Venafi SSH Certificate APIs API
The SSH Certificate APIs allow to manage the issuance of special certificates for SSH devices. These endpoints are valid only if you purchased SSH Manager for Machines.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/venafi-ssh-certificate-apis-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Trust Protection Foundation WebSDK SSH Certificate APIs API
description: '# Introduction
The Trust Protection Foundation Web SDK is a subset of REST APIs that allow you to:
* Automate certificate management
* Integrate with DevOps processes
* Discover machine identities
* Extract data to integrate with data warehouses
* Perform bulk actions
* Set up and administer Trust Protection Foundation
* Onboard teams
* Create custom, automated business logic and flows between internal systems
All these use cases can be accomplished using the Trust Protection Foundation REST…'
version: 26.1.1
servers:
- url: /
description: Current Host
- url: https://REPLACEdnsnameME/
description: System
- url: https://{dnsname}/
description: Configurable Hostname
variables:
dnsname:
default: localhost
description: Production API Hostname
security:
- AccessToken: []
tags:
- name: SSH Certificate APIs
description: The SSH Certificate APIs allow to manage the issuance of special certificates for SSH devices. These endpoints are valid only if you purchased SSH Manager for Machines.
paths:
/vedsdk/sshcertificates/request:
post:
tags:
- SSH Certificate APIs
summary: Requests a new SSH certificate
description: 'This endpoint can be used to request an SSH certificate based on the supplied parameters.
Prerequisites:
Requires setup. A master administrator or security team creates a SSH Certificate Issuance Template.
To see defaults and options, open the template from Configuration. For more information, see the SSH Key Discovery and Remediation Guide.
Permissions:
- The caller must have View and Create permission to the CA template (CADN).
- If the caller is passing CADN and PolicyDN: The caller must have View and Create permission to both the Certificate Issuance Template (CADN) and the Policy folder (PolicyDN) for the SSH certificate.
_Required scope: Any_'
operationId: Venafi_SshCertificate_WebSDK_SshCertificateRestService_RequestCertificate
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_Requests_RequestNewCertificateWebRequest'
required: true
responses:
'200':
description: SSH certificate has been successfully requested
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_RequestCertificateResponse'
'400':
description: Invalid request
'401':
description: Unauthorized
security:
- AccessToken: []
/vedsdk/sshcertificates/retrieve:
post:
tags:
- SSH Certificate APIs
summary: Returns the available certificate data and optional private key information for…
description: '_Required scope: Any_'
operationId: Venafi_SshCertificate_WebSDK_SshCertificateRestService_RetrieveCertificate
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_Requests_RetrieveCertificateWebRequest'
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_RetrieveCertificateResponse'
/vedsdk/sshcertificates/template/available:
get:
tags:
- SSH Certificate APIs
summary: Returns a list of SSH CA templates the current user can request certificates…
description: '_Required scope: Any_'
operationId: Venafi_SshCertificate_WebSDK_SshCertificateRestService_GetAvailableTemplates
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/List_1_SshCertificate_WebSDK_DataContract_AvailableTemplateResponse_'
/vedsdk/sshcertificates/template/retrieve:
post:
tags:
- SSH Certificate APIs
summary: Returns information about an SSH CA template
description: '_Required scope: Any_'
operationId: Venafi_SshCertificate_WebSDK_SshCertificateRestService_RetrieveTemplate
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_Requests_RetrieveTemplateWebRequest'
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_RetrieveTemplateResponse'
/vedsdk/sshcertificates/CaKeyPair/create:
post:
tags:
- SSH Certificate APIs
summary: Create new CA Keypair
description: '_Required scope: Any_'
operationId: Venafi_SshCertificate_WebSDK_SshCertificateRestService_CreateNewCAKeypair
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_Requests_CreateNewCAKeypairWebRequest'
required: true
responses:
'200':
description: SSH certificate has been successfully requested
content:
application/json:
schema:
$ref: '#/components/schemas/SshCertificate_WebSDK_DataContract_CreateCaKeyPairResponse'
'400':
description: Invalid request
'401':
description: Unauthorized
security:
- AccessToken: []
components:
schemas:
SshCertificate_WebSDK_DataContract_Requests_CreateNewCAKeypairWebRequest:
type: object
properties:
Name:
type: string
description: The friendly name of the CA key.
ParentDN:
type: string
description: The DN of the parent container.
KeyAlgorithm:
type: string
description: DEPRECATED - use PkixParameterSet instead
PkixParameterSet:
type: string
description: The PKIX Parameter Set describing the key algorithm which will be used to generate new key material.
KeyStorage:
type: string
description: The location where the key will be generated and stored.
PrivateKeyData:
type: string
description: The private key material which will be imported.
PrivateKeyPassphrase:
type: string
description: The passphrase which will be used to decrypt the PrivateKeyData.
description: The class for new CA keypair.
SshCertificate_WebSDK_DataContract_RetrieveTemplateResponse:
type: object
properties:
DN:
type: string
description: The DN of the template.
Guid:
type: string
description: The unique identifier of the template.
Name:
type: string
description: The name of the template.
Contacts:
type: array
items:
type: string
description: List identities for users or groups who receive notifications about events pertaining to the object.
CertificateObjectNamingPattern:
type: string
description: Pattern used to name the certificate objects dinamically
UseCertificateObjectNamingPattern:
type: boolean
description: Specify if the certificate object's name will be supplied on the request or if it will be built using a naming pattern
CreatedOn:
type: string
description: The creation date of the template.
CAKeyPairDN:
type: string
description: The CA key pair dn of the template.
CAKeyPairGuid:
type: string
description: The CA key pair guid of the template.
CAKeyPair:
type: object
properties:
DN:
type: string
description: The DN of the CA key pair.
Guid:
type: string
description: The unique identifier of the CA key pair.
Name:
type: string
description: The name of the CA key pair
PublicKeyData:
type: string
description: The CA public key of the requested template in a format which can be directly consumed by OpenSSH daemon.
FingerprintSHA256:
type: string
description: Base64 encoded SHA256 hash of the CA public key.
KeyAlgorithm:
type: string
description: DEPRECATED - use PkixParameterSet instead
PkixParameterSet:
type: string
description: The PKIX Parameter Set describing the algorithm and size/curve of the CA key.
CreatedOn:
type: string
description: The creation date of the CA key.
description: CAKeyPair section for the template.
Certificate:
type: object
properties:
CertificateDestinationDn:
type: string
description: The DN of the policy folder where issued certificates will be stored by default.
Type:
type: string
description: The type ("client" or "host") of certificates that this template issues.
ValidityPeriod:
type: string
description: The maximum certificate validity period.
AllowedPrivateKeyAlgorithms:
type: array
items:
type: string
description: The algorithms of the keys that can be sent for signing.
DefaultPrivateKeyAlgorithm:
type: string
description: The key algorithm and size/curve that will be used when a keys need to be generated by the service.
SignatureHashingAlgorithm:
type: string
description: The hashing algorithm which is used when signing certificates.
AllowPrivateKeyReuse:
type: boolean
description: Allow the reuse of the private key.
description: Certificate for the template.
AccessControl:
type: object
properties:
DefaultPrincipals:
type: array
items:
type: string
description: The default principals set on the certificate template
AllowedPrincipalsPatterns:
type: array
items:
type: string
description: The patterns which will be used to validate the requested principals.
AllowedExtensions:
type: array
items:
type: string
description: Includes standard and custom extensions allowed to be requested.
DefaultExtensions:
type: array
items:
type: string
description: DefaultExtensions
AllowedSourceAddresses:
type: array
items:
type: string
description: AllowedSourceAddresses
DefaultSourceAddresses:
type: array
items:
type: string
description: DefaultSourceAddresses
AllowedCertificateIdentifierPatterns:
type: array
items:
type: string
description: AllowedCertificateIdentifierPatterns
DefaultCertificateIdentifier:
type: string
description: DefaultCertificateIdentifier
AllowedForceCommandPatterns:
type: array
items:
type: string
description: AllowedForceCommandPatterns
DefaultForceCommand:
type: string
description: DefaultForceCommand
description: AccessControl section for the template.
APIClient:
type: object
properties:
AllowedToRequestPrincipals:
type: boolean
description: Enable or disable API clients to specify Principals
AllowedToRequestExtensions:
type: boolean
description: Enable or disable API clients to specify Extensions
AllowedToRequestForceCommand:
type: boolean
description: Allow API clients to specify Force Command
AllowedToRequestSourceAddresses:
type: boolean
description: Enable or disable API clients to specify Source Addresses
AllowedToRequestCertificateIdentifier:
type: boolean
description: Enable or disable API clients to specify Certificate Identifier
IncludeIssuedCertificateInRequest:
type: boolean
description: Enable or disable API clients to receive issued certificates in response to their enrollment requests
description: APIClient section for the template.
Response:
type: object
properties:
Success:
type: boolean
description: 'true: The operation succeeded
false: The operation failed.'
ErrorCode:
type: integer
description: Omitted if Success is true. The code that describes the error if any.
format: int32
ErrorMessage:
type: string
description: Omitted if Success is true.The corresponding error message if any.
description: SshWebResponse object with result of the operation.
description: The class for retrieving ssh certificate template response
SshCertificate_WebSDK_DataContract_CreateCaKeyPairResponse:
type: object
properties:
DN:
type: string
description: The DN of the object.
Guid:
type: string
description: A value that uniquely identifies the object.
Name:
type: string
description: The name of the CaKeyPair.
FingerprintSHA256:
type: string
description: The SHA256 fingerprint of the public key.
KeyAlgorithm:
type: string
description: DEPRECATED - use PkixParameterSet instead
PkixParameterSet:
type: string
description: The PKIX Parameter Set describing the key algorithm.
PublicKeyData:
type: string
description: The public key data.
CreatedOn:
type: string
description: The creation date of the CaKeyPair object.
ProcessingDetails:
type: object
properties:
Status:
type: string
description: The status.
StatusDescription:
type: string
description: The status description.
description: The processing details.
KeyStorage:
type: string
description: The key storage.
Response:
type: object
properties:
Success:
type: boolean
description: 'true: The operation succeeded
false: The operation failed.'
ErrorCode:
type: integer
description: Omitted if Success is true. The code that describes the error if any.
format: int32
ErrorMessage:
type: string
description: Omitted if Success is true.The corresponding error message if any.
description: SshWebResponse object with result of the operation.
description: The class for requesting new CaKeyPair response.
List_1_SshCertificate_WebSDK_DataContract_AvailableTemplateResponse_:
type: array
items:
type: object
properties:
DN:
type: string
description: The DN of the template.
Guid:
type: string
description: The unique identifier of the template.
description: The class defining details of an available for user template.
SshCertificate_WebSDK_DataContract_Requests_RetrieveCertificateWebRequest:
type: object
properties:
PrivateKeyPassphrase:
type: string
description: The passphrase which will be used to wrap the generated private key before it is returned in the API response.
IncludePrivateKeyData:
type: boolean
description: Whether or not to include the private key material.
IncludeCertificateDetails:
type: boolean
description: Whether or not to include the certificate details in the response.
DN:
type: string
description: The DN of the requested object.
Guid:
type: string
description: A value that uniquely identifies the object.
description: The class for retrieve certificate request.
SshCertificate_WebSDK_DataContract_RetrieveCertificateResponse:
type: object
properties:
Guid:
type: string
description: A value that uniquely identifies the certificate request.
DN:
type: string
description: The DN of the created SSH certificate object.
CertificateData:
type: string
description: Base-64 encoded string of the issued certificate.
PrivateKeyData:
type: string
description: The private key in base-64 encoded PEM/OpenSSH format which can be directly consumed by SSH clients.
PublicKeyData:
type: string
description: The public key in base-64 encoded OpenSSH format which can be directly consumed by SSH clients.
CAGuid:
type: string
description: Unique identifier of the CA used to sign the requested certificate.
ProcessingDetails:
type: object
properties:
Status:
type: string
description: The current status of the certificate.
StatusDescription:
type: string
description: Description of the current certificate status
RequestDetails:
type: object
properties:
DestinationAddress:
type: string
description: The class for the processing details response.
RequestedBy:
type: string
description: The class for the processing details response.
OriginatingIP:
type: string
description: The class for the processing details response.
CADN:
type: string
description: The DN of the CA used to sign the requested certificate.
CertificateDetails:
type: object
properties:
KeyType:
type: string
description: The type of the key.
CertificateType:
type: string
description: Indicates whether the issued certificate is for client or host authentication.
CertificateFingerprintSHA256:
type: string
description: Base-64 encoded SHA256 hash of the base-64 part of the issued certificate.
CAFingerprintSHA256:
type: string
description: Base-64 encoded SHA256 hash of the public key of the CA used for signing the requested certificate.
PublicKeyFingerprintSHA256:
type: string
description: Base-64 encoded SHA256 hash of the public key that was signed.
KeyID:
type: string
description: The identifier of the issued certificate.
SerialNumber:
type: string
description: The serial number of the certificate.
Principals:
type: array
items:
type: string
description: The principals of the issued certificate.
ValidFrom:
type: integer
description: A time in second since 1970-01-01 00:00:00 after the certificate is valid.
format: int64
ValidTo:
type: integer
description: A time in second since 1970-01-01 00:00:00 before the certificate is valid.
format: int64
ForceCommand:
type: string
description: The Force Command of the issued certificate.
SourceAddresses:
type: array
items:
type: string
description: The Source Addresses of the issued certificate.
Extensions:
type: object
additionalProperties:
type: string
description: The extensions of the issued certificate.
description: "_This property is a dictionary._ \nkey1: value1 \nkey2: value2 \n..."
description: The details of the issued certificate.
Response:
type: object
properties:
Success:
type: boolean
description: 'true: The operation succeeded
false: The operation failed.'
ErrorCode:
type: integer
description: Omitted if Success is true. The code that describes the error if any.
format: int32
ErrorMessage:
type: string
description: Omitted if Success is true.The corresponding error message if any.
description: SshWebResponse object with result of the operation.
description: The class for retrieving certificate response.
SshCertificate_WebSDK_DataContract_Requests_RetrieveTemplateWebRequest:
type: object
properties:
IncludeCAKeyPairDetails:
type: boolean
description: Whether or not to include the CA key pair details in the response.
DN:
type: string
description: The DN of the requested object.
Guid:
type: string
description: A value that uniquely identifies the object.
description: The class for retrieve template request.
SshCertificate_WebSDK_DataContract_RequestCertificateResponse:
type: object
properties:
DN:
type: string
description: The DN of the created SSH certificate object.
Guid:
type: string
description: A value that uniquely identifies the certificate object.
ProcessingDetails:
type: object
properties:
Status:
type: string
description: The current status of the certificate.
StatusDescription:
type: string
description: Description of the current certificate status
description: Provide the processing details of the certificate.
Response:
type: object
properties:
Success:
type: boolean
description: 'true: The operation succeeded
false: The operation failed.'
ErrorCode:
type: integer
description: Omitted if Success is true. The code that describes the error if any.
format: int32
ErrorMessage:
type: string
description: Omitted if Success is true.The corresponding error message if any.
description: SshWebResponse object with result of the operation.
description: The class for requesting new certificate response.
SshCertificate_WebSDK_DataContract_Requests_RequestNewCertificateWebRequest:
type: object
properties:
CADN:
type: string
description: The Distinguished Name (DN) of the issuing certificate template which will be used for signing.
PolicyDN:
type: string
description: (Optional) The DN of the policy folder where the certificate object will be created. Omit this parameter if you want the default from the SSH Certificate Issuance Template.
ObjectName:
type: string
description: '(Optional) The friendly name for the certificate object. If not specified, KeyId will be used as friendly name.
If certificate object with the same name is already present in the Policy folder (PolicyDN), then the old certificate is archived, and the CA issues a new certificate.'
DestinationAddress:
type: string
description: '(Optional) The destination host where the certificate will authenticate. Specify a Fully Qualified Domain name (FQDN) or IP address.
Only applies to client certificates for reporting or auditing.'
Origin:
type: string
description: (Optional) Additional information, such as the name and version of the calling application (Origin)
RequestedBy:
type: string
description: Prefixed universal ID of the user which requested the certificate.
OriginatingIP:
type: string
description: The IP of the client which requested the certificate.
KeyId:
type: string
description: The certificate identifier (Key ID) of the requested certificate (usually used to determine ownership).
Principals:
type: array
items:
type: string
description: (Optional) An array of names for which the requested certificate will be valid. Omit this parameter if you want the template defaults to be used.
ValidityPeriod:
type: string
description: '(Optional) The requested certificate expiration time. Cannot be greater than the maximum certificate validity configured on template.
If not provided, the maximum certificate validity configured on template will be used.
One of the following formats:
- Relative time: The format is space delimited in w (weeks) d (days) h (hours), m (minutes), s (seconds) Example: 1w 2d 3h 4m 50s.
- Universal Time Coordinated (UTC): One of these formats:
- Calendar date: Use the yyyyMMdd format. For example, 20251217.
- Both date and time: Use the yyyyMMddHHmmss format. For example, 20211217235900.'
PublicKeyData:
type: string
description: '(Optional) The Base-64 encoded public key in OpenSSH format which will be signed. Omit this parameter if you want the service
to generate a new key pair. The key algorithm must be allowed on the policy.
The Comment section at the end of the public key is optional.'
Extensions:
type: object
additionalProperties:
type: string
description: '(Optional) A case sensitive set of key-value pairs that contain certificate extensions. Omit this parameter
if you want the default from the SSH Certificate Issuance Template. Valid only for client certificates.'
description: "_This property is a dictionary._ \nkey1: value1 \nkey2: value2 \n..."
ForceCommand:
type: string
description: (Optional) The command to execute after a successful login. Valid only for client certificates.
SourceAddresses:
type: array
items:
type: string
description: (Optional) An array of one or more valid Classless Inter-Domain Routing (CIDR) addresses that the certificate should be signed for. Valid only for client certificates.
PrivateKeyPassphrase:
type: string
description: The passphrase which will be used to wrap the generated private key before it is returned in the API response.
IncludePrivateKeyData:
type: boolean
description: Whether or not to include the private key material.
IncludeCertificateDetails:
type: boolean
description: Whether or not to include the certificate details in the response.
ProcessingTimeout:
type:
- integer
- 'null'
description: How much time the server will hold the connection waiting for certificate issuance before a Pending response is returned.
format: int32
description: The class for new certificate request.
securitySchemes:
AccessToken:
type: http
scheme: bearer