The /api/certificate-authorities resource represents every CA the workspace knows how to talk to. TigerTrust supports ACME (Let’s Encrypt, ZeroSSL), commercial CAs (DigiCert, Sectigo, Entrust, GlobalSign), cloud (AWS PCA, Azure Key Vault, GCP CAS), enterprise (Vault, EJBCA, ADCS, Venafi), and self-hosted internal PKI. All endpoints require authentication and a workspace context.

​
List CAs

GET /api/certificate-authorities
​
page
integer
default:"1"
​
limit
integer
default:"50"
​
data[].id
integer
​
data[].name
string
​
data[].type
string
e.g. lets_encrypt, digicert, aws_pca, internal, vault.
​
data[].url
string
​
data[].status
string
active, disconnected, error.
​
data[].healthStatus
string
healthy, degraded, unhealthy, unknown.
​
data[].issuerPatterns
string[]
Case-insensitive substrings used to match discovered certificates to this CA.
​
data[].config
object
Type-specific configuration (endpoints, credentials, region, etc.).
​
data[].lastSync
string (ISO 8601)
curl https://api.tigertrust.example.com/api/certificate-authorities \
  -H "X-API-Key: ck_9f2a...7c4e"

​
Stats

GET /api/certificate-authorities/stats 
{
  "data": {
    "totalCAs": 7,
    "connectedCAs": 6,
    "disconnectedCAs": 1,
    "totalCertificatesIssued": 4218,
    "healthyCAs": 5
  }
}

​
Get a single CA

GET /api/certificate-authorities/:id
​
id
integer
required
Returns 404 NOT_FOUND if the CA doesn’t belong to the caller’s workspace.

​
Create a CA

POST /api/certificate-authorities
​
name
string
required
​
type
string
required
See list above. Determines which credentials config should carry.
​
description
string
​
url
string
CA endpoint (ACME directory, API base URL, Vault address, etc.). Also accepts legacy endpoint.
​
status
string
default:"active"
​
issuerPatterns
string[]
Overrides the built-in defaults for the CA type. Used to auto-classify discovered certs.
​
config
object
Type-specific credentials. Common keys: apiKey, apiSecret, organizationId, caArn, region, roleArn, vaultAddr, pkiPath, namespace, directoryUrl, rootCertificate.
​
scanCertificates
boolean
When true, auto-creates and starts a ca_certs discovery scan against the new CA.
curl -X POST https://api.tigertrust.example.com/api/certificate-authorities \
  -H "X-API-Key: ck_9f2a...7c4e" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Corp Vault PKI",
    "type": "vault",
    "url": "https://vault.corp.example.com:8200",
    "config": {
      "vaultAddr": "https://vault.corp.example.com:8200",
      "pkiPath": "pki_int",
      "namespace": "engineering"
    },
    "scanCertificates": true
  }'

{
  "data": {
    "id": 18,
    "workspaceId": "ws_2p9x8f4",
    "name": "Corp Vault PKI",
    "type": "vault",
    "issuerPatterns": ["vault", "hashicorp"],
    "url": "https://vault.corp.example.com:8200",
    "status": "active",
    "healthStatus": "healthy",
    "config": { "vaultAddr": "https://vault.corp.example.com:8200", "pkiPath": "pki_int" },
    "createdAt": "2026-08-25T14:22:03.812Z"
  }
}

​
Update a CA

Both PATCH (partial) and PUT (full replace) are accepted at /api/certificate-authorities/:id. Accepted fields: name, type, description, url, status, config.

​
Delete a CA

DELETE /api/certificate-authorities/:id Removes the CA row. Certificates previously issued through it remain in the inventory but lose the FK link.

​
Test connectivity (“health check”)

POST /api/certificate-authorities/:id/test Actively probes the CA endpoint using its type-specific protocol — ACME directory fetch for Let’s Encrypt/ZeroSSL, Vault /v1/sys/health for HashiCorp, ADCS /certsrv for Microsoft, HTTPS reachability for the rest. Also validates any bundled root certificate.
​
data.success
boolean
​
data.message
string
​
data.checks
array
​
data.details
object
Type-specific extras — for internal PKI includes subject, issuer, expiresAt, daysUntilExpiry.
{
  "data": {
    "success": true,
    "message": "ACME directory accessible",
    "checks": [
      { "name": "Directory Endpoint", "status": "pass", "message": "ACME directory is reachable" },
      { "name": "New Account URL", "status": "pass", "message": "Available" },
      { "name": "New Order URL", "status": "pass", "message": "Available" }
    ],
    "details": {
      "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory",
      "endpoints": ["newNonce", "newAccount", "newOrder", "revokeCert", "keyChange"]
    }
  }
}
The CA’s status field is updated automatically to active on success or error on failure.

​
Fetch certificates from a CA

POST /api/certificate-authorities/:id/fetch-certificates Starts a ca_certs discovery scan targeting the CA. Useful for onboarding — pulls the CA’s currently-issued certificates into the local inventory. 
{
  "data": {
    "success": true,
    "message": "Fetching certificates from CA...",
    "scanId": 4271
  }
}
Track progress by polling GET /api/discovery/scans/:scanId.

​
Sync

POST /api/certificate-authorities/:id/sync Marks the CA as freshly synchronized by touching lastSync. Full-fidelity sync (fetching every certificate) should be done via /fetch-certificates above.

​
See also

  • Certificates — issue certificates through a registered CA
  • Discovery — the scan engine /fetch-certificates triggers
  • Workflows — automate CA sync and issuance