Cisco Identity Services Engine Endpointcertificate API

openapi: 3.2.0
info:
  description: 'Endpoint Certificate API allows the client to create endpoint certificates signed by the Cisco ISE Internal CA. This API can takes in certificate request details, create a RSA key pair, create a certificate and return the resulting key pair and certificate as a ZIP file. ZIP files are returned as an octet stream.



    <h2>Revision History</h2>

    <table font-family:monospace>

    <tr valign=top style=''border:solid #CCCCCC 1.0pt;mso-border-alt:solid #CCCCCC .75pt;background:#DEEDF7''><td><b>Revision #</b></td><td><b>Resource Version</b></td><td><b>Cisco ISE Version</b></td><td><b>Description</b></td></tr>

    <tr style= ''border-bottom:solid #CCCCCC 1.0pt''><td>0</td><td>1.0</td><td>2.0</td><td>Initial Cisco ISE Version</td></tr>

    </table>

    <br><br>


    <h2>Resource Definition</h2>

    <table>

    <tr valign=top style=''border:solid #CCCCCC 1.0pt;mso-border-alt:solid #CCCCCC .75pt;background:#DEEDF7''><td><b>Attribute</b></td><td><b>Type</b></td><td><b>Required</b></td><td><b>Description</b></td><td><b>Example Values</b></td></tr>

    <tr><td style=''font-family:monospace''>name</td><td>String</td><td>Yes</td><td>Resource Name</td><td></td></tr>

    <tr valign=top style=''background:#f8f8f8''><td style=''font-family:monospace''>id</td><td>String</td><td>No</td><td>Resource UUID, mandatory for update</td><td></td></tr>

    <tr><td style=''font-family:monospace''>description</td><td>String</td><td>No</td><td>Resource Description</td><td></td></tr>

    <tr valign=top style=''background:#f8f8f8''><td style=''font-family:monospace''>certTemplateName</td><td>String</td><td>Yes</td><td>Name of an Internal CA template</td><td>Certificate_Template_Name</td></tr>

    <tr><td style=''font-family:monospace''>format</td><td>Enum</td><td>Yes</td><td>Allowed values: <br>- PKCS12,<br>- PKCS12_CHAIN,<br>- PKCS8,<br>- PKCS8_CHAIN</td><td>PKCS8</td></tr>

    <tr valign=top style=''background:#f8f8f8''><td style=''font-family:monospace''>password</td><td>String</td><td>Yes</td><td>Protects the private key. Must have more than 8 characters, less than 15 characters, at least one upper case letter, at least one lower case letter, at least one digit, and can only contain [A-Z][a-z][0-9]_#</td><td>Password_123</td></tr>

    <tr><td style=''font-family:monospace''>certificateRequest</td><td>Map</td><td>Yes</td><td>Key value map. Must have CN and SAN entries</td><td></td></tr>

    <tr><td style=''font-family:monospace''>- CN</td><td>String</td><td>Yes</td><td>Matches the requester''s User Name, unless the Requester is an ERS Admin. ERS Admins are allowed to create requests for any CN</td><td>userName [or] machineName</td></tr>

    <tr style= ''border-bottom:solid #CCCCCC 1.0pt''><td style=''font-family:monospace''>- SAN</td><td>String</td><td>Yes</td><td>Valid MAC Address, delimited by ''-''</td><td>11-22-33-44-55-66</td></tr>

    </table>

    '
  version: 1.0.0
  title: Endpoint Certificate Endpointcertificate API
  x-provenance:
    method: harvested
    authored_by: Cisco
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 103 ISE API descriptions (1,490 operations; 32 OpenAPI 3.0.x + 71 Swagger 2.0) enumerated from Cisco's own DevNet project manifest and fetched anonymously. Byte-identity reconfirmed 2026-08-19 by SHA-256 against the live source.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/identity-services-engine-api-v1/docs/
  - type: source
    url: https://developer.cisco.com/docs/identity-services-engine/
tags:
- name: endpointcertificate
paths:
  /ers/config/endpointcert/certRequest:
    put:
      tags:
      - endpointcertificate
      summary: Create endpoint certificate
      description: <p>This API allows the client to create an endpoint certificate.</p>
      parameters:
      - in: header
        name: HTTP ERS-Media-Type Header
        description: Example:- ca.endpointcert.1.0
        required: false
        schema:
          type: string
      - in: header
        name: HTTP X-CSRF-TOKEN Header
        description: Required Only if Enabled from GUI Example:- fetch
        schema:
          type: string
      - in: header
        name: Additional Information
        description: <table> <tr><td>CertTemplateName</td><td>(Required)</td><td>Must be the name of an Internal CA template</td></tr> <tr><td>CertificateRequest</td><td>(Required)</td><td>Must have CN and SAN entries</td></tr> <tr><td>CN</td><td>(Required)</td><td>Must match the requester's User Name, unless the Requester is an ERS Admin. ERS Admins are allowed to create requests for any CN</td></tr> <tr><td>SAN</td><td>(Required)</td><td>Must be a valid MAC Address, delimited by '-'</td></tr> <tr><td>Format</td><td>(Required)</td><td>Must be one of either PKCS12, PKCS12_CHAIN, PKCS8, or PKCS8_CHAIN</td></tr> <tr><td>Password</td><td>(Required)</td><td>Protects the private key. Must have more than 8 characters, less than 15 characters, at least one upper case letter, at least one lower case letter, at least one digit, and can only contain [A-Z][a-z][0-9]_#</td></tr> </table>
        schema:
          type: string
      responses:
        200:
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/endpointcert'
          application/xml:
            schema:
              $ref: '#/components/schemas/endpointcert'
  /ers/config/endpointcert/versioninfo:
    get:
      tags:
      - endpointcertificate
      summary: Get endpoint certificate version information
      description: <p>This API helps to retrieve the version information related to the endpoint certificate.</p>
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VersionInfo'
components:
  schemas:
    VersionInfo:
      type: object
      properties:
        VersionInfo:
          $ref: '#/components/schemas/version'
    ERSEndPointCert:
      properties:
        certTemplateName:
          type: string
          example: Certificate_Template_Name
        format:
          type: string
          example: PKCS8
        password:
          type: string
          example: Password_123
        certificateRequest:
          type: object
          properties:
            customAttributes:
              type: object
              properties:
                san:
                  type: string
                  example: 11-22-33-44-55-66
                cn:
                  type: string
                  example: userName [or] machineName
    version:
      type: object
      properties:
        currentServerVersion:
          type: string
          example: '1.0'
        supportedVersions:
          type: string
          example: '1.0'
        link:
          $ref: '#/components/schemas/link1'
    endpointcert:
      type: object
      properties:
        ERSEndPoint:
          $ref: '#/components/schemas/ERSEndPointCert'
    link1:
      type: object
      properties:
        rel:
          type: string
          example: self
        href:
          type: string
          example: https://<ise-ip>:9060/ers/config/endpointcert/versioninfo
        type:
          type: string
          example: application/json