Get mTLS Config
Read the mutual-TLS configuration for an endpoint. mTLS requires every connecting client to present an X.509 certificate signed by one of the trusted client CAs you've uploaded — useful for service-to-service auth where every caller can be issued a unique client cert.
Three modes:
disabled— no client cert required. Default.optional— client cert is parsed if presented and the cert subject becomes available to your upstream (for audit/logging), but missing certs don't block.required— connections without a valid client cert are rejected at the TLS layer. The cert subject is forwarded to the upstream asX-Client-Cert-Subject.
Configure via PUT /v1/endpoints/{uuid}/mtls. The list of trusted root CAs is managed independently via /client-cas.
Path parameters
uuid string (uuid) Req
Endpoint UUID.
Response (200 OK)
endpoint_uuid string (uuid)
The endpoint's
uuid (echo of the path).mode string
disabled | optional | required.ca_uuids string[] (uuid)
The
uuids of the trusted client CAs. Cross-reference with /client-cas to get full CA records (name, expiry, etc.). Empty when mode: "disabled".blocked_by_plan boolean
true when mode is optional or required but your plan no longer includes client certificates: the endpoint then accepts no client certificate (required refuses all connections) until they are back on your plan or you set mode: "disabled", which is always allowed.Deprecated: until the sunset this response also carries the legacy integer endpoint_id and ca_ids fields. Don't use them; read endpoint_uuid and ca_uuids.
Errors
401 Unauthorized
Missing auth.
404 Not Found
Endpoint doesn't exist or belongs to another user.
500
Database error reading the mTLS state.
Request
curl "https://api.ngris.com/v1/endpoints/<uuid>/mtls" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
mtls = client.client_cas.get_mtls("<endpoint_uuid>")
print(mtls.mode, mtls.ca_uuids)
Response — 200 OK
{
"mode": "required",
"ca_uuids": ["019af8a2-4b16-70ea-8090-9f63343250c8", "019b07e7-fbab-74be-a38d-e60284dd7254"],
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"blocked_by_plan": false
}
Response — disabled
{
"mode": "disabled",
"ca_uuids": [],
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"blocked_by_plan": false
}
Was this helpful?