Microsoft Azure App Service Site Certificates API

openapi: 3.2.0
info:
  title: Microsoft Azure App Service Site Certificates API
  version: '2026-08-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged SiteCertificates across 2 of this provider''s published API definitions: microsoft-azure-app-service-openapi-original.json, microsoft-azure-app-service-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: SiteCertificates
paths:
  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/certificates:
    get:
      operationId: SiteCertificates_List
      tags:
      - SiteCertificates
      summary: Get all certificates in a resource group under a site
      description: Get all certificates in a resource group under a site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateCollection'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      x-ms-pageable:
        nextLinkName: nextLink
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/certificates/{certificateName}
  : get:
      operationId: SiteCertificates_Get
      tags:
      - SiteCertificates
      summary: Get a certificate belonging to a given site
      description: Get a certificate belonging to a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
    put:
      operationId: SiteCertificates_CreateOrUpdate
      tags:
      - SiteCertificates
      summary: Create or update a certificate under a given site
      description: Create or update a certificate under a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource 'Certificate' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        '201':
          description: Resource 'Certificate' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Certificate'
        description: Details of certificate, if it exists already.
        required: true
    patch:
      operationId: SiteCertificates_Update
      tags:
      - SiteCertificates
      summary: Create or update a certificate under a given site
      description: Create or update a certificate under a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatePatchResource'
        description: Details of certificate, if it exists already.
        required: true
    delete:
      operationId: SiteCertificates_Delete
      tags:
      - SiteCertificates
      summary: Delete a certificate from the site
      description: Delete a certificate from the site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/certificates
  : get:
      operationId: SiteCertificates_ListSlot
      tags:
      - SiteCertificates
      summary: Get all certificates in a resource group for a given site and a deployment slot
      description: Get all certificates in a resource group for a given site and a deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateCollection'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      x-ms-pageable:
        nextLinkName: nextLink
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/certificates/{certificateName}
  : get:
      operationId: SiteCertificates_GetSlot
      tags:
      - SiteCertificates
      summary: Get a certificate for a given site and deployment slot
      description: Get a certificate for a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        schema:
          type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
    put:
      operationId: SiteCertificates_CreateOrUpdateSlot
      tags:
      - SiteCertificates
      summary: Create or update a certificate in a given site and deployment slot
      description: Create or update a certificate in a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        schema:
          type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource 'Certificate' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        '201':
          description: Resource 'Certificate' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Certificate'
        description: Details of certificate, if it exists already.
        required: true
    patch:
      operationId: SiteCertificates_UpdateSlot
      tags:
      - SiteCertificates
      summary: Create or update a certificate for a site and deployment slot
      description: Create or update a certificate for a site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        schema:
          type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificatePatchResource'
        description: Details of certificate, if it exists already.
        required: true
    delete:
      operationId: SiteCertificates_DeleteSlot
      tags:
      - SiteCertificates
      summary: Delete a certificate for a given site and deployment slot
      description: Delete a certificate for a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        schema:
          type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        schema:
          type: string
          pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefaultErrorResponse'
    servers:
    - url: https://management.azure.com
components:
  schemas:
    CertificateProperties:
      type: object
      description: Certificate resource specific properties
      properties:
        password:
          type: string
          description: Certificate password.
        friendlyName:
          type: string
          description: Friendly name of the certificate.
          readOnly: true
        subjectName:
          type: string
          description: Subject name of the certificate.
          readOnly: true
        hostNames:
          type: array
          description: Host names the certificate applies to.
          items:
            type: string
        pfxBlob:
          type: string
          format: byte
          description: Pfx blob.
        siteName:
          type: string
          description: App name.
          readOnly: true
        selfLink:
          type: string
          description: Self link.
          readOnly: true
        issuer:
          type: string
          description: Certificate issuer.
          readOnly: true
        issueDate:
          type: string
          format: date-time
          description: Certificate issue Date.
          readOnly: true
        expirationDate:
          type: string
          format: date-time
          description: Certificate expiration date.
          readOnly: true
        thumbprint:
          type: string
          description: Certificate thumbprint.
          readOnly: true
        valid:
          type: boolean
          description: Is the certificate valid?.
          readOnly: true
        cerBlob:
          type: string
          format: byte
          description: Raw bytes of .cer file
          readOnly: true
        publicKeyHash:
          type: string
          description: Public key hash.
          readOnly: true
        hostingEnvironmentProfile:
          $ref: '#/components/schemas/HostingEnvironmentProfile'
          description: Specification for the App Service Environment to use for the certificate.
          readOnly: true
        keyVaultId:
          type: string
          format: arm-id
          description: Azure Key Vault Csm resource Id.
          x-ms-arm-id-details:
            allowedResources:
            - type: Microsoft.KeyVault/vaults
        keyVaultSecretName:
          type: string
          description: Azure Key Vault secret name.
        keyVaultSecretStatus:
          $ref: '#/components/schemas/KeyVaultSecretStatus'
          description: Status of the Key Vault secret.
          readOnly: true
        serverFarmId:
          type: string
          format: arm-id
          description: Resource ID of the associated App Service plan.
          x-ms-arm-id-details:
            allowedResources:
            - type: Microsoft.Web/serverfarms
        canonicalName:
          type: string
          description: CNAME of the certificate to be issued via free certificate
        domainValidationMethod:
          type: string
          description: Method of domain validation for free cert
    DefaultErrorResponseErrorDetailsItem:
      type: object
      description: Detailed errors.
      properties:
        code:
          type: string
          description: Standardized string to programmatically identify the error.
          readOnly: true
        message:
          type: string
          description: Detailed error description and debugging information.
          readOnly: true
        target:
          type: string
          description: Detailed error description and debugging information.
          readOnly: true
    HostingEnvironmentProfile:
      type: object
      description: Specification for an App Service Environment to use for this resource.
      properties:
        id:
          type: string
          description: Resource ID of the App Service Environment.
        name:
          type: string
          description: Name of the App Service Environment.
          readOnly: true
        type:
          type: string
          description: Resource type of the App Service Environment.
          readOnly: true
    DefaultErrorResponseError:
      type: object
      description: Error model.
      properties:
        code:
          type: string
          description: Standardized string to programmatically identify the error.
          readOnly: true
        message:
          type: string
          description: Detailed error description and debugging information.
          readOnly: true
        target:
          type: string
          description: Detailed error description and debugging information.
          readOnly: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/DefaultErrorResponseErrorDetailsItem'
          x-ms-identifiers: []
        innererror:
          type: string
          description: More information to debug error.
          readOnly: true
    CertificateCollection:
      type: object
      description: Collection of certificates.
      properties:
        value:
          type: array
          description: The Certificate items on this page
          items:
            $ref: '#/components/schemas/Certificate'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
      required:
      - value
    Certificate:
      type: object
      description: SSL certificate for an app.
      properties:
        properties:
          $ref: '#/components/schemas/CertificateProperties'
          description: Certificate resource specific properties
          x-ms-client-flatten: true
        kind:
          type: string
          description: Kind of resource. If the resource is an app, you can refer to https://github.com/Azure/app-service-linux-docs/blob/master/Things_You_Should_Know/kind_property.md#app-service-resource-kind-reference for details supported values for kind.
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/TrackedResource
    DefaultErrorResponse:
      type: object
      description: App Service error response.
      properties:
        error:
          $ref: '#/components/schemas/DefaultErrorResponseError'
          description: Error model.
          readOnly: true
    CertificatePatchResource:
      type: object
      description: ARM resource for a certificate.
      properties:
        properties:
          $ref: '#/components/schemas/CertificatePatchResourceProperties'
          description: CertificatePatchResource resource specific properties
          x-ms-client-flatten: true
      allOf:
      - $ref: '#/components/schemas/ProxyOnlyResource'
    KeyVaultSecretStatus:
      type: string
      description: Status of the Key Vault secret.
      enum:
      - Initialized
      - WaitingOnCertificateOrder
      - Succeeded
      - CertificateOrderFailed
      - OperationNotPermittedOnKeyVault
      - AzureServiceUnauthorizedToAccessKeyVault
      - KeyVaultDoesNotExist
      - KeyVaultSecretDoesNotExist
      - UnknownError
      - ExternalPrivateKey
      - Unknown
      x-ms-enum:
        name: KeyVaultSecretStatus
        modelAsString: false
    ProxyOnlyResource:
      type: object
      description: Azure proxy only resource. This resource is not tracked by Azure Resource Manager.
      properties:
        id:
          type: string
          description: Resource Id.
          readOnly: true
        name:
          type: string
          description: Resource Name.
          readOnly: true
        kind:
          type: string
          description: Kind of resource.
        type:
          type: string
          description: Resource type.
          readOnly: true
    CertificatePatchResourceProperties:
      type: object
      description: CertificatePatchResource resource specific properties
      properties:
        password:
          type: string
          description: Certificate password.
          readOnly: true
        friendlyName:
          type: string
          description: Friendly name of the certificate.
          readOnly: true
        subjectName:
          type: string
          description: Subject name of the certificate.
          readOnly: true
        hostNames:
          type: array
          description: Host names the certificate applies to.
          items:
            type: string
        pfxBlob:
          type: string
          format: byte
          description: Pfx blob.
        siteName:
          type: string
          description: App name.
          readOnly: true
        selfLink:
          type: string
          description: Self link.
          readOnly: true
        issuer:
          type: string
          description: Certificate issuer.
          readOnly: true
        issueDate:
          type: string
          format: date-time
          description: Certificate issue Date.
          readOnly: true
        expirationDate:
          type: string
          format: date-time
          description: Certificate expiration date.
          readOnly: true
        thumbprint:
          type: string
          description: Certificate thumbprint.
          readOnly: true
        valid:
          type: boolean
          description: Is the certificate valid?.
          readOnly: true
        cerBlob:
          type: string
          format: byte
          description: Raw bytes of .cer file
          readOnly: true
        publicKeyHash:
          type: string
          description: Public key hash.
          readOnly: true
        hostingEnvironmentProfile:
          $ref: '#/components/schemas/HostingEnvironmentProfile'
          description: Specification for the App Service Environment to use for the certificate.
          readOnly: true
        keyVaultId:
          type: string
          description: Key Vault Csm resource Id.
        keyVaultSecretName:
          type: string
          description: Key Vault secret name.
        keyVaultSecretStatus:
          $ref: '#/components/schemas/KeyVaultSecretStatus'
          description: Status of the Key Vault secret.
          readOnly: true
        serverFarmId:
          type: string
          description: 'Resource ID of the associated App Service plan, formatted as: "/subscriptions/{subscriptionID}/resourceGroups/{groupName}/providers/Microsoft.Web/serverfarms/{appServicePlanName}".'
        canonicalName:
          type: string
          description: CNAME of the certificate to be issued via free certificate
        domainValidationMethod:
          type: string
          description: Method of domain validation for free cert
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-azure-app-service-openapi-original.json
- microsoft-azure-app-service-openapi.yml