GRgravitee-io
Certificates
Domains

Create or update a certificate

Changed on

Idempotent create-or-update. Uses the key field in the body to identify the certificate within the domain. Re-applying an unchanged definition is a no-op. The system flag is immutable; changing it requires deleting and recreating the certificate. When dryRun is true, the endpoint validates the payload without persisting; the returned certificate carries a dryRunErrors list (empty on success, populated with validation errors otherwise).

put/organizations/{orgId}/environments/{envId}/domains/{domainKey}/certificates

Request

  • Base URL
    http://localhost:8093/automation
  • URL
    http://localhost:8093/automation/organizations/{orgId}/environments/{envId}/domains/{domainKey}/certificates
  • Auth
    HTTP bearer

Path parameters

orgIdstring required

Identifier of the organization that owns the environment.

envIdstring required

Identifier of the environment the resource belongs to.

domainKeystring required

Key of the domain: its stable, immutable Automation identifier within the environment.

Query parameters

dryRunboolean

When true, validates the payload without persisting. The returned certificate includes a dryRunErrors field.

Request body

configurationstring

Plugin-specific configuration as a JSON-encoded string. Its shape is defined by the selected certificate type. Sensitive values, as flagged by the plugin, are returned as ******** in every response; an unset sensitive value is omitted. Sending ******** back on update keeps the stored value; sending it on create is rejected. The uploaded keystore file is masked too; sending ******** back keeps it.

createdAtstring date-time

Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

expiresAtstring date-time

Expiry timestamp (ISO-8601 / RFC 3339, UTC), when known for the certificate type. Read-only.

keystring required

Stable, immutable identifier for the certificate within its domain. Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric character. Used to identify the certificate on create-or-update.

namestring

Human-readable name of the certificate.

systemboolean

Whether this is the domain's system certificate. Immutable after creation. When true, only key is required; the certificate is built from the domains.certificates.default.* system settings and the name, type, and configuration fields are ignored.

typestring

Certificate plugin type identifier. Immutable after creation.

updatedAtstring date-time

Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

Example request

{
  "configuration": "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"},\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"secret\"}",
  "key": "signing-cert",
  "name": "Signing certificate",
  "type": "javakeystore-am-certificate"
}

Response

The created or updated certificate. When dryRun is true the certificate includes a dryRunErrors field with any validation errors.

configurationstring

Plugin-specific configuration as a JSON-encoded string. Its shape is defined by the selected certificate type. Sensitive values, as flagged by the plugin, are returned as ******** in every response; an unset sensitive value is omitted. Sending ******** back on update keeps the stored value; sending it on create is rejected. The uploaded keystore file is masked too; sending ******** back keeps it.

createdAtstring date-time

Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

expiresAtstring date-time

Expiry timestamp (ISO-8601 / RFC 3339, UTC), when known for the certificate type. Read-only.

keystring required

Stable, immutable identifier for the certificate within its domain. Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric character. Used to identify the certificate on create-or-update.

namestring

Human-readable name of the certificate.

systemboolean

Whether this is the domain's system certificate. Immutable after creation. When true, only key is required; the certificate is built from the domains.certificates.default.* system settings and the name, type, and configuration fields are ignored.

typestring

Certificate plugin type identifier. Immutable after creation.

updatedAtstring date-time

Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

Example response

{
  "configuration": "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"},\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"secret\"}",
  "key": "signing-cert",
  "name": "Signing certificate",
  "type": "javakeystore-am-certificate"
}

Changes

  • 821321fb3bcfRevision changes
    • info

      added the new optional query request parameter dryRun

    • info

      added the optional property to the response with the status