Skip to main content

Explain a certificate's state

GET 
/api/v1/operator/certificates/:identityId/explain

Deterministic and server-side. Composes reason codes the renewal-path, job and lifecycle services already produce and words them from a fixed table. It never returns a service's free-text summary or dependency list, which can name agents. Evidence that is missing is reported as an unknown area and never as a definitive answer. Authenticated only with an operator connection credential holding the mcp:certs:read scope; the workspace comes from the connection. Response shape: packages/contracts/mcp/mcp-read-tools.schema.json definition tt_explain_certificate_state_output (tool tt_explain_certificate_state). Unknown or repeated query parameters are refused with 400. Hidden with 404 while the operator interface or CertOps is disabled.

Request​

Responses​

Explain a certificate's state

Response Headers
    Cache-Control