Venafi

Venafi Certificate Management APIs API

The endpoints in this section manage TLS certificates. If you want certificates to secure SSH keys, see the _SshCertificates_ section ## PKIX Parameter Set ## As of TPP 25.1 algorithms are identified by an OID called PKIX Parameter Set. The following table lists the OID for each algorithm: **RSA Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | RSA 1024 | 1.3.6.1.4.1.28783.10.1.1.1024| RSA 1024 bits offers moderate security but is now considered vulnerable and outdated for most modern applications. | | RSA 2048 | 1.3.6.1.4.1.28783.10.1.1.2048| RSA 2048 bits offers strong security and is widely used for modern encryption and digital signatures. | | RSA 3072 | 1.3.6.1.4.1.28783.10.1.1.3072| RSA 3072 bits provides a higher security level, suitable for long-term protection of sensitive data. | | RSA 4096 | 1.3.6.1.4.1.28783.10.1.1.4096| RSA 4096 bits offers very high security, commonly used for highly sensitive data and long-term encryption. | | RSA 8192 | 1.3.6.1.4.1.28783.10.1.1.8192| RSA 8192 bits provides extremely high security, used for the most sensitive data and long-term protection. | | RSA PSS/OAEP 1024 | 1.3.6.1.4.1.28783.10.1.2.1024| RSA 1024 bits PSS provides moderate security for digital signatures, with PSS offering improved resistance against certain attacks, though it's now considered vulnerable for most applications. | | RSA PSS/OAEP 2048 | 1.3.6.1.4.1.28783.10.1.2.2048| RSA 2048 bits PSS offers strong security with enhanced resistance to forgery and adaptive chosen-message attacks, making it widely used in modern systems. | | RSA PSS/OAEP 3072 | 1.3.6.1.4.1.28783.10.1.2.3072| RSA 3072 bits PSS provides enhanced security for long-term digital signature protection, with PSS improving resistance to certain signature-related attacks. | | RSA PSS/OAEP 4096 | 1.3.6.1.4.1.28783.10.1.2.4096| RSA 4096 bits PSS provides very high security for digital signatures, with PSS offering added protection against vulnerabilities in deterministic signature schemes. | | RSA PSS/OAEP 8192 | 1.3.6.1.4.1.28783.10.1.2.8192| RSA 8192 bits PSS offers extremely high security for critical digital signatures, with PSS further strengthening resistance to advanced cryptographic attacks and long-term protection. | **Elliptic Curve Digital Signature Algorithms (ECDSA)** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | ECDSA P-256 | 1.3.6.1.4.1.28783.10.2.1.256| Digital signature algorithm based on the NIST P-256 curve, providing 128-bit security. | | ECDSA P-384 | 1.3.6.1.4.1.28783.10.2.1.384| Digital signature algorithm based on the NIST P-384 curve, providing 192-bit security. | | ECDSA P-521 | 1.3.6.1.4.1.28783.10.2.1.521| Digital signature algorithm based on the NIST P-521 curve, providing 256-bit security. | | Brainpool P-256r1 | 1.3.6.1.4.1.28783.10.2.2.1| Brainpool P256 is a 256-bit elliptic curve offering strong security for digital signatures and key exchange. | | Brainpool P-384r1 | 1.3.6.1.4.1.28783.10.2.2.2| Brainpool P384 is a 384-bit elliptic curve providing enhanced security for high-assurance applications. | | Brainpool P-512r1 | 1.3.6.1.4.1.28783.10.2.2.3| Brainpool P512 is a 512-bit elliptic curve offering very high security for sensitive data and long-term protection. | | Brainpool P-160r1 | 1.3.6.1.4.1.28783.10.2.2.4| Brainpool P160 is a 160-bit curve, offering moderate security for lightweight cryptographic applications. | | Brainpool P-160t1 | 1.3.6.1.4.1.28783.10.2.2.5| Brainpool P160T is a 160-bit twisted curve, offering efficient performance and moderate security for lightweight applications. | | Brainpool P-192r1 | 1.3.6.1.4.1.28783.10.2.2.6| Brainpool P192 is a 192-bit curve providing a balanced security level for general-purpose cryptography. | | Brainpool P-192t1 | 1.3.6.1.4.1.28783.10.2.2.7| Brainpool P192T is a 192-bit twisted curve, optimized for faster cryptographic operations with improved security. | | Brainpool P-224r1 | 1.3.6.1.4.1.28783.10.2.2.8| Brainpool P224 is a 224-bit curve offering strong security for medium-strength cryptographic applications. | | Brainpool P-224t1 | 1.3.6.1.4.1.28783.10.2.2.9| Brainpool P224T is a 224-bit twisted Edwards curve, optimized for efficient cryptographic operations with strong security. | | Brainpool P-256t1 | 1.3.6.1.4.1.28783.10.2.2.10| Brainpool P256T is a 256-bit twisted curve, optimized for faster operations and improved security in digital signatures and key exchange. | | Brainpool P-320r1 | 1.3.6.1.4.1.28783.10.2.2.11| Brainpool P320 is a 320-bit curve providing strong security for cryptographic operations, suitable for high-security applications. | | Brainpool P-320t1 | 1.3.6.1.4.1.28783.10.2.2.12| Brainpool P320T is a 320-bit twisted curve, balancing strong security and efficient performance for cryptographic tasks. | | Brainpool P-384t1 | 1.3.6.1.4.1.28783.10.2.2.13| Brainpool P384T is a 384-bit twisted curve providing strong security for digital signatures and key exchange, optimized for performance and efficiency. | | Brainpool P-512t1 | 1.3.6.1.4.1.28783.10.2.2.14| Brainpool P512T is a 512-bit twisted curve, providing very high security and optimized for efficient cryptographic processing. | | SEC P-256k1 | 1.3.6.1.4.1.28783.10.2.3.1| Sec P256K is a 256-bit curve widely used in Bitcoin and blockchain technologies, optimized for fast elliptic curve operations. | | SEC P-224r1 | 1.3.6.1.4.1.28783.10.2.3.2| Sec P224 is a 224-bit curve offering strong security for general-purpose cryptography, commonly used in digital signatures. | | SEC P-224k1 | 1.3.6.1.4.1.28783.10.2.3.3| Sec P224K is a 224-bit curve used in cryptographic applications with an emphasis on fast and efficient operations. | | SEC P-192r1 | 1.3.6.1.4.1.28783.10.2.3.4| Sec P192 is a 192-bit curve providing moderate security for lightweight cryptographic applications. | | SEC P-192k1 | 1.3.6.1.4.1.28783.10.2.3.5| Sec P192K is a 192-bit curve widely used in blockchain and cryptographic systems, optimized for efficient operations. | **Edwards Curve Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | Ed25519 | 1.3.6.1.4.1.28783.10.3.25519| Ed25519 is a high-security elliptic curve signature algorithm, designed for fast performance and resistance to side-channel attacks. | | Ed448 | 1.3.6.1.4.1.28783.10.3.44448| Ed448 is a highly secure elliptic curve signature algorithm, offering stronger security than ED25519, with a larger key size. | **ML-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | ML-DSA44 | 1.3.6.1.4.1.28783.10.4.44| ML-DSA44 offers 128-bit quantum security, designed for lightweight applications that require post-quantum resilience with moderate security. | | ML-DSA65 | 1.3.6.1.4.1.28783.10.4.65| ML-DSA65 provides 192-bit quantum security, offering stronger protection against quantum adversaries while maintaining efficiency for broader use cases. | | ML-DSA87 | 1.3.6.1.4.1.28783.10.4.87| ML-DSA87 delivers 256-bit quantum security, designed for high-assurance applications needing robust resistance to future quantum computing threats. | **SLH-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | SLH-DSA-SHA2-128s | 1.3.6.1.4.1.28783.10.5.1.1| SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. | | SLH-DSA-SHA2-128f | 1.3.6.1.4.1.28783.10.5.1.2| SLH-DSA SHAKE 128bit Fast: Delivers 128-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-SHA2-192s | 1.3.6.1.4.1.28783.10.5.1.3| SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-SHA2-192f | 1.3.6.1.4.1.28783.10.5.1.4| SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. | | SLH-DSA-SHA2-256s | 1.3.6.1.4.1.28783.10.5.1.5| SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-SHA2-256f | 1.3.6.1.4.1.28783.10.5.1.6| SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-Shake-128s | 1.3.6.1.4.1.28783.10.5.1.7| SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. | | SLH-DSA-Shake-128f | 1.3.6.1.4.1.28783.10.5.1.8| SLH-DSA SHAKE 128bit Fast: Ensures 128-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-Shake-192s | 1.3.6.1.4.1.28783.10.5.1.9| SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. | | SLH-DSA-Shake-192f | 1.3.6.1.4.1.28783.10.5.1.10| SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-Shake-256s | 1.3.6.1.4.1.28783.10.5.1.11| SLH-DSA SHAKE 256bit Small: Offers 256-bit security with SHAKE, suitable for small footprint applications. | | SLH-DSA-Shake-256f | 1.3.6.1.4.1.28783.10.5.1.12| SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. | **Pre-Hash SLH-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | HASH-SLH-DSA-SHA2-128s-SHA256 | 1.3.6.1.4.1.28783.10.5.2.1| Pre-Hash SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. | | HASH-SLH-DSA-SHA2-128f-SHA256 | 1.3.6.1.4.1.28783.10.5.2.2| Pre-Hash SLH-DSA SHA2 128bit Fast: Delivers 128-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-SHA2-192s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.3| Pre-Hash SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-SHA2-192f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.4| Pre-Hash SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-SHA2-256s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.5| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-SHA2-256f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.6| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-Shake-128s-Shake128 | 1.3.6.1.4.1.28783.10.5.2.7| Pre-Hash SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. | | HASH-SLH-DSA-Shake-128f-Shake128 | 1.3.6.1.4.1.28783.10.5.2.8| Pre-Hash SLH-DSA SHA2 128bit Fast: Ensures 128-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-Shake-192s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.9| Pre-Hash SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. | | HASH-SLH-DSA-Shake-192f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.10| Pre-Hash SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. | | HASH-SLH-DSA-Shake-256s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.11| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-Shake-256f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.12| Pre-Hash SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. | **Composite Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | Composite ML-DSA44 / PSS2048 | 1.3.6.1.4.1.28783.10.7.1| ML-DSA44 / RSA 2048 PSS combines 128-bit quantum security of ML-DSA44 with RSA2048PSS, suitable for moderate security applications requiring post-quantum and classical resilience. | | Composite ML-DSA44 / RSA2048 | 1.3.6.1.4.1.28783.10.7.2| ML-DSA44 / RSA 2048 combines 128-bit quantum security of ML-DSA44 with RSA 2048, suitable for moderate security applications requiring post-quantum and classical resilience. | | Composite ML-DSA44 / Ed25519 | 1.3.6.1.4.1.28783.10.7.3| ML-DSA44 / Ed25519 offers 128-bit quantum security of ML-DSA44 with Ed25519, optimized for fast and secure digital signatures. | | Composite ML-DSA44 / ECP256 | 1.3.6.1.4.1.28783.10.7.4| ML-DSA44 / ECP256 provides 128-bit quantum security of ML-DSA44 with ECDSA P-256, ideal for secure communications and data integrity. | | Composite ML-DSA65 / PSS3072 | 1.3.6.1.4.1.28783.10.7.5| ML-DSA65 / RSA 3072 PSS combines 192-bit quantum security of ML-DSA65 with RSA 3072 PSS, suitable for long-term protection and moderate security applications. | | Composite ML-DSA65 / RSA3072 | 1.3.6.1.4.1.28783.10.7.6| ML-DSA65 / RSA 3072 offers 192-bit quantum security of ML-DSA65 with RSA 3072, ideal for secure communications and data integrity. | | Composite ML-DSA65 / PSS4096 | 1.3.6.1.4.1.28783.10.7.7| ML-DSA65 / RSA 4096 PSS provides 192-bit quantum security of ML-DSA65 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA65 / RSA4096 | 1.3.6.1.4.1.28783.10.7.8| ML-DSA65 / RSA 4096 combines 192-bit quantum security of ML-DSA65 with RSA 4096, ideal for high-security applications needing long-term protection. | | Composite ML-DSA65 / ECP256 | 1.3.6.1.4.1.28783.10.7.9| ML-DSA65 / ECP256 offers 192-bit quantum security of ML-DSA65 with ECDSA P-256, designed for secure communications and data integrity. | | Composite ML-DSA65 / ECP384 | 1.3.6.1.4.1.28783.10.7.10| ML-DSA65 / ECP384 offers 192-bit quantum security of ML-DSA65 with ECDSA P-384, ideal for high-security applications needing long-term protection. | | Composite ML-DSA65 / Brainpool P-256 | 1.3.6.1.4.1.28783.10.7.11| ML-DSA65 / Brainpool P-256 provides 192-bit quantum security of ML-DSA65 with Brainpool P-256, designed for secure communications and data integrity. | | Composite ML-DSA65 / Ed25519 | 1.3.6.1.4.1.28783.10.7.12| ML-DSA65 / Ed25519 combines 192-bit quantum security of ML-DSA65 with Ed25519, optimized for fast and secure digital signatures. | | Composite ML-DSA87 / ECP384 | 1.3.6.1.4.1.28783.10.7.13| ML-DSA87 / ECP384 ensures 256-bit quantum security of ML-DSA87 with ECDSA P-384, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / Brainpool P-384 | 1.3.6.1.4.1.28783.10.7.14| ML-DSA87 / Brainpool P-384 offers 256-bit quantum security of ML-DSA87 with Brainpool P-384, ideal for secure financial transactions and data integrity. | | Composite ML-DSA87 / Ed448 | 1.3.6.1.4.1.28783.10.7.15| ML-DSA87 / Ed448 combines 256-bit quantum security of ML-DSA87 with Ed448, designed for high-security digital signatures and fast performance. | | Composite ML-DSA87 / PSS4096 | 1.3.6.1.4.1.28783.10.7.16| ML-DSA87 / RSA 4096 PSS provides 256-bit quantum security of ML-DSA87 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / PSS3072 | 1.3.6.1.4.1.28783.10.7.17| ML-DSA87 / RSA 3072 PSS provides 256-bit quantum security of ML-DSA87 with RSA 3072 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / ECP521 | 1.3.6.1.4.1.28783.10.7.18| ML-DSA87 / ECP521 ensures 256-bit quantum security of ML-DSA87 with ECDSA P-521, suitable for highly sensitive data and long-term protection. |

GitHub OpenAPI

Operations 22

POST /vedsdk/certificates/Retrieve/{vaultId} Retrieve a certificate by vault ID #
GET /vedsdk/certificates/Retrieve/{vaultId} Retrieve a certificate by vault ID (GET) #
GET /vedsdk/certificates/{guid}/PreviousVersions Get archived certificates #
POST /vedsdk/certificates/Validate Validate a deployed certificate #
PUT /vedsdk/certificates/{guid} Set or update certificate attributes #
GET /vedsdk/certificates/{guid} Get certificate details #
DELETE /vedsdk/certificates/{guid} Delete a certificate #
POST /vedsdk/certificates/CheckPolicy Check policy compliance #
POST /vedsdk/certificates/Request Enroll or provision a certificate #
POST /vedsdk/certificates/Retrieve Retrieve an issued certificate #
GET /vedsdk/certificates/Retrieve Retrieve an issued certificate (GET) #
POST /vedsdk/certificates/Renew Renew a certificate #
POST /vedsdk/certificates/Revoke Revoke a certificate #
GET /vedsdk/certificates/ Search certificates #
HEAD /vedsdk/certificates/ Get certificates count #
POST /vedsdk/certificates/Associate Associate an application #
POST /vedsdk/certificates/Dissociate Dissociate an application #
POST /vedsdk/certificates/Push Initiate provisioning #
POST /vedsdk/certificates/Import Import a certificate #
POST /vedsdk/certificates/Reset Reset processing state #
POST /vedsdk/certificates/Retry Retry processing #
GET /vedsdk/certificates/{guid}/ValidationResults Retrieve certificate validation results #

Documentation

📖
Documentation
https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
📖
Documentation
https://docs.venafi.com/Docs/currentSDK/TopNav/Content/SDK/WebSDK/cco-sdk-GettingStarted.php

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/openapi/venafi-certificate-management-apis-api-openapi.yml

Other Resources

🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/asyncapi/venafi-certificate-manager-saas-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/venafi-certificate-management-apis-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

venafi-certificate-management-apis-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Trust Protection Foundation WebSDK Certificate Management…
  description: '# Introduction

    The Trust Protection Foundation Web SDK is a subset of REST APIs that allow you to:

    * Automate certificate management

    * Integrate with DevOps processes

    * Discover machine identities

    * Extract data to integrate with data warehouses

    * Perform bulk actions

    * Set up and administer Trust Protection Foundation

    * Onboard teams

    * Create custom, automated business logic and flows between internal systems


    All these use cases can be accomplished using the Trust Protection Foundation REST…'
  version: 26.1.1
servers:
- url: /
  description: Current Host
- url: https://REPLACEdnsnameME/
  description: System
- url: https://{dnsname}/
  description: Configurable Hostname
  variables:
    dnsname:
      default: localhost
      description: Production API Hostname
security:
- AccessToken: []
tags:


# --- truncated at 32 KB (161 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/openapi/venafi-certificate-management-apis-api-openapi.yml