---
title: "Get mTLS CSR"
method: GET
path: "/webhooks_settings/mtls_csr"
tags: ["Webhooks V2"]
---

# Get mTLS CSR

`GET /webhooks_settings/mtls_csr`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/webhooks_settings/mtls_csr`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/webhooks_settings/mtls_csr/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the Certificate Signing Request (CSR) PEM that customers use to generate their signed client certificate.

The private key the CSR is built from is held by Fireblocks and is specific to this workspace. It is created on the first request for a given key type, and the same CSR is returned on subsequent requests for that type.

Pass `keyAlgorithm` to choose RSA or ECDSA. A workspace may hold one key of each: the CSR returned is always the one for the type requested, so a certificate signed against it matches the key used at delivery time.

**Endpoint Permissions:** Owner, Admin, Non-Signing Admin.

## Query parameters

- `keyAlgorithm` 'RSA' | 'ECDSA'

## Response `200`

The mTLS CSR PEM

- WebhookMtlsCsrResponse: mTLS Certificate Signing Request response
  - `csr` string, required: The Fireblocks PEM-encoded Certificate Signing Request (CSR).
  - `keyAlgorithm` 'RSA' | 'ECDSA', required: Algorithm of the Fireblocks-held mTLS private key. A workspace may hold one key of each type, so a CSR is always returned for the type requested, and the type is echoed back on the response. ECDSA keys are smaller and quicker to issue, but the certificate authority signing the request has to accept an EC subject key, which some do not by default.

## Other responses

- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)