API and automation

Everything you can do in the browser, you can also script. Servers can fetch their own certificates, so nothing needs to be copied around by hand.

API keys

Create keys on the API keys page. A key is shown once; only a hash of it is stored.

Keys can be limited to one or more departments. Send the key as a Bearer token.

Fetch a certificate from a server

The most common job: a server pulls its own certificate and reloads only when it has changed.

#!/bin/sh
CM=https://cert-manager.example.com
NAME=shop.example.com

curl -sf -H "Authorization: Bearer $CM_KEY" \
  "$CM/v1/certs/$NAME/download?format=fullchain" -o /tmp/$NAME.pem

cmp -s /tmp/$NAME.pem /etc/ssl/$NAME.pem || {
  mv /tmp/$NAME.pem /etc/ssl/$NAME.pem && systemctl reload nginx
}

Run it daily from cron. Available formats: crt, fullchain, chain, key, bundle and pfx, subject to your download policy.

Useful queries

# everything expiring within 30 days
curl -H "Authorization: Bearer $CM_KEY" -G "$CM/v1/certs" \
  --data-urlencode 'filter=daysLeft < 30'

# a short list: name, days left and status, soonest first
curl -H "Authorization: Bearer $CM_KEY" "$CM/v1/certs?fields=name,daysLeft,status&sort=daysLeft"

Filters combine with and, for example daysLeft < 30 and status == "critical". GET /v1/schema lists every field you can filter on, and limit / offset page through large estates.

The in-app API guide lists every endpoint with examples. Actions that take a while, such as issuing, stream their progress live.

Health check

GET /api/health is open, for container and load-balancer health checks.

AI assistants

An optional endpoint at /mcp lets AI assistants work with your certificates: answer questions such as "what expires next month?", run an expiry or crypto audit, check which servers picked up a renewal, verify what a host is serving, or explain how to pull a certificate. Turn it on in Config → AI / MCP.

The assistant sees exactly what its API key allows. It only reaches the departments the key covers, can be narrowed further to the person asking, and every call it makes is recorded in the audit log. The assistant's tools look and report; changes such as issuing or renewing go through the REST API with a write key.