Get Client CA
Read full record of one client CA, including the PEM-encoded root certificate. Used by tools that need to display or distribute the CA — e.g. an admin UI showing the CA fingerprint for clients to pin, or a script that exports the CA to a Kubernetes secret.
Returns the CA record (id, user_id, name, description, ca_pem, subject/issuer fields, fingerprint, not_before/not_after, created_at/updated_at). Unlike the list, this includes ca_pem but does not include endpoint_count.
Path parameters
id int64 Req
CA ID. Get from /client-cas.
Response (200 OK)
Same shape as a list entry, plus:
ca_pem string
PEM-encoded CA certificate. Multi-line;
-----BEGIN CERTIFICATE-----… -----END CERTIFICATE-----.Errors
400 Bad Request
Non-numeric ID.
401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
cert:read permission in the active account.404 Not Found
CA doesn't exist or belongs to another account.
Request
curl "https://api.ngris.com/v1/client-cas/7" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
ca = client.client_cas.get("7")
with open("ca.pem", "w") as f:
f.write(ca.ca_pem)
print(f"Fingerprint: {ca.fingerprint}")
Response — 200 OK
{
"id": 7,
"user_id": 1024,
"name": "internal-corp-ca",
"description": "Acme Corp internal PKI root",
"ca_pem": "-----BEGIN CERTIFICATE-----\nMIIDX...\n-----END CERTIFICATE-----\n",
"subject_cn": "Acme Corp Root CA",
"subject_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
"issuer_cn": "Acme Corp Root CA",
"issuer_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
"fingerprint": "ab:cd:ef:01:23:...",
"not_before": "2024-01-01T00:00:00Z",
"not_after": "2034-01-01T00:00:00Z",
"created_at": "2026-01-15T12:00:00Z",
"updated_at": "2026-01-15T12:00:00Z"
}