Get mTLS Config
Read the mutual-TLS configuration for an endpoint. mTLS requires every connecting client to present an X.509 certificate signed by one of the trusted client CAs you've uploaded — useful for service-to-service auth where every caller can be issued a unique client cert.
Three modes:
disabled— no client cert required. Default.optional— client cert is parsed if presented and the cert subject becomes available to your upstream (for audit/logging), but missing certs don't block.required— connections without a valid client cert are rejected at the TLS layer. The cert subject is forwarded to the upstream asX-Client-Cert-Subject.
Configure via PUT /v1/endpoints/{id}/mtls. The list of trusted root CAs is managed independently via /client-cas.
Path parameters
id string (uuid) Req
Endpoint UUID.
Response (200 OK)
endpoint_id int64
Numeric endpoint ID.
mode string
disabled | optional | required.ca_ids int64[]
List of trusted client-CA IDs. Cross-reference with /client-cas to get full CA records (name, expiry, etc.). Empty when
mode: "disabled".Errors
401 Unauthorized
Missing auth.
404 Not Found
Endpoint doesn't exist or belongs to another user.
500
Database error reading the mTLS state.
Request
curl "https://api.ngris.com/v1/endpoints/<uuid>/mtls" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
mtls = client.client_cas.get_mtls("<endpoint_uuid>")
print(mtls.mode, mtls.ca_ids)
Response — 200 OK
{
"endpoint_id": 184,
"mode": "required",
"ca_ids": [7, 12]
}
Response — disabled
{
"endpoint_id": 184,
"mode": "disabled",
"ca_ids": []
}