acme auto_renew: boolean disabled: boolean revision: integer(int64) created_by: string(uuid) created_by_display_id: string updated_by: string(uuid) updated_by_display_id: string created_at: string(date-time) updated_at: string(date-time) deleted_at?: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list
GET /v1/certificate-assets/{asset_id}/download
Download the current certificate version with its private key
- operationId
downloadCertificateAsset- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Description (from the contract)
fix-certops 下载证书. A zip with fullchain.pem (certificate chain) and privkey.pem (PKCS#8 PEM) of the latest activated version. Requires certificates.manage; a tenant downloads only its own certificates. Audited as certificate.asset.download in the same transaction before the key is returned. A revoked current version returns 409 certificate_asset_download_unavailable.
Parameters
downloadCertificateAsset Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Responses
downloadCertificateAsset Responses| Status | Description |
|---|
200 | Certificate zip (Content-Disposition attachment, named after the primary domain). |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
500 | Sanitized internal failure |
|---|
503 | Private key envelope unavailable (certificate_asset_envelope_unavailable) |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
POST /v1/certificate-assets/{asset_id}/versions/{version_id}/activate
Atomically activate one immutable certificate version
- operationId
activateCertificateAssetVersion- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：certificates.manage
Parameters
activateCertificateAssetVersion Parameters| Name | In | Type | Required | Description |
|---|
asset_id | path | string(uuid) | Yes | — |
|---|
version_id | path | string(uuid) | Yes | — |
|---|
target_scope_id | query | string(uuid) | No | Required for platform detail and write operations; optional for the collection GET to list active tenants. Forbidden when it differs from a tenant actor scope. |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | Retry an unknown result only with this exact key and unchanged request. |
|---|
Request body
application/json · Required：Yes
activateCertificateAssetVersion Request body| Name | Type | Required | Description |
|---|
expected_revision | integer(int64) | Yes | — |
|---|
Responses
activateCertificateAssetVersion Responses| Status | Description |
|---|
200 | Certificate asset version Fields：id: string(uuid) asset_id: string(uuid) tenant_scope_id: string(uuid) version: integer(int64) status: string: default / pending_activation / active / superseded / revoked / expired fingerprint_sha256: string certificate_pem: string(byte) sans: array<string> subject: string serial_number: string public_key_algorithm: string public_key_bits: integer signature_algorithm: string not_before: string(date-time) not_after: string(date-time) acme_order_id?: string(uuid) renewal_due_at?: string(date-time) renewal_due: boolean imported_by: string(uuid) imported_at: string(date-time) |
|---|
400 | Invalid request, metadata or certificate material |
|---|
401 | Bearer session missing or invalid |
|---|
403 | Tenant scope or live permission denied |
|---|
404 | Certificate asset or version not found |
|---|
405 | Method not allowed |
|---|
409 | Revision, idempotency, reference or lifecycle conflict |
|---|
413 | Request body exceeds 384 KiB |
|---|
415 | Content-Type is not application/json with optional UTF-8 charset |
|---|
500 | Sanitized internal failure |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.500 Outcome unknown: read back by ID or list first, then decide whether to retry with the original Idempotency-Key.
↑ Back to list