---
title: "Record intent to issue an edge-managed certificate"
method: POST
path: "/connections/{id}/ssl:provision"
tags: ["Secure"]
---

# Record intent to issue an edge-managed certificate

`POST /connections/{id}/ssl:provision`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/connections/{id}/ssl:provision`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Creates/updates the mirror row as `pending` + managed. The edge performs the actual ACME issuance on first handshake and reports back. Optionally sets `secure_root_domain` so the edge also secures the registrable apex.

## Path parameters

- `id` string, required

## Request body

- object
  - `secure_root_domain` boolean: also secure the registrable apex.

## Response `202`

Provisioning requested

- object
  - `certificate` Certificate
    - `id` string
    - `domain` string, required
    - `application_id` string
    - `status` 'pending' | 'issued' | 'renewing' | 'failed' | 'revoked', required
    - `issuer` string
    - `not_before` string, date-time
    - `not_after` string, date-time
    - `last_error` string: most recent issuance/renewal failure; empty when healthy.
    - `managed` boolean, required: true = edge auto-manages (ACME); false = operator-imported.
    - `renew_after` string, date-time
    - `updated_at` string, date-time

## Other responses

- `401`: Error envelope: {code, title, details}.
- `404`: Error envelope: {code, title, details}.
- `503`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)