CLI reference
Every CertAutoPilot subcommand, every flag, every exit code. The binary is the same on standalone hosts (/usr/local/bin/certautopilot) and in Kubernetes pods (run via kubectl exec). All subcommands read the same config.yaml and env vars as the main server, so run them from the same host or an equivalent one with MongoDB access.
API overview
Everything in the UI is available via the REST API. JSON requests + responses, cursor-based pagination, deterministic error shapes, per-route RBAC enforcement. 190+ endpoints under /api/v1.
API authentication
One JWT identity, two transports: browsers use httpOnly cookies + double-submit CSRF; programmatic clients carry the same access token in an Authorization: Bearer header (CSRF-exempt). This page shows the exact wire shape for each.
API reference
Complete endpoint catalog, grouped by resource. Each row lists the route, method, minimum role, and a cross-link to the feature page that describes the semantics + request / response bodies. For the auth + conventions, see Overview and Authentication.
Configuration
Single YAML config file (/etc/certautopilot/config.yaml on standalone, rendered from the Helm config: block on Kubernetes), every value override-able via a CERTAUTOPILOT_* environment variable. Sensitive values — KEK material, JWT secret, MongoDB password, HSM PIN — live only in env, never on disk.
Job types
Every job type the workers process: what enqueues it, what it does, which worker lane runs it, and how many attempts it gets before going dead. Grouped by area — ACME, MSCA, distribution, KEK rotation, maintenance, notifications, discovery.
Distribution error codes
Structured per-target error codes emitted by every distribution module, the error class each code maps to, and which classes the fan-out per-target retry re-attempts. Codes appear in the error_code field of per-target results on the distribution and in job logs.
Prometheus metrics
The complete list of Prometheus metrics the backend registers — name, type, labels, and meaning — plus where the /metrics endpoint lives and which process emits which metric. Verified against the telemetry package; this page is the authoritative reference.