Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Retrieve certificate detail
Returns the full Certificate read model that backs the certificate detail page: subject + issuer
identity (CN, issuer DN, origin, serial), validity window (notBefore/notAfter), key and
signature algorithms, SHA-1/SHA-256 thumbprints, subject alternative names, the auto-renew
flag, the trust chain (Leaf → Intermediate → Root), the activity feed, and key/value tags.
Private key material is never included in this response.
Validation: scopeId must be a scope the caller can read; certificateId must reference a
certificate inside that scope, otherwise 404 NOT_FOUND. No request body is accepted.
Async & state: Synchronous read; no state change.
Errors: 401 when unauthenticated; 403 when the caller lacks reader access to the scope;
404 when the scope or certificate does not exist or is soft-deleted; 500 on backend failure.
Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries
no ETag; the delete does not check If-Match.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
certificateId*stringIdentifier of the certificate.
Certificate detail read model.
application/json- response
TLS certificate read model backing the Certificates page and the certificate detail page. Contains public material and metadata only — the private key is write-only at import time and never appears here.
id*stringStable certificate identifier.
name*stringFriendly name in the vault (lowercase letters, digits, hyphens; max 64 chars).
subjectCn*stringSubject common name (primary hostname), e.g. api.acme.io.
sans*array<string>Subject alternative names (DNS names, possibly wildcards) the certificate covers.
issuer*stringFull issuer distinguished name (DN).
issuerCn*stringIssuer common name shown in lists.
status*stringLifecycle status derived from the validity window and revocation.
"valid""expiring""expired"origin*stringHow the certificate entered the vault.
"IMPORTED""MANAGED""CSR"notBefore*stringStart of the validity window (ISO 8601).
date-timenotAfter*stringEnd of the validity window (ISO 8601).
date-timeserial*stringCertificate serial number (colon-separated uppercase hex).
thumbprintSha1*stringSHA-1 thumbprint (colon-separated uppercase hex).
thumbprintSha256*stringSHA-256 thumbprint (colon-separated uppercase hex).
keyAlgorithm*stringKey algorithm of the certificate's key pair (KeyAlgo).
"RSA-2048""RSA-4096""EC-P256""AES-256"signatureAlgorithm*stringSignature algorithm identifier, e.g. SHA256-RSA or ECDSA-SHA256.
autoRenew*booleanWhether the platform renews the certificate automatically before expiry.
chain*array<>Trust chain from the leaf to a trusted root.
activity*array<>Recent lifecycle activity entries for the certificate.
tags*array<>Key/value tags for cost allocation and organization.
curl -X GET "https://example.com/scopes/string/keys/certificates/string"{ "id": "string", "name": "string", "subjectCn": "string", "sans": [ "string" ], "issuer": "string", "issuerCn": "string", "status": "valid", "origin": "IMPORTED", "notBefore": "2019-08-24T14:15:22Z", "notAfter": "2019-08-24T14:15:22Z", "serial": "string", "thumbprintSha1": "string", "thumbprintSha256": "string", "keyAlgorithm": "RSA-2048", "signatureAlgorithm": "string", "autoRenew": true, "chain": [ { "cn": "string", "kind": "Leaf" } ], "activity": [ { "id": "string", "at": "2019-08-24T14:15:22Z", "action": "string", "actor": "string", "detail": "string", "status": "SUCCESS" } ], "tags": [ { "key": "string", "value": "string" } ]}