Certificate API version v1
/api/v1
/health
/profiles
/device-types
List supported device types
/{profile}/certificates
List all certificates issued under a profile, grouped by serial name
get /{profile}/certificates
List all certificates issued under a profile, grouped by serial name
URI Parameters
- profile: required(string)
The VPN profile name
Example:
nsic-gw1-prod
HTTP status code 200
Body
Media type: application/json
Type: any
Example:
[
{
"serial_name": "DEVICE-001",
"device_types": ["ios", "windows"]
},
{
"serial_name": "DEVICE-002",
"device_types": ["linux"]
}
]
HTTP status code 401
Missing or invalid bearer token
HTTP status code 404
Unknown profile
Body
Media type: application/json
Type: any
Example:
{"error": "Unknown profile"}
Get presigned S3 download URLs (1-hour expiry) for all artifact files for a serial + device type
get /{profile}/certificates/{serial_name}/{device_type}
Get presigned S3 download URLs (1-hour expiry) for all artifact files for a serial + device type
URI Parameters
- profile: required(string)
The VPN profile name
Example:
nsic-gw1-prod - serial_name: required(string)
The device serial identifier
Example:
DEVICE-001 - device_type: required(one of windows, ios, macos, linux)
The device platform
Example:
windows
HTTP status code 200
Body
Media type: application/json
Type: any
Example:
{
"serial_name": "DEVICE-001",
"profile": "nsic-gw1-prod",
"device_type": "windows",
"files": [
{"filename": "DEVICE-001.p12", "url": "https://..."},
{"filename": "DEVICE-001.ps1", "url": "https://..."}
]
}
HTTP status code 400
Unknown device type
Body
Media type: application/json
Type: any
Example:
{"error": "Unknown device_type: fax"}
HTTP status code 401
Missing or invalid bearer token
HTTP status code 404
Unknown profile or no files found for that serial + device type
Body
Media type: application/json
Type: any
Example:
{"error": "No files found"}
/history
Return the last 50 certificate generation events across all profiles, most recent first
get /history
Return the last 50 certificate generation events across all profiles, most recent first
HTTP status code 200
Body
Media type: application/json
Type: object
Properties- entries: required(array of object)
Items: items
- timestamp: required(string)
ISO 8601 UTC timestamp
Example:
2026-05-21T14:00:00Z - user: required(string)
Identity of the caller (preferred_username or app ID)
- serial_name: required(string)
- profile: required(string)
- ca_cn: required(string)
Common name of the CA used to sign the certificate
- device_type: required(one of windows, ios, macos, linux)
- timestamp: required(string)
Example:
{
"entries": [
{
"timestamp": "2026-05-21T14:00:00Z",
"user": "alice@example.com",
"serial_name": "DEVICE-001",
"profile": "cyberhive-gw1-prod",
"ca_cn": "CyberHive CA",
"device_type": "windows"
}
]
}
HTTP status code 401
Missing or invalid bearer token
/{profile}/certificate
Generate a client certificate, package it for the specified device type, and upload to S3
post /{profile}/certificate
Generate a client certificate, package it for the specified device type, and upload to S3
URI Parameters
- profile: required(string)
The VPN profile name to generate a certificate against
Example:
cyberhive-gw1-prod
Body
Media type: application/json
Type: object
Properties- serial_name: required(string)
The serial number or identifier of the device
Example:
device-001 - device_type: required(one of windows, ios, macos, linux)
The target device platform
Example:
windows
Example:
{
"serial_name": "device-001",
"device_type": "windows"
}
HTTP status code 201
Certificate generated and uploaded successfully
Body
Media type: application/json
Type: object
Properties- serial_name: required(string)
- profile: required(string)
- device_type: required(string)
- s3_paths: required(array of string)
Example:
{
"serial_name": "device-001",
"profile": "cyberhive-gw1-prod",
"device_type": "windows",
"s3_paths": [
"s3://gatekeeper-s3-bucket/cyberhive_gw1_prod/windows/device-001.p12",
"s3://gatekeeper-s3-bucket/cyberhive_gw1_prod/windows/device-001.ps1"
]
}
HTTP status code 400
Invalid request (missing fields or invalid device type)
Body
Media type: application/json
Type: any
Example:
{
"error": "serial_name is required"
}
HTTP status code 404
Unknown VPN profile
Body
Media type: application/json
Type: any
Example:
{
"error": "Unknown profile: nonexistent"
}
HTTP status code 500
Internal error (e.g. failed to load secrets)
Body
Media type: application/json
Type: any
Example:
{
"error": "Failed to load profile secrets: ..."
}
Delete all S3 artifact files for a given serial name and device type
delete /{profile}/certificate/{serial_name}/{device_type}
Delete all S3 artifact files for a given serial name and device type
URI Parameters
- profile: required(string)
The VPN profile name to generate a certificate against
Example:
cyberhive-gw1-prod - serial_name: required(string)
The device serial identifier
Example:
DEVICE-001 - device_type: required(one of windows, ios, macos, linux)
Example:
windows
HTTP status code 200
Body
Media type: application/json
Type: object
Properties- deleted: required(integer)
Number of S3 objects deleted
Example:
{"deleted": 2}
HTTP status code 400
Unknown device type
Body
Media type: application/json
Type: any
Example:
{"error": "Unknown device_type: fax"}
HTTP status code 401
Missing or invalid bearer token
HTTP status code 404
Unknown profile
Body
Media type: application/json
Type: any
Example:
{"error": "Unknown profile"}