Create a manual CertOps job
POST/api/v1/workspaces/:id/certops/jobs
Creates a workspace-scoped CertOps job through the manual creation surface. This is a session-authenticated exception path for the pre-certops-scheduler window (and a break-glass path afterward); jobs created this way are always recorded with source "api" and cannot be attributed to the executor or automated-scheduler pipelines. Requires workspace_manager role or above. Private key or secret material in the request body is rejected.
Request
Responses
- 201
- 400
- 401
- 403
- 404
- 409
- 422
- 500
- 503
Job created
Malformed request body, (for "distribute-trust"/"revoke-trust") an agentId that is not a well-formed UUID, or (for "renew") a payload naming an execution field other than "reason", which the server now resolves exclusively from the certificate's stored renewal profile.
Unauthorized
Forbidden
Not found, or (for "distribute-trust"/"revoke-trust") a well-formed agentId that does not match a registered agent in this workspace.
idempotencyKey conflict, workspace CertOps is paused, per-CA renewal capacity exceeded, the subject certificate has no agent-manageable key custody, or (for "distribute-trust"/"revoke-trust") the trust anchor is not currently active or the idempotencyKey (scoped to its full operation/target tuple) was already used with a different distribute-trust/revoke-trust request.
The request contained private-key or forbidden secret material
Internal server error
Workspace pause state could not be read; new CertOps work is denied fail-closed