Infisical PKI Certificate Profiles API
The PKI Certificate Profiles API from Infisical — 12 operation(s) for pki certificate profiles.
OpenAPI Specification
openapi: 3.0.3
info:
title: Infisical Admin PKI Certificate Profiles API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: PKI Certificate Profiles
paths:
/api/v1/cert-manager/certificate-profiles:
post:
operationId: createCertificateProfile
tags:
- PKI Certificate Profiles
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
caId:
type: string
format: uuid
certificatePolicyId:
type: string
format: uuid
slug:
type: string
minLength: 1
maxLength: 255
pattern: ^[a-z0-9-]+$
description:
type: string
maxLength: 1000
issuerType:
type: string
enum:
- ca
- self-signed
default: ca
externalConfigs:
anyOf:
- type: object
properties:
template:
type: string
minLength: 1
description: Certificate template name for Azure AD CS
required:
- template
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
nullable: true
defaults:
type: object
properties:
ttlDays:
type: integer
exclusiveMinimum: true
minimum: 0
commonName:
type: string
keyAlgorithm:
type: string
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_prime256v1
- EC_secp384r1
- EC_secp521r1
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
signatureAlgorithm:
type: string
enum:
- RSA-SHA256
- RSA-SHA384
- RSA-SHA512
- ECDSA-SHA256
- ECDSA-SHA384
- ECDSA-SHA512
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
keyUsages:
type: array
items:
type: string
enum:
- digital_signature
- key_encipherment
- non_repudiation
- data_encipherment
- key_agreement
- key_cert_sign
- crl_sign
- encipher_only
- decipher_only
extendedKeyUsages:
type: array
items:
type: string
enum:
- client_auth
- server_auth
- code_signing
- email_protection
- ocsp_signing
- time_stamping
basicConstraints:
type: object
properties:
isCA:
type: boolean
pathLength:
type: integer
minimum: 0
required:
- isCA
additionalProperties: false
organization:
type: string
organizationalUnit:
type: string
country:
type: string
state:
type: string
locality:
type: string
additionalProperties: false
nullable: true
required:
- certificatePolicyId
- slug
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
certificateProfile:
type: object
properties:
id:
type: string
format: uuid
caId:
type: string
format: uuid
nullable: true
certificatePolicyId:
type: string
format: uuid
slug:
type: string
description:
type: string
nullable: true
enrollmentType:
type: string
estConfigId:
type: string
format: uuid
nullable: true
apiConfigId:
type: string
format: uuid
nullable: true
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
acmeConfigId:
type: string
format: uuid
nullable: true
issuerType:
type: string
default: ca
externalConfigs:
anyOf:
- type: object
properties:
template:
type: string
minLength: 1
description: Certificate template name for Azure AD CS
required:
- template
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
nullable: true
defaults:
type: object
properties:
ttlDays:
type: number
commonName:
type: string
keyAlgorithm:
type: string
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_prime256v1
- EC_secp384r1
- EC_secp521r1
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
signatureAlgorithm:
type: string
enum:
- RSA-SHA256
- RSA-SHA384
- RSA-SHA512
- ECDSA-SHA256
- ECDSA-SHA384
- ECDSA-SHA512
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
keyUsages:
type: array
items:
type: string
enum:
- digital_signature
- key_encipherment
- non_repudiation
- data_encipherment
- key_agreement
- key_cert_sign
- crl_sign
- encipher_only
- decipher_only
extendedKeyUsages:
type: array
items:
type: string
enum:
- client_auth
- server_auth
- code_signing
- email_protection
- ocsp_signing
- time_stamping
basicConstraints:
type: object
properties:
isCA:
type: boolean
pathLength:
type: number
required:
- isCA
additionalProperties: false
organization:
type: string
organizationalUnit:
type: string
country:
type: string
state:
type: string
locality:
type: string
additionalProperties: false
nullable: true
scepConfigId:
type: string
format: uuid
nullable: true
required:
- id
- certificatePolicyId
- slug
- enrollmentType
- createdAt
- updatedAt
additionalProperties: false
required:
- certificateProfile
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
get:
operationId: listCertificateProfiles
tags:
- PKI Certificate Profiles
parameters:
- schema:
type: number
minimum: 0
default: 0
in: query
name: offset
required: false
- schema:
type: number
minimum: 1
maximum: 100
default: 20
in: query
name: limit
required: false
- schema:
type: string
in: query
name: search
required: false
- schema:
type: string
enum:
- api
- est
- acme
- scep
in: query
name: enrollmentType
required: false
- schema:
type: string
enum:
- ca
- self-signed
in: query
name: issuerType
required: false
- schema:
type: string
format: uuid
in: query
name: caId
required: false
- schema:
type: string
format: uuid
in: query
name: applicationId
required: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
certificateProfiles:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
caId:
type: string
format: uuid
nullable: true
certificatePolicyId:
type: string
format: uuid
slug:
type: string
description:
type: string
nullable: true
enrollmentType:
type: string
estConfigId:
type: string
format: uuid
nullable: true
apiConfigId:
type: string
format: uuid
nullable: true
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
acmeConfigId:
type: string
format: uuid
nullable: true
issuerType:
type: string
default: ca
externalConfigs:
anyOf:
- type: object
properties:
template:
type: string
minLength: 1
description: Certificate template name for Azure AD CS
required:
- template
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
- type: object
properties: {}
additionalProperties: false
nullable: true
defaults:
type: object
properties:
ttlDays:
type: number
commonName:
type: string
keyAlgorithm:
type: string
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_prime256v1
- EC_secp384r1
- EC_secp521r1
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
signatureAlgorithm:
type: string
enum:
- RSA-SHA256
- RSA-SHA384
- RSA-SHA512
- ECDSA-SHA256
- ECDSA-SHA384
- ECDSA-SHA512
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
keyUsages:
type: array
items:
type: string
enum:
- digital_signature
- key_encipherment
- non_repudiation
- data_encipherment
- key_agreement
- key_cert_sign
- crl_sign
- encipher_only
- decipher_only
extendedKeyUsages:
type: array
items:
type: string
enum:
- client_auth
- server_auth
- code_signing
- email_protection
- ocsp_signing
- time_stamping
basicConstraints:
type: object
properties:
isCA:
type: boolean
pathLength:
type: number
required:
- isCA
additionalProperties: false
organization:
type: string
organizationalUnit:
type: string
country:
type: string
state:
type: string
locality:
type: string
additionalProperties: false
nullable: true
scepConfigId:
type: string
format: uuid
nullable: true
certificateAuthority:
type: object
properties:
id:
type: string
status:
type: string
name:
type: string
isExternal:
type: boolean
externalType:
type: string
nullable: true
required:
- id
- status
- name
additionalProperties: false
metrics:
type: object
properties:
profileId:
type: string
totalCertificates:
type: number
activeCertificates:
type: number
expiredCertificates:
type: number
expiringCertificates:
type: number
revokedCertificates:
type: number
required:
- profileId
- totalCertificates
- activeCertificates
- expiredCertificates
- expiringCertificates
- revokedCertificates
additionalProperties: false
estConfig:
type: object
properties:
id:
type: string
disableBootstrapCaValidation:
type: boolean
passphrase:
type: string
caChain:
type: string
required:
- id
- disableBootstrapCaValidation
additionalProperties: false
apiConfig:
type: object
properties:
id:
type: string
autoRenew:
type: boolean
renewBeforeDays:
type: number
required:
- id
- autoRenew
additionalProperties: false
acmeConfig:
type: object
properties:
id:
type: string
directoryUrl:
type: string
skipDnsOwnershipVerification:
type: boolean
skipEabBinding:
type: boolean
required:
- id
- directoryUrl
additionalProperties: false
scepConfig:
type: object
properties:
id:
type: string
scepEndpointUrl:
type: string
raCertificatePem:
type: string
raCertExpiresAt:
type: string
format: date-time
includeCaCertInResponse:
type: boolean
allowCertBasedRenewal:
type: boolean
challengeType:
type: string
challengeEndpointUrl:
type: string
dynamicChallengeExpiryMinutes:
type: number
dynamicChallengeMaxPending:
type: number
required:
- id
- scepEndpointUrl
- raCertificatePem
- raCertExpiresAt
- includeCaCertInResponse
- allowCertBasedRenewal
- challengeType
# --- truncated at 32 KB (219 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/infisical/refs/heads/main/openapi/infisical-pki-certificate-profiles-api-openapi.yml