Venafi

Venafi is the machine identity security platform for discovering, issuing, provisioning and retiring TLS/SSL certificates, SSH keys, code-signing keys and workload identities across data centers, clouds and Kubernetes. Its Control Plane ships two public REST contracts: the SaaS "Certificate Manager - SaaS" API on api.venafi.cloud (six data-residency regions) and the self-hosted Trust Protection Foundation WebSDK. Venafi was acquired by CyberArk in 2024 and the products now carry CyberArk Certificate Manager branding; venafi.com itself 301s to Palo Alto Networks following its acquisition of CyberArk, while developer.venafi.com, docs.venafi.com, docs.venafi.cloud, api.venafi.cloud and github.com/Venafi remain live and are where every artifact in this profile came from.

Venafi publishes 2 APIs on the APIs.io network: Certificate Manager - SaaS API (Venafi Control Plane) and Trust Protection Foundation WebSDK (Venafi Trust Protection Platform). Tagged areas include Company, Security, Certificates, PKI, and Machine Identity.

The Venafi catalog on APIs.io includes 1 event-driven AsyncAPI specification.

Venafi’s developer surface includes authentication, documentation, API reference, getting-started guide, support, signup flow, changelog, and 23 more developer resources.

🌐 Visit website 📡 Source on GitHub
46.6/100 developing Agent 32/100 agent ready Full breakdown ↓
scored 2026-09-02 · rubric v0.18.0
2 APIs 1 MCP Servers
CompanySecurityCertificatesPKIMachine IdentityIdentityCryptographyKey ManagementCertificate Lifecycle ManagementDevOpsKubernetesCode Signing

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-09-02 · rubric v0.18.0
Composite quality — 46.6/100 · developing
Contract Quality 15.0 / 25
Developer Ergonomics 14.2 / 20
Access Clarity 2.6 / 20
Operational Transparency 5.8 / 13
Contract Governance 2.2 / 12
Discoverability 6.9 / 10
Agent readiness — 32/100 · agent ready
Machine-Readable Contract 18 / 18
Agentic Access Contract 0 / 10
Documented Reversibility 0 / 6
MCP Server 12 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 8 / 8
Request/Response Examples 7 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 6 / 6
Agent Skills 5 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Delegated User Identity 0 / 6
Protected Resource Metadata 0 / 5
Registration Without a Human 0 / 6
Agentic Commerce Surface 0 / 5
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from github.com/api-evangelist/venafi: open an issue to ask a question, or submit a pull request to add artifacts. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

APIs 2

Individual APIs this provider publishes, each with its own machine-readable definition.

Certificate Manager - SaaS API (Venafi Control Plane)

The Venafi / CyberArk Certificate Manager - SaaS REST API. 184 operations across 120 paths covering certificate inventory and search, certificate requests and issuing templates,...

Trust Protection Foundation WebSDK (Venafi Trust Protection Platform)

The self-hosted Venafi / CyberArk Trust Protection Foundation Web SDK, version 26.1.1. 388 operations across 364 paths covering certificate management, discovery, identity and p...

MCP Servers 1

Model Context Protocol servers that expose these APIs to AI agents.

Venafi MCP Server

MCP SERVER

Pricing Plans 1

Published pricing tiers and plan structures.

Venafi Plans Pricing

0 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Venafi Rate Limits

0 limits

RATE LIMITS

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Venafi Certificate Manager Saas Webhooks

ASYNCAPI

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Venafi Authentication

apiKey/http/oauth2 · 4 schemes

SECURITY

Venafi Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Scopes 1

OAuth scopes governing access to this provider's APIs.

Venafi Scopes

OAuth 2.0 · no documented scopes

0 scopes

SCOPES

Resources

Get Started 3

Portal, sign-up, and the first successful call

DeveloperPortal
DeveloperPortal
 GettingStarted
GettingStarted
 SignUp
SignUp

Documentation 2

Reference material describing how the API behaves

Documentation
Documentation
 APIReference
APIReference

Agent Surfaces 3

MCP servers, agent skills, and machine-readable catalogs

MCPServer
MCPServer
 LLMsTxt
LLMsTxt
 AgentSkill
AgentSkill

Design & Contract 6

Pagination, idempotency, versioning, errors, and events

Conformance
Conformance
 ErrorCatalog
ErrorCatalog
 Lifecycle
Lifecycle
 Conventions
Conventions
 DataModel
DataModel
 Webhooks
Webhooks

Build 4

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization
 Packages
Packages
 SDKs
SDKs
 CLI
CLI

Access & Security 3

Authentication, authorization, and security posture

DomainSecurity
DomainSecurity
 Authentication
Authentication
 OAuthScopes
OAuthScopes

Operate 5

Status, limits, changes, and where to get help

Support
Support
 StatusPage
StatusPage
 ChangeLog
ChangeLog
 ChangeLog
ChangeLog
 RateLimits
RateLimits

Commercial 1

Pricing, plans, and the legal terms of use

Plans
Plans

Company 1

The organization behind the API

Website
Website

Other 2

Properties that don't map to a standard resource type

Overlay
Overlay
 Overlay
Overlay

Source (apis.yml)

apis.yml Raw ↑ 
aid: venafi
name: Venafi
description: 'Venafi is the machine identity security platform for discovering, issuing, provisioning and retiring TLS/SSL
  certificates, SSH keys, code-signing keys and workload identities across data centers, clouds and Kubernetes. Its Control
  Plane ships two public REST contracts: the SaaS "Certificate Manager - SaaS" API on api.venafi.cloud (six data-residency
  regions) and the self-hosted Trust Protection Foundation WebSDK. Venafi was acquired by CyberArk in 2024 and the products
  now carry CyberArk Certificate Manager branding; venafi.com itself 301s to Palo Alto Networks following its acquisition
  of CyberArk, while developer.venafi.com, docs.venafi.com, docs.venafi.cloud, api.venafi.cloud and github.com/Venafi remain
  live and are where every artifact in this profile came from.'
image: https://avatars.githubusercontent.com/u/7817722?v=4
url: https://raw.githubusercontent.com/api-evangelist/venafi/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-09-02'
modified: '2026-09-02'
tags:
- Company
- Security
- Certificates
- PKI
- Machine Identity
- Identity
- Cryptography
- Key Management
- Certificate Lifecycle Management
- DevOps
- Kubernetes
- Code Signing
apis:
- aid: venafi:certificate-manager-saas
  name: Certificate Manager - SaaS API (Venafi Control Plane)
  description: The Venafi / CyberArk Certificate Manager - SaaS REST API. 184 operations across 120 paths covering certificate
    inventory and search, certificate requests and issuing templates, applications, machines and machine identities, credential
    managers, teams and users, service accounts and scopes, tags, event logs, VSatellites (edge instances/workers), webhook
    connectors, expiration/auto-renewal monitoring, approval rules, plugins and Workload Identity Manager (distributed issuers).
    Served from six regional hosts under venafi.cloud.
  humanURL: https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
  baseURL: https://api.venafi.cloud
  tags:
  - Certificates
  - PKI
  - Machine Identity
  - Certificate Lifecycle Management
  - Security
  properties:
  - type: OpenAPI
    url: openapi/venafi-certificate-manager-saas-openapi.yml
  - type: Documentation
    url: https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
  - type: Webhooks
    url: asyncapi/venafi-certificate-manager-saas-webhooks.yml
- aid: venafi:trust-protection-foundation-websdk
  name: Trust Protection Foundation WebSDK (Venafi Trust Protection Platform)
  description: The self-hosted Venafi / CyberArk Trust Protection Foundation Web SDK, version 26.1.1. 388 operations across
    364 paths covering certificate management, discovery, identity and permissions, OAuth application/scope administration
    (/vedauth, /vedsdk/oauth), SSH certificates and authorized keys, code signing and HSM, SecretStore, flows, recycle bin,
    processing engines, statistics and system status. Because the product is customer-installed, the contract publishes a
    templated server (https://{dnsname}/) rather than a vendor host.
  humanURL: https://docs.venafi.com/Docs/currentAPI/
  baseURL: https://{dnsname}/
  tags:
  - Certificates
  - PKI
  - SSH
  - Code Signing
  - Machine Identity
  properties:
  - type: OpenAPI
    url: openapi/venafi-trust-protection-foundation-websdk-openapi.yml
  - type: Documentation
    url: https://docs.venafi.com/Docs/currentSDK/TopNav/Content/SDK/WebSDK/cco-sdk-GettingStarted.php
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DomainSecurity
  url: security/venafi-domain-security.yml
- type: Authentication
  url: authentication/venafi-authentication.yml
- type: Website
  url: https://venafi.com/
- type: DeveloperPortal
  url: https://developer.venafi.com/tlsprotectcloud
- type: Documentation
  url: https://docs.venafi.cloud/
- type: APIReference
  url: https://developer.venafi.com/tlsprotectcloud/reference/tls-protect-overview
- type: GettingStarted
  url: https://docs.venafi.cloud/api/api-setup/
- type: Support
  url: https://community.cyberark.com/s/
- type: GitHubOrganization
  url: https://github.com/Venafi
- type: SignUp
  url: https://login.venafi.cloud/
- type: StatusPage
  url: https://status.venafi.cloud/
- type: ChangeLog
  url: https://docs.venafi.cloud/whatsnew/
- type: Packages
  url: packages/venafi-packages.yml
- type: SDKs
  url: packages/venafi-packages.yml
- type: CLI
  url: cli/venafi-cli.yml
- type: MCPServer
  url: mcp/venafi-mcp.yml
- type: LLMsTxt
  url: llms/venafi-llms.txt
- type: Overlay
  url: overlays/venafi-certificate-manager-saas-overlay.yaml
- type: Overlay
  url: overlays/venafi-trust-protection-foundation-websdk-overlay.yaml
- type: Conformance
  url: conformance/venafi-conformance.yml
- type: ErrorCatalog
  url: errors/venafi-problem-types.yml
- type: Lifecycle
  url: lifecycle/venafi-lifecycle.yml
- type: OAuthScopes
  url: scopes/venafi-scopes.yml
- type: Conventions
  url: conventions/venafi-conventions.yml
- type: ChangeLog
  url: changelog/venafi-changelog.yml
- type: DataModel
  url: data-model/venafi-data-model.yml
- type: Webhooks
  url: asyncapi/venafi-certificate-manager-saas-webhooks.yml
- type: AgentSkill
  url: skills/_index.yml
- type: Plans
  url: plans/venafi-plans-pricing.yml
- type: RateLimits
  url: rate-limits/venafi-rate-limits.yml
x-enrichment:
  date: '2026-09-02'
  status: enriched
  artifacts_added: 29
  pass: local-v1

Work with this as data

Every provider here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for providers

9 MCP tools reach this
  • find_providersBrowse and filter every provider in the catalog.
  • get_provider_artifactsEvery artifact this provider publishes, grouped by type.
  • get_provider_operationsEvery operation across all of their OpenAPIs — one call instead of parsing every spec.
  • get_provider_toolsEvery MCP tool they ship, with the operation each wraps.
  • get_provider_evidenceHow each part of their score was established. Free — the basis for a claim should not sit behind it.
  • get_provider_ratingPRO — composite, band, trend and facet scores.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This provider 
curl "https://apis.io/api/v1/providers/venafi"
All providers 
curl "https://apis.io/api/v1/providers?limit=25"
Every operation they expose 
curl "https://apis.io/api/v1/providers/venafi/operations?limit=25"
How their score was established 
curl "https://apis.io/api/v1/providers/venafi/evidence"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.