# Certificate Management (https://developer.godaddy.com/en/docs/references/rest/ans/certificate-management)

***

title: Certificate Management
description: ''
full: true
\_openapi:
toc:

* depth: 2
  title: Retrieve agent identity certificates
  url: '#retrieve-agent-identity-certificates'
* depth: 2
  title: Submit identity certificate CSR
  url: '#submit-identity-certificate-csr'
* depth: 2
  title: Retrieve agent server certificates
  url: '#retrieve-agent-server-certificates'
* depth: 2
  title: Retrieve pending renewal status
  url: '#retrieve-pending-renewal-status'
* depth: 2
  title: Submit server certificate renewal request
  url: '#submit-server-certificate-renewal-request'
* depth: 2
  title: Cancel pending renewal
  url: '#cancel-pending-renewal'
* depth: 2
  title: Verify ACME challenges for pending server cert renewal
  url: '#verify-acme-challenges-for-pending-server-cert-renewal'
* depth: 2
  title: Get CSR status
  url: '#get-csr-status'
  structuredData:
  headings:
  * content: Retrieve agent identity certificates
    id: retrieve-agent-identity-certificates
  * content: Submit identity certificate CSR
    id: submit-identity-certificate-csr
  * content: Retrieve agent server certificates
    id: retrieve-agent-server-certificates
  * content: Retrieve pending renewal status
    id: retrieve-pending-renewal-status
  * content: Submit server certificate renewal request
    id: submit-server-certificate-renewal-request
  * content: Cancel pending renewal
    id: cancel-pending-renewal
  * content: Verify ACME challenges for pending server cert renewal
    id: verify-acme-challenges-for-pending-server-cert-renewal
  * content: Get CSR status
    id: get-csr-status
    contents:
  * content: Retrieves all identity certificates for the specified agent
    heading: retrieve-agent-identity-certificates
  * content: >
    Submits a Certificate Signing Request (CSR) for the agent's identity
    certificate.

    The response contains a "csrId", that is going to match the same field
    from CertificateResponse.
    heading: submit-identity-certificate-csr
  * content: Retrieves all TLS server certificates for the specified agent
    heading: retrieve-agent-server-certificates
  * content: |
    Returns current renewal status if one exists.
    Used for:
    * Checking if ACME verification is complete
    * Polling for certificate issuance (CSR path)
    * Retrieving challenges if client lost the POST response
    * Getting TLSA record after completion
      heading: retrieve-pending-renewal-status
  * content: >
    Initiates server certificate renewal. Returns ACME challenges; the
    caller must verify domain control via POST verify-acme.

    Supports two paths:

    * CSR path: RA issues a new certificate.

    * BYOC path: Client provides a certificate; RA validates and stores
      it.

    Only one pending renewal is allowed per agent (409 if one already
    exists).
    heading: submit-server-certificate-renewal-request
  * content: |
    Cancels the pending server certificate renewal for this agent.

    Use cases:

    * Client submitted incorrect CSR and wants to retry
    * Client wants to switch from CSR path to BYOC path (or vice versa)
    * Client no longer wishes to complete the renewal

    Side effects:

    * If renewal type is SERVER\_CSR, marks the associated CSR as REJECTED
    * Removes pending renewal from database
    * Client can immediately submit a new renewal request
      heading: cancel-pending-renewal
  * content: >
    Triggers ACME validation for a pending server certificate renewal.

    Verifies:

    * DNS-01 challenge (TXT record at \_acme-challenge.)

    * HTTP-01 challenge (file at /.well-known/acme-challenge/)

    Response depends on renewal type:

    * SERVER\_CSR: Returns 202 (asynchronous certificate issuance).

    * SERVER\_BYOC: Returns 200 (certificate stored; TLSA record ready for
      DNS update).
      heading: verify-acme-challenges-for-pending-server-cert-renewal
  * content: >
    Retrieves the current status of a Certificate Signing Request (CSR).

    This endpoint allows clients to check if a CSR has been signed, is
    still pending,

    or has been rejected. The failureReason field provides additional
    context when

    a CSR is rejected.
    heading: get-csr-status

***

## GET /v1/agents/{agentId}/certificates/identity

Retrieve agent identity certificates

Retrieves all identity certificates for the specified agent

### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Responses

**200** — Identity certificate(s) retrieved successfully

Content-Type: `application/json`

Schema:

- array
  - items:
      - `certificateIssuer`: string | null — Certificate issuer distinguished name
      - `certificatePEM` (required): string — Base64 encoded PEM certificate
      - `certificatePublicKeyAlgorithm`: string | null — Public key algorithm used in the certificate
      - `certificateSerialNumber`: string | null — Certificate serial number
      - `certificateSignatureAlgorithm`: string | null — Signature algorithm used for the certificate
      - `certificateSubject`: string | null — Certificate subject distinguished name with ANS name as Subject Alternative Name (SAN) URI
      - `certificateValidFrom` (required): string <date-time> — Certificate validity start date
      - `certificateValidTo` (required): string <date-time> — Certificate validity end date
      - `chainPEM`: string | null — Base64 encoded PEM certificate chain (intermediate and root certificates)
      - `csrId` (required): string <uuid> — Unique identifier for the CSR that generated this certificate

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — Agent or certificate not found

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## POST /v1/agents/{agentId}/certificates/identity

Submit identity certificate CSR

Submits a Certificate Signing Request (CSR) for the agent's identity certificate.
The response contains a "csrId", that is going to match the same field from CertificateResponse.


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Request body (required)

CSR submission request

Content-Type: `application/json`

Schema:

- object — Request to submit a Certificate Signing Request
  - `csrPEM` (required): string — Base64 encoded PEM Certificate Signing Request

### Responses

**202** — CSR accepted for processing

Content-Type: `application/json`

Schema:

- object — Response to a CSR submission request
  - `csrId` (required): string <uuid> — Unique identifier assigned to the submitted CSR
  - `message`: string — Additional information about the submission

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — Agent not found

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**422** — Invalid CSR request (semantic validation failure)

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## GET /v1/agents/{agentId}/certificates/server

Retrieve agent server certificates

Retrieves all TLS server certificates for the specified agent

### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Responses

**200** — Server certificate(s) retrieved successfully

Content-Type: `application/json`

Schema:

- array
  - items:
      - `certificateIssuer`: string | null — Certificate issuer distinguished name
      - `certificatePEM` (required): string — Base64 encoded PEM certificate
      - `certificatePublicKeyAlgorithm`: string | null — Public key algorithm used in the certificate
      - `certificateSerialNumber`: string | null — Certificate serial number
      - `certificateSignatureAlgorithm`: string | null — Signature algorithm used for the certificate
      - `certificateSubject`: string | null — Certificate subject distinguished name with ANS name as Subject Alternative Name (SAN) URI
      - `certificateValidFrom` (required): string <date-time> — Certificate validity start date
      - `certificateValidTo` (required): string <date-time> — Certificate validity end date
      - `chainPEM`: string | null — Base64 encoded PEM certificate chain (intermediate and root certificates)
      - `csrId` (required): string <uuid> — Unique identifier for the CSR that generated this certificate

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — Agent or certificate not found

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## GET /v1/agents/{agentId}/certificates/server/renewal

Retrieve pending renewal status

Returns current renewal status if one exists.
Used for:
- Checking if ACME verification is complete
- Polling for certificate issuance (CSR path)
- Retrieving challenges if client lost the POST response
- Getting TLSA record after completion


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Responses

**200** — Renewal found

Content-Type: `application/json`

Schema:

- object — Current status of pending renewal with conditional fields
  - `renewalType` (required): string — Type of renewal (CSR or BYOC)
    - enum: "SERVER_CSR", "SERVER_BYOC"
  - `status` (required): string — Current renewal status
    - enum: "PENDING_VALIDATION", "ISSUING_CERTIFICATE", "COMPLETED", "FAILED", "EXPIRED"
  - `csrId`: string | null <uuid> — CSR identifier (present only for SERVER_CSR renewals). Null for SERVER_BYOC renewals.
  - `challenges`: object — ACME challenges for domain validation. Present when status is PENDING_VALIDATION; null otherwise.
      - `dns01`: object — ACME challenge information
          - `dnsRecord`: object
              - `name`: string
              - `type`: string
              - `value`: string
          - `expiresAt`: string <date-time>
          - `httpPath`: string
          - `keyAuthorization`: string — Key authorization string
          - `token`: string — Challenge token
          - `type`: string
            - enum: "DNS_01", "HTTP_01"
      - `http01`: object — ACME challenge information
          - `dnsRecord`: object
          - `expiresAt`: string <date-time>
          - `httpPath`: string
          - `keyAuthorization`: string — Key authorization string
          - `token`: string — Challenge token
          - `type`: string
            - enum: "DNS_01", "HTTP_01"
  - `tlsaDnsRecord`: object
      - `name` (required): string — Full DNS record name
      - `priority`: integer — For HTTPS records
      - `purpose`: string — Purpose of this DNS record
        - enum: "DISCOVERY", "TRUST", "CERTIFICATE_BINDING", "BADGE"
      - `required`: boolean — Whether this record is required
      - `ttl`: integer
      - `type` (required): string
        - enum: "HTTPS", "TLSA", "TXT"
      - `value` (required): string — Record value to set
  - `failureReason`: string | null — Error message explaining why the renewal failed. Present when status is FAILED; null otherwise.
  - `expiresAt` (required): string <date-time> — When this renewal request expires
  - `nextStep` (required): object
      - `action`: string
        - enum: "CONFIGURE_DNS", "CONFIGURE_HTTP", "VERIFY_DNS", "VALIDATE_DOMAIN", "WAIT"
      - `description`: string
      - `endpoint`: string <uri>

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — No renewal exists for this agent (never submitted, or previously cancelled/deleted)

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## POST /v1/agents/{agentId}/certificates/server/renewal

Submit server certificate renewal request

Initiates server certificate renewal. Returns ACME challenges; the caller must verify domain control via POST verify-acme.

Supports two paths:
- CSR path: RA issues a new certificate.
- BYOC path: Client provides a certificate; RA validates and stores it.

Only one pending renewal is allowed per agent (409 if one already exists).


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Request body (required)

Renewal request (CSR or BYOC)

Content-Type: `application/json`

Schema:

- object — Request to renew server certificate (CSR or BYOC path). Exactly one of serverCsrPEM or serverCertificatePEM must be provided; they are mutually exclusive. serverCertificateChainPEM is only valid when serverCertificatePEM is provided.
  - `serverCsrPEM`: string — PEM-encoded CSR for RA to issue new certificate. Mutually exclusive with serverCertificatePEM.
  - `serverCertificatePEM`: string — PEM-encoded BYOC server certificate. Mutually exclusive with serverCsrPEM.
  - `serverCertificateChainPEM`: string — Optional PEM-encoded certificate chain for BYOC. Only valid when serverCertificatePEM is provided.

### Responses

**202** — Renewal request accepted. Returns ACME challenges for domain validation; the caller must complete verification via POST verify-acme. For the CSR path, the response also includes a csrId for tracking.

Content-Type: `application/json`

Schema:

- object — Response to renewal submission (context-aware based on agent type)
  - `renewalType` (required): string — Type of renewal initiated
    - enum: "SERVER_CSR", "SERVER_BYOC"
  - `status` (required): string — PENDING_VALIDATION: ACME verification required before certificate issuance. ISSUING_CERTIFICATE: Certificate issuance in progress.
    - enum: "PENDING_VALIDATION", "ISSUING_CERTIFICATE"
  - `csrId`: string | null <uuid> — CSR identifier for tracking (SERVER_CSR path only). Null for BYOC path.
  - `challenges`: object — ACME challenges for domain control validation. Present when status is PENDING_VALIDATION.
      - `dns01`: object — ACME challenge information
          - `dnsRecord`: object
              - `name`: string
              - `type`: string
              - `value`: string
          - `expiresAt`: string <date-time>
          - `httpPath`: string
          - `keyAuthorization`: string — Key authorization string
          - `token`: string — Challenge token
          - `type`: string
            - enum: "DNS_01", "HTTP_01"
      - `http01`: object — ACME challenge information
          - `dnsRecord`: object
          - `expiresAt`: string <date-time>
          - `httpPath`: string
          - `keyAuthorization`: string — Key authorization string
          - `token`: string — Challenge token
          - `type`: string
            - enum: "DNS_01", "HTTP_01"
  - `expiresAt` (required): string <date-time> — When this renewal request expires (7 days from submission)
  - `nextStep` (required): object
      - `action`: string
        - enum: "CONFIGURE_DNS", "CONFIGURE_HTTP", "VERIFY_DNS", "VALIDATE_DOMAIN", "WAIT"
      - `description`: string
      - `endpoint`: string <uri>
  - `links`: array
      - items:
          - `href` (required): string <uri> — Link URL
          - `rel` (required): string — Link relation type

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — Agent not found

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**409** — Pending renewal already exists for this agent

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**422** — Validation failed:
- Agent not ACTIVE
- Neither serverCsrPEM nor serverCertificatePEM provided
- Both serverCsrPEM and serverCertificatePEM provided
- CSR validation failed (SAN/CN mismatch)
- BYOC cert validation failed (expired, SAN/CN mismatch)
- serverCertificateChainPEM provided without serverCertificatePEM

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## DELETE /v1/agents/{agentId}/certificates/server/renewal

Cancel pending renewal

Cancels the pending server certificate renewal for this agent.

Use cases:
- Client submitted incorrect CSR and wants to retry
- Client wants to switch from CSR path to BYOC path (or vice versa)
- Client no longer wishes to complete the renewal

Side effects:
- If renewal type is SERVER_CSR, marks the associated CSR as REJECTED
- Removes pending renewal from database
- Client can immediately submit a new renewal request


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Responses

**204** — Pending renewal successfully deleted

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — No pending renewal to delete

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**422** — Cannot delete (renewal already completed)

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## POST /v1/agents/{agentId}/certificates/server/renewal/verify-acme

Verify ACME challenges for pending server cert renewal

Triggers ACME validation for a pending server certificate renewal.

Verifies:
- DNS-01 challenge (TXT record at _acme-challenge.{agentHost})
- HTTP-01 challenge (file at /.well-known/acme-challenge/{token})

Response depends on renewal type:
- SERVER_CSR: Returns 202 (asynchronous certificate issuance).
- SERVER_BYOC: Returns 200 (certificate stored; TLSA record ready for DNS update).


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |

### Responses

**200** — BYOC renewal completed synchronously.
TLSA record returned for DNS update.

Content-Type: `application/json`

Schema:

- object — Response after ACME verification attempt
  - `status` (required): string — VERIFIED: CSR path - async cert issuance started. COMPLETED: BYOC path - cert stored, TLSA record ready.
    - enum: "VERIFIED", "ISSUING_CERTIFICATE", "COMPLETED"
  - `csrId`: string | null <uuid> — CSR identifier (present only for SERVER_CSR renewals)
  - `tlsaDnsRecord`: object
      - `name` (required): string — Full DNS record name
      - `priority`: integer — For HTTPS records
      - `purpose`: string — Purpose of this DNS record
        - enum: "DISCOVERY", "TRUST", "CERTIFICATE_BINDING", "BADGE"
      - `required`: boolean — Whether this record is required
      - `ttl`: integer
      - `type` (required): string
        - enum: "HTTPS", "TLSA", "TXT"
      - `value` (required): string — Record value to set
  - `nextStep` (required): object
      - `action`: string
        - enum: "CONFIGURE_DNS", "CONFIGURE_HTTP", "VERIFY_DNS", "VALIDATE_DOMAIN", "WAIT"
      - `description`: string
      - `endpoint`: string <uri>

**202** — CSR renewal validation succeeded.
Certificate issuance in progress (poll GET /certificates/server).

Content-Type: `application/json`

Schema:

- object — Response after ACME verification attempt
  - `status` (required): string — VERIFIED: CSR path - async cert issuance started. COMPLETED: BYOC path - cert stored, TLSA record ready.
    - enum: "VERIFIED", "ISSUING_CERTIFICATE", "COMPLETED"
  - `csrId`: string | null <uuid> — CSR identifier (present only for SERVER_CSR renewals)
  - `tlsaDnsRecord`: object
      - `name` (required): string — Full DNS record name
      - `priority`: integer — For HTTPS records
      - `purpose`: string — Purpose of this DNS record
        - enum: "DISCOVERY", "TRUST", "CERTIFICATE_BINDING", "BADGE"
      - `required`: boolean — Whether this record is required
      - `ttl`: integer
      - `type` (required): string
        - enum: "HTTPS", "TLSA", "TXT"
      - `value` (required): string — Record value to set
  - `nextStep` (required): object
      - `action`: string
        - enum: "CONFIGURE_DNS", "CONFIGURE_HTTP", "VERIFY_DNS", "VALIDATE_DOMAIN", "WAIT"
      - `description`: string
      - `endpoint`: string <uri>

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — No pending renewal found

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**422** — Validation failed:
- No pending renewal found
- Renewal expired (>7 days old)
- ACME challenges not found in DNS/HTTP
- Agent not ACTIVE

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

## GET /v1/agents/{agentId}/csrs/{csrId}/status

Get CSR status

Retrieves the current status of a Certificate Signing Request (CSR).
This endpoint allows clients to check if a CSR has been signed, is still pending,
or has been rejected. The failureReason field provides additional context when
a CSR is rejected.


### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `agentId` | string | yes | Unique identifier of the agent (UUID format) |
| `csrId` | string <uuid> | yes | Unique identifier of the CSR |

### Responses

**200** — CSR status retrieved successfully

Content-Type: `application/json`

Schema:

- object — Status information for a Certificate Signing Request
  - `csrId` (required): string <uuid> — Unique identifier of the CSR
  - `failureReason`: string | null — Reason for rejection (only present when status=REJECTED)
  - `status` (required): string — Current status of the CSR
    - enum: "PENDING", "SIGNED", "REJECTED"
  - `submittedAt` (required): string <date-time> — When the CSR was submitted
  - `type` (required): string — Type of certificate requested
    - enum: "SERVER", "IDENTITY"
  - `updatedAt` (required): string <date-time> — When the status was last updated

**401** — Authentication failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**403** — Authorization failed

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**404** — CSR not found or does not belong to this agent

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**422** — Invalid request parameters (semantic validation failure)

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"

**500** — Internal server error

Content-Type: `application/json`

Schema:

- object
  - `code` (required): string — Application-specific error code for client-side error handling
  - `details`: object
  - `message` (required): string
  - `status` (required): string
    - enum: "ERROR"