---
title: "List a production's certificates"
method: GET
path: "/api/v1/productions/{productionId}/certificates"
tags: ["Productions"]
---

# List a production's certificates

`GET /api/v1/productions/{productionId}/certificates`

## Request

- Base URL: `https://easy2257.com`
- URL: `https://easy2257.com/api/v1/productions/{productionId}/certificates`
- Auth: HTTP bearer

Every certificate minted for a linked production, newest first, with lifecycle status and — for certificates issued since storage began — the signed JWT itself. Use it to re-fetch a certificate you missed or lost, to pick up the replacement after a renewal, and to see at a glance which certificate is `CURRENT`. Certificates issued before storage began return `jwt: null`; those arrive with the next annual renewal. Scoped to productions linked to your partner account: anything else returns 404.

## Path parameters

- `productionId` string, required

## Response `200`

Certificate list, newest first.

- CertificatesResponse
  - `productionId` string, required
  - `retrievedAt` string, date-time, required
  - `certificates` object[], required: Every certificate minted for the production, newest first.
    - `jwtId` string, required: The certificate's `jti` claim — its stable identifier across this API.
    - `kid` string, required: Signing key id, resolvable against the public JWKS.
    - `issuedAt` string, date-time, required
    - `expiresAt` string, date-time, required
    - `status` 'CURRENT' | 'SUPERSEDED' | 'REVOKED', required: Lifecycle state. `CURRENT` is the one live certificate. `SUPERSEDED` means an annual renewal replaced it; the content stays up. `REVOKED` means the certified record was pulled; take the content down.
    - `revokedAt` string, date-time, nullable, required: Set on revoked certificates. Also present on certificates recorded as superseded before supersession was split out of revocation; `status` is the field to branch on.
    - `supersededAt` string, date-time, nullable, required: Set when an annual renewal replaced this certificate. Null on records that predate the supersession split; `status` is the field to branch on.
    - `supersededByJwtId` string, nullable, required: `jwtId` of the replacing certificate, when superseded.
    - `jwt` string, nullable, required: The signed certificate itself. `null` on certificates issued before certificates were stored; those were delivered once in their webhook and arrive again with the next annual renewal.

## Other responses

- `400`: Invalid request: a required field is missing or malformed.
- `401`: No `Authorization: Bearer` header, or a key that is unknown, revoked, or expired. The body carries only `error`, never a `code`.
- `403`: Rejected before the handler: a test-mode key (`TEST_MODE_UNAVAILABLE`) or a partner account that is not ACTIVE. Never used for cross-partner access, which returns 404.
- `404`: No such production, or it is not linked to your partner account.
- `429`: Rate limit exceeded: 300 requests per 60 seconds per API key, shared across all `/api/v1` endpoints (requests without a `Bearer` key fall back to 60 per 60 seconds per client IP, and a per-address flood ceiling of 1200 per 60 seconds also applies). Honor `Retry-After`.
- `500`: Server error. Retry with exponential backoff.

---

[API](https://skmtc.dev/easy2257/apis/easy2257-partner-api.md) · [All operations](https://skmtc.dev/easy2257/apis/easy2257-partner-api/llms.txt) · [OpenAPI document](https://skmtc.dev/easy2257/apis/easy2257-partner-api/revisions/f880026c1f04?raw)