Install Jentic One Beta

Connect the Certman API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Certman API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcertman.app%2Fcertman" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcertman.app%2Fcertman" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Certman API.

Issue a new certificate from a managed Certificate Authority

Renew a certificate before it expires

Revoke a certificate and record the reason

List and inspect your Certificate Authorities and their certificates

Retrieve the full CA certificate chain for a trust store

GET STARTED

Start building with Certman API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Certman API for, with concrete tasks.

★ Agent-Driven Certificate Lifecycle

An AI agent connected to the Certman API can manage the lifecycle of a service's certificates end to end. It lists the Certificate Authorities the account can issue from, issues a certificate for a new service, and later renews or revokes it, so provisioning and rotation happen through one credential instead of manual CA tooling. The whoami endpoint lets the agent confirm its scopes before attempting a write.

List available Certificate Authorities, issue a certificate from the first CA for the hostname api.example.com, and confirm it was issued

Automated Renewal Before Expiry

Expired certificates cause outages. With the Certman API an agent can list an account's certificates, find those approaching expiry, and call the renew endpoint for each before it lapses. Because renewal is a single scoped operation per certificate id, a scheduled agent can keep a fleet of certificates current without a human running the CA console.

List certificates, select any whose expiry is within 30 days, and call the renew operation for each selected certificate

Compromise Response and Revocation

When a key is suspected compromised, the certificate must be revoked quickly. The Certman API exposes a revoke operation per certificate id so an incident-response agent can pull the affected certificate and revoke it with a reason, cutting the window of exposure. Revocation is a distinct scoped action, so it can be granted to a response runbook without granting issuance.

Revoke the certificate with the given id and record the revocation reason as key compromise

Trust Chain Retrieval for Deployment

Services that validate a certificate need the issuing CA's full chain. The Certman API returns a CA's certificate chain from the chain endpoint, so a deployment agent can fetch the chain for the issuing CA and write it into a trust store or server configuration alongside the leaf certificate it just issued.

Fetch the certificate chain for a given Certificate Authority id and return the PEM chain for the trust store

Key Endpoints

8 endpoints — the certman api manages cloud-hosted certificate authorities and the full certificate lifecycle, issuing, renewing, and revoking certificates programmatically.

METHOD

PATH

DESCRIPTION

POST

/v1/certificates

Issue a new certificate

POST

/v1/certificates/{id}/renew

Renew a certificate

POST

/v1/certificates/{id}/revoke

Revoke a certificate

GET

/v1/certificates

List certificates

GET

/v1/cas

List Certificate Authorities

GET

/v1/cas/{id}

Get Certificate Authority details

GET

/v1/cas/{id}/chain

Get the CA certificate chain

GET

/v1/whoami

Get the current identity and scopes

POST

/v1/certificates

Issue a new certificate

POST

/v1/certificates/{id}/renew

Renew a certificate

POST

/v1/certificates/{id}/revoke

Revoke a certificate

GET

/v1/certificates

List certificates

GET

/v1/cas

List Certificate Authorities

GET

/v1/cas/{id}

Get Certificate Authority details

GET

/v1/cas/{id}/chain

Get the CA certificate chain

GET

/v1/whoami

Get the current identity and scopes

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Certman API by hand means handling either its cm_ API key or the OAuth 2.1 PKCE flow with its ca:read, ca:issue, and ca:revoke scopes, and tracking which CA each certificate belongs to. Through Jentic you install once, import Certman from the API Directory, store the credential once, and your agent calls it.

Permission scoping

Certman puts the CA and certificate id in the URL path (/v1/cas/{id}, /v1/certificates/{id}/revoke), so a rule can pin your agent to one Certificate Authority and the operations you pick. You can let it list and read certificates without granting the issue, renew, or revoke operations.

Credential isolation

Your Certman credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'issue a certificate' or 'renew a TLS certificate', and Jentic returns the matching Certman operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using Certman API through Jentic.

What authentication does the Certman API use?

The Certman API supports two authentication methods per its OpenAPI spec: an API key sent as a bearer token (prefixed cm_) and OAuth 2.1 authorization code flow with PKCE, which exposes the scopes ca:read, ca:issue, and ca:revoke. Through Jentic the credential is stored once by your own self-hosted instance and injected at call time, so it never sits in your agent's prompt or logs.

Is there a Certman MCP server?

You do not need an MCP server to give your agent the Certman API. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the issue, renew, revoke, and list operations on demand. Operations are discovered when needed, so no extra server's tool definitions are loaded into the agent's context.

Can I limit what my agent is allowed to do with the Certman API?

Yes. Write a rule that allows only the list and read operations under one Certificate Authority, so the agent can inspect certificates and fetch the chain but cannot issue, renew, or revoke anything. The API's own OAuth scopes (ca:read, ca:issue, ca:revoke) map to the same split, and every call the agent makes is logged.

Can I issue and revoke certificates with the Certman API?

Yes. Issue a certificate with POST /v1/certificates against a Certificate Authority the account owns, renew it with POST /v1/certificates/{id}/renew, and revoke it with POST /v1/certificates/{id}/revoke. You can list the CAs you may issue from at /v1/cas and retrieve a CA's full chain from /v1/cas/{id}/chain for trust configuration.

What are the rate limits for the Certman API?

The OpenAPI spec does not specify rate limits for the Certman API. Check the documentation at https://certman.app for current limits and plan allowances before running an agent that issues or renews certificates at volume.

How do I issue a certificate with the Certman API through Jentic?

Search Jentic for 'issue a certificate' and it returns the POST /v1/certificates operation with its input schema. Pass the Certificate Authority id and the certificate request and the agent gets back the issued certificate. To run it on your own infrastructure, install Jentic One from its GitHub repo.

Certman App Certman API

AI ReadinessAI-Aware (A-)70/100

See full scorecard

Official vendor OpenAPI document · agent-readySecuritySecrets Managementbearer, oauth28 EndpointsREST

For Agents

Issue, renew, and revoke certificates against cloud-hosted Certificate Authorities, list CAs and their certificate chains, and read the identity and scopes of the calling credential.

Use for: Issue a certificate for a new service from one of my CAs, Renew a certificate that is about to expire, Revoke a certificate that was compromised, List the Certificate Authorities I can issue from

Not supported: Does not handle DNS records, load balancer configuration, or storage of other secret types. Use for Certificate Authority management and the certificate lifecycle only.

The Certman API manages cloud-hosted Certificate Authorities and the full certificate lifecycle, issuing, renewing, and revoking certificates programmatically. It lists the Certificate Authorities an account can issue from, returns each CA's certificate chain for trust stores, and reports the identity and scopes tied to the calling credential. Access is by API key or OAuth 2.1 authorization code flow with per-action scopes for reading, issuing, and revoking.

Jentic One on Github View OpenAPI Document

Show dimension breakdown

100

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: A+Signals: 4

99%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

100%

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

100%

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: BSignals: 4

12%

Example Density

How richly the API is illustrated with examples.

91%

Example Validity

Percentage of examples that conform to their schemas.

50%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

100%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: C-Signals: 4

46%

Description Coverage

Coverage of descriptions across API elements.

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

88%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

67%

Summary Coverage

Coverage of summaries across operations/tags/info.

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: A+Signals: 1

94%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

Security

Trust, risk posture, and security compliance.

Grade: A-Signals: 1

75%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: A-Signals: 1

78%

Descriptive Richness

Clarity and depth of descriptions across API elements.

Connect the Certman API to your agent

Capabilities

Start building with Certman API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

Certman App Certman API

Jentic AI Readiness Score

Certman API

Foundational Compliance

Lint Results

Resolution Completeness

Specification Validity

Structural Integrity

Developer Experience & Jentic Compatibility

Example Density

Example Validity

Response Coverage

Tooling Readiness

AI-Readiness & Agent Experience

Description Coverage

Error Standardization

OperationId Quality

Summary Coverage

Agent Usability

Complexity Comfort

Security

Authentication Strength

AI Discoverability

Descriptive Richness