---
title: "Create a draft order (price fixed). The platform generates the key unless you send your own CSR. Then POST .../submit"
method: POST
path: "/certificates/orders"
tags: ["Certificates"]
---

# Create a draft order (price fixed). The platform generates the key unless you send your own CSR. Then POST .../submit

`POST /certificates/orders`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/certificates/orders`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Query parameters

- `orgId` string: Organization id (required when you belong to several)

## Request body

- object
  - `productId` string, uuid, required
  - `names` string[], required: the first is the common name
  - `dcvMethod` 'dns' | 'http' | 'email'
  - `approverEmail` string, email: required for e-mail validation, e.g. admin@example.com
  - `contact` object, required
    - `firstName` string, required
    - `lastName` string, required
    - `email` string, email, required
    - `phone` string, required
    - `title` string
  - `organization` object: required for OV and EV certificates
    - `name` string, required
    - `division` string
    - `addressLine1` string, required
    - `addressLine2` string
    - `city` string, required
    - `region` string
    - `postalCode` string, required
    - `country` string, required
    - `phone` string, required
  - `csrPem` string: your own CSR (you keep the key and upload it with the issued certificate); omit to let the platform generate the key, which installs the certificate automatically

## Response `201`

Draft

- object
  - `id` string, uuid, required
  - `organizationId` string, uuid, required
  - `productId` string, uuid, required
  - `productName` string, required
  - `provider` string, required
  - `validation` 'dv' | 'ov' | 'ev', required
  - `periodMonths` integer, required
  - `amount` integer, required
  - `currency` string, required
  - `names` string[], required
  - `dcvMethod` 'dns' | 'http' | 'email', required
  - `approverEmail` string, nullable, required
  - `state` 'draft' | 'awaiting_payment' | 'paid' | 'pending_validation' | 'issued' | 'installed' | 'canceled' | 'refunded' | 'failed' | 'expired', required
  - `paymentStatus` 'none' | 'pending' | 'paid' | 'refunded' | 'failed', required
  - `paidVia` 'billing' | 'operator' | 'null', nullable, required
  - `paidAt` string, nullable, required: ISO-8601 timestamp
  - `providerStatus` string, nullable, required
  - `dcv` object[], required
    - `name` string, required
    - `method` 'dns' | 'http' | 'email', required
    - `recordType` 'CNAME' | 'TXT' | 'null', nullable, required
    - `recordName` string, nullable, required
    - `recordValue` string, nullable, required
    - `fileUrl` string, nullable, required
    - `fileContent` string, nullable, required
    - `email` string, nullable, required
    - `status` 'pending' | 'validated' | 'unknown', required
  - `certificateId` string, uuid, nullable, required
  - `keyManagedByPlatform` boolean, required
  - `certificatePem` string, nullable, required
  - `chainPem` string, nullable, required
  - `lastError` string, nullable, required
  - `renewalOf` string, uuid, nullable, required
  - `events` object[], required
    - `fromState` string, nullable, required
    - `toState` string, required
    - `actorKind` string, required
    - `reason` string, nullable, required
    - `createdAt` string, required: ISO-8601 timestamp
  - `createdAt` string, required: ISO-8601 timestamp
  - `updatedAt` string, required: ISO-8601 timestamp
  - `submittedAt` string, nullable, required: ISO-8601 timestamp
  - `issuedAt` string, nullable, required: ISO-8601 timestamp
  - `finishedAt` string, nullable, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request); details.problems lists every certificate problem
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Not available on this server (code not_configured)
- `503`: Certificate provider unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)