---
title: "POST /get-kube-exec-creds"
method: POST
path: "/get-kube-exec-creds"
tags: ["Authentication"]
---

# POST /get-kube-exec-creds

`POST /get-kube-exec-creds`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/get-kube-exec-creds`
- Auth: none declared

## Request body

- GetKubeExecCreds: getKubeExecCreds is a command that gets credentials for authentication with Kubernetes cluster based on a PKI cert issuer.
  - `alt-names` string: The Subject Alternative Names to be included in the PKI certificate (in a comma-separated list) (if CSR is supplied this flag is ignored and any DNS.* names are taken from it)
  - `api-version` string: Client authentication API version
  - `cert-issuer-name` string, required: The name of the PKI certificate issuer
  - `common-name` string: The common name to be included in the PKI certificate (if CSR is supplied this flag is ignored and the CSR subject CN is taken)
  - `csr-data-base64` string: Certificate Signing Request contents encoded in base64 to generate the certificate with
  - `extended-key-usage` string: A comma-separated list of extended key usage requests which will be used for certificate issuance. Supported values: 'clientauth', 'serverauth', 'codesigning'. If critical is present the extension will be marked as critical
  - `extra-extensions` string: A json string that defines the requested extra extensions for the certificate
  - `json` boolean: Set output format to JSON
  - `key-data-base64` string: PKI key file contents. If this option is used, the certificate will be printed to stdout
  - `max-path-len` integer: The maximum path length for the generated certificate. -1, means unlimited unless the signing certificate has a maximum path length set
  - `token` string: Authentication token (see `/auth` and `/configure`)
  - `ttl` string: Updated certificate lifetime in seconds (must be less than the Certificate Issuer default TTL). Ignored for Let's Encrypt public CA issuers, which always use the CA default lifetime (about 90 days).
  - `uid-token` string: The universal identity token, Required only for universal_identity authentication
  - `uri-sans` string: The URI Subject Alternative Names to be included in the PKI certificate (in a comma-separated list) (if CSR is supplied this flag is ignored and any URI.* names are taken from it)

## Response `200`

getKubeExecCredsResponse wraps response body.

- GetKubeExecCredsOutput
  - `apiVersion` string
  - `kind` string
  - `status` ClientData
    - `clientCertificateData` string
    - `clientKeyData` string
    - `parentCertificateData` string

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.dev/akeyless/apis/identity-access.md) - [All operations](https://skmtc.dev/akeyless/apis/identity-access/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/identity-access/revisions/6fbc3858ec88?raw)