---
title: "List API Key certificates [EXPERIMENTAL]"
method: GET
path: "/apiKeys/{apiKey}/certificates"
tags: ["API Keys"]
---

# List API Key certificates \[EXPERIMENTAL\]

`GET /apiKeys/{apiKey}/certificates`

## Request

- Base URL: `https://eu-west-1.api.silverflow.com/v1`
- URL: `https://eu-west-1.api.silverflow.com/v1/apiKeys/{apiKey}/certificates`
- Auth: one of:
  - HTTP basic
  - HTTP bearer
- TypeScript: <https://skmtc.dev/silverflow/apis/silverflow-api/docs/apiKeys/:apiKey/certificates/get.ts> (a function with typed inputs; its response is checked against the schema)

This operation returns the client certificates bound to the API Key. Active certificates are returned unless
`archived` is set to true. Archived certificates are no longer accepted for authentication.

Requires `apiKeys:Get` permission.

## Path parameters

- `apiKey` string, required: Uniquely identifies an API Key

## Query parameters

- `archived` boolean

## Response `200`

The certificates bound to the API Key

- ApiKeyCertificatesList: The client certificates bound to an API Key, either the active or the archived ones
  - `certificates` ApiKeyCertificate[], required
    - `certificateKey` string, required: Uniquely identifies a certificate bound to an API Key
    - `fingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
    - `notBefore` string, date-time, required: The start of the certificate's validity period, taken from the certificate
    - `notAfter` string, date-time, required: The end of the certificate's validity period, taken from the certificate
    - `description` string
    - `created` string, date-time, required: The date and time this object was created
    - `trustAnchorFingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
    - `status` 'active' | 'archived', required: The status of the certificate. Archived certificates stay in the list.

## Other responses

- `401`: Authentication information is missing or invalid
- `403`: The authenticated client is forbidden to make the request for the resource identified.
- `404`: The requested resource was not found
- `429`: The number of requests (per minute) has exceeded the configured maximum

---

[API](https://skmtc.dev/silverflow/apis/silverflow-api.md) - [All operations](https://skmtc.dev/silverflow/apis/silverflow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/silverflow/apis/silverflow-api/revisions/43ecbe4fd6ea?raw)