Get Client Cas

Get Client CA

GET /v1/client-cas/{uuid}

Read full record of one client CA, including the PEM-encoded root certificate. Used by tools that need to display or distribute the CA — e.g. an admin UI showing the CA fingerprint for clients to pin, or a script that exports the CA to a Kubernetes secret.

Returns the CA record (uuid, user_uuid, name, description, ca_pem, subject/issuer fields, fingerprint, not_before/not_after, created_at/updated_at, kind (uploaded or managed), and quota_paused_at while it is paused over the plan's limit). A managed CA's ca_pem is its public certificate only: ngris keeps its private key, which can't be exported. user_uuid is the member who uploaded it, absent once that user is deleted — the CA is the account's either way. Unlike the list, this includes ca_pem but does not include endpoint_count.

Path parameters

uuid string (uuid) Req

The CA's uuid from /client-cas.

Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.

Response (200 OK)

Same shape as a list entry, plus:

ca_pem string

PEM-encoded CA certificate. Multi-line; -----BEGIN CERTIFICATE-----… -----END CERTIFICATE-----.

Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.

Errors

400 Bad Request

An integer id after the sunset (integer_id_unsupported). A path segment that is neither a uuid nor an integer matches no route (404).

401 Unauthorized

Missing auth.

403 Forbidden

Caller lacks the cert:read permission in the active account.

404 Not Found

CA doesn't exist or belongs to another account.

Request
curl "https://api.ngris.com/v1/client-cas/019af8a2-4b16-70ea-8090-9f63343250c8" \
  -H "X-API-KEY: <your_api_key>"

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
ca = client.client_cas.get("019af8a2-4b16-70ea-8090-9f63343250c8")
with open("ca.pem", "w") as f:
    f.write(ca.ca_pem)
print(f"Fingerprint: {ca.fingerprint}")

Response — 200 OK
{
  "uuid": "019af8a2-4b16-70ea-8090-9f63343250c8",
  "user_uuid": "019a52c2-ca1e-78ba-ab5c-50362cc29134",
  "name": "internal-corp-ca",
  "description": "Acme Corp internal PKI root",
  "ca_pem": "-----BEGIN CERTIFICATE-----\nMIIDX...\n-----END CERTIFICATE-----\n",
  "subject_cn": "Acme Corp Root CA",
  "subject_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
  "issuer_cn": "Acme Corp Root CA",
  "issuer_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
  "fingerprint": "ab:cd:ef:01:23:...",
  "not_before": "2024-01-01T00:00:00Z",
  "not_after": "2034-01-01T00:00:00Z",
  "kind": "uploaded",
  "created_at": "2026-01-15T12:00:00Z",
  "updated_at": "2026-01-15T12:00:00Z"
}

Was this helpful?

PreviousList Client CAs NextUpload Client CA

On this page

Get Client CA

Was this helpful?