---
title: "Sign Csr Endpoint"
method: POST
path: "/api/v1/tunnels/{tunnel_id}/sign-csr"
tags: ["Tunnels"]
---

# Sign Csr Endpoint

`POST /api/v1/tunnels/{tunnel_id}/sign-csr`

## Request

- Base URL: `https://api.inkbox.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.inkbox.ai/api/v1/tunnels/{tunnel_id}/sign-csr`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

## Path parameters

- `tunnel_id` string, uuid, required

## Request body

- SignCsrRequest
  - `csr_pem` string, required: PEM-encoded CSR. CN must equal the tunnel hostname.

## Response `200`

Successful Response

- SignCsrResponse
  - `cert_pem` string, required
  - `chain_pem` string, required
  - `cert_fingerprint_sha256` string, required
  - `cert_expires_at` string, date-time, required

## Other responses

- `422`: Validation Error
- `4XX`: Client error with Support Agent information.
- `5XX`: Server error with Support Agent information.

## Changes

- **2026-10-30** `77c7e3ee70cf`: 2 info
  - added `#/components/schemas/HTTPValidationError` to the response body `allOf` list for the response status `422`
  - removed `subschema #1` from the response body `allOf` list for the response status `422`
- **2026-10-30** `a0729c3c4a0b`: 2 info
  - added `subschema #1` to the response body `allOf` list for the response status `422`
  - removed `#/components/schemas/HTTPValidationError` from the response body `allOf` list for the response status `422`

[Operation history](https://skmtc.dev/inkbox/apis/inkbox-api/changes/api/v1/tunnels/:tunnel_id/sign-csr/post.md)

---

[API](https://skmtc.dev/inkbox/apis/inkbox-api.md) - [All operations](https://skmtc.dev/inkbox/apis/inkbox-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inkbox/apis/inkbox-api/revisions/3e862146bf53?raw)