List Client Certificates
List the device certificates a CA managed by ngris issued, newest first, a page at a time. An uploaded CA has none, so its list is empty. Listing works whatever your plan, so you can always find and revoke a certificate.
Path parameters
uuid string (uuid) Req
The CA's
uuid from /client-cas.Query parameters
status string
Optional.
active or revoked.q string
Optional. Part of the device name, or the start of the serial or fingerprint. At most 128 characters.
page int
Optional. 1-based page number. Default
1.page_size int
Optional. Certificates per page. Default
15, capped at 200.Response (200 OK)
items array
The certificates on this page (the object below).
[] when there are none.total int
Matching certificates across all pages.
page, page_size int
The page returned and the page size used.
The certificate object
uuid string (uuid)
The certificate's uuid. Used in /client-certificates/{uuid}.
name string
The device name. Names don't have to be unique: a renewed device has one certificate per renewal.
status string
active or revoked. An active certificate past not_after has expired and is refused.serial string
The serial number, lowercase hex. Your app receives it in
X-Ngris-Client-Cert-Serial.fingerprint_sha256 string
The certificate's SHA-256 fingerprint, lowercase hex. Your app receives it in
X-Ngris-Client-Cert-Fingerprint.subject string
The subject,
CN=<name>.public_key_alg string
The type of the device's key.
not_before, not_after datetime
When the certificate starts and stops being valid.
delivery string
csr: issued for the device's signing request. bundle: downloaded in the dashboard as a file for a browser or phone.created_via string
dashboard, api, cli or mcp.created_by_user_uuid string (uuid)?
Who issued it. Omitted once that user is deleted.
client_ca_uuid string (uuid)
The CA that issued it.
revoked_at, revoke_reason, revoked_by_user_uuid ?
Set once the certificate is revoked. Deleting its CA revokes it with the reason
The certificate authority was deleted.quota_paused_at datetime?
Set while the certificate is paused because the account has more active certificates than its plan allows: endpoints refuse it until the account has room again (it resumes on its own). Absent otherwise.
created_at datetime
RFC 3339 UTC timestamp.
Errors
400 Bad Request
status other than active or revoked, or q longer than 128 characters.401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
cert:read permission in the active account.404 Not Found
The CA doesn't exist or belongs to another account.
Request
curl "https://api.ngris.com/v1/client-cas/019b2c40-1a2b-7c3d-8e4f-5a6b7c8d9e0f/certificates?status=active&q=laptop" \
-H "X-API-KEY: <your_api_key>"
Response — 200 OK
{
"items": [
{
"uuid": "019b2c41-7d0e-7f3a-9c5e-2a6b8d4f1e07",
"name": "laptop-anna",
"serial": "5b1e0c9a3f7d42e8b6a1c0d9e8f7a6b5",
"fingerprint_sha256": "9a8b7c6d5e4f30211203f4e5d6c7b8a99a8b7c6d5e4f30211203f4e5d6c7b8a9",
"subject": "CN=laptop-anna",
"public_key_alg": "rsa-2048",
"not_before": "2026-10-29T09:55:00Z",
"not_after": "2027-01-27T10:00:00Z",
"delivery": "csr",
"status": "active",
"created_via": "cli",
"created_at": "2026-10-29T10:00:00Z",
"client_ca_uuid": "019b2c40-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"created_by_user_uuid": "019a52c2-ca1e-78ba-ab5c-50362cc29134"
}
],
"total": 1,
"page": 1,
"page_size": 15
}
Was this helpful?