The TLS Certificate Management API allows authorised participants to self-manage their AEMO-signed TLS certificates. This API provides the following features:
\nFinal. Participants can use this specification to build their APIs.
\nBefore using the TLS Certificate Management API, you must:
\nTLS Certificate Management Open API Specification
\nThis API is protected by MTLS authentication. A valid AEMO-signed TLS certificate is required to access this API. See Prerequisites above on how to get an AEMO-signed TLS certificate for the first time.
\nParticipant administrators provide access to the TLS Certificate Management API using the TLS_CERTIFICATE_MANAGEMENT entity. See the User Rights Management guide (URM) for details on managing URM functions.
\nUsers must be assigned rights that have access to the entity TLS_CERTIFICATE_MANAGEMENT. The API allows two privileges (access levels) of access rights for that entity:
\nWhen calling this API, your username must be subscribed to a valid right under the TLS_CERTIFICATE_MANAGEMENT entity. You authorize your identity using Base64 encoding of your username and password, separated by a colon, in the Basic Auth header. For example:
\nAuthorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
To control traffic, AEMO implements Throttling on all API Endpoint requests. Also, some endpoints have a specific quota of requests. If a Participant ID requests exceed the Throttling limit a HTTP 429 or 422 response returns. For more details, see the examples under each request.
\nFor detailed examples of response codes see the provided example under each request.
\nThe API is available over the internet on the following base URLs:
\nTLS Certificates created in the pre-production environment contain the \"MOCK\" suffix in the commonName, and are mock certificates only. These certificates automatically expire after 10 days and cannot be used for accessing any AEMO systems.
\nTLS Certificates created in the production environment contain either the \"PROD\" or \"NONPROD\" suffix in the commonName depending on the environment entered in the API request. These certificates automatically expire after 3-years and are used for accessing MTLS-protected AEMO systems (both pre-production and production systems).
\nNONPROD certificates can only be used for accessing AEMO non-production systems (for example APIs on https://partner.api.preprod.aemo.com.au, https://apis.preprod.aemo.com.au:9319, or https://apis.preprod.marketnet.net.au:9319). You need to use a pre-prod certificate to access AEMO non-production environments that are MTLS protected. The NONPROD certificate is issued by the certificate authority AEMO-ICA-TEST G1.
\nProd certificates can only be used for accessing AEMO production systems (for example APIs on https://partner.api.aemo.com.au, https://apis.aemo.com.au:9319, or https://apis.marketnet.net.au:9319). You need to use the PROD certificate to access AEMO Production environments that are MTLS protected. The PROD certificate is issued by the certificate authority AEMO-ICA-MARKET G1.
\n(Required) The participant ID who the request is from. Type; string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Content-Type","value":"application/json","description":"(Optional)
\n"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"body":{"mode":"raw","raw":"{\n \"csr\": \"-----BEGIN CERTIFICATE REQUEST----- MIIDFjCCAf4CAQAwgbkxCzAJBgNVBAYTAkFVMREwDwYDVQQIDAhDb3JjYWlnaDES MBAGA1UEBwwJRGVpcyBNdWluMSIwIAYDVQQKDBlTb25yYWkgQ29uc3VsdGluZyBQ dHkgTHRkMSYwJAYDVQQLDB1HZXQgeW91ciBBUEkgcHJvZ3JhbSBvbiB0cmFjazEU MBIGA1UEAwwLU09OUkFJLVByb2QxITAfBgkqhkiG9w0BCQEWEmluZm9Ac29ucmFp LmNvbS5hdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKpMFG4WhHKX G6yyY//sDzgW1WujgtJLhWu32uWtH0l4VDEOSNgFTszKfpSfmblf5WOpxR5eqM52 Fy0/yNqAclUWVSqKK7QDbWVsd8wdOfmAD9d3Ex7xQvouLtNGOyo2JEXwryULeM65 D9Vu+grxVN55vhUUHA3Xt9dYBb+M/gplwt/t5KswgtuaDzktW+X407QwAmy/RYsU Jf/nDdPyna+/0z3ByprzgYaA4gaKOZMGjq3nrBIR7iO0AQbmo6R1Pv1k+kduue2S WCQkiA9y6RLxzM/Sg9wUO9uNK0A+5v0TKQm8gDweISdH60DRGSHgC4int5ncbE5j 2/ZSxtJpxl8CAwEAAaAXMBUGCSqGSIb3DQEJAjEIDAZTb25yYWkwDQYJKoZIhvcN AQELBQADggEBAJek88Bm7LLYHbI9ft99ibR8l1wSCKhrdvJcyNjhnriMe+X62nq3 vxb32nPPilA0c541zbOlOlFcxlh5jk9FB/csuYNGGiQfkXHSS51IidDQFp20O2cl nFAl3lsLMZrEE8Cu1r+7AYEOrKTN8Qj76uejPzLpmBEGje5lo5XqDEryBoyg4DDa Va++leYdxbPwoTCTzsTDoZsVEikGjD6MVT3eMNwXEe334v6T3dJlWNSpTJvgA8qr OC31BRhiAjCIJ0H7yPcacZ8wE6n/iI/9QOPgPITHOSl51YNM8Spl74MG49A1PTfj hnoEsWrXPakyOfUYDIZmbhMe+L50sfqyfEg= -----END CERTIFICATE REQUEST-----\",\n \"usage\": \"production\"\n}","options":{"raw":{"language":"json"}}},"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/certificates","description":"Generate a new certificate and a new order by providing a valid Certificate Signing Request (CSR) and an environment (non-prod or production) in the request body. This certificate is created under your Participant ID.
Generating the CSR depends on your server and operating system. For more information, see CSR requirements.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["certificates"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[]}},"response":[{"id":"6929bbb6-3c2f-48f9-a8c4-b9fdee44b166","name":"A successful response with confirmation of Certificate creation, and the TLS certificate itself","originalRequest":{"method":"POST","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"Basic(Required) The participant ID who the request is from. Type: string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/certificates/:certificate-id/download","description":"Download a certificate. This is returned in PEM format.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["certificates",":certificate-id","download"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[{"id":"888a0e71-0924-424d-874a-57f798c3b05b","description":{"content":"(Required) The specific ID of a Certificate. Type; string
\n","type":"text/plain"},"type":"any","value":"235774749","key":"certificate-id"}]}},"response":[{"id":"c4851f24-d7c6-480d-9184-413ec05c8c87","name":"A successful response with details on your specified certificate","originalRequest":{"method":"GET","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"Basic(Required) The participant ID who the request is from. Type: string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Content-Type","value":"application/json","description":"(Optional)
\n"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"body":{"mode":"raw","raw":"{\r\n \"orderId\": \"21584451\",\r\n \"certificateCommonName\": \"EASTENGY-Prod\"\r\n}","options":{"raw":{"language":"json"}}},"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/certificates/:certificate-id/revoke","description":"Revoke an existing TLS certificate if it’s no longer required or that the certificate’s private key has been compromised. Once revoked, it cannot be used to access AEMO systems.
\nTo revoke a certificate, you must provide an orderId and certificateCommonName in the request body that is associated with the certificate-id in the request path.
(Required) The specific ID of a Certificate. Type: string
\n","type":"text/plain"},"type":"any","value":"235774749","key":"certificate-id"}]}},"response":[{"id":"e35635e7-cbde-4372-ba6e-4d5f0038b8ea","name":"A successful response with confirmation of certificate revoking.","originalRequest":{"method":"POST","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"BasicThe /certificates Endpoint allows participants to create new certificates, download certificates or revoke certificates.
(Required) The participant ID who the request is from. Type: string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/orders/:order-id","description":"Get all certificates (including expired, revoked, renewed and reissued certificates) associated with a particular order for a Participant ID.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["orders",":order-id"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[{"id":"a4292004-e67b-4387-8aee-bc9c8946974a","description":{"content":"(Required) The order ID of a Certificate. Type: string
\n","type":"text/plain"},"type":"any","value":"234113242","key":"order-id"}]}},"response":[{"id":"54491371-4a59-4cfb-bfe5-6a8608ea6f20","name":"A successful response with details on the order","originalRequest":{"method":"GET","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"Basic(Required) The participant ID who the request is from. Type: string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/orders","description":"Get all the certificate orders for a Participant ID.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["orders"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[]}},"response":[{"id":"070af94d-1b5a-4e35-9fc6-0fd9d572212b","name":"A successful response with confirmation of Certificate creation","originalRequest":{"method":"GET","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"Basic(Required) The participant ID who the request is from. Type: string
\n","key":"X-InitiatingParticipantID","value":"EASTENGY"},{"key":"Content-Type","value":"application/json","description":"(Optional)
\n"},{"key":"Accept","value":"application/json","description":"(Optional)
\n"}],"body":{"mode":"raw","raw":"{\n \"csr\": \"-----BEGIN CERTIFICATE REQUEST----- MIIDFjCCAf4CAQAwgbkxCzAJBgNVBAYTAkFVMREwDwYDVQQIDAhDb3JjYWlnaDES MBAGA1UEBwwJRGVpcyBNdWluMSIwIAYDVQQKDBlTb25yYWkgQ29uc3VsdGluZyBQ dHkgTHRkMSYwJAYDVQQLDB1HZXQgeW91ciBBUEkgcHJvZ3JhbSBvbiB0cmFjazEU MBIGA1UEAwwLU09OUkFJLVByb2QxITAfBgkqhkiG9w0BCQEWEmluZm9Ac29ucmFp LmNvbS5hdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKpMFG4WhHKX G6yyY//sDzgW1WujgtJLhWu32uWtH0l4VDEOSNgFTszKfpSfmblf5WOpxR5eqM52 Fy0/yNqAclUWVSqKK7QDbWVsd8wdOfmAD9d3Ex7xQvouLtNGOyo2JEXwryULeM65 D9Vu+grxVN55vhUUHA3Xt9dYBb+M/gplwt/t5KswgtuaDzktW+X407QwAmy/RYsU Jf/nDdPyna+/0z3ByprzgYaA4gaKOZMGjq3nrBIR7iO0AQbmo6R1Pv1k+kduue2S WCQkiA9y6RLxzM/Sg9wUO9uNK0A+5v0TKQm8gDweISdH60DRGSHgC4int5ncbE5j 2/ZSxtJpxl8CAwEAAaAXMBUGCSqGSIb3DQEJAjEIDAZTb25yYWkwDQYJKoZIhvcN AQELBQADggEBAJek88Bm7LLYHbI9ft99ibR8l1wSCKhrdvJcyNjhnriMe+X62nq3 vxb32nPPilA0c541zbOlOlFcxlh5jk9FB/csuYNGGiQfkXHSS51IidDQFp20O2cl nFAl3lsLMZrEE8Cu1r+7AYEOrKTN8Qj76uejPzLpmBEGje5lo5XqDEryBoyg4DDa Va++leYdxbPwoTCTzsTDoZsVEikGjD6MVT3eMNwXEe334v6T3dJlWNSpTJvgA8qr OC31BRhiAjCIJ0H7yPcacZ8wE6n/iI/9QOPgPITHOSl51YNM8Spl74MG49A1PTfj hnoEsWrXPakyOfUYDIZmbhMe+L50sfqyfEg= -----END CERTIFICATE REQUEST-----\",\n \"certificateCommonName\": \"EASTENGY-Prod\"\n}","options":{"raw":{"language":"json"}}},"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/orders/:order-id/reissue","description":"Reissue a certificate. A certificate reissue creates a new certificate with a new CSR. By providing an optional CSR, a reissued certificate uses the private key for that CSR.
\nTo reissue a certificate, you must provide a csr and certificateCommonName in the request body, where the certificateCommonName is associated with the order-id in the request path.
The reissued certificate is the primary certificate on the order (certificate
renewals use the primary certificate for renewal). It has the same expiry date as the original certificate on the order.
Multiple reissues of the same certificate can be made.
\nFor CSR requirements, see the POST /certificate.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["orders",":order-id","reissue"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[{"id":"55be7ea3-7508-4c87-9583-de1393bd3224","description":{"content":"(Required) The specific order ID of a Certificate. Type: string
\n","type":"text/plain"},"type":"any","value":"234113242","key":"order-id"}]}},"response":[{"id":"22729935-f8c1-4c62-8ca3-977f3159c2d3","name":"A successful response with confirmation of Certificate creation","originalRequest":{"method":"POST","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"Basic(Required) The participant ID who the request is from. Type: string
\n"},{"key":"Accept","value":"application/json","type":"text","description":"(Optional)
\n"}],"url":"https://partner.api.aemo.com.au/v1/TlsCertificateMgmt/orders/:order-id/renewal","description":"Renew a certificate under an existing order. A renewed certificate uses the CSR for the newest (primary) certificate issued under that order. You can only renew a certificate within 90-days of the certificate expiry or after it has expired.
\nIf you need to renew a certificate using a new CSR, make a /renewal API call first, then a /reissue API call with your new CSR.
\n","auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"{{basicAuthUsername}}"},{"key":"password","value":"{{basicAuthPassword}}"}]},"isInherited":true,"source":{"_postman_id":"df0be2fe-5715-4453-b7ff-5d949248e11a","id":"df0be2fe-5715-4453-b7ff-5d949248e11a","name":"TLS Certificate Management API","type":"collection"}},"urlObject":{"path":["orders",":order-id","renewal"],"host":["https://partner.api.aemo.com.au/v1/TlsCertificateMgmt"],"query":[],"variable":[{"id":"3464438a-0aab-495d-ac31-5fd70681622a","description":{"content":"(Required) The specific order ID of a Certificate. Type: string
\n","type":"text/plain"},"type":"any","value":"234113242","key":"order-id"}]}},"response":[{"id":"d9674003-4ee8-4b62-91cd-c43d4ac11661","name":"A successful response with confirmation of certificate creation","originalRequest":{"method":"POST","header":[{"description":"Added as a part of security scheme: basic","key":"Authorization","value":"BasicThe /orders Endpoint allows participants to get a list of their certificate orders, certificate order details, reissue or renew a certificate under an order.