---
title: "Every hostname your projects serve with the certificate the proxy presents (issuer, validity, SANs, status), plus your managed certificates"
method: GET
path: "/certificates"
tags: ["Certificates"]
---

# Every hostname your projects serve with the certificate the proxy presents (issuer, validity, SANs, status), plus your managed certificates

`GET /certificates`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/certificates`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Query parameters

- `orgId` string: Organization id (required when you belong to several)

## Response `200`

Inventory

- object
  - `inventory` object[], required
    - `id` string, uuid, required
    - `hostname` string, required
    - `kind` 'default' | 'custom' | 'platform', required: project default hostname, custom domain, or one of the platform's own hosts
    - `organizationId` string, uuid, nullable, required
    - `projectId` string, uuid, nullable, required
    - `projectName` string, nullable, required
    - `status` 'valid' | 'expiring' | 'expired' | 'error' | 'pending', required
    - `statusReason` string, nullable, required
    - `observed` object, nullable, required: what a TLS handshake against our ingress returned (null before the first check)
      - `issuer` string, required
      - `subject` string, nullable, required
      - `names` string[], required
      - `serial` string, nullable, required
      - `fingerprint` string, nullable, required: SHA-256 fingerprint AB:CD:…
      - `notBefore` string, nullable, required: ISO-8601 timestamp
      - `notAfter` string, nullable, required: ISO-8601 timestamp
      - `trusted` boolean, nullable, required: chain + hostname verified against the public trust store
      - `daysLeft` integer, nullable, required
    - `checkedAt` string, nullable, required: ISO-8601 timestamp
    - `nextCheckAt` string, nullable, required: ISO-8601 timestamp
    - `managedCertificateId` string, uuid, nullable, required: the active certificate the platform manages for this hostname (uploaded, free or purchased)
    - `coveredByWildcard` boolean, required: served by the platform's wildcard certificate
    - `source` 'automatic' | 'managed' | 'wildcard', required: automatic = Let's Encrypt through the proxy; managed = a certificate of yours
  - `managed` object[], required
    - `id` string, uuid, required
    - `organizationId` string, uuid, required
    - `source` 'upload' | 'acme' | 'reseller', required
    - `names` string[], required
    - `commonName` string, nullable, required
    - `issuer` string, required
    - `serial` string, required
    - `fingerprint` string, required
    - `notBefore` string, required: ISO-8601 timestamp
    - `notAfter` string, required: ISO-8601 timestamp
    - `daysLeft` integer, required
    - `keyType` 'rsa' | 'ec', required
    - `keyBits` integer, required
    - `state` 'active' | 'replaced' | 'removed' | 'expired' | 'conflict', required
    - `stateReason` string, nullable, required
    - `deliveryStatus` 'pending' | 'delivered' | 'error' | 'withdrawn', required
    - `deliveryError` string, nullable, required
    - `deliveredAt` string, nullable, required: ISO-8601 timestamp
    - `serving` 'unknown' | 'serving' | 'shadowed', required: serving: the proxy presents this certificate; shadowed: it still presents another one (see docs)
    - `servingCheckedAt` string, nullable, required: ISO-8601 timestamp
    - `autoRenew` boolean, required
    - `renewalOf` string, uuid, nullable, required
    - `replacedBy` string, uuid, nullable, required
    - `orderId` string, uuid, nullable, required
    - `acmeRequestId` string, uuid, nullable, required
    - `certificatePem` string, required: public certificate (leaf), PEM
    - `chainPem` string, required: intermediates, PEM
    - `createdAt` string, required: ISO-8601 timestamp
    - `updatedAt` string, required: ISO-8601 timestamp
  - `counts` object, required
    - `valid` integer
    - `expiring` integer
    - `expired` integer
    - `error` integer
    - `pending` integer
  - `capabilities` object, required
    - `delivery` boolean, required: uploaded/issued certificates can be delivered to the proxy
    - `freeCertificates` boolean, required: the platform ACME client is configured (DNS API token)
    - `paidCertificates` boolean, required: a certificate reseller is configured
    - `wildcard` boolean, required: the platform wildcard certificate is enabled
    - `acmeZone` string, nullable, required: zone that CNAME delegations point into

## Other responses

- `400`: Invalid request (code invalid_request); details.problems lists every certificate problem
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Not available on this server (code not_configured)
- `503`: Certificate provider unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)