---
title: "Request Certificate"
method: POST
path: "/api/admin/clusters/{cluster_id}/authorizations/certificate"
tags: ["admin-clusters"]
---

# Request Certificate

`POST /api/admin/clusters/{cluster_id}/authorizations/certificate`

Sign the requesting admin's SSH public key via Vault.

If a ``publicKey`` is provided in the body, it is signed directly.
Otherwise the admin's DB-stored SSH public key is used.

## Path parameters

- `cluster_id` string, required

## Request body

- CertificateRequest — Optional request body for the admin certificate endpoint. If ``public_key`` is provided the backend will sign it directly; otherwise it falls back to the admin's DB-stored SSH public key.
  - `publicKey` string, nullable
  - `ttl` string, nullable — Requested certificate TTL as a Vault-style duration (e.g. '30m', '2h'). Capped at 8h; omit to use the server default.

## Response `200`

Successful Response

- GenericResponseCertificateResponse
  - `data` CertificateResponse
    - `signedKey` string, required
    - `validPrincipals` string[], required
    - `ttl` string, required
    - `nodes` ClusterNodeConnection[] — All connectable SSH endpoints for the cluster.
      - `podId` string, required
      - `podName` string, nullable
      - `host` string, required
      - `port` integer
      - `user` string, required
      - `role` string, nullable
      - `isControlNode` boolean
  - `status` string, nullable — Response status

## Other responses

- `401` — Authorization failed
- `403` — Insufficient permissions
- `422` — Invalid request data

---

[API](https://skmtc.dev/primeintellect/apis/pi-api.md) · [All operations](https://skmtc.dev/primeintellect/apis/pi-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/primeintellect/pi-api/revisions/08d946cba60c/schema)