# Venafi Certificate Management APIs API

**Canonical:** https://apis.io/apis/venafi/venafi-certificate-management-apis-api/  
**Provider:** Venafi — https://apis.io/providers/venafi/  
**Base URL:** https://api.venafi.cloud  
**Documentation:** https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview

Venafi Certificate Management APIs API is one of 58 APIs that [Venafi](https://apis.io/providers/venafi/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Certificate Management APIs. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

The endpoints in this section manage TLS certificates. If you want certificates to secure SSH keys, see the _SshCertificates_ section ## PKIX Parameter Set ## As of TPP 25.1 algorithms are identified by an OID called PKIX Parameter Set. The following table lists the OID for each algorithm: **RSA Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | RSA 1024 | 1.3.6.1.4.1.28783.10.1.1.1024| RSA 1024 bits offers moderate security but is now considered vulnerable and outdated for most modern applications. | | RSA 2048 | 1.3.6.1.4.1.28783.10.1.1.2048| RSA 2048 bits offers strong security and is widely used for modern encryption and digital signatures. | | RSA 3072 | 1.3.6.1.4.1.28783.10.1.1.3072| RSA 3072 bits provides a higher security level, suitable for long-term protection of sensitive data. | | RSA 4096 | 1.3.6.1.4.1.28783.10.1.1.4096| RSA 4096 bits offers very high security, commonly used for highly sensitive data and long-term encryption. | | RSA 8192 | 1.3.6.1.4.1.28783.10.1.1.8192| RSA 8192 bits provides extremely high security, used for the most sensitive data and long-term protection. | | RSA PSS/OAEP 1024 | 1.3.6.1.4.1.28783.10.1.2.1024| RSA 1024 bits PSS provides moderate security for digital signatures, with PSS offering improved resistance against certain attacks, though it's now considered vulnerable for most applications. | | RSA PSS/OAEP 2048 | 1.3.6.1.4.1.28783.10.1.2.2048| RSA 2048 bits PSS offers strong security with enhanced resistance to forgery and adaptive chosen-message attacks, making it widely used in modern systems. | | RSA PSS/OAEP 3072 | 1.3.6.1.4.1.28783.10.1.2.3072| RSA 3072 bits PSS provides enhanced security for long-term digital signature protection, with PSS improving resistance to certain signature-related attacks. | | RSA PSS/OAEP 4096 | 1.3.6.1.4.1.28783.10.1.2.4096| RSA 4096 bits PSS provides very high security for digital signatures, with PSS offering added protection against vulnerabilities in deterministic signature schemes. | | RSA PSS/OAEP 8192 | 1.3.6.1.4.1.28783.10.1.2.8192| RSA 8192 bits PSS offers extremely high security for critical digital signatures, with PSS further strengthening resistance to advanced cryptographic attacks and long-term protection. | **Elliptic Curve Digital Signature Algorithms (ECDSA)** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | ECDSA P-256 | 1.3.6.1.4.1.28783.10.2.1.256| Digital signature algorithm based on the NIST P-256 curve, providing 128-bit security. | | ECDSA P-384 | 1.3.6.1.4.1.28783.10.2.1.384| Digital signature algorithm based on the NIST P-384 curve, providing 192-bit security. | | ECDSA P-521 | 1.3.6.1.4.1.28783.10.2.1.521| Digital signature algorithm based on the NIST P-521 curve, providing 256-bit security. | | Brainpool P-256r1 | 1.3.6.1.4.1.28783.10.2.2.1| Brainpool P256 is a 256-bit elliptic curve offering strong security for digital signatures and key exchange. | | Brainpool P-384r1 | 1.3.6.1.4.1.28783.10.2.2.2| Brainpool P384 is a 384-bit elliptic curve providing enhanced security for high-assurance applications. | | Brainpool P-512r1 | 1.3.6.1.4.1.28783.10.2.2.3| Brainpool P512 is a 512-bit elliptic curve offering very high security for sensitive data and long-term protection. | | Brainpool P-160r1 | 1.3.6.1.4.1.28783.10.2.2.4| Brainpool P160 is a 160-bit curve, offering moderate security for lightweight cryptographic applications. | | Brainpool P-160t1 | 1.3.6.1.4.1.28783.10.2.2.5| Brainpool P160T is a 160-bit twisted curve, offering efficient performance and moderate security for lightweight applications. | | Brainpool P-192r1 | 1.3.6.1.4.1.28783.10.2.2.6| Brainpool P192 is a 192-bit curve providing a balanced security level for general-purpose cryptography. | | Brainpool P-192t1 | 1.3.6.1.4.1.28783.10.2.2.7| Brainpool P192T is a 192-bit twisted curve, optimized for faster cryptographic operations with improved security. | | Brainpool P-224r1 | 1.3.6.1.4.1.28783.10.2.2.8| Brainpool P224 is a 224-bit curve offering strong security for medium-strength cryptographic applications. | | Brainpool P-224t1 | 1.3.6.1.4.1.28783.10.2.2.9| Brainpool P224T is a 224-bit twisted Edwards curve, optimized for efficient cryptographic operations with strong security. | | Brainpool P-256t1 | 1.3.6.1.4.1.28783.10.2.2.10| Brainpool P256T is a 256-bit twisted curve, optimized for faster operations and improved security in digital signatures and key exchange. | | Brainpool P-320r1 | 1.3.6.1.4.1.28783.10.2.2.11| Brainpool P320 is a 320-bit curve providing strong security for cryptographic operations, suitable for high-security applications. | | Brainpool P-320t1 | 1.3.6.1.4.1.28783.10.2.2.12| Brainpool P320T is a 320-bit twisted curve, balancing strong security and efficient performance for cryptographic tasks. | | Brainpool P-384t1 | 1.3.6.1.4.1.28783.10.2.2.13| Brainpool P384T is a 384-bit twisted curve providing strong security for digital signatures and key exchange, optimized for performance and efficiency. | | Brainpool P-512t1 | 1.3.6.1.4.1.28783.10.2.2.14| Brainpool P512T is a 512-bit twisted curve, providing very high security and optimized for efficient cryptographic processing. | | SEC P-256k1 | 1.3.6.1.4.1.28783.10.2.3.1| Sec P256K is a 256-bit curve widely used in Bitcoin and blockchain technologies, optimized for fast elliptic curve operations. | | SEC P-224r1 | 1.3.6.1.4.1.28783.10.2.3.2| Sec P224 is a 224-bit curve offering strong security for general-purpose cryptography, commonly used in digital signatures. | | SEC P-224k1 | 1.3.6.1.4.1.28783.10.2.3.3| Sec P224K is a 224-bit curve used in cryptographic applications with an emphasis on fast and efficient operations. | | SEC P-192r1 | 1.3.6.1.4.1.28783.10.2.3.4| Sec P192 is a 192-bit curve providing moderate security for lightweight cryptographic applications. | | SEC P-192k1 | 1.3.6.1.4.1.28783.10.2.3.5| Sec P192K is a 192-bit curve widely used in blockchain and cryptographic systems, optimized for efficient operations. | **Edwards Curve Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | Ed25519 | 1.3.6.1.4.1.28783.10.3.25519| Ed25519 is a high-security elliptic curve signature algorithm, designed for fast performance and resistance to side-channel attacks. | | Ed448 | 1.3.6.1.4.1.28783.10.3.44448| Ed448 is a highly secure elliptic curve signature algorithm, offering stronger security than ED25519, with a larger key size. | **ML-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | ML-DSA44 | 1.3.6.1.4.1.28783.10.4.44| ML-DSA44 offers 128-bit quantum security, designed for lightweight applications that require post-quantum resilience with moderate security. | | ML-DSA65 | 1.3.6.1.4.1.28783.10.4.65| ML-DSA65 provides 192-bit quantum security, offering stronger protection against quantum adversaries while maintaining efficiency for broader use cases. | | ML-DSA87 | 1.3.6.1.4.1.28783.10.4.87| ML-DSA87 delivers 256-bit quantum security, designed for high-assurance applications needing robust resistance to future quantum computing threats. | **SLH-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | SLH-DSA-SHA2-128s | 1.3.6.1.4.1.28783.10.5.1.1| SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. | | SLH-DSA-SHA2-128f | 1.3.6.1.4.1.28783.10.5.1.2| SLH-DSA SHAKE 128bit Fast: Delivers 128-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-SHA2-192s | 1.3.6.1.4.1.28783.10.5.1.3| SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-SHA2-192f | 1.3.6.1.4.1.28783.10.5.1.4| SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. | | SLH-DSA-SHA2-256s | 1.3.6.1.4.1.28783.10.5.1.5| SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-SHA2-256f | 1.3.6.1.4.1.28783.10.5.1.6| SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | SLH-DSA-Shake-128s | 1.3.6.1.4.1.28783.10.5.1.7| SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. | | SLH-DSA-Shake-128f | 1.3.6.1.4.1.28783.10.5.1.8| SLH-DSA SHAKE 128bit Fast: Ensures 128-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-Shake-192s | 1.3.6.1.4.1.28783.10.5.1.9| SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. | | SLH-DSA-Shake-192f | 1.3.6.1.4.1.28783.10.5.1.10| SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. | | SLH-DSA-Shake-256s | 1.3.6.1.4.1.28783.10.5.1.11| SLH-DSA SHAKE 256bit Small: Offers 256-bit security with SHAKE, suitable for small footprint applications. | | SLH-DSA-Shake-256f | 1.3.6.1.4.1.28783.10.5.1.12| SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. | **Pre-Hash SLH-DSA Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | HASH-SLH-DSA-SHA2-128s-SHA256 | 1.3.6.1.4.1.28783.10.5.2.1| Pre-Hash SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. | | HASH-SLH-DSA-SHA2-128f-SHA256 | 1.3.6.1.4.1.28783.10.5.2.2| Pre-Hash SLH-DSA SHA2 128bit Fast: Delivers 128-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-SHA2-192s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.3| Pre-Hash SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-SHA2-192f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.4| Pre-Hash SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-SHA2-256s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.5| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-SHA2-256f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.6| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-Shake-128s-Shake128 | 1.3.6.1.4.1.28783.10.5.2.7| Pre-Hash SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. | | HASH-SLH-DSA-Shake-128f-Shake128 | 1.3.6.1.4.1.28783.10.5.2.8| Pre-Hash SLH-DSA SHA2 128bit Fast: Ensures 128-bit security with SHA-2, optimized for fast performance. | | HASH-SLH-DSA-Shake-192s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.9| Pre-Hash SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. | | HASH-SLH-DSA-Shake-192f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.10| Pre-Hash SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. | | HASH-SLH-DSA-Shake-256s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.11| Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. | | HASH-SLH-DSA-Shake-256f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.12| Pre-Hash SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. | **Composite Quantum-Safe Algorithms** | Algorithm | PKIX Parameter Set | Description | |-----------|--------------------|--------------------------| | Composite ML-DSA44 / PSS2048 | 1.3.6.1.4.1.28783.10.7.1| ML-DSA44 / RSA 2048 PSS combines 128-bit quantum security of ML-DSA44 with RSA2048PSS, suitable for moderate security applications requiring post-quantum and classical resilience. | | Composite ML-DSA44 / RSA2048 | 1.3.6.1.4.1.28783.10.7.2| ML-DSA44 / RSA 2048 combines 128-bit quantum security of ML-DSA44 with RSA 2048, suitable for moderate security applications requiring post-quantum and classical resilience. | | Composite ML-DSA44 / Ed25519 | 1.3.6.1.4.1.28783.10.7.3| ML-DSA44 / Ed25519 offers 128-bit quantum security of ML-DSA44 with Ed25519, optimized for fast and secure digital signatures. | | Composite ML-DSA44 / ECP256 | 1.3.6.1.4.1.28783.10.7.4| ML-DSA44 / ECP256 provides 128-bit quantum security of ML-DSA44 with ECDSA P-256, ideal for secure communications and data integrity. | | Composite ML-DSA65 / PSS3072 | 1.3.6.1.4.1.28783.10.7.5| ML-DSA65 / RSA 3072 PSS combines 192-bit quantum security of ML-DSA65 with RSA 3072 PSS, suitable for long-term protection and moderate security applications. | | Composite ML-DSA65 / RSA3072 | 1.3.6.1.4.1.28783.10.7.6| ML-DSA65 / RSA 3072 offers 192-bit quantum security of ML-DSA65 with RSA 3072, ideal for secure communications and data integrity. | | Composite ML-DSA65 / PSS4096 | 1.3.6.1.4.1.28783.10.7.7| ML-DSA65 / RSA 4096 PSS provides 192-bit quantum security of ML-DSA65 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA65 / RSA4096 | 1.3.6.1.4.1.28783.10.7.8| ML-DSA65 / RSA 4096 combines 192-bit quantum security of ML-DSA65 with RSA 4096, ideal for high-security applications needing long-term protection. | | Composite ML-DSA65 / ECP256 | 1.3.6.1.4.1.28783.10.7.9| ML-DSA65 / ECP256 offers 192-bit quantum security of ML-DSA65 with ECDSA P-256, designed for secure communications and data integrity. | | Composite ML-DSA65 / ECP384 | 1.3.6.1.4.1.28783.10.7.10| ML-DSA65 / ECP384 offers 192-bit quantum security of ML-DSA65 with ECDSA P-384, ideal for high-security applications needing long-term protection. | | Composite ML-DSA65 / Brainpool P-256 | 1.3.6.1.4.1.28783.10.7.11| ML-DSA65 / Brainpool P-256 provides 192-bit quantum security of ML-DSA65 with Brainpool P-256, designed for secure communications and data integrity. | | Composite ML-DSA65 / Ed25519 | 1.3.6.1.4.1.28783.10.7.12| ML-DSA65 / Ed25519 combines 192-bit quantum security of ML-DSA65 with Ed25519, optimized for fast and secure digital signatures. | | Composite ML-DSA87 / ECP384 | 1.3.6.1.4.1.28783.10.7.13| ML-DSA87 / ECP384 ensures 256-bit quantum security of ML-DSA87 with ECDSA P-384, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / Brainpool P-384 | 1.3.6.1.4.1.28783.10.7.14| ML-DSA87 / Brainpool P-384 offers 256-bit quantum security of ML-DSA87 with Brainpool P-384, ideal for secure financial transactions and data integrity. | | Composite ML-DSA87 / Ed448 | 1.3.6.1.4.1.28783.10.7.15| ML-DSA87 / Ed448 combines 256-bit quantum security of ML-DSA87 with Ed448, designed for high-security digital signatures and fast performance. | | Composite ML-DSA87 / PSS4096 | 1.3.6.1.4.1.28783.10.7.16| ML-DSA87 / RSA 4096 PSS provides 256-bit quantum security of ML-DSA87 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / PSS3072 | 1.3.6.1.4.1.28783.10.7.17| ML-DSA87 / RSA 3072 PSS provides 256-bit quantum security of ML-DSA87 with RSA 3072 PSS, suitable for highly sensitive data and long-term protection. | | Composite ML-DSA87 / ECP521 | 1.3.6.1.4.1.28783.10.7.18| ML-DSA87 / ECP521 ensures 256-bit quantum security of ML-DSA87 with ECDSA P-521, suitable for highly sensitive data and long-term protection. |

## Operations (22)

| Method | Path | Summary |
|---|---|---|
| POST | `/vedsdk/certificates/Retrieve/{vaultId}` | Retrieve a certificate by vault ID |
| GET | `/vedsdk/certificates/Retrieve/{vaultId}` | Retrieve a certificate by vault ID (GET) |
| GET | `/vedsdk/certificates/{guid}/PreviousVersions` | Get archived certificates |
| POST | `/vedsdk/certificates/Validate` | Validate a deployed certificate |
| PUT | `/vedsdk/certificates/{guid}` | Set or update certificate attributes |
| GET | `/vedsdk/certificates/{guid}` | Get certificate details |
| DELETE | `/vedsdk/certificates/{guid}` | Delete a certificate |
| POST | `/vedsdk/certificates/CheckPolicy` | Check policy compliance |
| POST | `/vedsdk/certificates/Request` | Enroll or provision a certificate |
| POST | `/vedsdk/certificates/Retrieve` | Retrieve an issued certificate |
| GET | `/vedsdk/certificates/Retrieve` | Retrieve an issued certificate (GET) |
| POST | `/vedsdk/certificates/Renew` | Renew a certificate |
| POST | `/vedsdk/certificates/Revoke` | Revoke a certificate |
| GET | `/vedsdk/certificates/` | Search certificates |
| HEAD | `/vedsdk/certificates/` | Get certificates count |
| POST | `/vedsdk/certificates/Associate` | Associate an application |
| POST | `/vedsdk/certificates/Dissociate` | Dissociate an application |
| POST | `/vedsdk/certificates/Push` | Initiate provisioning |
| POST | `/vedsdk/certificates/Import` | Import a certificate |
| POST | `/vedsdk/certificates/Reset` | Reset processing state |
| POST | `/vedsdk/certificates/Retry` | Retry processing |
| GET | `/vedsdk/certificates/{guid}/ValidationResults` | Retrieve certificate validation results |

## Machine-readable artifacts (4)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/openapi/venafi-certificate-management-apis-api-openapi.yml
- **Documentation** — https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
- **Webhooks** — https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/asyncapi/venafi-certificate-manager-saas-webhooks.yml
- **Documentation** — https://docs.venafi.com/Docs/currentSDK/TopNav/Content/SDK/WebSDK/cco-sdk-GettingStarted.php

## Other Venafi APIs (12)

- [Venafi Access Management APIs API](https://apis.io/apis/venafi/venafi-access-management-apis-api/)
- [Venafi AlgorithmSelector APIs API](https://apis.io/apis/venafi/venafi-algorithmselector-apis-api/)
- [Venafi Application API](https://apis.io/apis/venafi/venafi-application-api/)
- [Venafi Authentication Server APIs API](https://apis.io/apis/venafi/venafi-authentication-server-apis-api/)
- [Venafi Certificate Approvals API](https://apis.io/apis/venafi/venafi-certificate-approvals-api/)
- [Venafi Certificate Auto-renewal Monitoring API](https://apis.io/apis/venafi/venafi-certificate-auto-renewal-monitoring-api/)
- [Venafi Certificate Discovery API](https://apis.io/apis/venafi/venafi-certificate-discovery-api/)
- [Venafi Certificate Expiration Reports API](https://apis.io/apis/venafi/venafi-certificate-expiration-reports-api/)
- [Venafi Certificate Import API](https://apis.io/apis/venafi/venafi-certificate-import-api/)
- [Venafi Certificate Installations API](https://apis.io/apis/venafi/venafi-certificate-installations-api/)
- [Venafi Certificate Inventory Monitoring API](https://apis.io/apis/venafi/venafi-certificate-inventory-monitoring-api/)
- [Venafi Certificate Policy API](https://apis.io/apis/venafi/venafi-certificate-policy-api/)

## Tags

Certificate Management APIs

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/venafi/venafi-certificate-management-apis-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/venafi/.