Create Managed Client CA
Have ngris create a client certificate authority for your account, then issue a certificate for each device from it. ngris keeps the CA's private key; it can't be exported. Attach the CA to endpoints like an uploaded one, with PUT /v1/endpoints/{uuid}/mtls: every certificate it issues is then accepted there. Endpoints trust CAs, not single certificates, so create one CA for each group of devices that should reach different endpoints.
The CA is listed with your other CAs with "kind": "managed". Download its public certificate with GET /v1/client-cas/{uuid}/certificate.pem. Plan-gated: needs both the mtls_attachment and the managed_client_ca entitlements; how many managed CAs the account can have is plan_limits.max_managed_cas on GET /v1/account/plan. Managed CAs don't count toward the uploaded client CA limit.
Request body
Company laptops: 1 to 64 characters, on one line.Response (201 Created)
The CA, in the shape of GET /v1/client-cas/{uuid}:
managed here.Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
name, a name longer than 64 characters or over more than one line, or a body that isn't JSON.cert:write permission; the plan doesn't include mtls_attachment or managed_client_ca ("code": "entitlement_required"); or the account has reached its plan's number of managed CAs.Retry-After says when to try again."Managed client certificates aren't available right now." Try again later.