Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


GET /config/certificates/root_certificates

SUMMARY Gets the list of all root certificates that have been uploaded and deployed. You must have System Administrator or Security Administrator permissions to use this endpoint.

Table 1: GET /config/certificates/root_certificates resource details:

GET /config/certificates/root_certificates resource details



Table 2: GET /config/certificates/root_certificates request parameter details:

GET /config/certificates/root_certificates request parameter details

Parameter Type Optionality Data Type MIME Type Description






Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.






Optional - This parameter is used to restrict the elements in a list base on the contents of various fields.






Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero.

Table 3: GET /config/certificates/root_certificates response codes:

GET /config/certificates/root_certificates response codes

HTTP Response Code Unique Code Description


An array of the certificate resources.



Not able to return the certificate collection.

Response Description

An array of the root certificate resources that are deployed. A Certificate object has the following format
  • id - Uniquely identifies the certificate. This value is derived from subject_key_id.
  • subject_key_id - Returns the Subject Key Identifier of the CA certificate.
  • authority_key_id - Returns the Authority Key Identifier of the CA certificate.
  • subject - Returns the Subject of the CA certificate.
  • issuer - Returns the Issuer of the CA certificate.
  • not_before - Returns the "Validity Not Before" field of the certificate, represented as the number of milliseconds since UNIX epoch.
  • expiry - Returns the "Validity Not After" field of the certificate, represented as the number of milliseconds since UNIX epoch. 
  • status - Returns the status of the certificate.
    • DEPLOYED indicates that the certificate was uploaded and the changes were deployed.
    • DELETE_PENDING indicates that the certificate was deployed, but will be deleted pending the next deployment.
  • validation - Returns the code to indicate whether the certificate is valid. If not, it returns the reason that the certificate is not valid.

    • -1 - Certificate has not been validated.
    • 0 - Certificate is valid or has not been checked.
    • 2001 - Error parsing a certificate.
    • 2002 - Error decoding a certificate.
    • 2003 - The certificate is expired.
    • 2004 - The certificate is not yet valid.
    • 2005 - The certificate is revoked.
    • 2010 - Unexpected error occurred when processing a certificate.
    • 2011 - Error finding the issuer certificates.
    • 2012 - The certificate's key usage or extended key usage does not match its purpose.
    • 2013 - Error validating the full chain of the certificate.
    • 2014 - The certificate is an invalid self-signed certificate.
    • 2020 - The CRL is invalid.
    • 2030 - Unexpected error when processing the CRL.
    • 2031 - Error finding the issuer certificates for the CRL.
    • 2032 - The issuer does not have the CRL sign usage.
    • 2033 - Error validating the CRL.
    • 2034 - The CRL is expired.

Response Sample