---
title: "Create an mTLS configuration"
method: POST
path: "/webhooks_settings/mtls"
tags: ["Webhooks V2"]
---

# Create an mTLS configuration

`POST /webhooks_settings/mtls`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/webhooks_settings/mtls`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/webhooks_settings/mtls/post.ts> (a function with typed inputs; its response is checked against the schema)

Stores a certificate signed against the CSR from `GET /v1/webhooks_settings/mtls_csr` and returns its id, which is then set as `webhookMtlsId` on a webhook or on OAuth credentials. The private key the certificate was issued for is derived from the certificate, so it is never named by the caller.

Re-uploading a certificate already stored returns the existing id rather than creating a second configuration, so several webhooks and OAuth credentials can share one certificate.

A certificate that was not issued for a private key this workspace holds is rejected with a `400`.

**Endpoint Permissions:** Owner, Admin, Non-Signing Admin.

## Headers

- `Idempotency-Key` string

## Request body

- CreateWebhookMtlsConfigRequest
  - `name` string: A label for this mTLS configuration, to tell several certificates apart. Letters, digits and spaces only.
  - `signedCert` string, required: Signed client certificate PEM, issued for the CSR from `GET /v1/webhooks_settings/mtls_csr`. The private key it belongs to is derived from the certificate itself.

## Response `201`

The stored mTLS configuration

- WebhookMtlsConfig: A signed client certificate stored for the workspace, and the id a webhook or OAuth credentials set references to use it. Several of them may share one configuration, so replacing the certificate here switches all of them at once.
  - `id` string, uuid, required: The unique identifier of the mTLS configuration, to be set as `webhookMtlsId` on a webhook or on OAuth credentials.
  - `name` string: The label given to this mTLS configuration.
  - `signedCert` string, required: The signed client certificate PEM.
  - `expiresAt` integer, required: When the certificate itself expires, in milliseconds since the epoch.
  - `createdAt` integer, required: When the certificate was uploaded, in milliseconds since the epoch.
  - `updatedAt` integer, required: When this configuration was last changed, in milliseconds since the epoch. Differs from createdAt once the certificate has been replaced or the configuration renamed.

## Other responses

- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)