Infisical PKI Certificates API
The PKI Certificates API from Infisical — 26 operation(s) for pki certificates.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/infisical-pki-certificates-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Infisical Admin PKI Certificates API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: PKI Certificates
paths:
/api/v1/projects/{projectId}/certificates/search:
post:
operationId: searchProjectCertificates
tags:
- PKI Certificates
description: Search and filter certificates within a project.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
friendlyName:
type: string
description: The friendly name of the certificate to filter by.
commonName:
type: string
description: The common name of the certificate to filter by.
offset:
type: number
minimum: 0
default: 0
description: The offset to start from. If you enter 10, it will start from the 10th certificate.
limit:
type: number
minimum: 1
maximum: 100
default: 25
description: The number of certificates to return.
forPkiSync:
type: boolean
default: false
description: Retrieve only certificates available for PKI sync.
search:
type: string
description: Search by SAN, CN, certificate ID, or serial number.
status:
type: string
description: Filter by certificate status.
profileIds:
type: array
items:
type: string
format: uuid
description: Filter by certificate profile IDs.
fromDate:
type: string
format: date-time
description: Filter certificates created from this date.
toDate:
type: string
format: date-time
description: Filter certificates created until this date.
metadata:
type: array
items:
type: object
properties:
key:
type: string
minLength: 1
maxLength: 255
value:
type: string
maxLength: 1020
required:
- key
additionalProperties: false
description: Filter by metadata key-value pairs. Each entry should have a key (required) and optionally a value to match against.
extendedKeyUsage:
type: string
description: Filter by extended key usage. Only certificates containing this EKU will be returned (e.g. 'codeSigning', 'serverAuth').
keyAlgorithm:
anyOf:
- type: string
- type: array
items:
type: string
description: Filter by key algorithm (e.g. 'RSA_2048', 'EC_prime256v1').
signatureAlgorithm:
type: string
description: Filter by signature algorithm (e.g. 'RSA-SHA256', 'ECDSA-SHA256').
keySizes:
type: array
items:
type: number
description: Filter by key sizes in bits (e.g. [2048, 4096]).
caIds:
type: array
items:
type: string
format: uuid
description: Filter by certificate authority IDs.
enrollmentTypes:
type: array
items:
type: string
description: Filter by enrollment types (e.g. 'api', 'est', 'acme', 'scep').
source:
anyOf:
- type: string
- type: array
items:
type: string
description: Filter by certificate source ('issued', 'discovered', 'imported').
notAfterFrom:
type: string
format: date-time
description: Filter certificates expiring on or after this date.
notAfterTo:
type: string
format: date-time
description: Filter certificates expiring on or before this date.
notBeforeFrom:
type: string
format: date-time
description: Filter certificates issued on or after this date.
notBeforeTo:
type: string
format: date-time
description: Filter certificates issued on or before this date.
applicationId:
type: string
format: uuid
description: Filter to certificates issued through a specific Application.
applicationIds:
type: array
items:
type: string
format: uuid
description: Filter to certificates issued through any of the supplied Applications.
sortBy:
type: string
enum:
- notAfter
- notBefore
- createdAt
- commonName
- keyAlgorithm
- status
description: Column to sort by (e.g. 'notAfter', 'notBefore', 'commonName').
sortOrder:
type: string
enum:
- asc
- desc
description: 'Sort direction: ''asc'' or ''desc''.'
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: projectId
required: true
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
certificates:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
caId:
type:
- string
- 'null'
format: uuid
status:
type: string
serialNumber:
type: string
friendlyName:
type: string
commonName:
type: string
notBefore:
type: string
format: date-time
notAfter:
type: string
format: date-time
revokedAt:
type:
- string
- 'null'
format: date-time
revocationReason:
type:
- number
- 'null'
altNames:
type:
- string
- 'null'
caCertId:
type:
- string
- 'null'
format: uuid
certificateTemplateId:
type:
- string
- 'null'
format: uuid
keyUsages:
type:
- array
- 'null'
items:
type: string
extendedKeyUsages:
type:
- array
- 'null'
items:
type: string
projectId:
type: string
pkiSubscriberId:
type:
- string
- 'null'
format: uuid
profileId:
type:
- string
- 'null'
format: uuid
renewBeforeDays:
type:
- number
- 'null'
renewedFromCertificateId:
type:
- string
- 'null'
format: uuid
renewedByCertificateId:
type:
- string
- 'null'
format: uuid
renewalError:
type:
- string
- 'null'
keyAlgorithm:
type:
- string
- 'null'
signatureAlgorithm:
type:
- string
- 'null'
subjectOrganization:
type:
- string
- 'null'
subjectOrganizationalUnit:
type:
- string
- 'null'
subjectCountry:
type:
- string
- 'null'
subjectState:
type:
- string
- 'null'
subjectLocality:
type:
- string
- 'null'
fingerprintSha256:
type:
- string
- 'null'
fingerprintSha1:
type:
- string
- 'null'
isCA:
type:
- boolean
- 'null'
pathLength:
type:
- number
- 'null'
source:
type:
- string
- 'null'
discoveryMetadata: {}
externalMetadata: {}
applicationId:
type:
- string
- 'null'
format: uuid
hasPrivateKey:
type: boolean
caName:
type:
- string
- 'null'
profileName:
type:
- string
- 'null'
enrollmentType:
type:
- string
- 'null'
applicationName:
type:
- string
- 'null'
required:
- id
- createdAt
- updatedAt
- status
- serialNumber
- friendlyName
- commonName
- notBefore
- notAfter
- projectId
- hasPrivateKey
additionalProperties: false
totalCount:
type: number
required:
- certificates
- totalCount
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/cert-manager/certificates:
post:
operationId: createCertificate
tags:
- PKI Certificates
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
profileId:
type: string
format: uuid
applicationId:
type: string
format: uuid
csr:
type: string
minLength: 1
maxLength: 4096
attributes:
type: object
properties:
commonName:
type:
- string
- 'null'
minLength: 1
maxLength: 100
organization:
type:
- string
- 'null'
minLength: 1
maxLength: 100
organizationalUnit:
type:
- string
- 'null'
minLength: 1
maxLength: 100
country:
type:
- string
- 'null'
minLength: 1
maxLength: 100
state:
type:
- string
- 'null'
minLength: 1
maxLength: 100
locality:
type:
- string
- 'null'
minLength: 1
maxLength: 100
keyUsages:
type: array
items:
type: string
enum:
- digital_signature
- key_encipherment
- non_repudiation
- data_encipherment
- key_agreement
- key_cert_sign
- crl_sign
- encipher_only
- decipher_only
extendedKeyUsages:
type: array
items:
type: string
enum:
- client_auth
- server_auth
- code_signing
- email_protection
- ocsp_signing
- time_stamping
altNames:
type: array
items:
type: object
properties:
type:
type: string
enum:
- dns_name
- ip_address
- email
- uri
value:
type: string
minLength: 1
required:
- type
- value
additionalProperties: false
signatureAlgorithm:
type: string
enum:
- RSA-SHA256
- RSA-SHA384
- RSA-SHA512
- ECDSA-SHA256
- ECDSA-SHA384
- ECDSA-SHA512
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
keyAlgorithm:
type: string
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_prime256v1
- EC_secp384r1
- EC_secp521r1
- ML-DSA-44
- ML-DSA-65
- ML-DSA-87
- SLH-DSA-SHA2-128f
- SLH-DSA-SHA2-128s
- SLH-DSA-SHA2-192f
- SLH-DSA-SHA2-192s
- SLH-DSA-SHA2-256f
- SLH-DSA-SHA2-256s
- SLH-DSA-SHAKE-128f
- SLH-DSA-SHAKE-128s
- SLH-DSA-SHAKE-192f
- SLH-DSA-SHAKE-192s
- SLH-DSA-SHAKE-256f
- SLH-DSA-SHAKE-256s
ttl:
type: string
notBefore:
type: string
notAfter:
type: string
basicConstraints:
type: object
properties:
isCA:
type: boolean
pathLength:
type: integer
minimum: 0
required:
- isCA
additionalProperties: false
additionalProperties: false
removeRootsFromChain:
anyOf:
- type: boolean
- type: string
default: false
metadata:
type: array
items:
type: object
properties:
key:
type: string
minLength: 1
maxLength: 255
value:
type: string
maxLength: 1020
default: ''
required:
- key
additionalProperties: false
required:
- profileId
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
certificate:
type:
- object
- 'null'
properties:
certificate:
type: string
issuingCaCertificate:
type: string
certificateChain:
type: string
privateKey:
type: string
serialNumber:
type: string
certificateId:
type: string
required:
- certificate
- issuingCaCertificate
- certificateChain
- serialNumber
- certificateId
additionalProperties: false
certificateRequestId:
type: string
status:
type: string
enum:
- pending_approval
- pending
- pending_validation
- issued
- failed
- rejected
message:
type: string
required:
- certificate
- certificateRequestId
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/cert-manager/certificates/certificate-requests/{requestId}:
get:
operationId: getCertificateRequest
tags:
- PKI Certificates
parameters:
- schema:
type: string
format: uuid
in: path
name: requestId
required: true
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
status:
type: string
enum:
- pending_approval
- pending
- pending_validation
- issued
- failed
- rejected
certificate:
type:
- string
- 'null'
certificateId:
type:
- string
- 'null'
privateKey:
type:
- string
- 'null'
serialNumber:
type:
- string
- 'null'
errorMessage:
type:
- string
- 'null'
pendingMessage:
type:
- string
- 'null'
commonName:
type:
- string
- 'null'
organization:
type:
- string
- 'null'
organizationalUnit:
type:
- string
- 'null'
country:
type:
- string
- 'null'
state:
type:
- string
- 'null'
locality:
type:
- string
- 'null'
basicConstraints:
type:
- object
- 'null'
properties:
isCA:
type: boolean
pathLength:
type: number
required:
- isCA
additionalProperties: false
metadata:
type: array
items:
type: object
properties:
key:
type: string
value:
type: string
required:
- key
- value
additionalProperties: false
createdAt:
type: string
format: date-time
# --- truncated at 32 KB (213 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/infisical/refs/heads/main/openapi/infisical-pki-certificates-api-openapi.yml