CertAutoPilot logo CertAutoPilot
Get started →

API reference

Complete endpoint catalog, grouped by resource. Each row lists the route, method, minimum role, and a cross-link to the feature page that describes the semantics + request / response bodies. For the auth + conventions, see Overview and Authentication.

Canonical schemas in OpenAPI

The authoritative request / response schemas live in /api/v1/openapi.json. Generate a client SDK with openapi-generator or feed the spec into your favourite API tool. This page is a human-readable index; the OpenAPI file is the wire contract.

01Authentication & user

MethodPathRoleSee
POST/auth/loginanonymousLogin
POST/auth/logoutanyLogout
POST/auth/refreshanyRefresh flow
GET/auth/meanyWho am I
POST/GET/auth/me/otp/*any (self)2FA

02Organisation / admin

MethodPathRoleSee
GET/POST/PATCH/DELETE/users (& /users/{id})adminUsers
GET/PUT/settings/ldapadminLDAP
GET/POST/DELETE/api-keys (& /api-keys/{id})adminAPI keys
GET/PUT/settings/syslogadminSyslog
GET/PUT/settings/generaladmin—
GET/PUT/licenseownerLicense
GET/license/statusanyLicense status
GET/audit-logsviewerAudit logs
GET/audit-logs/exportadminAudit export
GET/POST/PATCH/DELETE/organizations (& /organizations/{id})owner—
GET/POST/PATCH/DELETE/projects (& /projects/{id})admin—
GET/ca-providersviewercatalogue of ACME CAs the backend knows by default

03Project — CA providers

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/acme-accountsoperatorACME accounts
POST/projects/{projectId}/acme-accounts/{id}/validateoperatorre-check CA connection
GET/projects/{projectId}/acme-accounts/{id}/usageviewercerts referencing this account
GET/POST/PATCH/DELETE/projects/{projectId}/msca-connectionsoperatorMSCA
POST/projects/{projectId}/msca-connections/{id}/sync-templatesoperatorrefresh the template catalogue
POST/projects/{projectId}/msca-connections/{id}/testoperatorprobe CES / CEP

04Project — DNS

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/dns-credentialsoperatorDNS providers
POST/projects/{projectId}/dns-credentials/{id}/testoperatorsmoke-test the credential
GET/POST/PATCH/DELETE/projects/{projectId}/zonesoperatorZones
GET/projects/{projectId}/zones/{id}/rate-limit-statusviewerweekly budget + projection

05Project — certificates

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/certificatesviewer (list) / operator (mutate)Issue
POST/projects/{projectId}/certificates/{id}/renewoperatorRenew
POST/projects/{projectId}/certificates/{id}/reissueoperatorReissue
POST/projects/{projectId}/certificates/{id}/revokeoperatorRevoke
POST/GET/projects/{projectId}/certificates/{id}/downloadsoperatorDownload
POST/projects/{projectId}/certificates/{id}/validate-manual-dnsoperatorManual DNS
GET/projects/{projectId}/certificates/{id}/eventsviewerTimeline
GET/projects/{projectId}/certificates/{id}/jobsviewerjobs scoped to this cert
GET/projects/{projectId}/certificates/{id}/dependenciesviewerDependencies
GET/projects/{projectId}/certificates/{id}/riskviewerRisk
GET/PUT/DELETE/projects/{projectId}/certificate-policyadminPolicy

06Project — distribution

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/modulesoperatorModules
POST/projects/{projectId}/modules/{id}/healthoperatorlive health check
GET/POST/PATCH/DELETE/projects/{projectId}/credentialsoperatorModule creds
GET/POST/PATCH/DELETE/projects/{projectId}/targetsoperatorTargets
GET/POST/PATCH/DELETE/projects/{projectId}/target-groupsoperatorTarget groups
GET/POST/PATCH/DELETE/projects/{projectId}/path-setsoperatorPath sets
GET/POST/PATCH/DELETE/projects/{projectId}/action-setsoperatorAction sets
POST/projects/{projectId}/action-sets/lintoperatortemplate-variable lint
GET/POST/PATCH/DELETE/projects/{projectId}/variablesoperatorVariables
GET/POST/PATCH/DELETE/projects/{projectId}/certificates/{id}/distributionsoperatorattach / edit
POST.../distributions/{id}/executeoperatorrun now
POST.../distributions/{id}/dry-runoperatorpreview actions
POST.../distributions/{id}/rollbackoperatorRollback

07Project — discovery

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/discovery-sourcesoperatorSources
POST.../discovery-sources/{id}/scanoperatortrigger immediate scan
GET/projects/{projectId}/discovery/certificatesviewerInventory
GET/projects/{projectId}/discovery/endpointsviewerendpoint-level list
GET/PATCH/projects/{projectId}/discovery/findings (& /{id})viewer (list) / operator (status)Findings
POST.../discovery/certificates/{fingerprint}/manageoperatorManage
GET/projects/{projectId}/discovery/summaryviewerdashboard numbers

08Project — notifications

MethodPathRoleSee
GET/POST/PATCH/DELETE/projects/{projectId}/notification-channelsadminChannels
POST.../notification-channels/{id}/testadmindelivery probe
GET/POST/PATCH/DELETE/projects/{projectId}/notification-rulesadminRules
GET/POST/PATCH/DELETE/projects/{projectId}/notification-templatesadminTemplates
GET/projects/{projectId}/notification-historyviewerHistory

09Project — operations

MethodPathRoleSee
GET/projects/{projectId}/jobsviewerJobs
GET/projects/{projectId}/jobs/{id}viewerjob detail
GET/projects/{projectId}/jobs/{id}/logsviewerstream logs
POST/projects/{projectId}/jobs/{id}/retryoperatorretry a failed job
POST/projects/{projectId}/jobs/{id}/canceloperatorcancel a pending / in-progress job
GET/POST/PATCH/DELETE/projects/{projectId}/domain-trackingsoperatorDomain tracking
POST.../domain-trackings/{id}/checkoperatortrigger WHOIS refresh
GET/POST/projects/{projectId}/bulk-actionsoperatorBulk
GET/POST/PATCH/DELETE/projects/{projectId}/approval-requestsscoped by actionApprovals

10Project — dashboards

MethodPathRoleSee
GET/projects/{projectId}/dashboard/summaryviewerSummary
GET/projects/{projectId}/dashboard/trendsviewertime-series renewals / distributions
GET/projects/{projectId}/dashboard/readiness-47dayviewer47-Day

11Encryption & KEK

KEK lifecycle is CLI-first, not REST (operational safety). See CLI → kek.

12Fetch the OpenAPI

curl https://cap.example.com/api/v1/openapi.json -o openapi.json
# Generate Go client:
openapi-generator generate -i openapi.json -g go -o ./cap-client
# Generate TS client:
openapi-generator generate -i openapi.json -g typescript-axios -o ./cap-client-ts