canonical: https://jentic.com/apis/certman.app/certman # Certman App Certman API The Certman API manages cloud-hosted Certificate Authorities and the full certificate lifecycle, issuing, renewing, and revoking certificates programmatically. It lists the Certificate Authorities an account can issue from, returns each CA's certificate chain for trust stores, and reports the identity and scopes tied to the calling credential. Access is by API key or OAuth 2.1 authorization code flow with per-action scopes for reading, issuing, and revoking. ## For AI agents Issue, renew, and revoke certificates against cloud-hosted Certificate Authorities, list CAs and their certificate chains, and read the identity and scopes of the calling credential. ## Scope Does not handle DNS records, load balancer configuration, or storage of other secret types. Use for Certificate Authority management and the certificate lifecycle only. ## Capabilities - Issue a new certificate from a managed Certificate Authority - Renew a certificate before it expires - Revoke a certificate and record the reason - List and inspect your Certificate Authorities and their certificates - Retrieve the full CA certificate chain for a trust store - Check the identity and OAuth scopes tied to the current credential ## Use cases ### Agent-Driven Certificate Lifecycle An AI agent connected to the Certman API can manage the lifecycle of a service's certificates end to end. It lists the Certificate Authorities the account can issue from, issues a certificate for a new service, and later renews or revokes it, so provisioning and rotation happen through one credential instead of manual CA tooling. The whoami endpoint lets the agent confirm its scopes before attempting a write. Example prompt: List available Certificate Authorities, issue a certificate from the first CA for the hostname api.example.com, and confirm it was issued ### Automated Renewal Before Expiry Expired certificates cause outages. With the Certman API an agent can list an account's certificates, find those approaching expiry, and call the renew endpoint for each before it lapses. Because renewal is a single scoped operation per certificate id, a scheduled agent can keep a fleet of certificates current without a human running the CA console. Example prompt: List certificates, select any whose expiry is within 30 days, and call the renew operation for each selected certificate ### Compromise Response and Revocation When a key is suspected compromised, the certificate must be revoked quickly. The Certman API exposes a revoke operation per certificate id so an incident-response agent can pull the affected certificate and revoke it with a reason, cutting the window of exposure. Revocation is a distinct scoped action, so it can be granted to a response runbook without granting issuance. Example prompt: Revoke the certificate with the given id and record the revocation reason as key compromise ### Trust Chain Retrieval for Deployment Services that validate a certificate need the issuing CA's full chain. The Certman API returns a CA's certificate chain from the chain endpoint, so a deployment agent can fetch the chain for the issuing CA and write it into a trust store or server configuration alongside the leaf certificate it just issued. Example prompt: Fetch the certificate chain for a given Certificate Authority id and return the PEM chain for the trust store ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/v1/certificates` | Issue a new certificate | | POST | `/v1/certificates/{id}/renew` | Renew a certificate | | POST | `/v1/certificates/{id}/revoke` | Revoke a certificate | | GET | `/v1/certificates` | List certificates | | GET | `/v1/cas` | List Certificate Authorities | | GET | `/v1/cas/{id}` | Get Certificate Authority details | | GET | `/v1/cas/{id}/chain` | Get the CA certificate chain | | GET | `/v1/whoami` | Get the current identity and scopes | ## Key resources - **Certificates** — List, issue, renew, and revoke certificates against a managed Certificate Authority - **Certificate Authorities** — List CAs, read one CA's details, and retrieve its certificate chain - **Identity** — Read the identity and OAuth scopes tied to the current credential ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 70 / 100 - **Maturity:** AI-Aware - **Dimensions:** - Foundational Compliance: 100 / 100 - Developer Experience & Jentic Compatibility: 63 / 100 - AI-Readiness & Agent Experience: 50 / 100 - Agent Usability: 94 / 100 - Security: 75 / 100 - AI Discoverability: 78 / 100 - **View full report:** https://jentic.com/apis/certman.app/certman/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring the Certman API by hand means handling either its cm_ API key or the OAuth 2.1 PKCE flow with its ca:read, ca:issue, and ca:revoke scopes, and tracking which CA each certificate belongs to. Through Jentic you install once, import Certman from the API Directory, store the credential once, and your agent calls it. - **Permission scoping:** Certman puts the CA and certificate id in the URL path (`/v1/cas/{id}`, `/v1/certificates/{id}/revoke`), so a rule can pin your agent to one Certificate Authority and the operations you pick. You can let it list and read certificates without granting the issue, renew, or revoke operations. - **Credential handling:** Your Certman credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'issue a certificate' or 'renew a TLS certificate', and Jentic returns the matching Certman operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Akeyless** — Secrets and certificate management platform covering more credential types than certificates alone. - **Cloudflare** — Issues and manages SSL/TLS certificates as part of a broader DNS and edge platform. - **SSL Labs** — Tests and grades a deployed certificate's TLS configuration after Certman issues it. ## FAQ ### What authentication does the Certman API use? The Certman API supports two authentication methods per its OpenAPI spec: an API key sent as a bearer token (prefixed cm_) and OAuth 2.1 authorization code flow with PKCE, which exposes the scopes ca:read, ca:issue, and ca:revoke. Through Jentic the credential is stored once by your own self-hosted instance and injected at call time, so it never sits in your agent's prompt or logs. ### Is there a Certman MCP server? You do not need an MCP server to give your agent the Certman API. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the issue, renew, revoke, and list operations on demand. Operations are discovered when needed, so no extra server's tool definitions are loaded into the agent's context. ### Can I limit what my agent is allowed to do with the Certman API? Yes. Write a rule that allows only the list and read operations under one Certificate Authority, so the agent can inspect certificates and fetch the chain but cannot issue, renew, or revoke anything. The API's own OAuth scopes (ca:read, ca:issue, ca:revoke) map to the same split, and every call the agent makes is logged. ### Can I issue and revoke certificates with the Certman API? Yes. Issue a certificate with POST `/v1/certificates` against a Certificate Authority the account owns, renew it with POST `/v1/certificates/{id}/renew`, and revoke it with POST `/v1/certificates/{id}/revoke.` You can list the CAs you may issue from at `/v1/cas` and retrieve a CA's full chain from `/v1/cas/{id}/chain` for trust configuration. ### What are the rate limits for the Certman API? The OpenAPI spec does not specify rate limits for the Certman API. Check the documentation at https://certman.app for current limits and plan allowances before running an agent that issues or renews certificates at volume. ### How do I issue a certificate with the Certman API through Jentic? Search Jentic for 'issue a certificate' and it returns the POST `/v1/certificates` operation with its input schema. Pass the Certificate Authority id and the certificate request and the agent gets back the issued certificate. To run it on your own infrastructure, install Jentic One from its GitHub repo.