Venafi

Venafi HashiCorp PKI APIs API

The Public Key Infrastructure (PKI) interface allows Trust Protection Foundation to act as an Intermediate Certificate Authority for certificate vaults. This interface also sends the CSR to the CA to sign. The signed certificate includes the root, intermediate, and end user certificate chain. Trust Protection Foundation provisions the chain to the vault and stores information about the chain. The vault stores the intermediate and end user certificates. The PKI interface is only available through the Web SDK.However, the HashiCorpVault PKI application object and Role object appear in the Policy folder. For other details, see HashiCorp Vault PKI—overview. This interface is valid only if you purchased a certificate product.

GitHub OpenAPI

Operations 11

POST /vedsdk/pki/hashicorp/role/ Create a role #
DELETE /vedsdk/pki/hashicorp/role/{guid} Remove policy enforcement settings #
GET /vedsdk/pki/hashicorp/role/{guid} Retrieve policy information #
PUT /vedsdk/pki/hashicorp/role/{guid} Update Trust Protection Foundation info #
POST /vedsdk/pki/hashicorp/ca/{guid} Create or update roles #
GET /vedsdk/pki/hashicorp/ca/{guid} Retrieve details #
PUT /vedsdk/pki/hashicorp/ca/{guid} Update configuration #
DELETE /vedsdk/pki/hashicorp/ca/{guid} Remove PKI configuration #
POST /vedsdk/pki/hashicorp/ca/{guid}/renew Initiate renewal or first time enrollment #
POST /vedsdk/pki/hashicorp/ca/ Define configuration #
GET /vedsdk/pki/hashicorp/ca/ List all HashiCorp Vault PKI secrets #

Documentation

📖
Documentation
https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
📖
Documentation
https://docs.venafi.com/Docs/currentSDK/TopNav/Content/SDK/WebSDK/cco-sdk-GettingStarted.php

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/openapi/venafi-hashicorp-pki-apis-api-openapi.yml

Other Resources

🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/asyncapi/venafi-certificate-manager-saas-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/venafi-hashicorp-pki-apis-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

venafi-hashicorp-pki-apis-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Trust Protection Foundation WebSDK HashiCorp PKI APIs API
  description: '# Introduction

    The Trust Protection Foundation Web SDK is a subset of REST APIs that allow you to:

    * Automate certificate management

    * Integrate with DevOps processes

    * Discover machine identities

    * Extract data to integrate with data warehouses

    * Perform bulk actions

    * Set up and administer Trust Protection Foundation

    * Onboard teams

    * Create custom, automated business logic and flows between internal systems


    All these use cases can be accomplished using the Trust Protection Foundation REST…'
  version: 26.1.1
servers:
- url: /
  description: Current Host
- url: https://REPLACEdnsnameME/
  description: System
- url: https://{dnsname}/
  description: Configurable Hostname
  variables:
    dnsname:
      default: localhost
      description: Production API Hostname
security:
- AccessToken: []
tags:
- name: HashiCorp PKI APIs
  description: 'The Public Key Infrastructure (PKI) interface allows Trust Protection Foundation to act as an Intermediate Certificate

    Authority for certificate vaults.'
paths:
  /vedsdk/pki/hashicorp/role/:
    post:
      tags:
      - HashiCorp PKI APIs
      summary: Create a role
      description: 'Create a role in Trust Protection Foundation.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiRoles_Create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreateRoleRequest_'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreateRoleResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
  /vedsdk/pki/hashicorp/role/{guid}:
    parameters:
    - name: guid
      in: path
      description: ''
      required: true
      schema:
        type: string
    delete:
      tags:
      - HashiCorp PKI APIs
      summary: Remove policy enforcement settings
      description: 'Remove policy enforcement settings for a HashiCorp Vault PKI role from Trust Protection Foundation.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiRoles_Delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreateRoleResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    get:
      tags:
      - HashiCorp PKI APIs
      summary: Retrieve policy information
      description: 'Retrieve policy information from Trust Protection Foundation about a HashiCorp Vault PKI role.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiRoles_GetByGuid
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_Role'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    put:
      tags:
      - HashiCorp PKI APIs
      summary: Update Trust Protection Foundation info
      description: 'Update Trust Protection Foundation information about a HashiCorp role.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiRoles_Update
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreateRoleResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
  /vedsdk/pki/hashicorp/ca/{guid}:
    parameters:
    - name: guid
      in: path
      description: ''
      required: true
      schema:
        type: string
    post:
      tags:
      - HashiCorp PKI APIs
      summary: Create or update roles
      description: 'Create or update roles in the HashiCorp Vault PKI secrets engine according to the Trust Protection Foundation configuration.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_EnforceRoles
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    get:
      tags:
      - HashiCorp PKI APIs
      summary: Retrieve details
      description: 'Retrieve details about a HashiCorp Vault PKI secrets engine.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_GetByGuid
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_PkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    put:
      tags:
      - HashiCorp PKI APIs
      summary: Update configuration
      description: 'Update configuration for a HashiCorp Vault PKI secrets engine that is managed by Trust Protection Foundation.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_Update
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    delete:
      tags:
      - HashiCorp PKI APIs
      summary: Remove PKI configuration
      description: 'Remove configuration for managing a HashiCorp Vault PKI secrets engine from Trust Protection Foundation.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_Delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
  /vedsdk/pki/hashicorp/ca/{guid}/renew:
    parameters:
    - name: guid
      in: path
      description: ''
      required: true
      schema:
        type: string
    post:
      tags:
      - HashiCorp PKI APIs
      summary: Initiate renewal or first time enrollment
      description: 'Initiate renewal or first time enrollment of a HashiCorp Vault PKI intermediate CA certificate.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_EnrollAndProvision
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
  /vedsdk/pki/hashicorp/ca/:
    post:
      tags:
      - HashiCorp PKI APIs
      summary: Define configuration
      description: 'Define configuration for Trust Protection Foundation to manage the intermediate CA certificate.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_Create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_CreatePkiResponse'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
    get:
      tags:
      - HashiCorp PKI APIs
      summary: List all HashiCorp Vault PKI secrets
      description: 'List all HashiCorp Vault PKI secrets engines that are managed by Trust Protection Foundation.


        _Required scope: certificate_'
      operationId: Venafi_Drivers_Applications_HashiCorp_HashiCorpPkiConfiguration_Get
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Drivers_Applications_HashiCorp_REST_Pkis'
        '403':
          description: ' The API requires a scope not granted to the provided access token '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '400':
          description: ' Missing or invalid request property. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
        '401':
          description: ' A valid access token is required. '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
      security:
      - AccessToken: []
components:
  schemas:
    Drivers_Applications_HashiCorp_REST_Pkis:
      type: object
      properties:
        pkis:
          type: array
          items:
            type: object
            properties:
              PkiGuid:
                type: string
                description: Guid of PKI object.
              PkiDn:
                type: string
                description: DN of PKI object.
              CertificateGuid:
                type: string
                description: Guid of certificate associated to PKI object.
              CertificateDn:
                type: string
                description: DN of certificate associated to PKI object.
            description: PKI object.
          description: List if PKI objects.
        Error:
          type: string
          description: Error.
      description: List of all PKI objects.
    Drivers_Applications_HashiCorp_REST_CreateRoleRequest_:
      required:
      - FolderDn
      - RoleName
      type: object
      properties:
        FolderDn:
          type: string
          description: Dn of the policy object.
        RoleName:
          type: string
          description: HashiCorp role name.
    Drivers_Applications_HashiCorp_REST_Role:
      type: object
      properties:
        Guid:
          type: string
          description: Guid of policy object.
        FolderDn:
          type: string
          description: Dn of the policy object.
        RoleName:
          type: string
          description: HashiCorp role name.
        WhitelistedDomains:
          type: array
          items:
            type: string
          description: Whitelisted domains.
        OrganizationalUnits:
          type: array
          items:
            type: string
          description: Organizational unit.
        Organization:
          type: string
          description: Organization.
        City:
          type: string
          description: City.
        State:
          type: string
          description: State.
        Country:
          type: string
          description: Country.
        KeyAlgorithm:
          type: string
          description: Key algorithm.
        KeyBitSize:
          type: string
          description: Key strength.
        PkixParameterSet:
          type: string
          description: Pkix Parameter Set
        EnhancedKeyUsage:
          type: array
          items:
            type: string
          description: Enhanced key usage (server_flag, client_flag, code_signing_flag, email_protection_flag).
        Error:
          type: string
          description: Error.
      description: HashiCorp Role policy object.
    Web_SDK_Authentication_OAuthError:
      type: object
      properties:
        error:
          type: string
          description: Gets or sets the short error name
        error_description:
          type: string
          description: Gets or sets the description of the error
      description: REST OAuth Error Response
    Drivers_Applications_HashiCorp_REST_PkiResponse:
      type: object
      properties:
        FolderDn:
          type: string
          description: Device DN where PKI object should be created.
        PkiPath:
          type: string
          description: PKI path name.
        Certificate:
          type: object
          properties:
            CommonName:
              type: string
              description: Common name.
            Organization:
              type: string
              description: Organization.
            OrganizationalUnits:
              type: array
              items:
                type: string
              description: Organization units.
            City:
              type: string
              description: City.
            State:
              type: string
              description: State.
            Country:
              type: string
              description: Country.
            SubjectAltNames:
              type: array
              items:
                type: object
                properties:
                  Name:
                    type: string
                    description: Name
                  TypeName:
                    type: string
                    description: Type (DNS, RFC822, UPN, URI, IP)
                description: Subject alternative name collection.
              description: Subject alternative name collection.
            KeyBitSize:
              type: string
              description: DEPRECATED - Use PkixParameterSet
            KeyAlgorithm:
              type: string
              description: DEPRECATED - Use PkixParameterSet
            PkixParameterSet:
              type: string
              description: PKIX Parameter Set
          description: CA certificate configuration.
        Installation:
          type: object
          properties:
            Host:
              type: string
              description: Pki host.
            Port:
              type:
              - integer
              - 'null'
              description: Pki port.
              format: int32
            CredentialDn:
              type: string
              description: DN of password credential object.
            Status:
              type: string
              description: Installation status.
            InError:
              type: boolean
              description: Installation is in error flag.
          description: PKI installation settings.
        CRLAddress:
          type: string
          description: CRL address.
        OCSPAddress:
          type: string
          description: OCSP address.
        CreateCertificateAuthority:
          type: boolean
          description: If true, creates CA if doesn't exist.
        CreatePKIRole:
          type: boolean
          description: If true, creates Role if doesn't exist.
        Roles:
          type: array
          items:
            type: string
          description: Roles.
        Error:
          type: string
          description: Error.
      description: PKI details.
    Drivers_Applications_HashiCorp_REST_CreateRoleResponse:
      type: object
      properties:
        Guid:
          type: string
          description: Guid of created role.
        Error:
          type: string
          description: Error.
      description: Response for role creation request.
    Drivers_Applications_HashiCorp_REST_CreatePkiRequest:
      type: object
      properties:
        FolderDn:
          type: string
          description: Device DN where PKI object should be created.
        PkiPath:
          type: string
          description: PKI path name.
        Certificate:
          type: object
          properties:
            CommonName:
              type: string
              description: Common name.
            Organization:
              type: string
              description: Organization.
            OrganizationalUnits:
              type: array
              items:
                type: string
              description: Organization units.
            City:
              type: string
              description: City.
            State:
              type: string
              description: State.
            Country:
              type: string
              description: Country.
            SubjectAltNames:
              type: array
              items:
                type: object
                properties:
                  Name:
                    type: string
                    description: Name
                  TypeName:
                    type: string
                    description: Type (DNS, RFC822, UPN, URI, IP)
                description: Subject alternative name collection.
              description: Subject alternative name collection.
            KeyBitSize:
              type: string
              description: DEPRECATED - Use PkixParameterSet
            KeyAlgorithm:
              type: string
              description: DEPRECATED - Use PkixParameterSet
            PkixParameterSet:
              type: string
              description: PKIX Parameter Set
          description: CA certificate configuration.
        Installation:
          type: object
          properties:
            Host:
              type: string
              description: Pki host.
            Port:
              type:
              - integer
              - 'null'
              description: Pki port.
              format: int32
            CredentialDn:
              type: string
              description: DN of password credential object.
          description: PKI installation settings.
        CRLAddress:
          type: string
          description: CRL address.
        OCSPAddress:
          type: string
          description: OCSP address.
        CreateCertificateAuthority:
          type:
          - boolean
          - 'null'
          description: If true, creates CA if doesn't exist.
        CreatePKIRole:
          type:
          - boolean
          - 'null'
          description: If true, creates Role if doesn't exist.
        Roles:
          type: array
          items:
            type: string
          description: Roles.
      description: Create HashiCorp PKI request.
    Drivers_Applications_HashiCorp_REST_CreatePkiResponse:
      type: object
      properties:
        Guid:
          type: string
          description: Guid of PKI object.
        CertificateGuid:
          type: string
          description: Guid of associated certificate object.
        Error:
          type: string
          description: Error.
        CertificateDN:
          type: string
          description: DN of certificate object.
      description: Response for PKI create request.
  securitySchemes:
    AccessToken:
      type: http
      scheme: bearer