---
title: "The domain's certificate, its renewal and its history"
method: GET
path: "/connections/{id}/certificate"
tags: ["Connections"]
---

# The domain's certificate, its renewal and its history

`GET /connections/{id}/certificate`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/connections/{id}/certificate`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.customdomain.ai/oauth/agent/authorize`, token URL `https://api.customdomain.ai/oauth/agent/token`, scopes: `domains:read`)

The HTTPS certificate the edge holds for the domain, as the edge last reported it: status, issuer, when it was issued and last renewed, when it expires and the next renewal starts, the last error while renewing keeps failing, and the certificate history (issued, renewed, failed, expiring). An apex that redirects www also gets `www_certificate`. Every served domain has one, so this read is not behind the Secure plan feature (the `/ssl` management routes are). `status` is `not_reported` until the edge reports the certificate.

A delegated agent token needs `domains:read`.

## Path parameters

- `id` string, required

## Response `200`

The certificate

- object
  - `connection_id` string, required
  - `certificate` CertificateView, required
    - `host` string, required
    - `status` 'issued' | 'renewing' | 'failed' | 'pending' | 'revoked' | 'not_reported', required: `issued`: a valid certificate. `renewing`: renewing keeps failing while the current certificate still serves (`last_error` says why). `failed`: no valid certificate. `not_reported`: the edge has not reported one yet.
    - `issuer` string: The issuing CA certificate's name, for example R11 or E6 (Let's Encrypt).
    - `issued_at` string, date-time
    - `renewed_at` string, date-time
    - `not_before` string, date-time
    - `expires_at` string, date-time
    - `days_left` integer
    - `next_renewal_at` string, date-time: When the edge starts renewing (about 30 days before expiry). Omitted while a failing renewal is being retried.
    - `last_error` string
    - `failing_since` string, date-time
    - `failure_count` integer
    - `managed` boolean, required
    - `attention` 'failed' | 'renewal_failing' | 'expired' | 'expiring'
    - `updated_at` string, date-time
  - `www_certificate` CertificateView
    - `host` string, required
    - `status` 'issued' | 'renewing' | 'failed' | 'pending' | 'revoked' | 'not_reported', required: `issued`: a valid certificate. `renewing`: renewing keeps failing while the current certificate still serves (`last_error` says why). `failed`: no valid certificate. `not_reported`: the edge has not reported one yet.
    - `issuer` string: The issuing CA certificate's name, for example R11 or E6 (Let's Encrypt).
    - `issued_at` string, date-time
    - `renewed_at` string, date-time
    - `not_before` string, date-time
    - `expires_at` string, date-time
    - `days_left` integer
    - `next_renewal_at` string, date-time: When the edge starts renewing (about 30 days before expiry). Omitted while a failing renewal is being retried.
    - `last_error` string
    - `failing_since` string, date-time
    - `failure_count` integer
    - `managed` boolean, required
    - `attention` 'failed' | 'renewal_failing' | 'expired' | 'expiring'
    - `updated_at` string, date-time
  - `renewal` object, required
    - `automatic` boolean
    - `needs_dns_access` boolean: Always false; the edge renews through the domain itself (TLS-ALPN-01 or HTTP-01).
    - `retry_every` string
    - `how` string
  - `history` DomainEvent[], required
    - `id` string, required
    - `application_id` string
    - `connection_id` string
    - `domain` string, required
    - `kind` string, required: One of connection.created, connection.applied, connection.live, connection.failed, connection.records.updated, connection.reapply.failed, connection.records_outdated, connection.disconnected, records.removed, records.rewritten, certificate.issued, certificate.renewed, certificate.failed, certificate.expiring, certificate.removed, drift.found, drift.fixed, drift.fix_failed, drift.action_required, drift.restored, access.granted, access.revoked, access.needs_reconnect. A connection or certificate kind that is also a webhook event type is written with the webhook, so the timeline and an integrator see the same history.
    - `detail` object
    - `created_at` string, date-time, required

## Other responses

- `401`: Error envelope: {code, title, details}.
- `403`: Error envelope: {code, title, details}.
- `404`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)