---
title: "Platform operators: upload a certificate for the platform's own hostnames, held by a team (fresh admin session and a reason; logged)"
method: POST
path: "/operator/certificates/platform/managed"
tags: ["Certificates"]
---

# Platform operators: upload a certificate for the platform's own hostnames, held by a team (fresh admin session and a reason; logged)

`POST /operator/certificates/platform/managed`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/operator/certificates/platform/managed`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Request body

- object
  - `certificatePem` string, required: PEM certificate; may also contain the chain after the leaf
  - `chainPem` string: intermediate certificate(s), PEM
  - `privateKeyPem` string, required: unencrypted PEM private key (PKCS#8, PKCS#1 or SEC1); stored encrypted, never shown again
  - `organizationId` string, uuid, required: the team that will hold the certificate (usually the operators' own team)
  - `reason` string, required: why (logged with the operator certificate decisions)

## Response `201`

Installed

- object
  - `id` string, uuid, required
  - `organizationId` string, uuid, required
  - `source` 'upload' | 'acme' | 'reseller', required
  - `names` string[], required
  - `commonName` string, nullable, required
  - `issuer` string, required
  - `serial` string, required
  - `fingerprint` string, required
  - `notBefore` string, required: ISO-8601 timestamp
  - `notAfter` string, required: ISO-8601 timestamp
  - `daysLeft` integer, required
  - `keyType` 'rsa' | 'ec', required
  - `keyBits` integer, required
  - `state` 'active' | 'replaced' | 'removed' | 'expired' | 'conflict', required
  - `stateReason` string, nullable, required
  - `deliveryStatus` 'pending' | 'delivered' | 'error' | 'withdrawn', required
  - `deliveryError` string, nullable, required
  - `deliveredAt` string, nullable, required: ISO-8601 timestamp
  - `serving` 'unknown' | 'serving' | 'shadowed', required: serving: the proxy presents this certificate; shadowed: it still presents another one (see docs)
  - `servingCheckedAt` string, nullable, required: ISO-8601 timestamp
  - `autoRenew` boolean, required
  - `renewalOf` string, uuid, nullable, required
  - `replacedBy` string, uuid, nullable, required
  - `orderId` string, uuid, nullable, required
  - `acmeRequestId` string, uuid, nullable, required
  - `certificatePem` string, required: public certificate (leaf), PEM
  - `chainPem` string, required: intermediates, PEM
  - `createdAt` string, required: ISO-8601 timestamp
  - `updatedAt` string, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request); details.problems lists every certificate problem
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Not available on this server (code not_configured)
- `503`: Certificate provider unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)