---
title: "Extend the life of a currently enrolled router's certificates"
method: POST
path: "/enroll/extend/router"
tags: ["Enroll", "Extend Enrollment"]
---

# Extend the life of a currently enrolled router's certificates

`POST /enroll/extend/router`

## Request

- Base URL: `https://demo.ziti.dev/edge/client/v1`
- URL: `https://demo.ziti.dev/edge/client/v1/enroll/extend/router`
- Auth: none declared
- TypeScript: <https://skmtc.dev/openziti/apis/ziti-edge-client/docs/enroll/extend/router/post.ts> (a function with typed inputs; its response is checked against the schema)

Allows a router to extend its certificates' expiration date by
using its current and valid client certificate to submit a CSR. This CSR may
be passed in using a new private key, thus allowing private key rotation or swapping.

After completion any new connections must be made with certificates returned from a 200 OK
response. The previous client certificate is rendered invalid for use with the controller even if it
has not expired.

This request must be made using the existing, valid, client certificate.

## Request body

- RouterExtendEnrollmentRequest
  - `certCsr` string, required
  - `serverCertCsr` string, required

## Response `200`

A response containing the edge routers new signed certificates (server chain, server cert, CAs).

- EnrollmentCertsEnvelope
  - `data` EnrollmentCerts: Common data returned on any successful enrollment, regardless of method. The controllers field carries the set of controllers in the cluster the enrolling client may connect to.
    - `controllers` ControllerDetail[]: An array of controller resources
      - `_links` object, required: A map of named links
      - `createdAt` string, date-time, required
      - `id` string, required
      - `tags` Tags
      - `updatedAt` string, date-time, required
      - `apiAddresses` ApiAddressList
      - `certPem` string, required
      - `ctrlAddress` string, nullable
      - `fingerprint` string, required
      - `isOnline` boolean, required
      - `isPreferredLeader` boolean
      - `lastJoinedAt` string, date-time, required
      - `name` string, required
    - `ca` string: A PEM encoded set of CA certificates to trust
    - `cert` string: A PEM encoded set of certificates to use as the client chain
    - `serverCert` string: A PEM encoded set of certificates to use as the servers chain
  - `meta` Meta
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `400`: The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
- `401`: The supplied session does not have the correct access rights to request this resource
- `429`: The resource requested is rate limited and the rate limit has been exceeded

## Changes

- **2026-10-14** `f7b51eaafbbb`: 1 breaking, 3 warning, 1 info
  - the `data` response's property type changed from `object` to no type for status `200`
  - removed the optional property `data/ca` from the response with the `200` status
  - removed the optional property `data/cert` from the response with the `200` status
  - removed the optional property `data/serverCert` from the response with the `200` status
  - …1 more
- **2025-03-17** `058711718149`: 1 info
  - added the non-success response with the status `400`
- **2024-05-29** `cce2800c1357`: 3 warning, 1 info
  - the optional response header `WWW-Authenticate` removed for the status `200`
  - the optional response header `WWW-Authenticate` removed for the status `401`
  - the optional response header `WWW-Authenticate` removed for the status `429`
  - removed the non-success response with the status `400`

[Operation history](https://skmtc.dev/openziti/apis/ziti-edge-client/changes/enroll/extend/router/post.md)

---

[API](https://skmtc.dev/openziti/apis/ziti-edge-client.md) - [All operations](https://skmtc.dev/openziti/apis/ziti-edge-client/llms.txt) - [OpenAPI document](https://skmtc.dev/openziti/apis/ziti-edge-client/revisions/f7b51eaafbbb?raw)