{"info":{"_postman_id":"ca7fc443-d7a0-4eec-b685-c167bb9d2298","name":"CERTInext API v2","description":"

CERTInext API v2 — Customer REST APIs

RESTful API for CERTInext certificate lifecycle management — issue, track, validate, renew, and revoke certificates programmatically.

Getting started (three steps)

Pick your environment. Use the environment dropdown (top-right in Postman) — Production (India / US), Sandbox, Demo, QA, or Localhost.
Fill in credentials. Set the appCode and accessKey environment variables. Both are generated in the CERTInext portal under Integration → REST APIs.
Get a token. Open Authentication → Get Bearer Token and hit Send. The response's tokenDetails.accessToken is auto-captured into — every other request uses it.

After that, run any folder top-to-bottom. The test scripts auto-capture orderId, requestId, etc. so the next request in the flow works without editing.

Workflow cheat sheet

SSL / TLS (DV example)

1. Authentication → Get Bearer Token\n2. SSL/TLS → 1. Create Order          → captures orderId\n3. SSL/TLS → 2. Get DCV Challenges    → returns HTTP / DNS / email proofs\n4. (publish the challenge on your domain)\n5. SSL/TLS → 3. Verify DCV            → CA re-checks\n6. SSL/TLS → 4. Submit CSR\n7. SSL/TLS → 5. Accept Agreement\n8. SSL/TLS → 6. Download Certificate\n

Optional alternatives:

Cancel before issuance → 7. Cancel Order
Revoke after issuance → 8. Revoke Certificate

Document Signer

1. Authentication → Get Bearer Token\n2. Document Signer → 1. Create Order         → captures orderId\n3. Document Signer → 2. Upload Documents (pending — use v1 /SubmitDocument)\n4. Document Signer → 3. Submit CSR\n5. Document Signer → 4. Accept Agreement\n6. Document Signer → 5. Download Certificate\n

Private PKI

1. Authentication → Get Bearer Token\n2. Private PKI → 1. Create Order   → captures orderId\n3. Private PKI → 2. Submit CSR\n4. Private PKI → 3. Download Certificate\n

Reconnaissance (call once per integration deploy, cache client-side)

Catalog → List Products — stable productCode per family (use in X-Product-Code)
Accounts → List Organizations / Domains / Groups — pre-vetted entitlements

Conventions used across the API

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Aspect	Standard
Auth	`Authorization: Bearer <jwt>` on every call
Idempotency	`Idempotency-Key` header on every unsafe POST (auto-populated with `0fb5a44a-09a2-406d-bfd6-75868f716a0c` below)
Timestamps	RFC 3339 UTC with `Z`
Phones	E.164 — e.g. `+919481081094`
Countries	ISO 3166-1 alpha-2 — e.g. `IN`, `US`
IDs	Opaque strings — do not parse
Errors	RFC 7807 `application/problem+json` with `type`, `title`, `status`, `detail`, `instance`, `code`
Pagination	`?page=0&size=50` where applicable

Environment variables (auto-managed)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Variable	Filled by	Purpose
`appCode`	You (once)	Account identifier from portal
`accessKey`	You (once)	Plain-text access key from portal
`accessToken`	`Get Bearer Token` test script	Bearer JWT on every call
`refreshToken`	`Get Bearer Token` test script	Future token refresh
`orderId`	`Create *` test scripts	Reused by subsequent lifecycle calls
`requestId`	`Create *` test scripts	Draft-only orders
`productCodeSslDv / Ov / Ev`	Pre-filled per env	`X-Product-Code` header for SSL
`productCodeDocSignerNp1Y / Lp1Y / Le1Y`	Pre-filled per env	`X-Product-Code` header for Document Signer
`productCodePkiIntranet / Igtf`	Pre-filled per env	`X-Product-Code` header for Private PKI
`caProfileId`, `masterProductId`	You (Private PKI orders)	CA template + subscription slot

Send any request with Send — all boilerplate (auth header, idempotency key, token refresh, state capture) runs automatically.

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[{"content":"CERTInext API v2 — Customer REST APIs","slug":"certinext-api-v2-customer-rest-apis"}],"owner":"40123569","collectionId":"ca7fc443-d7a0-4eec-b685-c167bb9d2298","publishedId":"2sBXqJJLFh","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2026-04-28T03:13:17.000Z"},"item":[{"name":"Authentication","item":[{"name":"Get Bearer Token","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["// Build ts + txn + SHA256(accessKey + ts + txn) → authKey.","// The v1 auth layer (which v2 reuses at the crypto level) expects this hashed form.","const ts = new Date().toISOString().replace(/\\.\\d{3}Z$/, '+00:00');","const txn = 'pm' + Date.now() + Math.floor(Math.random() * 1e6);","const accessKey = pm.environment.get('accessKey');","if (!accessKey || accessKey.startsWith('<')) {"," throw new Error('Set accessKey in the environment (CERTInext portal → Integration → REST APIs).');","}","const hash = CryptoJS.SHA256(accessKey + ts + txn).toString(CryptoJS.enc.Hex);","pm.variables.set('_ts', ts);","pm.variables.set('_txn', txn);","pm.variables.set('_hash', hash);"],"id":"67a650bf-1711-4e31-8716-e1d2755b53ac"}},{"listen":"test","script":{"type":"text/javascript","exec":["pm.test('200 OK', () => pm.response.to.have.status(200));","const body = pm.response.json();","const tok = body && body.tokenDetails ? body.tokenDetails.accessToken : null;","const ref = body && body.tokenDetails ? body.tokenDetails.refreshToken : null;","if (tok) {"," pm.collectionVariables.set('accessToken', tok);"," pm.collectionVariables.set('refreshToken', ref || '');"," pm.test('accessToken captured', () => pm.expect(tok).to.be.a('string').and.not.empty);"," console.log('Bearer token saved to — valid for', body.tokenDetails.expiresIn, 'seconds.');","} else {"," const err = (body && (body.meta || body)) || {};"," pm.test('Token request failed: ' + (err.errorMessage || err.error_description || err.error || JSON.stringify(err)), () => false);","}"],"id":"63bdb361-db3e-4665-8676-c4039d6fa5e4"}}],"id":"9d2a1764-1df6-40b8-95d7-805e76a342b3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"grant_type\": \"client_credentials\",\n \"accountNumber\": \"{{appCode}}\",\n \"authKey\": \"{{_hash}}\",\n \"ver\": \"1.0\",\n \"ts\": \"{{_ts}}\",\n \"txn\": \"{{_txn}}\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/oauth/token","description":"

What it does

Exchanges your appCode + accessKey for a short-lived Bearer token.

When to call

At the start of every session.
When the previous token expires (1 hour lifetime).

Request

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Value	Notes
`grant_type`	`client_credentials`	Always this for machine-to-machine
`accountNumber`	`{{appCode}}`	Your account identifier
`authKey`	`SHA256(accessKey + ts + txn)`	The pre-request script computes this — you don't need to
`ver`	`1.0`
`ts`	RFC 3339 UTC	Generated by script
`txn`	Unique ID	Generated by script

Response

{\n  \"meta\": { \"status\": \"1\", \"ts\": \"...\", \"txn\": \"...\" },\n  \"tokenDetails\": {\n    \"accessToken\": \"<JWT>\",\n    \"tokenType\": \"Bearer\",\n    \"expiresIn\": 3600,\n    \"refreshToken\": \"<opaque>\"\n  }\n}\n

The test script captures accessToken into — every downstream request uses it automatically.

→ Pick a product family folder (SSL/TLS, Document Signer, Private PKI) and call its 1. Create Order request.

Common errors

400 EMS-2028 — meta field missing. Check appCode is set in the environment.
401 EMS-2037 — access key mismatch. Regenerate in portal if needed.
403 EMS-2022 — OAuth2 not enabled on this client. Contact support.

\n","urlObject":{"path":["oauth","token"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"9d2a1764-1df6-40b8-95d7-805e76a342b3"},{"name":"Refresh Token","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["const ts = new Date().toISOString().replace(/\\.\\d{3}Z$/, '+00:00');","const txn = 'pm' + Date.now() + Math.floor(Math.random() * 1e6);","const accessKey = pm.environment.get('accessKey');","if (!accessKey || accessKey.startsWith('<')) { throw new Error('Set accessKey in the environment.'); }","const hash = CryptoJS.SHA256(accessKey + ts + txn).toString(CryptoJS.enc.Hex);","pm.variables.set('_ts', ts);","pm.variables.set('_txn', txn);","pm.variables.set('_hash', hash);"],"id":"ff32f20c-309b-4c46-b0bf-1a8cd3a65c32"}},{"listen":"test","script":{"type":"text/javascript","exec":["pm.test('200 OK', () => pm.response.to.have.status(200));","const body = pm.response.json();","const tok = body && body.tokenDetails ? body.tokenDetails.accessToken : null;","const ref = body && body.tokenDetails ? body.tokenDetails.refreshToken : null;","if (tok) {"," pm.collectionVariables.set('accessToken', tok);"," pm.collectionVariables.set('refreshToken', ref || '');"," pm.test('accessToken refreshed', () => pm.expect(tok).to.be.a('string').and.not.empty);","} else {"," const err = (body && (body.meta || body)) || {};"," pm.test('Refresh failed: ' + (err.errorMessage || err.error_description || JSON.stringify(err)), () => false);","}"],"id":"faf84432-8cbf-4028-af80-fd2540a1cbc4"}}],"id":"1cc82c34-747e-473c-bf58-a8607e1bfd16","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"grant_type\": \"refresh_token\",\n \"accountNumber\": \"{{appCode}}\",\n \"authKey\": \"{{_hash}}\",\n \"refresh_token\": \"\",\n \"ver\": \"1.0\",\n \"ts\": \"{{_ts}}\",\n \"txn\": \"{{_txn}}\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/oauth/token","description":"

What it does

Exchanges a refreshToken for a fresh accessToken — no need to re-hash your accessKey from scratch.

When to call

When is close to expiry (default TTL is 3600 seconds) but is still valid. Use this to avoid interactive re-auth.

Response

Same shape as Get Bearer Token. The test script replaces both and .

Common errors

401 EMS-2038 — refresh token expired or revoked. Call Get Bearer Token to re-authenticate.

\n","urlObject":{"path":["oauth","token"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"1cc82c34-747e-473c-bf58-a8607e1bfd16"}],"id":"6ea8d347-37da-47c4-9fef-d64b175b916d","description":"

Run Get Bearer Token once at the start of every session. The test script captures the JWT into so every other request can use it via Authorization: Bearer . Tokens expire in 1 hour — either re-run Get Bearer Token or use Refresh Token.

\n","_postman_id":"6ea8d347-37da-47c4-9fef-d64b175b916d"},{"name":"SSL/TLS Certificates","item":[{"name":"1. Create Order","event":[{"listen":"test","script":{"type":"text/javascript","exec":["const body = pm.response.json();","if (pm.response.code === 201 && body.orderId) {"," pm.collectionVariables.set('orderId', body.orderId);"," pm.collectionVariables.set('requestId', body.requestId || '');"," pm.test('SSL order created, orderId=' + body.orderId, () => pm.expect(body.orderId).to.be.a('string'));"," console.log('Next: run \"2. Get DCV Challenges\" to fetch the domain-validation proofs.');","} else {"," pm.test('Create FAILED: ' + (body.detail || body.title || JSON.stringify(body)), () => false);","}"],"id":"d96ad120-723a-4ee0-bde1-6e7ea6b733fc"}}],"id":"6ae18adc-22a1-479c-9f2b-c1a878343273","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"e1b26fb3-faf9-4719-bfd8-b8434a009ecc","description":"

Auto-generated — same key + body replays the original response.

\n"},{"key":"X-Product-Code","value":"{{productCodeSslDv}}","description":"

842=DV, 846=OV, 850=EV. Discover via Catalog → List Products.

\n"}],"body":{"mode":"raw","raw":"{\n \"productVariant\": \"dv\",\n \"emailNotifications\": \"all\",\n \"requestor\": {\n \"name\": \"John Smith\",\n \"email\": \"john@example.com\",\n \"phone\": \"+19481081094\",\n \"designation\": \"IT Administrator\"\n },\n \"certificate\": {\n \"domain\": \"example.com\",\n \"autoSecureWww\": true\n },\n \"subscription\": {\n \"validityYears\": 1,\n \"autoRenew\": true,\n \"renewBeforeDays\": 30\n },\n \"agreement\": {\n \"signerName\": \"John Smith\",\n \"signerIp\": \"10.24.108.199\",\n \"signerPlace\": \"New York\",\n \"accepted\": true\n },\n \"remarks\": \"Postman test run\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates","description":"

What it does

Creates a new SSL/TLS certificate order.

When to call

At the very start of every new SSL issuance.

Headers

X-Product-Code — which variant (842 DV, 846 OV, 850 EV, etc.)
Idempotency-Key — safe retries

Body

productVariant — dv, ov, or ev
requestor — who to contact about this order
certificate.domain — primary domain; autoSecureWww adds www.<domain> automatically
subscription.validityYears — 1, 2, or 3
agreement.accepted — must be true to place a public-CA order

Response (201 Created)

{\n  \"orderId\": \"ord_abc123\",\n  \"requestId\": \"req_def456\",\n  \"status\": \"pending-dcv\",\n  \"productVariant\": \"dv\",\n  \"domain\": \"example.com\",\n  \"_links\": {\n    \"self\":        { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123\" },\n    \"dcv\":         { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/dcv\" },\n    \"csr\":         { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/csr\" },\n    \"agreement\":   { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/agreement\" },\n    \"certificate\": { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/certificate\" },\n    \"cancel\":      { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/cancel\" },\n    \"revoke\":      { \"href\": \"/api/certinext/v2/ssl-certificates/ord_abc123/revoke\" }\n  }\n}\n

orderId is auto-captured into — next requests use it.

→ 2. Get DCV Challenges (for public DV/OV/EV SSL)

Common errors (422)

EMS-915 invalid product code
EMS-916 missing requestor info
EMS-917 missing certificate info
EMS-918 missing additional info

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"6ae18adc-22a1-479c-9f2b-c1a878343273"},{"name":"2. Get DCV Challenges","id":"acb2c1a1-35cd-4204-9b53-420a450f12b3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//dcv?domain=example.com","description":"

What it does

Returns the three DCV methods — HTTP file, DNS TXT, email — with the exact artifact to publish.

When to call

Immediately after 1. Create Order for public DV/OV/EV SSL.

Query parameters

domain — required. Use the same domain from your create request.

Response (200 OK)

{\n  \"domains\": [{\n    \"domain\": \"example.com\",\n    \"methods\": {\n      \"http-url\": {\n        \"path\": \"/.well-known/pki-validation/emudhra-<token>.txt\",\n        \"expectedContent\": \"<random-hex>\"\n      },\n      \"dns-txt\": {\n        \"host\": \"_emudhra-challenge.example.com\",\n        \"expectedValue\": \"emudhra-dcv-<random>\"\n      },\n      \"email\": {\n        \"sendTo\": [\"admin@example.com\", \"webmaster@example.com\"]\n      }\n    }\n  }]\n}\n

→ Publish the challenge on your server (host the file, create the TXT record, or reply to the email)\n→ Then call 3. Verify DCV

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","dcv"],"host":["{{v2BaseURL}}"],"query":[{"description":{"content":"

Required. Domain on the order to fetch challenges for.

\n","type":"text/plain"},"key":"domain","value":"example.com"}],"variable":[]}},"response":[],"_postman_id":"acb2c1a1-35cd-4204-9b53-420a450f12b3"},{"name":"3. Verify DCV","id":"ebb9da7f-eff7-4ec7-8638-aa9dd385d437","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"domain\": \"example.com\",\n \"method\": \"http-url\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//dcv/verify","description":"

What it does

Asks the CA to re-check the DCV artifact you just published.

Body

domain — same domain as on the order
method — http-url, dns-txt, or email (match what you actually published)

Response

204 No Content — DCV passed; order advances to pending-csr
422 — CA couldn't find / match the artifact; check the file path or DNS propagation

→ 4. Submit CSR

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","dcv","verify"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"ebb9da7f-eff7-4ec7-8638-aa9dd385d437"},{"name":"4. Submit CSR","id":"550f5832-7676-4010-8132-b5372ab25c54","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"PUT","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"csr\": \"-----BEGIN CERTIFICATE REQUEST-----\\n\\n-----END CERTIFICATE REQUEST-----\",\n \"attested\": false\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//csr","description":"

What it does

Attaches a PEM-encoded Certificate Signing Request to the order.

Body

csr — full PEM including the BEGIN/END markers. Generate with openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out csr.pem.
attested — true only when the key was produced by an attested/HSM-backed generator.

Response

204 No Content — CSR accepted
422 — CSR malformed, or order not in a state that accepts a CSR

→ 5. Accept Agreement

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","csr"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"550f5832-7676-4010-8132-b5372ab25c54"},{"name":"5. Accept Agreement","id":"57242ca2-f319-4c2b-8a8d-b1a579636f8b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"agreement\": {\n \"signerName\": \"John Smith\",\n \"signerIp\": \"10.24.108.199\",\n \"signerPlace\": \"New York\",\n \"accepted\": true\n }\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//agreement","description":"

What it does

Records the Subscriber Agreement acceptance.

Response

204 No Content — recorded; the CA now issues

→ Poll Track Order until status=issued, then 6. Download Certificate

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","agreement"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"57242ca2-f319-4c2b-8a8d-b1a579636f8b"},{"name":"6. Download Certificate","id":"a0aff4ee-b1da-4fb6-9c17-6ba1f6b3ef43","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "},{"key":"Accept","value":"application/json","description":"

Use application/x-pem-file for PEM text, application/pkix-cert for DER bytes.

\n"}],"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//certificate","description":"

What it does

Returns the issued certificate.

Content negotiation

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Accept header	Response body
`application/json` (default)	JSON envelope with PEM + metadata (serial, subject, issuer, validity)
`application/x-pem-file`	Plain PEM text
`application/pkix-cert`	Binary DER

Response (JSON)

{\n  \"orderId\": \"ord_abc123\",\n  \"serialNumber\": \"0A1B2C3D4E...\",\n  \"subject\": \"CN=example.com\",\n  \"issuer\": \"CN=CERTInext TLS Intermediate\",\n  \"notBefore\": \"2026-04-24T10:00:00Z\",\n  \"notAfter\":  \"2027-04-24T10:00:00Z\",\n  \"certificatePem\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\"\n}\n

When it fails

422 if the order is not yet issued. Poll Track Order first.

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","certificate"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"a0aff4ee-b1da-4fb6-9c17-6ba1f6b3ef43"},{"name":"Track Order","id":"7126d3ef-e2b3-4586-92d1-dcd64ac7227a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates/","description":"

What it does

Returns the current state of an SSL order.

Status values

pending-dcv → pending-csr → pending-agreement → issued (or cancelled / revoked)

Poll this between lifecycle steps. Use the _links in the response to discover the next allowed operation.

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates",""],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"7126d3ef-e2b3-4586-92d1-dcd64ac7227a"},{"name":"7. Cancel Order","id":"caf73a31-5059-4566-9ea8-20970390d1a8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{ \"reason\": \"No longer required\" }","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//cancel","description":"

When to use

Withdraw an order before it has been issued. Once issued, use Revoke Certificate instead.

Response

204 No Content — cancelled
422 — order is in a state that cannot be cancelled (e.g. already revoked)

The order remains visible via Track Order with status=cancelled.

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","cancel"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"caf73a31-5059-4566-9ea8-20970390d1a8"},{"name":"Reject Draft Request","id":"e948f4e3-cd38-47c0-8337-7f257cdf966d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{ \"reason\": \"Draft no longer needed\" }","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates/requests//cancel","description":"

When to use

Only for draft requests (saveAsDraft=true) that returned a requestId but no orderId. If the draft has been promoted to a real order, use Cancel Order with the orderId instead.

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","requests","","cancel"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"e948f4e3-cd38-47c0-8337-7f257cdf966d"},{"name":"8. Revoke Certificate","id":"65ec4451-56d7-45f3-ab73-b0b1eeecd2b9","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"7eb7e971-dbd8-4772-8d91-0c16cb6c1ffd"}],"body":{"mode":"raw","raw":"{\n \"reason\": \"superseded\",\n \"note\": \"Replaced by a newer certificate\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/ssl-certificates//revoke","description":"

When to use

Permanently revoke an issued certificate.

Reason values (RFC 5280)

unspecified
keyCompromise
caCompromise
affiliationChanged
superseded
cessationOfOperation
privilegeWithdrawn

Response

204 No Content — revocation queued; CRL / OCSP reflect this on next publish.
422 — order not yet issued, or already revoked.

\n","urlObject":{"path":["api","certinext","v2","ssl-certificates","","revoke"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"65ec4451-56d7-45f3-ab73-b0b1eeecd2b9"}],"id":"c290592a-6b90-4d84-a0d5-51ba7e644cd5","description":"

Public SSL/TLS certificate lifecycle — DV, OV, EV, plus wildcard and UCC variants.

Typical flow: Create → Get DCV → Verify DCV → Submit CSR → Accept Agreement → Download Certificate.

Use Cancel to withdraw before issuance and Revoke to invalidate an already-issued cert.

The first request (Create Order) captures the into the collection so every subsequent request uses it without editing.

\n","_postman_id":"c290592a-6b90-4d84-a0d5-51ba7e644cd5"},{"name":"Document Signer Certificates","item":[{"name":"1. Create Order (Natural Person)","event":[{"listen":"test","script":{"type":"text/javascript","exec":["const body = pm.response.json();","if (pm.response.code === 201 && body.orderId) {"," pm.collectionVariables.set('orderId', body.orderId);"," pm.collectionVariables.set('requestId', body.requestId || '');"," pm.test('Signature order created, orderId=' + body.orderId, () => pm.expect(body.orderId).to.be.a('string'));"," console.log('Next: run \"2. Upload Documents\" once the v2 endpoint lands (today still returns 501 — use v1 /emSignHub-API/SubmitDocument).');","} else {"," pm.test('Create FAILED: ' + (body.detail || body.title || JSON.stringify(body)), () => false);","}"],"id":"4e8a44b8-8915-4c5c-a0a0-bd3b11ecd5b6"}}],"id":"1b3e93ae-48f9-48b2-ab75-345c9ce54611","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"55e6e35d-092f-4d11-bff1-60b53c23680c"},{"key":"X-Product-Code","value":"{{productCodeDocSignerNp1Y}}","description":"

819=NP 1Y, 822=LP 1Y, 825=LE 1Y.

\n"}],"body":{"mode":"raw","raw":"{\n \"subjectType\": \"natural-person\",\n \"emailNotifications\": \"all\",\n \"requestor\": {\n \"name\": \"Jane Doe\",\n \"email\": \"jane@example.com\",\n \"phone\": \"+19481081094\",\n \"designation\": \"Signer\"\n },\n \"subject\": {\n \"givenName\": \"Jane\",\n \"surname\": \"Doe\",\n \"email\": \"jane@example.com\",\n \"countryCode\": \"IN\"\n },\n \"subscription\": { \"validityYears\": 1, \"autoRenew\": false },\n \"agreement\": {\n \"signerName\": \"Jane Doe\",\n \"signerIp\": \"10.24.108.199\",\n \"signerPlace\": \"Bangalore\",\n \"accepted\": true\n }\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates","description":"

What it does

Creates a Document Signer order.

`subjectType` values

natural-person — individual signer
legal-person — employee signing on behalf of an org
legal-entity — the org itself

→ 2. Upload Documents (currently pending, use v1 /emSignHub-API/SubmitDocument until v2 ships)

\n","urlObject":{"path":["api","certinext","v2","signature-certificates"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"1b3e93ae-48f9-48b2-ab75-345c9ce54611"},{"name":"Track Order","id":"9051e4a4-79d0-4145-b04e-de42cd4fe46c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates/","description":"

Returns the current state. Expected sequence: pending-documents → pending-vetting → pending-csr → pending-agreement → issued.

\n","urlObject":{"path":["api","certinext","v2","signature-certificates",""],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"9051e4a4-79d0-4145-b04e-de42cd4fe46c"},{"name":"2. Upload Documents (pending v2 wiring)","id":"dab87546-9ace-472b-866b-02dda17742dc","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "}],"body":{"mode":"formdata","formdata":[{"key":"identityProof","type":"file","description":"

PAN / Aadhaar / passport scan.

\n","value":null},{"key":"addressProof","type":"file","description":"

Utility bill, bank statement, etc.

\n","value":null}]},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//documents","description":"

Currently returns 501 Not Implemented. Workaround until v2 multipart forwarder ships: use v1 POST /emSignHub-API/SubmitDocument with the same account credentials.

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","documents"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"dab87546-9ace-472b-866b-02dda17742dc"},{"name":"3. Submit CSR","id":"fc2152c6-5c88-44f0-bd05-fca7ac7a2384","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"PUT","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"csr\": \"-----BEGIN CERTIFICATE REQUEST-----\\n\\n-----END CERTIFICATE REQUEST-----\",\n \"attested\": false\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//csr","description":"

What it does

Attaches a PEM-encoded CSR to the Document Signer order so the CA can issue the certificate against it.

Body

csr — full PEM with -----BEGIN CERTIFICATE REQUEST----- / -----END CERTIFICATE REQUEST----- markers. Generate with openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out csr.pem.
attested — true only when the key was generated by an attested/HSM-backed module.

Response

204 No Content — CSR accepted; order advances to pending-agreement.
422 — CSR malformed or order not in a CSR-acceptable state.

→ 4. Accept Agreement

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","csr"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"fc2152c6-5c88-44f0-bd05-fca7ac7a2384"},{"name":"4. Accept Agreement","id":"202e1315-1270-40a1-b1c8-dfefa5ee9c8b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"agreement\": {\n \"signerName\": \"Jane Doe\",\n \"signerIp\": \"10.24.108.199\",\n \"signerPlace\": \"Bangalore\",\n \"accepted\": true\n }\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//agreement","description":"

What it does

Records the Subscriber Agreement acceptance for the Document Signer order. Required before the CA will issue the certificate.

Response

204 No Content — recorded; order advances toward issuance.
422 — order not in a state that accepts an agreement yet.

→ Poll Track Order until status=issued, then 5. Download Certificate

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","agreement"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"202e1315-1270-40a1-b1c8-dfefa5ee9c8b"},{"name":"Cancel Order","id":"99c19b26-ac06-43d2-8257-60f952d3d591","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{ \"reason\": \"No longer required\" }","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//cancel","description":"

Withdraw a Document Signer order before issuance. Use Revoke after issuance.

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","cancel"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"99c19b26-ac06-43d2-8257-60f952d3d591"},{"name":"Revoke Certificate","id":"bae9b905-7c8d-44f5-865b-8db36eedd80a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"09882081-d6dd-4456-83c9-b1cdc0ba9fd5"}],"body":{"mode":"raw","raw":"{\n \"reason\": \"keyCompromise\",\n \"note\": \"Private key reported leaked\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//revoke","description":"

When to use

Permanently revoke an issued Document Signer certificate. Revoked certs surface in CRL / OCSP on the next publication cycle.

Reason values (RFC 5280)

unspecified, keyCompromise, affiliationChanged, superseded, cessationOfOperation, privilegeWithdrawn

Response

204 No Content — revocation queued.
422 — order not issued yet, or already revoked.

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","revoke"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"bae9b905-7c8d-44f5-865b-8db36eedd80a"},{"name":"5. Download Certificate","id":"28e70d21-baac-4523-a720-f28431e40f0f","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "},{"key":"Accept","value":"application/json"}],"url":"{{v2BaseURL}}/api/certinext/v2/signature-certificates//certificate","description":"

Download the issued signature certificate. JSON / PEM / DER via Accept header.

\n","urlObject":{"path":["api","certinext","v2","signature-certificates","","certificate"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"28e70d21-baac-4523-a720-f28431e40f0f"}],"id":"2e01710c-33b9-4ecd-8dd7-604739dfb839","description":"

Digital-signature certificates for Natural Person (individuals), Legal Person (employees), and Legal Entity (organizations).

Typical flow: Create → Upload Documents → Submit CSR → Accept Agreement → Download Certificate.

Unlike SSL there is no DCV step — instead the CA vets uploaded identity documents.

\n","_postman_id":"2e01710c-33b9-4ecd-8dd7-604739dfb839"},{"name":"Private PKI Certificates","item":[{"name":"1. Create Order","event":[{"listen":"test","script":{"type":"text/javascript","exec":["const body = pm.response.json();","if (pm.response.code === 201 && body.orderId) {"," pm.collectionVariables.set('orderId', body.orderId);"," pm.collectionVariables.set('requestId', body.requestId || '');"," pm.test('PKI order created, orderId=' + body.orderId, () => pm.expect(body.orderId).to.be.a('string'));"," console.log('Next: run \"2. Submit CSR\".');","} else {"," pm.test('Create FAILED: ' + (body.detail || body.title || JSON.stringify(body)), () => false);","}"],"id":"6e105734-b5cb-4136-93d5-6de942f72910"}}],"id":"0583dfec-5754-4ba2-ad4f-5269d2fb5879","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"35967bdb-8089-4e71-b562-be8b32fcef16"},{"key":"X-Product-Code","value":"{{productCodePkiIntranet}}","description":"

From your private catalog.

\n"}],"body":{"mode":"raw","raw":"{\n \"variant\": \"intranet-ssl\",\n \"caProfileId\": \"{{caProfileId}}\",\n \"masterProductId\": \"{{masterProductId}}\",\n \"hostname\": \"intranet.example.local\",\n \"additionalHosts\": [\"portal.example.local\"],\n \"emailNotifications\": \"all\",\n \"subscription\": { \"validityYears\": 1 },\n \"requestor\": {\n \"name\": \"Ops Team\",\n \"email\": \"ops@example.com\",\n \"phone\": \"+19481081094\",\n \"designation\": \"Infra\"\n }\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates","description":"

What it does

Creates an order against your own PKI CA.

Required fields

variant — intranet-ssl or igtf-host
caProfileId — CA template (set in portal)
masterProductId — subscription slot
hostname — primary CN
additionalHosts[] — SANs (DNS names or IPs)

→ 2. Submit CSR

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"0583dfec-5754-4ba2-ad4f-5269d2fb5879"},{"name":"Track Order","id":"f8b84179-c720-4f0e-8fdb-6f17dd05d070","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates/","description":"

What it does

Returns the current state of a Private PKI order.

Status values

pending-csr → issued (or cancelled / revoked). Private PKI orders usually skip long vetting stages because the CA is customer-owned.

Poll this between Submit CSR and Download Certificate to confirm issuance.

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates",""],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"f8b84179-c720-4f0e-8fdb-6f17dd05d070"},{"name":"2. Submit CSR","id":"2d2c863e-4335-43dc-a1ed-f6810ba4473a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"PUT","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\n \"csr\": \"-----BEGIN CERTIFICATE REQUEST-----\\n\\n-----END CERTIFICATE REQUEST-----\",\n \"attested\": false\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates//csr","description":"

Attach a PEM CSR. The customer CA signs immediately. 204 No Content on success.

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates","","csr"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"2d2c863e-4335-43dc-a1ed-f6810ba4473a"},{"name":"Cancel Order","id":"157b389d-f320-41d8-8829-f73825585aa1","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{ \"reason\": \"No longer required\" }","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates//cancel","description":"

When to use

Withdraw a Private PKI order before issuance. After issuance, use Revoke Certificate.

Response

204 No Content — cancelled; order remains visible via Track Order with status=cancelled.
422 — order already issued / revoked / cancelled.

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates","","cancel"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"157b389d-f320-41d8-8829-f73825585aa1"},{"name":"Revoke Certificate","id":"0c511f7d-8b3b-4d07-b515-4721b7cb0c47","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer "},{"key":"Content-Type","value":"application/json"},{"key":"Idempotency-Key","value":"9b090acf-1bce-47fd-a608-aae2eacc9829"}],"body":{"mode":"raw","raw":"{\n \"reason\": \"superseded\",\n \"note\": \"Replaced by newer cert\"\n}","options":{"raw":{"language":"json"}}},"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates//revoke","description":"

When to use

Permanently revoke an issued Private PKI certificate.

Reason values (RFC 5280)

unspecified, keyCompromise, affiliationChanged, superseded, cessationOfOperation, privilegeWithdrawn

Response

204 No Content — revocation recorded on the customer CA.
422 — order not issued yet, or already revoked.

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates","","revoke"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"0c511f7d-8b3b-4d07-b515-4721b7cb0c47"},{"name":"3. Download Certificate","id":"fb75f24b-8892-4da5-945b-96135168ed99","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "},{"key":"Accept","value":"application/json"}],"url":"{{v2BaseURL}}/api/certinext/v2/private-pki-certificates//certificate","description":"

Download the issued Private PKI cert. JSON / PEM / DER via Accept.

\n","urlObject":{"path":["api","certinext","v2","private-pki-certificates","","certificate"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"fb75f24b-8892-4da5-945b-96135168ed99"}],"id":"28ea7a1c-47a4-45e4-8da0-32b253de21c9","description":"

Certificates issued from a customer-owned PKI CA — Intranet SSL and IGTF Host variants.

Typical flow: Create → Submit CSR → Download Certificate.

No DCV (CA is yours) and no Subscriber Agreement.

\n","_postman_id":"28ea7a1c-47a4-45e4-8da0-32b253de21c9"},{"name":"Accounts","item":[{"name":"Who am I (from token)","id":"d3bd8ef6-0f0a-4510-bc1e-1e3e915e22aa","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/auth/me","description":"

What it does

Returns the account context the Bearer token resolves to — appCode, internal accountId, accountUserId, authType.

When to call

As a post-login sanity check, or to confirm the token you're about to use is still valid.

\n","urlObject":{"path":["api","certinext","v2","auth","me"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"d3bd8ef6-0f0a-4510-bc1e-1e3e915e22aa"},{"name":"List Groups","id":"45fb8128-2f37-4aea-ae1c-86223e8b9f6f","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/groups","description":"

Billing groups accessible to your account. Use a groupNumber from here in order bodies to charge a specific cost centre.

\n","urlObject":{"path":["api","certinext","v2","groups"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"45fb8128-2f37-4aea-ae1c-86223e8b9f6f"},{"name":"List Organizations","id":"46ff8a12-ec9e-435d-b276-4eff0eb64639","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/organizations","description":"

Pre-vetted organizations available for OV/EV SSL. Reference an organizationNumber in order bodies to skip re-vetting.

\n","urlObject":{"path":["api","certinext","v2","organizations"],"host":["{{v2BaseURL}}"],"query":[{"disabled":true,"description":{"content":"

Optional — filter to a group.

\n","type":"text/plain"},"key":"groupNumber","value":""}],"variable":[]}},"response":[],"_postman_id":"46ff8a12-ec9e-435d-b276-4eff0eb64639"},{"name":"Get Organization","id":"7e49fb0f-ab56-4a72-bf52-9c97f6d01840","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/organizations/{{organizationNumber}}","description":"

Full details for a single organization: address, representatives, linked domains, agreement status.

\n","urlObject":{"path":["api","certinext","v2","organizations","{{organizationNumber}}"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"7e49fb0f-ab56-4a72-bf52-9c97f6d01840"},{"name":"List Domains","id":"147dcd5f-6ca9-437b-b526-fae90fd5fc25","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/domains","description":"

Domains already pre-validated under your account — DCV does not need to be repeated for these.

\n","urlObject":{"path":["api","certinext","v2","domains"],"host":["{{v2BaseURL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"147dcd5f-6ca9-437b-b526-fae90fd5fc25"}],"id":"4375aa7d-fa38-4fa4-959d-5cc4da1a4584","description":"

Cross-cutting reads — identity, billing groups, pre-vetted organizations, and registered domains. Call these before placing orders to discover your entitlements.

\n","_postman_id":"4375aa7d-fa38-4fa4-959d-5cc4da1a4584"},{"name":"Catalog","item":[{"name":"List Products","id":"89f1055c-be02-4d8d-9592-3c12bb8410ca","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/catalog/products","description":"

Returns every SSL / Document Signer / Private PKI product your account can order. Each entry has a stable productCode + productType + variant metadata.

\n","urlObject":{"path":["api","certinext","v2","catalog","products"],"host":["{{v2BaseURL}}"],"query":[{"disabled":true,"description":{"content":"

Optional — scope to a billing group.

\n","type":"text/plain"},"key":"groupNumber","value":""}],"variable":[]}},"response":[],"_postman_id":"89f1055c-be02-4d8d-9592-3c12bb8410ca"},{"name":"Get Custom Fields for Product","id":"3f5c1802-c105-48f9-b237-a90ed81b6d3c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/catalog/products/{{productCodeSslDv}}/custom-fields","description":"

Returns mandatory + optional customFields for the given product. Include these in the customFields[] array on order creation.

\n","urlObject":{"path":["api","certinext","v2","catalog","products","{{productCodeSslDv}}","custom-fields"],"host":["{{v2BaseURL}}"],"query":[{"disabled":true,"description":{"content":"

Optional — scope to an organization.

\n","type":"text/plain"},"key":"organizationNumber","value":"{{organizationNumber}}"}],"variable":[]}},"response":[],"_postman_id":"3f5c1802-c105-48f9-b237-a90ed81b6d3c"}],"id":"74deaa60-90de-4ab2-a01a-63c504f609fa","description":"

Products you are entitled to order + their custom-field definitions. Call List Products once per integration build and cache the productCode values — they are the source of truth for the X-Product-Code header.

\n","_postman_id":"74deaa60-90de-4ab2-a01a-63c504f609fa"},{"name":"Reports","item":[{"name":"Orders Report","id":"8707e240-f277-4780-9fd7-1041e6de33d6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/reports/orders?page=0&size=50","description":"

Paginated, filterable order history. Note: currently returns 501 Not Implemented. Use v1 POST /emSignHub-API/GetOrderReport meanwhile.

\n","urlObject":{"path":["api","certinext","v2","reports","orders"],"host":["{{v2BaseURL}}"],"query":[{"disabled":true,"description":{"content":"

ssl | signature | private-pki

\n","type":"text/plain"},"key":"productType","value":"ssl"},{"disabled":true,"description":{"content":"

Filter by order status.

\n","type":"text/plain"},"key":"status","value":"issued"},{"disabled":true,"description":{"content":"

Start date (RFC 3339).

\n","type":"text/plain"},"key":"from","value":"2026-01-01T00:00:00Z"},{"disabled":true,"description":{"content":"

End date (RFC 3339).

\n","type":"text/plain"},"key":"to","value":"2026-04-24T23:59:59Z"},{"key":"page","value":"0"},{"key":"size","value":"50"}],"variable":[]}},"response":[],"_postman_id":"8707e240-f277-4780-9fd7-1041e6de33d6"},{"name":"Ledger Statement","id":"062d05e0-0a98-4309-a74b-0a13edeeb203","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer "}],"url":"{{v2BaseURL}}/api/certinext/v2/reports/ledger?page=0&size=50","description":"

Debit / credit ledger movements for the account, with pagination. Pair with groupNumber to isolate a cost centre.

\n","urlObject":{"path":["api","certinext","v2","reports","ledger"],"host":["{{v2BaseURL}}"],"query":[{"disabled":true,"description":{"content":"

Optional — filter to a billing group.

\n","type":"text/plain"},"key":"groupNumber","value":""},{"key":"page","value":"0"},{"key":"size","value":"50"}],"variable":[]}},"response":[],"_postman_id":"062d05e0-0a98-4309-a74b-0a13edeeb203"}],"id":"9b659a27-344e-4920-9f48-aea74a95714b","description":"

Operational + financial reports.

\n","_postman_id":"9b659a27-344e-4920-9f48-aea74a95714b"},{"name":"Reference","item":[{"name":"Error Codes","id":"2b03b4a9-2b51-4fce-8765-2feb17cdd04d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"about:reference/error-codes","description":"

CERTInext API v2 — Error Codes

Every error response follows RFC 7807 and carries an EMS-xxxx code in detail. Use this table to diagnose failures quickly.

Authentication (`/oauth/token`)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	HTTP	Meaning	Fix
`EMS-2006`	401	Invalid access key	Regenerate in portal → Integration → REST APIs
`EMS-2007`	422	No active API access key provisioned	Activate a key under the account
`EMS-2022`	403	OAuth2 not enabled for this client	Ask an admin to enable OAuth2 auth_type
`EMS-2028`	400	Missing required meta (grant_type / ts / txn / accountNumber / authKey)	Populate the token body with all required fields
`EMS-2036`	401	App code not found	Check `appCode` env variable
`EMS-2037`	401	Access key mismatch (SHA256 hash doesn't match)	Re-hash; make sure `ts` matches what you send
`EMS-2038`	401	Refresh token expired/revoked	Call `Get Bearer Token` to re-authenticate

Order creation (`POST /{product}-certificates`)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	HTTP	Meaning
`EMS-915`	422	Invalid / unknown product code
`EMS-916`	422	Requestor info missing
`EMS-917`	422	Certificate info missing
`EMS-918`	422	Additional information missing
`EMS-919`	422	Subscription info missing
`EMS-920`	422	Agreement not accepted

Order lifecycle (DCV / CSR / Agreement / Cancel / Revoke)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	HTTP	Meaning
`EMS-1157`	422	Domain name cannot be empty (pass `?domain=` on `GET /dcv`)
`EMS-1158`	422	Invalid DCV method
`EMS-1160`	422	DCV challenge not found at expected location
`EMS-921`	422	CSR format invalid
`EMS-922`	422	CSR subject doesn't match order
`EMS-930`	422	Order not in cancellable state
`EMS-931`	422	Order not issued (revoke unavailable)

Transport / content negotiation (RFC 7807)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

HTTP	Condition
`400`	Body malformed, required header/param missing, field validation failed (see `errors[]`)
`401`	Missing or invalid Bearer token
`403`	Caller lacks permission
`404`	Resource or handler doesn't exist
`405`	Method not supported on resource (`Allow` header lists supported methods)
`406`	Accept header can't be satisfied
`409`	Idempotency-Key conflict (same key, different body)
`415`	Content-Type not supported
`422`	Body parsed but failed business validation
`429`	Too many requests (`Retry-After` header)
`500`	Internal error
`501`	Endpoint exists but not yet wired in v2 — fallback to v1 handler mentioned in the response

Response body shape

{\n  \"type\": \"https://api.certinext.io/errors/<slug>\",\n  \"title\": \"Human-readable title\",\n  \"status\": 422,\n  \"detail\": \"[EMS-918] Additional information cannot be empty\",\n  \"instance\": \"/api/certinext/v2/ssl-certificates\",\n  \"errors\": [\n    { \"field\": \"certificate.domain\", \"message\": \"must not be blank\" }\n  ]\n}\n

\n","urlObject":{"port":"reference","path":["error-codes"],"host":["about"],"query":[],"variable":[]}},"response":[],"_postman_id":"2b03b4a9-2b51-4fce-8765-2feb17cdd04d"},{"name":"Product Codes","id":"0c4e801f-6a96-40ec-a7f9-fdd40b766e77","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"about:reference/product-codes","description":"

Product Codes

The numeric productCode goes in the X-Product-Code header on every order-create request. The canonical source is Catalog → List Products — these values match most environments but are authoritative only in the catalog response.

SSL / TLS

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	Product
`842`	SSL DV
`843`	SSL DV Wildcard
`844`	SSL DV UCC
`845`	SSL DV Wildcard UCC
`846`	SSL OV
`847`	SSL OV Wildcard
`848`	SSL OV UCC
`849`	SSL OV Wildcard UCC
`850`	SSL EV
`851`	SSL EV UCC

Document Signer

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	Product
`819`	Document Signer — Natural Person, 1 year
`820`	Document Signer — Natural Person, 2 year
`821`	Document Signer — Natural Person, 3 year
`822`	Document Signer — Legal Person, 1 year
`823`	Document Signer — Legal Person, 2 year
`824`	Document Signer — Legal Person, 3 year
`825`	Document Signer — Legal Entity, 1 year
`826`	Document Signer — Legal Entity, 2 year
`827`	Document Signer — Legal Entity, 3 year

Private PKI

Private PKI product codes vary per customer catalog. Query Catalog → List Products with your token; the entries with productType=private-pki will list the codes available to your account.

Environment variables

The environment files expose these as {{productCodeSslDv}}, {{productCodeDocSignerNp1Y}}, etc. — the requests in the lifecycle folders already reference them so you don't have to edit headers.

\n","urlObject":{"port":"reference","path":["product-codes"],"host":["about"],"query":[],"variable":[]}},"response":[],"_postman_id":"0c4e801f-6a96-40ec-a7f9-fdd40b766e77"},{"name":"Country Codes","id":"9fe4fe24-be69-4ea1-b6dd-fb4563092261","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"about:reference/country-codes","description":"

Country Codes

All countryCode fields in request bodies use ISO 3166-1 alpha-2 (two-letter uppercase). Common values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	Country
`AE`	United Arab Emirates
`AU`	Australia
`BH`	Bahrain
`BR`	Brazil
`CA`	Canada
`CH`	Switzerland
`CN`	China
`DE`	Germany
`EG`	Egypt
`ES`	Spain
`FR`	France
`GB`	United Kingdom
`HK`	Hong Kong
`IN`	India
`IT`	Italy
`JP`	Japan
`KE`	Kenya
`KR`	South Korea
`KW`	Kuwait
`LK`	Sri Lanka
`MX`	Mexico
`MY`	Malaysia
`NG`	Nigeria
`NL`	Netherlands
`NO`	Norway
`NZ`	New Zealand
`OM`	Oman
`PH`	Philippines
`QA`	Qatar
`SA`	Saudi Arabia
`SE`	Sweden
`SG`	Singapore
`TH`	Thailand
`TR`	Turkey
`US`	United States
`VN`	Vietnam
`ZA`	South Africa

The full ISO 3166-1 alpha-2 list: https://www.iso.org/obp/ui/#search

\n","urlObject":{"port":"reference","path":["country-codes"],"host":["about"],"query":[],"variable":[]}},"response":[],"_postman_id":"9fe4fe24-be69-4ea1-b6dd-fb4563092261"},{"name":"Migration Guide — v1 → v2","id":"576d3717-081a-4fff-ab1b-e536f94e455a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"about:reference/migration-v1-to-v2","description":"

Migrating from v1 (`/emSignHub-API/`) to v2 (`/api/certinext/v2/`)

The v1 endpoints remain live — v2 is additive. Every v1 response now carries Deprecation: true and Link: rel=\"successor-version\" headers pointing at its v2 equivalent.

1. Auth changes

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

v1	v2
Body contains `meta { ver, ts, txn, accountNumber, authKey }`	Body carries business fields only
`authKey = SHA256(accessKey + ts + txn)` on every call	`authKey` only on `POST /oauth/token`; every other call uses `Authorization: Bearer <jwt>`
No token; credentials re-hashed per request	Short-lived JWT (1 hour); refresh via `grant_type=refresh_token`

2. Endpoint map

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

v1 RPC	v2 REST
`POST /GenerateOrderSSL`	`POST /api/certinext/v2/ssl-certificates`
`POST /GenerateOrderSignature`	`POST /api/certinext/v2/signature-certificates`
`POST /GenerateOrderPrivatePKI`	`POST /api/certinext/v2/private-pki-certificates`
`POST /TrackOrder`	`GET /{product}-certificates/{orderId}`
`POST /GetDcv`	`GET /ssl-certificates/{orderId}/dcv?domain=…`
`POST /VerifyDcv`	`POST /ssl-certificates/{orderId}/dcv/verify`
`POST /SubmitCSR`	`PUT /{product}-certificates/{orderId}/csr`
`POST /SubmitDocument`	`POST /signature-certificates/{orderId}/documents` (pending — keep using v1 until wired)
`POST /AgreementAcceptance`	`POST /{product}-certificates/{orderId}/agreement`
`POST /RejectOrder`	`POST /{product}-certificates/{orderId}/cancel`
`POST /RejectRequest`	`POST /ssl-certificates/requests/{requestId}/cancel`
`POST /GetCertificate`	`GET /{product}-certificates/{orderId}/certificate`
`POST /RevokeOrder`	`POST /{product}-certificates/{orderId}/revoke`
`POST /ValidateCredentials`	`GET /auth/me`
`POST /GetGroupDetails` + `GetGroupDetailsV2`	`GET /groups`
`POST /GetOrganizationDetails`	`GET /organizations[/{orgNumber}]`
`POST /GetDomainDetails`	`GET /domains`
`POST /GetProductDetails`	`GET /catalog/products`
`POST /GetFieldDetails`	`GET /catalog/products/{code}/custom-fields`
`POST /GetLedgerStatementDetails`	`GET /reports/ledger`
`POST /GetOrderReport`	`GET /reports/orders` (pending — keep using v1 until wired)

3. Shape changes

No meta envelope. Requests carry business fields at the top level. Successful responses return the resource directly, not wrapped.
Types: booleans are real true/false (v1 used \"0\"/\"1\"). Enums are lowercase-hyphenated (dv, natural-person, intranet-ssl). Product code is a header (X-Product-Code), not a body field.
Phone numbers are E.164 single field (+919481081094) — no more isdCode/mobileNumber split.
IDs are opaque strings — do not parse.
Errors are RFC 7807 application/problem+json with type, title, status, detail, instance, code, errors[].
Pagination uses ?page=0&size=50.

4. Idempotency

Every unsafe POST accepts an Idempotency-Key header. Re-sending the same key with the same body returns the original response. Different body with the same key returns 409 Conflict with code=idempotency_conflict.

5. Migration checklist

Replace the hash-per-request loop with a single POST /oauth/token call at session start.
Strip the meta envelope out of every request body.
Rewrite URLs from /emSignHub-API/<Verb> to /api/certinext/v2/<resource>/<id>/<sub>.
Convert \"0\"/\"1\" booleans to true/false and numeric product codes to the X-Product-Code header.
Handle RFC 7807 error shape instead of parsing meta.errorCode / meta.errorMessage.
Add an Idempotency-Key per logical retry.
Start using the _links map in responses to drive the next lifecycle step.

\n","urlObject":{"port":"reference","path":["migration-v1-to-v2"],"host":["about"],"query":[],"variable":[]}},"response":[],"_postman_id":"576d3717-081a-4fff-ab1b-e536f94e455a"}],"id":"671fcd9f-adaa-4fcf-97fb-090593339a35","description":"

Read-only reference material. The requests in this folder are not real HTTP calls — they're stubs that exist to anchor the detailed tables in their descriptions. Open any item to see the reference content.

\n","_postman_id":"671fcd9f-adaa-4fcf-97fb-090593339a35"}],"variable":[{"key":"accessToken","value":""},{"key":"refreshToken","value":""},{"key":"orderId","value":""},{"key":"requestId","value":""}]}

CERTInext API v2 — Customer REST APIs

Getting started (three steps)

Workflow cheat sheet

SSL / TLS (DV example)

Document Signer

Private PKI

Reconnaissance (call once per integration deploy, cache client-side)

Conventions used across the API

Environment variables (auto-managed)

What it does

When to call

Request

Response

Next

Common errors

What it does

When to call

Response

Common errors

What it does

When to call

Headers

Body

Response (201 Created)

Next

Common errors (422)

What it does

When to call

Query parameters

Response (200 OK)

Next

What it does

Body

Response

Next

What it does

Body

Response

Next

What it does

Response

Next

What it does

Content negotiation

Response (JSON)

When it fails

What it does

Status values

When to use

Response

When to use

When to use

Reason values (RFC 5280)

Response

What it does

subjectType values

Next

What it does

Body

Response

Next

What it does

Response

Next

When to use

Reason values (RFC 5280)

Response

What it does

Required fields

Next

What it does

Status values

When to use

Response

When to use

Reason values (RFC 5280)

Response

What it does

When to call

CERTInext API v2 — Error Codes

`subjectType` values

Authentication (`/oauth/token`)

Order creation (`POST /{product}-certificates`)

Migrating from v1 (`/emSignHub-API/`) to v2 (`/api/certinext/v2/`)