---
title: "Get Certificate Raw"
method: GET
path: "/v1/certificates/{sha256}/raw"
tags: ["certificates"]
---

# Get Certificate Raw

`GET /v1/certificates/{sha256}/raw`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/v1/certificates/{sha256}/raw`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Tier-gated raw PEM retrieval by SHA-256 (GH #205).

Paid tiers only. Serves the leaf PEM from cold storage; when the bytes
are absent (unbackfilled row, or dropped by the retention sweep) they
are materialized on demand from crt.sh, fingerprint-verified, returned
and best-effort persisted back to cold storage. ``chain`` is currently
always empty with ``chain_available=false`` — CertIndex persists only
leaf bytes; the field keeps the contract stable if chains are stored
later.

## Path parameters

- `sha256` string, required

## Query parameters

- `include_parsed_extensions` boolean: When true (default), attach the ``parsed_extensions`` view (EKU, SAN types, basic constraints, SCT list) parsed from the returned bytes.

## Cookies

- `ctix_session` string, nullable

## Response `200`

Successful Response

- CertificateRawResponse: Response for the tier-gated ``GET /v1/certificates/{sha256}/raw`` endpoint (GH #205).
  - `sha256` string, required
  - `raw_pem` string, required
  - `chain` string[]
  - `chain_available` boolean
  - `materialized_on_demand` boolean
  - `parsed_extensions` ParsedExtensions: Customer-facing extension view parsed from the raw cert bytes (GH #205) — EKU, SAN breakdown by type, basic constraints and the embedded SCT list, so consumers don't have to parse PEM themselves.
    - `extended_key_usage` string[], nullable
    - `san_types` object
    - `basic_constraints` object, nullable
    - `sct_list` object[]
    - `is_precert_poisoned` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)