List Client Cas

List Client CAs

GET /v1/client-cas

List the X.509 root CAs the calling user has uploaded for mTLS validation. Once uploaded, a client CA can be attached to one or more endpoints via PUT /v1/endpoints/{id}/mtls — clients connecting to that endpoint must present a leaf cert chained to one of the trusted roots, or the TLS handshake fails at the edge.

Account scope: these client CAs belong to your active account and are shared with its members per your role's permissions. Use switch account to manage a different account's CAs.

Use this for service-to-service auth where every caller has a unique client cert (issued by your own internal PKI), or for high-assurance deployments where password/token auth alone isn't enough.

Listed CAs include an endpoint_count showing how many endpoints currently use each CA — non-zero counts block deletion until you detach.

Response (200 OK)

items array

Client CAs ordered by created_at DESC.

items[].id int64

Numeric ID. Used in mTLS config as ca_ids[].

items[].user_id int64

ID of the user who uploaded the CA.

items[].name string

Friendly label. Max 128 chars.

items[].description string

Optional longer description. Max 512 chars.

items[].subject_cn string

Subject Common Name from the CA cert.

items[].subject_raw string

Full RFC 4514 subject DN.

items[].issuer_cn, issuer_raw string

Issuer (typically the CA itself for self-signed roots).

items[].fingerprint string

SHA-256 fingerprint (hex). Unique per CA per user — uploading the same CA again returns 409.

items[].not_before, not_after datetime

CA validity window. Expired CAs still appear in the list but won't validate any leaf cert that chains to them.

items[].endpoint_count int

How many endpoints currently trust this CA. Non-zero blocks deletion.

items[].created_at, updated_at datetime

RFC 3339 UTC timestamps.

Errors

401 Unauthorized

Missing auth.

403 Forbidden

Caller lacks the cert:read permission in the active account.

Request
curl "https://api.ngris.com/v1/client-cas" \
  -H "X-API-KEY: <your_api_key>"

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
result = client.client_cas.list()
for ca in result["items"]:
    print(f"#{ca['id']} {ca['name']} ({ca['endpoint_count']} endpoints)")

Response — 200 OK
{
  "items": [
    {
      "id": 7,
      "user_id": 1024,
      "name": "internal-corp-ca",
      "description": "Acme Corp internal PKI root",
      "subject_cn": "Acme Corp Root CA",
      "subject_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
      "issuer_cn": "Acme Corp Root CA",
      "issuer_raw": "CN=Acme Corp Root CA,O=Acme Corp,C=US",
      "fingerprint": "ab:cd:ef:01:23:...",
      "not_before": "2024-01-01T00:00:00Z",
      "not_after": "2034-01-01T00:00:00Z",
      "endpoint_count": 2,
      "created_at": "2026-01-15T12:00:00Z",
      "updated_at": "2026-01-15T12:00:00Z"
    }
  ]
}

PreviousDelete Certificate NextGet Client CA

On this page

List Client CAs