Canonical Certificates API

The certificates API from Canonical — 4 operation(s) for certificates.

Documentation GitHub OpenAPI

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /1.0/certificates List trusted client certificates · Get a list of certificates #

Ask an LLM

“Which client certificates are trusted by this server?”

“Can I get the list of trusted certificate URLs?”

Tell an agent

List the trusted client certificates.

Show the fingerprints of every trusted client.

POST /1.0/certificates Trust a new client certificate · Add a new client certificate #

Ask an LLM

“How do I add a new trusted client by its certificate?”

“Can a client be trusted using the trust password?”

Tell an agent

Add client certificate {certificate} to the trust store.

Trust the certificate {certificate} using trust password {password}.

GET /1.0/certificates/{fingerprint} Get a trusted certificate · Get the information about a certificate #

Ask an LLM

“What details are stored for a trusted certificate?”

“Can I look up a client certificate by its fingerprint?”

Tell an agent

Show the trusted certificate {fingerprint}.

Get the details for certificate fingerprint {fingerprint}.

DELETE /1.0/certificates/{fingerprint} Remove a trusted certificate · Delete a client's trusted certificate #

Ask an LLM

“How do I revoke a client's trust on this server?”

“What happens when I delete a certificate from the trust store?”

Tell an agent destructive · confirm first

Delete trusted certificate {fingerprint}.

Revoke trust for the client with fingerprint {fingerprint}.

PATCH /1.0/certificates/{fingerprint} Update some fields of a trusted certificate · Partially update the trusted certificate #

Ask an LLM

“Can I just rename a trusted certificate without changing anything else?”

“Is there a partial update to restrict a certificate to certain projects?”

Tell an agent

Rename trusted certificate {fingerprint} to {name}.

Patch the certificate to be restricted to projects {projects}.

PUT /1.0/certificates/{fingerprint} Replace a trusted certificate's configuration · Update the trusted certificate #

Ask an LLM

“How do I overwrite all settings of a trusted certificate?”

“Can I fully redefine which projects a certificate is restricted to?”

Tell an agent

Replace the certificate's configuration with name {name}, restricted {restricted} and projects {projects}.

Overwrite the whole trusted certificate entry {fingerprint} with type {type}.

GET /1.0/certificates?recursion=1 List trusted certificates with details · Get a list of expanded certificates #

Ask an LLM

“Can I list trusted certificates with all their fields expanded?”

“Which call returns full certificate objects instead of URLs?”

Tell an agent

List all trusted certificates with full details.

Show each trusted certificate's name, type and restrictions in one response.

POST /1.0/certificates?public Add a certificate as an untrusted client · Add a trusted certificate #

Ask an LLM

“How does a client that isn't trusted yet add itself using a token?”

“Can a new client register its own TLS certificate with a trust token?”

Tell an agent

Add my client certificate using trust token {trust_token}.

Register certificate {certificate} as {name} with token {token}.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/canonical:canonical-certificates-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Canonical Certificates API
  version: '1.0'
  description: 'Operations tagged certificates across 2 of this provider''s published API definitions: canonical-anbox-cloud-ams-api-openapi.json, canonical-lxd-rest-api-openapi.yml. Each path carries the servers of the definition it was published in.'
tags:
- name: Certificates
paths:
  /1.0/certificates:
    get:
      description: This endpoint returns a list of certificates of trusted clients
      tags:
      - Certificates
      summary: Get a list of certificates
      operationId: certificates_get
      parameters:
      - description: Expand the returned resource definition
        name: recursion
        in: query
        schema:
          type: integer
          enum:
          - 0
          - 1
          default: 0
      responses:
        '200':
          description: Success response of the service
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/CollectionResponse'
                properties:
                  metadata:
                    description: List of endpoints
                    type: array
                    items:
                      type: string
                    example: "[\n  \"/1.0/certificates/b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9\",\n  \"/1.0/certificates/a52c80e8337d3e08a52e52c6aa25ecfac473eae34a4880ed0088b9dbc2fagcd5\"\n]"
        default:
          $ref: '#/components/responses/InternalServerError'
    post:
      description: 'This endpoint adds a new trusted client to the service by adding a new

        client certificate.'
      tags:
      - Certificates
      summary: Add a new client certificate
      operationId: certificates_post
      responses:
        '202':
          description: Success response of the service
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperationResponse'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '409':
          $ref: '#/components/responses/ErrorAlreadyExists'
        default:
          $ref: '#/components/responses/InternalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatesPost'
        description: Details of the certificate to create
        required: true
  /1.0/certificates/{fingerprint}:
    get:
      description: 'The endpoint gets the information of a trusted client''s certificate and its

        fingerprint.'
      tags:
      - Certificates
      summary: Get the information about a certificate
      operationId: certificate_get
      parameters:
      - description: SHA-256 fingerprint of the certificate to retrieve
        name: fingerprint
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success response of the service
          headers:
            Etag:
              description: E-Tag of the resource
              schema:
                type: string
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/NoMetaSyncResponse'
                properties:
                  metadata:
                    $ref: '#/components/schemas/Certificate'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '404':
          $ref: '#/components/responses/ErrorNotFound'
        default:
          $ref: '#/components/responses/InternalServerError'
    delete:
      description: 'This endpoint deletes a client''s trusted certificate from the service''s

        trust store.'
      tags:
      - Certificates
      summary: Delete a client's trusted certificate
      operationId: certificate_delete
      parameters:
      - description: SHA-256 fingerprint of the certificate
        name: fingerprint
        in: path
        required: true
        schema:
          type: string
      responses:
        '202':
          description: Success response of the service
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperationResponse'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '404':
          $ref: '#/components/responses/ErrorNotFound'
        default:
          $ref: '#/components/responses/InternalServerError'
    patch:
      description: Updates a subset of the certificate configuration.
      operationId: certificate_patch
      responses:
        '200':
          $ref: '#/components/responses/EmptySyncResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '500':
          $ref: '#/components/responses/InternalServerError_2'
      summary: Partially update the trusted certificate
      tags:
      - Certificates
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatePut'
        description: Certificate configuration
        required: true
    put:
      description: Updates the entire certificate configuration.
      operationId: certificate_put
      responses:
        '200':
          $ref: '#/components/responses/EmptySyncResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '500':
          $ref: '#/components/responses/InternalServerError_2'
      summary: Update the trusted certificate
      tags:
      - Certificates
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatePut'
        description: Certificate configuration
        required: true
  /1.0/certificates?recursion=1:
    get:
      description: This endpoint returns a list of certificates of trusted clients.
      tags:
      - Certificates
      summary: Get a list of expanded certificates
      operationId: certificates_get_recursion1
      parameters:
      - description: Expand the returned resource definition
        name: recursion
        in: query
        schema:
          type: integer
          enum:
          - 0
          - 1
          default: 0
      responses:
        '200':
          description: Success response of the service
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/CollectionResponse'
                properties:
                  metadata:
                    type: array
                    items:
                      $ref: '#/components/schemas/Certificate'
        default:
          $ref: '#/components/responses/InternalServerError'
  /1.0/certificates?public:
    post:
      description: 'Adds a certificate to the trust store as an untrusted user.

        In this mode, the `token` property must be set to the correct value.


        The `certificate` field can be omitted in which case the TLS client

        certificate in use for the connection will be retrieved and added to the

        trust store.


        The `?public` part of the URL isn''t required, it''s simply used to

        separate the two behaviors of this endpoint.'
      operationId: certificates_post_untrusted
      responses:
        '200':
          $ref: '#/components/responses/EmptySyncResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError_2'
      summary: Add a trusted certificate
      tags:
      - Certificates
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatesPost_2'
        description: Certificate
        required: true
components:
  schemas:
    Operation:
      description: Operation represents a background operation
      type: object
      properties:
        class:
          description: Class of the operation
          type: string
          enum:
          - task
          - websocket
          - token
          example: task
        created_at:
          description: When the operation was created
          type: string
          format: date-time
        description:
          description: Human readable description of the operation
          type: string
          example: updating addon 3apqo5te
        err:
          description: The error string if the operation failed
          type: string
        id:
          description: UUID of the operation
          type: string
          example: c6832c58-0867-467e-b245-2962d6527876
        may_cancel:
          description: Whether this operation can be canceled (DELETE over REST)
          type: boolean
          example: false
        metadata:
          description: Metadata related to the operation and affected resources
          type: object
          additionalProperties: {}
          example: {}
        resources:
          description: 'Dictionnary of resource types (containers, snapshots, images)

            and affected resources'
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          example:
            applications:
            - /1.0/applications/my-app
        server_address:
          description: The address of the server where the operation ran
          type: string
          format: ipv4
        status:
          description: String version of the operation status
          type: string
          example: Running
        status_code:
          $ref: '#/components/schemas/StatusCode'
        updated_at:
          description: When the operation was updated
          type: string
          format: date-time
    CollectionResponse:
      description: Collection Response
      allOf:
      - $ref: '#/components/schemas/NoMetaSyncResponse'
      - type: object
        properties:
          total_size:
            description: Total Count of the collection
            type: integer
            format: int64
            example: 99
    CertificatesPost:
      description: CertificatesPost represents the fields of a new auth provided certificate
      type: object
      properties:
        certificate:
          description: Base64 encoded certificate content without the header or the footer
          type: string
          example: MIIFUTCCAzmgAw...xjKoUEEQOzJ9
        trust-password:
          description: TrustPassword is used to register a new client with the service
          type: string
          example: sUp3rs3cr3t
    StatusCode:
      description: StatusCode represents a valid REST operation
      type: integer
      format: int64
    OperationResponse:
      description: Operation
      type: object
      properties:
        metadata:
          $ref: '#/components/schemas/Operation'
        operation:
          type: string
          example: /1.0/operations/66e83638-9dd7-4a26-aef2-5462814869a1
        status:
          type: string
          example: Operation created
        status_code:
          type: integer
          format: int64
          example: 100
        type:
          type: string
          example: async
    NoMetaSyncResponse:
      description: Swagger Synchronous response without metadata field
      type: object
      properties:
        error_code:
          description: Error code for the operation
          type: integer
          format: int64
          example: 0
        status:
          description: Status of requested operation
          type: string
          example: Success
        status_code:
          description: Status code of the request
          type: integer
          format: int64
          example: 200
        type:
          description: Type of operation response
          type: string
          example: sync
    Certificate:
      description: Certificate represents an available client certificate
      type: object
      properties:
        certificate:
          description: Base64 encoded certificate content without the header or the footer
          type: string
          example: MIIFUTCCAzmgAw...xjKoUEEQOzJ9
        fingerprint:
          description: SHA-256 fingerprint of the certificate
          type: string
          example: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
    CertificatesPost_2:
      description: CertificatesPost represents the fields of a new LXD certificate
      properties:
        certificate:
          description: 'The certificate itself, as base64 encoded X509 PEM certificate


            API extension: certificate_self_renewal'
          example: base64 encoded X509 PEM certificate
          type: string
          x-go-name: Certificate
        name:
          description: Name associated with the certificate
          example: castiana
          type: string
          x-go-name: Name
        password:
          description: 'Server trust password (used to add an untrusted client, deprecated, use trust_token)


            Deprecated: Use TrustToken.'
          example: blah
          type: string
          x-deprecated: true
          x-go-name: Password
        projects:
          description: 'List of allowed projects (applies when restricted)


            API extension: certificate_project'
          example:
          - default
          - foo
          - bar
          items:
            type: string
          type: array
          x-go-name: Projects
        restricted:
          description: 'Whether to limit the certificate to listed projects


            API extension: certificate_project'
          example: true
          type: boolean
          x-go-name: Restricted
        token:
          description: 'Whether to create a certificate add token


            API extension: certificate_token'
          example: true
          type: boolean
          x-go-name: Token
        trust_token:
          description: 'Trust token (used to add an untrusted client)


            API extension: explicit_trust_token'
          example: blah
          type: string
          x-go-name: TrustToken
        type:
          description: Usage type for the certificate
          example: client
          type: string
          x-go-name: Type
      type: object
      x-go-package: github.com/canonical/lxd/shared/api
    CertificatePut:
      description: CertificatePut represents the modifiable fields of a LXD certificate
      properties:
        certificate:
          description: 'The certificate itself, as PEM encoded X509 certificate


            API extension: certificate_self_renewal'
          example: X509 PEM certificate
          type: string
          x-go-name: Certificate
        name:
          description: Name associated with the certificate
          example: castiana
          type: string
          x-go-name: Name
        projects:
          description: 'List of allowed projects (applies when restricted)


            API extension: certificate_project'
          example:
          - default
          - foo
          - bar
          items:
            type: string
          type: array
          x-go-name: Projects
        restricted:
          description: 'Whether to limit the certificate to listed projects


            API extension: certificate_project'
          example: true
          type: boolean
          x-go-name: Restricted
        type:
          description: Usage type for the certificate
          example: client
          type: string
          x-go-name: Type
      type: object
      x-go-package: github.com/canonical/lxd/shared/api
    Certificate_2:
      description: Certificate represents a LXD certificate
      properties:
        access_entitlements:
          description: AccessEntitlements represents the entitlements that are granted to the requesting user on the attached entity.
          example:
          - can_view
          - can_edit
          items:
            type: string
          type: array
          x-go-name: AccessEntitlements
        certificate:
          description: 'The certificate itself, as PEM encoded X509 certificate


            API extension: certificate_self_renewal'
          example: X509 PEM certificate
          type: string
          x-go-name: Certificate
        fingerprint:
          description: SHA256 fingerprint of the certificate
          example: fd200419b271f1dc2a5591b693cc5774b7f234e1ff8c6b78ad703b6888fe2b69
          readOnly: true
          type: string
          x-go-name: Fingerprint
        name:
          description: Name associated with the certificate
          example: castiana
          type: string
          x-go-name: Name
        projects:
          description: 'List of allowed projects (applies when restricted)


            API extension: certificate_project'
          example:
          - default
          - foo
          - bar
          items:
            type: string
          type: array
          x-go-name: Projects
        restricted:
          description: 'Whether to limit the certificate to listed projects


            API extension: certificate_project'
          example: true
          type: boolean
          x-go-name: Restricted
        type:
          description: Usage type for the certificate
          example: client
          type: string
          x-go-name: Type
      type: object
      x-go-package: github.com/canonical/lxd/shared/api
  responses:
    ErrorNotFound:
      description: Not found
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                example: not found
              error_code:
                type: integer
                format: int64
                example: 404
              type:
                type: string
                example: error
    ErrorAlreadyExists:
      description: Already Exists
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                example: already exists
              error_code:
                type: integer
                format: int64
                example: 409
              type:
                type: string
                example: error
    ErrorForbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                example: Not Authorized
              error_code:
                type: integer
                format: int64
                example: 403
              type:
                type: string
                example: error
    InternalServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                example: internal server error
              error_code:
                type: integer
                format: int64
                example: 500
              metadata:
                example: '{}'
              type:
                type: string
                example: error
    ErrorBadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                example: bad request
              error_code:
                type: integer
                format: int64
                example: 400
              metadata:
                example: '{}'
              type:
                type: string
                example: error
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            properties:
              error:
                example: bad request
                type: string
                x-go-name: Error
              error_code:
                example: 400
                format: int64
                type: integer
                x-go-name: ErrorCode
              type:
                example: error
                type: string
                x-go-name: Type
            type: object
    EmptySyncResponse:
      description: Empty sync response
      content:
        application/json:
          schema:
            properties:
              status:
                example: Success
                type: string
                x-go-name: Status
              status_code:
                example: 200
                format: int64
                type: integer
                x-go-name: StatusCode
              type:
                example: sync
                type: string
                x-go-name: Type
            type: object
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            properties:
              error:
                example: not authorized
                type: string
                x-go-name: Error
              error_code:
                example: 403
                format: int64
                type: integer
                x-go-name: ErrorCode
              type:
                example: error
                type: string
                x-go-name: Type
            type: object
    InternalServerError_2:
      description: Internal Server Error
      content:
        application/json:
          schema:
            properties:
              error:
                example: internal server error
                type: string
                x-go-name: Error
              error_code:
                example: 500
                format: int64
                type: integer
                x-go-name: ErrorCode
              type:
                example: error
                type: string
                x-go-name: Type
            type: object
    PreconditionFailed:
      description: Precondition Failed
      content:
        application/json:
          schema:
            properties:
              error:
                example: precondition failed
                type: string
                x-go-name: Error
              error_code:
                example: 412
                format: int64
                type: integer
                x-go-name: ErrorCode
              type:
                example: error
                type: string
                x-go-name: Type
            type: object
x-refined-from:
- canonical-anbox-cloud-ams-api-openapi.json
- canonical-lxd-rest-api-openapi.yml

Canonical Certificates API

Operations 8

Documentation

Specifications

Schemas & Data

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification