Preview renewing one certificate

POST 
/api/v1/operator/renewals/preview

Needs the mcp:renew:request scope, and the instance flag MCP_OPERATOR_WRITES_ENABLED and the workspace setting must both be on. Changes nothing except storing an expiring plan record. Runs the same validation a real renewal would, so it refuses what could not be renewed. The body is closed: only identityId. Response shape: packages/contracts/mcp/mcp-renew-tools.schema.json definition tt_preview_renew_output.

Responses

201

A plan, valid for ten minutes

400

Bad request

401

Unauthorized

402

Cloud workspace plan does not include certificate operations (PLAN_FEATURE_REQUIRED)

403

The connection lacks scope, assistant writes are disabled, or the Cloud workspace is frozen (WORKSPACE_FROZEN)

404

Not found

409

Refused for a stable reason: the plan does not match or the certificate changed since the preview, the request id was used for something different, the certificate is retired or unmanaged, the certificate authority is at capacity, or the workspace is paused. The code says which; the message is fixed wording.

410

The preview expired

429

Too many assistant requests are already waiting for approval

500

Internal server error