canonical: https://jentic.com/apis/googleapis.com/certificate-authority # Google Certificate Authority API The Google Cloud Certificate Authority Service API lets you provision, manage, and operate private certificate authorities (CAs) at scale on Google Cloud. It supports CA pools, root and subordinate CAs, certificate templates, issuance policies, and lifecycle operations such as activate, disable, enable, and revoke. The API also exposes certificate revocation lists, audit-friendly resource hierarchies, and IAM-based access control so private PKI can be automated alongside other Google Cloud workloads. ## For AI agents Issue, revoke, and manage X.509 certificates from private certificate authorities on Google Cloud, including CA pool and template lifecycle operations. ## Scope Does not handle public browser-trusted certificate issuance, ACME account binding, or key generation in HSMs - use for Google Cloud private certificate authority operations only. ## Capabilities - Create CA pools and provision root or subordinate certificate authorities under a Google Cloud project - Issue private X.509 certificates against a CA pool using configurable certificate templates - Revoke previously issued certificates and fetch the resulting certificate revocation lists - Activate, disable, enable, and undelete certificate authorities through dedicated lifecycle endpoints - List certificates issued by a CA pool and inspect their issuance metadata for compliance reviews - Fetch the trust chain CA certificates for a CA pool to distribute to clients and devices ## Use cases ### Internal Service mTLS Issue short-lived X.509 certificates for mutual TLS between microservices on Google Cloud without operating bespoke CA software. Certificate Authority Service handles key protection, audit logging, and CRL publication while certificate templates pin key usages and SANs to internal naming conventions. Example prompt: Create a CA pool in DevOps tier, then issue a 90-day certificate for service.internal.example.com using a template that enforces serverAuth and clientAuth extended key usages. ### Device and IoT PKI Provision unique device certificates for fleets of IoT or edge devices using a private CA hierarchy hosted on Google Cloud. The API supports template-based issuance and revocation so devices can be rotated, retired, or quarantined without rebuilding the trust chain. Example prompt: Issue a certificate with a device serial number embedded as the subject CN, then later revoke it with reason key_compromise when the device is decommissioned. ### Compliance and Audit Reporting Generate periodic compliance reports on certificate issuance, expiry, and revocation across all CA pools in an organization. The API exposes structured certificate metadata and CA state so audit pipelines can verify issuance policy enforcement and detect drift. Example prompt: List all certificates issued by ca-pool projects/p/locations/us-central1/caPools/prod where state is ENABLED, then export issuer, subject, and notAfter fields for the audit team. ### Agent-Driven CA Lifecycle Management An AI operations agent uses Jentic to discover and call Certificate Authority Service operations on behalf of platform engineers - provisioning new CAs, rotating subordinate CAs, and revoking certificates in response to security alerts without needing direct console access. Example prompt: Search Jentic for revoke a certificate, load the schema for projects.locations.caPools.certificates.revoke, and call it for the certificate referenced in a SOC alert. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /v1/{+caPool}:fetchCaCerts | Fetch CA chain certificates for a CA pool | | POST | /v1/{+name}:activate | Activate a subordinate certificate authority | | POST | /v1/{+name}:disable | Disable a certificate authority | | POST | /v1/{+name}:enable | Enable a certificate authority | | POST | /v1/{+name}:revoke | Revoke a previously issued certificate | | POST | /v1/{+name}:undelete | Undelete a certificate authority within its retention window | ## Key resources - **caPools** — Logical groups of certificate authorities with a shared issuance policy and tier - **certificateAuthorities** — Root and subordinate CAs that sign certificates within a pool - **certificates** — X.509 certificates issued by a CA pool, including revoke and fetch operations - **certificateTemplates** — Reusable templates that constrain certificate fields, extensions, and key usages - **certificateRevocationLists** — CRLs published per CA for relying parties to consume ## Why Jentic - **Setup:** Wiring the Certificate Authority API by hand means standing up Google OAuth 2.0 with the cloud-platform scope, refreshing access tokens, and tracking CA pool and certificate resource names across every request against privateca.googleapis.com. Through Jentic you install once, import the Certificate Authority API from the API Directory, store the OAuth credential once, and your agent calls it. - **Permission scoping:** This API puts the resource name in the URL path (/v1/{+name} and /v1/{+caPool}), so a rule can pin your agent to one CA pool or certificate authority: it can issue and fetch CA certs for that resource and nothing else. You choose the operations it may call, so state-changing ones like disabling a CA or revoking a certificate are not included unless you add them. - **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'issue a certificate' or 'revoke a certificate from a CA pool', and Jentic returns the matching Certificate Authority API operation with its input schema so the agent calls the right endpoint without browsing the Google Cloud reference docs. ## Related APIs - **Public Certificate Authority API** — Public CA for ACME-issued, browser-trusted certificates instead of private PKI - **Cloud Key Management Service API** — Manages the cryptographic keys that back private CAs - **Secret Manager API** — Stores private keys, CA chains, and credentials issued alongside certificates ## FAQ ### What authentication does the Certificate Authority API use? The API uses Google OAuth 2.0 with the cloud-platform scope, sent as a Bearer token in the Authorization header. Through Jentic the OAuth credentials are stored in the vault and short-lived access tokens are injected at call time, so the raw refresh token never enters the agent context. ### Can I issue certificates for arbitrary domains with this API? No, this API issues certificates from your own private CAs, so issuance is constrained by the CA pool issuance policy and any certificate template attached to the call. It is not a public CA and the certificates it issues are not trusted by browsers by default. ### What are the rate limits for the Certificate Authority API? Quotas are enforced per Google Cloud project and are configurable in the Cloud console under IAM and admin quotas. Default per-minute write quotas apply to certificate issuance and CA mutation operations, and bulk issuance should batch requests rather than fire them in tight loops. ### How do I revoke a certificate through Jentic? Search Jentic for revoke a certificate, load the schema for the projects.locations.caPools.certificates.revoke operation which maps to POST /v1/{+name}:revoke, then execute it with the full certificate resource name and a reason such as KEY_COMPROMISE. ### Is the Certificate Authority API free? No, Certificate Authority Service is billed per CA per month based on tier (DevOps or Enterprise) plus a per-certificate issuance fee. Pricing is published on the Google Cloud pricing page and applies whether the API is called directly or via Jentic. ### How do I fetch the trust chain CA certificates for a CA pool? Call POST /v1/{+caPool}:fetchCaCerts with the full CA pool resource name. The response contains the PEM-encoded CA certificates that relying parties need to trust certificates issued by the pool. ### Can I limit what my agent is allowed to do with the Certificate Authority API? Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and the API puts the resource name in the URL path (/v1/{+name} and /v1/{+caPool}), so you can pin the agent to a single CA pool or certificate authority. You also choose which operations it may call, so read-only work like fetching CA chain certificates can be allowed while state-changing calls such as revoking a certificate, disabling a CA, or activating a subordinate CA stay off unless you add them. The scoped access token is injected only at execution time, so the agent can act on exactly the resources and operations you permit and nothing more.