--- title: "Renew SSL certificate" method: POST path: "/api/ssl-certificates/{sid}/renew" tags: ["ssl_certificates"] --- # Renew SSL certificate `POST /api/ssl-certificates/{sid}/renew` ## Request - Base URL: `https://beta.getsales.io/id/v1` - URL: `https://beta.getsales.io/id/v1/api/ssl-certificates/{sid}/renew` - Auth: HTTP bearer and API key in header `Team-SID` Force a re-issue of an existing certificate, ignoring the 30-day renewal window. ASYNC, the same HTTP-01 path as issue on the same row. An active certificate STAYS active and keeps serving while challenge carries the attempt: on success the certificate is replaced and re-stamped, on failure last_error is set and the current one keeps serving. A failed or expired row flips to challenge and ends active or failed like issue. Poll get_ssl_certificate until challenge is null. Use after a DNS or CA fix, or to recover a lapsed certificate. 409 conflict: issuance_already_in_progress (the daily sweep's attempt included), cannot_issue_deleted_certificate, acme_unreachable; an active row is not refused. Contract: - MCP tool `renew_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.partner`. - Operation `action`, response envelope `action_async`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API. ## Path parameters - `sid` string, required: SSL certificate sid (id_sc_...). ## Response `200` `action_async` success envelope. - RenewSslCertificateResponse - `success` true, required - `operation` 'action', required - `action` string, required - `async` true, required - `item` object, nullable, required - `sid` string, required: Certificate sid (id_sc_...). - `team_sid` string, required: The reseller team (ts_tm_...). - `domain` string, required: The brand's host, lowercase FQDN. - `status` 'pending' | 'challenge' | 'active' | 'failed' | 'expired', required: pending = registered; challenge = a first issuance in flight; active = serving; failed; expired. A renewal of an active row keeps active. - `challenge` object, nullable, required: The attempt in flight (first issuance or renewal); null when none. - `type` 'http-01', required: The one challenge type served. - `token` string, required: The ACME token the platform serves at well_known_path. - `key_authorization` string, required: The key authorization the CA expects there. - `well_known_path` string, required: The path the CA fetches on the domain. - `cname_target` string, required: The platform host the domain's CNAME must point at. - `expires_at` string, nullable, required: ISO 8601 UTC when the authorization lapses at the CA. - `issuer` string, nullable, required: The CA that issued the serving certificate; null until one did. - `issued_at` string, nullable, required: ISO 8601 UTC; null until issued. - `expires_at` string, nullable, required: ISO 8601 UTC the serving certificate lapses; renewed 30 days ahead. - `last_error` string, nullable, required: Why the last attempt failed, as a token: domain_not_pointed (fix the CNAME), domain_validation_failed (CAA or other DNS), issuance_unavailable (our side or the CA, contact support). null = none. - `created_by` object, required: Who registered the domain (the brand's activation). - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required - `actor_sid` string, nullable, required - `team_sid` string, required - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path. - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract. - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write. - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row. - `created_at` string, required: ISO 8601 UTC. - `updated_at` string, required: ISO 8601 UTC. - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live. - `pending` object[], required: One ref: the attempt in flight. - `expected_completion_seconds` integer, required: 120: the self-check, the validation and the finalize once the domain resolves. - `webhook_events` string[], required: issue: ssl-certificates.issued, ssl-certificates.failed; renew: ssl-certificates.renewed, ssl-certificates.renewal-failed, ssl-certificates.failed. - `polling_hint` string, required: Poll get_ssl_certificate: after issue until status is active or failed; after renew until challenge is null. - `result` object, required - `meta` object, required - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header. - `span_id` string, required: 16 hex chars, root span of this request. - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. - `duration_ms` integer, required: Server-side wall clock. - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. ## Other responses - `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. - `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable. --- [API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/revisions/95e48541fe85?raw)