SIsilverflow
Trust Anchors

Create Trust Anchor [EXPERIMENTAL]

This operation registers a CA certificate as a Trust Anchor for the Agent. Client certificates bound to the Agent's API keys must chain to one of its Trust Anchors.

An Agent can have at most two active Trust Anchors. The limit exists so that a CA can be rotated without downtime: register the new CA as the second Trust Anchor, move your client certificates over to it, then archive the old one. If two Trust Anchors are already active, archive one before creating another.

The fingerprint and validity period are taken from the certificate. Changes can take up to 15 minutes to take effect.

Requires trustAnchors:Create permission.

post/trustAnchors

Request

Request body

certificatestring required

A single PEM-encoded X.509 v3 CA certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The certificate must be valid now, have an RSA 2048, 3072 or 4096 key or an ECDSA P-256 or P-384 key, be signed with SHA-256, SHA-384 or SHA-512, and be at most 16384 bytes when DER-encoded.

descriptionstring

Response

The created Trust Anchor

keystring required
agentKeystring required

Uniquely identifies an Agent

fingerprintstring required

The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using - and _, ending in =). This is the value of the CloudFront-Viewer-Cert-Sha256 header for the certificate. To compute it from a certificate file: openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'.

status'active' | 'archived' required

The status of the Trust Anchor

descriptionstring
notBeforestring date-time required

The start of the certificate's validity period, taken from the certificate

notAfterstring date-time required

The end of the certificate's validity period, taken from the certificate

createdstring date-time required

The date and time this object was created

lastModifiedstring date-time

The date and time this object was last modified

versioninteger required

The version of this object

Example response

{
  "key": "tra-4Z3saOmareGlixYDolaT",
  "agentKey": "cgt-3jmy9i8u7ywJkKVkxeNO",
  "fingerprint": "89b2QsnoZIU1GnMPBTChiL1VQdUw2iwgzuhIlm_L_Fo=",
  "status": "active",
  "description": "Example Corp Root CA",
  "notBefore": "2026-01-01T00:00:00.000Z",
  "notAfter": "2036-01-01T00:00:00.000Z",
  "created": "2026-10-07T09:00:00.000Z",
  "version": 1
}

Changes

No recorded changes to this operation across all 1 revision of this API.