List Domain Certificates
List the certificates of one domain: the certificate ngris issues for it through ACME (Let's Encrypt) and any certificate you uploaded for it. The domain's default certificate, the one served for it, comes first; the rest follow, newest first.
A domain has one ACME certificate. Renewal replaces it in place (same uuid, new validity dates), so this is not an issuance history. To list the certificates of every domain in your account, with search and status filters, use GET /v1/certificates/self.
Account scope: the domain must belong to your active account, and your role needs read access to certificates.
Path parameters
uuid string (uuid) Req
The domain's
uuid from /domains/available.Query parameters
page int
1-based page number. Without it the response holds every certificate of the domain and no
page / page_size.page_size int
Certificates per page when
page is set. Default 15, max 200.Response (200 OK)
domain_uuid string (uuid)
The domain's uuid.
domain_name string
The domain name, e.g.
example.com.certificates array | null
The certificates, default first, then newest first.
null when the domain has none.total int
Number of certificates of the domain (all pages).
page, page_size int
Only when
page was sent.Each entry in certificates:
uuid string (uuid)
The certificate's uuid. Send it as
certificate_uuid to PUT /v1/domains/self/{uuid}/active-cert, and use it in DELETE /v1/domains/self/{uuid}/certificates/{cert_uuid}.name string
The label you gave an uploaded certificate. ACME certificates are named
LE cert for <domain>.cn string
Subject Common Name read from the certificate. Empty when the certificate can't be parsed.
sans string[] | null
The DNS names (Subject Alternative Names) the certificate covers.
null when it has none or can't be parsed.issuer string
The issuer's organization (e.g.
Let's Encrypt), else its Common Name, else Unknown.not_before, not_after datetime
Validity window, RFC 3339.
status string
valid, expiring (expires within 30 days) or expired, from not_after.is_default boolean
true for the certificate served for the domain. Change it with PUT /v1/domains/self/{uuid}/active-cert.is_active boolean
Whether the certificate is switched on. An expired certificate stays on and is served until it is replaced: renewed, or another certificate uploaded or assigned.
acme_issued boolean
true for the certificate ngris issued through ACME, false for one you uploaded.acme_email string
The ACME account email of an ACME certificate. Left out when empty.
quota_paused boolean
true when an uploaded certificate is paused because the account is over its plan's custom-certificate limit: it is kept but not served, and can't be made the default.created_at, updated_at datetime
RFC 3339. An ACME renewal updates
updated_at.Deprecated: until the sunset this response also carries the legacy integer domain_id and the integer id of each certificate. Don't use them; read domain_uuid and uuid.
Errors
401 Unauthorized
Missing auth.
403 Forbidden
Your role can't read certificates.
404 Not Found
The domain doesn't exist, belongs to another account, or the path segment isn't a uuid.
Request
curl "https://api.ngris.com/v1/domains/self/019bd08f-98db-71b2-8e54-f518d319f111/certificates" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
resp = client._get_raw("/domains/self/019bd08f-98db-71b2-8e54-f518d319f111/certificates")
for c in resp["certificates"] or []:
served = "DEFAULT" if c["is_default"] else ""
print(c["uuid"], c["issuer"], c["status"], c["not_after"], served)
Response — 200 OK
{
"domain_uuid": "019bd08f-98db-71b2-8e54-f518d319f111",
"domain_name": "example.com",
"certificates": [
{
"uuid": "019be236-c4fb-72c2-b153-1eefef23705b",
"name": "LE cert for example.com",
"not_before": "2026-09-20T08:23:00Z",
"not_after": "2026-12-19T08:23:00Z",
"is_active": true,
"is_default": true,
"acme_issued": true,
"acme_email": "acme@ngris.com",
"issuer": "Let's Encrypt",
"cn": "example.com",
"sans": ["example.com", "*.example.com"],
"status": "valid",
"created_at": "2026-04-15T08:23:00Z",
"updated_at": "2026-09-20T08:23:00Z",
"quota_paused": false
},
{
"uuid": "019c11a4-2e0b-7c51-9a40-6b1f0d2e7a93",
"name": "wildcard from DigiCert",
"not_before": "2026-01-01T00:00:00Z",
"not_after": "2026-11-01T23:59:59Z",
"is_active": true,
"is_default": false,
"acme_issued": false,
"issuer": "DigiCert Inc",
"cn": "*.example.com",
"sans": ["*.example.com", "example.com"],
"status": "expiring",
"created_at": "2026-01-02T10:00:00Z",
"updated_at": "2026-01-02T10:00:00Z",
"quota_paused": false
}
],
"total": 2
}
Was this helpful?