---
title: "Create One X.509 Certificate for One Database User"
method: POST
path: "/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs"
tags: ["X.509 Authentication"]
---

# Create One X.509 Certificate for One Database User

`POST /api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs`

Generates one X.509 certificate for the specified MongoDB user. Atlas manages the            certificate and MongoDB user that belong to one project.


To get MongoDB Cloud to generate a managed certificate for a database user, set `"x509Type" : "MANAGED"` on the desired MongoDB Database User.

If you are managing your own Certificate Authority (CA) in Self-Managed X.509 mode, you must generate certificates for database users using your own CA.

## Path parameters

- `groupId` string, required
- `username` string, required

## Query parameters

- `envelope` boolean
- `pretty` boolean

## Response `201`

This endpoint returns a PEM file with the certificate and private key.

## Other responses

- `400` — Bad Request.
- `401` — Unauthorized.
- `403` — Forbidden.
- `404` — Not Found.
- `409` — Conflict.
- `429` — Too Many Requests.
- `500` — Internal Server Error.

---

[API](https://skmtc.dev/mongodb/apis/atlas-admin-api.md) · [All operations](https://skmtc.dev/mongodb/apis/atlas-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mongodb/atlas-admin-api/revisions/e37e8ef8429f/schema)