---
title: "List of Certificate Authorities"
method: GET
path: "/iam/v2/certificate-authorities"
tags: ["Certificate Authorities (iam/v2)"]
---

# List of Certificate Authorities

`GET /iam/v2/certificate-authorities`

[![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](#section/Versioning/API-Lifecycle-Policy)

Retrieve a sorted, filtered, paginated list of all certificate authorities.

## Query parameters

- `page_size` integer
- `page_token` string

## Response `200`

Certificate Authority.

- IamV2CertificateAuthorityList — `CertificateAuthority` objects represent signing certificate authorities in Confluent Cloud. The API allows you to list, create, read, update, and delete your Certificate Authority.
  - `api_version` 'iam/v2', required — APIVersion defines the schema version of this representation of a resource.
  - `kind` 'CertificateAuthorityList', required — Kind defines the object this REST resource represents.
  - `metadata` object, required — ListMeta describes metadata that resource collections may have
    - `first` string, uri, nullable — A link to the first page of results. If a response does not contain a first link, then direct navigation to the first page is not supported.
    - `last` string, uri, nullable — A link to the last page of results. If a response does not contain a last link, then direct navigation to the last page is not supported.
    - `prev` string, uri, nullable — A link to the previous page of results. If a response does not contain a prev link, then either there is no previous data or backwards traversal through the result set is not supported.
    - `next` string, uri, nullable — A link to the next page of results. If a response does not contain a next link, then there is no more data available.
    - `total_size` integer — Number of records in the full result set. This response may be paginated and have a smaller number of records.
  - `data` object[], required — A data property that contains an array of resource items. Each entry in the array is a separate resource.
    - `api_version` 'iam/v2' — APIVersion defines the schema version of this representation of a resource.
    - `kind` 'CertificateAuthority' — Kind defines the object this REST resource represents.
    - `id` string, required — ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object `kinds` or objects of the same `kind` within a different scope/namespace ("space").
    - `metadata` object, required — ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
      - `self` string, uri, required — Self is a Uniform Resource Locator (URL) at which an object can be addressed. This URL encodes the service location, API version, and other particulars necessary to locate the resource at a point in time
      - `resource_name` string, uri — Resource Name is a Uniform Resource Identifier (URI) that is globally unique across space and time. It is represented as a Confluent Resource Name
      - `created_at` string, date-time — The date and time at which this object was created. It is represented in RFC3339 format and is in UTC.
      - `updated_at` string, date-time — The date and time at which this object was last updated. It is represented in RFC3339 format and is in UTC.
      - `deleted_at` string, date-time — The date and time at which this object was (or will be) deleted. It is represented in RFC3339 format and is in UTC.
    - `display_name` string, required — The human-readable name of the certificate authority.
    - `description` string, required — A description of the certificate authority.
    - `fingerprints` string[], required — The fingerprints for each certificate in the certificate chain. These are SHA-1 encoded strings that act as unique identifiers for the certificates in the chain.
    - `expiration_dates` string[], required — The expiration dates of certificates in the chain.
    - `serial_numbers` string[], required — The serial numbers for each certificate in the certificate chain.
    - `certificate_chain_filename` string, required — The file name of the uploaded pem file for this certificate authority.
    - `crl_source` string — The source specifies whether the Certificate Revocation List (CRL) is updated from either local file uploaded (LOCAL) or from url of CRL (URL).
    - `crl_url` string, uri — The url from which to fetch the CRL for the certificate authority if crl_source is URL.
    - `crl_updated_at` string, date-time — The timestamp for when CRL was last updated.
    - `state` string, required — The current state of the certificate authority.
    - `require_crl_on_client_certificate` boolean, required — Whether to require CRL validation on client certificates. If `require_crl_on_client_certificate` is true, then a CRL must be configured. At time of mTLS auth, if the client certificate is revoked in the CRL or the client issuer does not match the CRL issuer, certificate verification will fail even if TLS handshake is successful (OpenSSL -crl_check default behavior). If `require_crl_on_client_certificate` is false, this mTLS identity provider cannot configure a new CRL.

## Other responses

- `400` — Bad Request
- `401` — The request lacks valid authentication credentials for this resource.
- `403` — The access credentials were considered insufficient to grant access
- `429` — Rate Limit Exceeded
- `500` — Oops, something went wrong!

---

[API](https://skmtc.dev/confluent/apis/confluent-cloud-apis.md) · [All operations](https://skmtc.dev/confluent/apis/confluent-cloud-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/confluent/confluent-cloud-apis/revisions/a6a73f98a698/schema)