CertOps
Certificate lifecycle orchestration (workspace-scoped). Control plane never stores private key material. Workspace managers can create executor jobs manually with Create a manual CertOps job (POST /api/v1/workspaces/{id}/certops/jobs) or the dashboard Create manual job button.
List managed certificates
Returns the workspace's managed certificate inventory. Response objects contain public certificate material and public metadata only.
Create or register a managed certificate
Registers a managed certificate from public certificate material. Request bodies containing private key material are rejected before feature gating.
Get a managed certificate
Returns a single managed certificate. Response objects contain public certificate material and public metadata only.
List managed certificate instances
Returns public, workspace-scoped certificate observation history for one managed certificate. Private key material, evidence, raw output, and secret fields are never returned.
Retire a managed certificate
Soft-retires a managed certificate by moving public lifecycle status to revoked or decommissioned. The managed certificate, linked token, and instance history are preserved; request bodies containing private key material are rejected before feature gating.
Import certificates from public material
Imports certificates from PEM/public material. Private key material is rejected before feature gating.
List CertOps jobs
Returns paginated public CertOps job summaries for the workspace. Consumers must follow pagination.limit and pagination.offset; long job histories can require multiple requests. Private key material, raw executor output, token hashes, and credentials are never returned.
Create a manual CertOps job
Creates a workspace-scoped CertOps job through the manual creation surface. This is a session-authenticated exception path for the pre-certops-scheduler window (and a break-glass path afterward); jobs created this way are always recorded with source 'api' and cannot be attributed to the executor or automated-scheduler pipelines. Requires workspace_manager role or above. Private key or secret material in the request body is rejected.
Get a CertOps job
Returns one sanitized CertOps job detail for the authorized workspace.
List CertOps job log entries
Returns paginated sanitized timeline entries for one workspace-scoped CertOps job. Consumers must follow pagination.limit and pagination.offset; long job histories can require multiple requests.
List CertOps job evidence
Returns paginated sanitized public evidence metadata for one workspace-scoped CertOps job. Consumers must follow pagination.limit and pagination.offset; long job histories can require multiple requests. Raw secrets, private keys, token hashes, and key-bearing artifacts are never returned.
List CertOps API tokens
Returns workspace-scoped CertOps API-token metadata only. Plaintext tokens, token hashes, Authorization headers, and credential material are never returned.
Issue a scoped CertOps API token
Issues a scoped CertOps API token. The one-time plaintext token is returned only by this create response and is never stored in recoverable form. List and revoke responses never include plaintext tokens, token hashes, Authorization headers, or credential material.
Revoke a scoped CertOps API token
Revokes a scoped CertOps API token within the authorized workspace and returns metadata only. The response never includes plaintext tokens, token hashes, Authorization headers, or credential material.