SwissSign RA REST API

https://github.com/swisssign-ag/raapi
Admin
SwissSign RA REST API is an OpenAPI specification for managing digital certificates, enabling...
Tokens:13,127
Snippets:66
Trust Score:4
Update:6 months ago
Show doc for...
Tokens:
Raw
### Get Client by Reference

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve detailed information for a specific client using their unique UUID.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/client/cli-123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer $JWT_TOKEN"

# Response:
# {
#   "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
#   "name": "Company XYZ",
#   "description": "Enterprise SSL customer",
#   "products": [
#     {
#       "uuid": "pma-123e4567-e89b-12d3-a456-426614174000",
#       "productName": "SSL Gold EV",
#       "keyGenerationType": "PKCS10",
#       "keyType": "RSA_4096",
#       "issuanceNotification": true,
#       "revocationNotification": true,
#       "isCABDNSValidationRequired": true
#     }
#   ]
# }
```

--------------------------------

### Get Certificate Order Details

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieves the full details of a specific certificate order by its UUID.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Client Management - Get Client by Reference

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve detailed information for a specific client using their unique UUID.

```APIDOC
## Get Client by Reference

### Description
Retrieve a specific client's details using their UUID reference.

### Method
POST

### Endpoint
`/v2/client/{client_uuid}`

### Parameters
#### Path Parameters
- **client_uuid** (string) - Required - The UUID of the client to retrieve.

### Request Example
```bash
curl -X POST "https://api.ra.swisssign.ch/v2/client/cli-123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

### Response
#### Success Response (200)
- **uuid** (string) - Unique identifier for the client.
- **name** (string) - Name of the client.
- **description** (string) - Description of the client.
- **products** (array) - List of certificate products associated with the client.
  - **uuid** (string) - Unique identifier for the product.
  - **productName** (string) - Name of the certificate product.
  - **keyGenerationType** (string) - Type of key generation supported (e.g., PKCS10).
  - **keyType** (string) - Type of key (e.g., RSA_4096).
  - **issuanceNotification** (boolean) - Whether issuance notifications are enabled.
  - **revocationNotification** (boolean) - Whether revocation notifications are enabled.
  - **isCABDNSValidationRequired** (boolean) - Whether CAB/DNS validation is required.

### Response Example
```json
{
  "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
  "name": "Company XYZ",
  "description": "Enterprise SSL customer",
  "products": [
    {
      "uuid": "pma-123e4567-e89b-12d3-a456-426614174000",
      "productName": "SSL Gold EV",
      "keyGenerationType": "PKCS10",
      "keyType": "RSA_4096",
      "issuanceNotification": true,
      "revocationNotification": true,
      "isCABDNSValidationRequired": true
    }
  ]
}
```
```

--------------------------------

### Search Certificate Orders with Paging

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search certificate orders with pagination for large datasets. The `start` parameter indicates the offset and `length` specifies the number of records to retrieve.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/orders/paged?start=0&length=100" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "orderStatus": ["ISSUED"],
    "clientReferences": ["cli-123e4567-e89b-12d3-a456-426614174000"]
  }'
```

--------------------------------

### Get Certificate Order Tasks

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve the list of tasks associated with a certificate order for troubleshooting and monitoring.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/tasks" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### List Pre-Validated Domains

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Get all pre-validated domains for a client, including their validation status and expiration. The response provides details such as domain name, validation method, and status.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/client/domain/cli-123e4567-e89b-12d3-a456-426614174000/list" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Get Certificate Chain

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve the full certificate chain for an issued certificate order. Returns certificates from leaf to root.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/certificate/chain" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Get Certificate Order

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve complete details of a certificate order including the issued certificate when available.

```APIDOC
## POST /v2/order/{orderUuid}

### Description
Retrieve complete details of a certificate order including the issued certificate when available.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/order/{orderUuid}

### Parameters
#### Path Parameters
- **orderUuid** (string) - Required - The unique identifier of the certificate order.

### Response
#### Success Response (200)
- **uuid** (string) - The unique identifier for the order.
- **createdOn** (string) - The date and time the order was created.
- **status** (string) - The current status of the order.
- **clientReference** (string) - The client-provided reference for the order.
- **productReference** (string) - The reference of the product for the certificate.
- **certificate** (object) - Details of the issued certificate (if available).
  - **subject** (string) - The certificate subject.
  - **issuer** (string) - The certificate issuer.
  - **serial** (string) - The certificate serial number.
  - **startValidity** (string) - The start date of certificate validity.
  - **endValidity** (string) - The end date of certificate validity.
  - **certificate** (string) - The certificate in PEM format.
- **tags** (array) - Tags associated with the order.
- **issuedBy** (string) - The identifier of the operator who issued the certificate.

#### Response Example
```json
{
  "uuid": "ord-f0725b50-c533-4802-a844-de57bfb7a80e",
  "createdOn": "2024-01-15T10:30:00.00Z",
  "status": "ISSUED",
  "clientReference": "cli-123e4567-e89b-12d3-a456-426614174000",
  "productReference": "pma-123e4567-e89b-12d3-a456-426614174000",
  "certificate": {
    "subject": "CN=www.example.com,O=Acme Ltd,C=US",
    "issuer": "CN=SwissSign SSL CA,O=SwissSign AG,C=CH",
    "serial": "3893409CB666E1F092B7B6F28E1EAF4582AA7F21",
    "startValidity": "2024-01-15T00:00:00Z",
    "endValidity": "2025-01-15T23:59:59Z",
    "certificate": "MIIFjTCCBHWgAwIBAgIU..."
  },
  "tags": ["production", "web-server"],
  "issuedBy": "operator@company.com"
}
```
```

--------------------------------

### Get Pre-Validated Domain Details

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve details for a specific pre-validated domain reference using its client domain ID. Requires a JWT token for authorization.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/client/domain/cld-10877aec-412f-4b96-a5d4-f5f95da8634e" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Get Certificate Order Status

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve only the status of a certificate order for lightweight polling.

```APIDOC
## POST /v2/order/{orderUuid}/status

### Description
Retrieve only the status of a certificate order for lightweight polling.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/order/{orderUuid}/status

### Parameters
#### Path Parameters
- **orderUuid** (string) - Required - The unique identifier of the certificate order.

### Response
#### Success Response (200)
- **status** (string) - The current status of the certificate order.
  Possible values: NEW, KEY_VALIDATION, PRE_VALIDATION, GENERATE_TBS, PENDING_AUTH, PRE_ISSUE, ISSUE, POST_VALIDATION, FINALIZE_ISSUANCE, ISSUED, REVOKED, FAILED, REJECTED, PENDING_CSR_RENEWAL

#### Response Example
"ISSUED"
```

--------------------------------

### Get Certificate Order Status

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieves the current status of a certificate order, suitable for lightweight polling.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/status" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Search Clients with Paging

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve a paginated list of clients by specifying offset and length parameters.

```bash
# Search with paging - get 50 results starting from offset 100
curl -X POST "https://api.ra.swisssign.ch/v2/clients/paged?search=*&start=100&length=50" \
  -H "Authorization: Bearer $JWT_TOKEN"

# Response:
# {
#   "draw": 1,
#   "recordsTotal": 500,
#   "recordsFiltered": 250,
#   "data": [
#     {
#       "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
#       "name": "Company ABC",
#       "products": [...]
#     }
#   ]
# }
```

--------------------------------

### Search Clients

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve client information using standard search or wildcard patterns.

```bash
# Search all clients
curl -X POST "https://api.ra.swisssign.ch/v2/clients" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json"

# Search with wildcard pattern
curl -X POST "https://api.ra.swisssign.ch/v2/clients?search=Company*%20Ltd" \
  -H "Authorization: Bearer $JWT_TOKEN"

# Response:
# [
#   {
#     "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
#     "name": "Company XYZ Ltd",
#     "description": "Enterprise customer",
#     "products": [
#       {
#         "uuid": "pma-123e4567-e89b-12d3-a456-426614174000",
#         "productName": "SSL Silver",
#         "keyGenerationType": "PKCS10",
#         "keyType": "RSA_2048"
#       }
#     ]
#   }
# ]
```

--------------------------------

### Register Domains for Pre-Validation

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Register new domains for pre-validation. Requires a JWT token for authorization. The response includes DNS TXT record details for verification.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/client/domain/cli-123e4567-e89b-12d3-a456-426614174000/register" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '["example.com", "api.example.com", "*.example.com"]'
```

--------------------------------

### Client Management - Search Clients with Paging

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search for clients with pagination support, allowing retrieval of large result sets by specifying offset and page length.

```APIDOC
## Search Clients with Paging

### Description
Search for clients with pagination support for large result sets. Allows specifying offset and page length.

### Method
POST

### Endpoint
`/v2/clients/paged`

### Query Parameters
- **search** (string) - Optional - A wildcard pattern to search for client names. Defaults to `*` if not provided.
- **start** (integer) - Optional - The offset for pagination. Defaults to 0.
- **length** (integer) - Optional - The number of results to return per page. Defaults to 50.

### Request Example
```bash
# Search with paging - get 50 results starting from offset 100
curl -X POST "https://api.ra.swisssign.ch/v2/clients/paged?search=*&start=100&length=50" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

### Response
#### Success Response (200)
- **draw** (integer) - A unique identifier for the request, used for dataTables.js.
- **recordsTotal** (integer) - The total number of records available without filtering.
- **recordsFiltered** (integer) - The total number of records available after applying filters.
- **data** (array) - An array of client objects.
  - **uuid** (string) - Unique identifier for the client.
  - **name** (string) - Name of the client.
  - **products** (array) - List of certificate products associated with the client.

### Response Example
```json
{
  "draw": 1,
  "recordsTotal": 500,
  "recordsFiltered": 250,
  "data": [
    {
      "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
      "name": "Company ABC",
      "products": [...] 
    }
  ]
}
```
```

--------------------------------

### POST /client/domain/{clientId}/list

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve all pre-validated domains for a specific client.

```APIDOC
## POST /client/domain/{clientId}/list

### Description
Get all pre-validated domains for a client, including their validation status and expiration.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{clientId}/list

### Parameters
#### Path Parameters
- **clientId** (string) - Required - The unique identifier of the client.

### Response
#### Success Response (200)
- **domains** (array) - List of domain validation objects.
```

--------------------------------

### POST /order/{uuid}/tasks

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve the list of tasks or jobs associated with a specific certificate order for monitoring and troubleshooting.

```APIDOC
## POST /order/{uuid}/tasks

### Description
Retrieve the list of tasks/jobs associated with a certificate order for troubleshooting and monitoring.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/order/{uuid}/tasks

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the certificate order.

### Response
#### Success Response (200)
- **tasks** (array) - List of task objects containing uuid, status, type, and execution details.
```

--------------------------------

### Generate JWT Token for Authentication

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Authenticate by exchanging a username and API key for a JWT token, which must be included in the Authorization header for subsequent requests.

```bash
# Generate JWT token for API authentication
curl -X POST "https://api.ra.swisssign.ch/v2/jwt/your-username" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "userSecret=your-api-key"

# Response: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Use the token in subsequent requests
export JWT_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
curl -X POST "https://api.ra.swisssign.ch/v2/clients" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json"
```

--------------------------------

### Publish Certificate

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Publish a certificate to configured external repositories such as LDAP, SFTP, or file system. Requires a JWT token for authorization. A successful request returns HTTP 204 No Content.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/publish" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### POST /orders

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search for certificate orders based on various criteria such as status, client, date range, and tags.

```APIDOC
## POST /orders

### Description
Search for certificate orders using various criteria including status, client, date range, serial number, and tags.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/orders

### Parameters
#### Request Body
- **clientReferences** (array) - Optional - List of client reference IDs.
- **orderStatus** (array) - Optional - List of order statuses to filter by.
- **startAfter** (string) - Optional - ISO date string.
- **startBefore** (string) - Optional - ISO date string.
- **attribute** (string) - Optional - Search attribute string.
- **tags** (array) - Optional - List of tags.
- **includeCertificateChain** (boolean) - Optional - Flag to include certificate chain in response.

### Response
#### Success Response (200)
- **orders** (array) - List of matching certificate order objects.
```

--------------------------------

### POST /orders/paged

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search for certificate orders with pagination support for large datasets.

```APIDOC
## POST /orders/paged

### Description
Search certificate orders with pagination for large datasets.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/orders/paged?start={start}&length={length}

### Parameters
#### Query Parameters
- **start** (integer) - Required - Starting index.
- **length** (integer) - Required - Number of records to return.

#### Request Body
- **orderStatus** (array) - Optional - List of order statuses.
- **clientReferences** (array) - Optional - List of client reference IDs.

### Response
#### Success Response (200)
- **draw** (integer) - Request identifier.
- **recordsTotal** (integer) - Total records available.
- **recordsFiltered** (integer) - Total records after filtering.
- **data** (array) - Page of certificate order objects.
```

--------------------------------

### Issue Certificate with CSR

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Submit a PEM-encoded CSR to issue a certificate for a specific product.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/issue/csr/pma-123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: text/plain" \
  -d '-----BEGIN CERTIFICATE REQUEST-----
MIICijCCAXICAQAwGTEXMBUGA1UEAwwOd3d3LnNhbXBsZS5vcmcwggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCY6+oWhcAadQJ3kuNHZIbujX6yt11MN7RN
YIf1+tCFK/zHlbrekiochGQXHasbbTcAqVPM+atvvPl5BMQO6BW8/RzpKC05WAQL
wM580Qnq7WcOUX+h+tU6v0W/mRF0KyEt2eI7W+J1ec27AYS2SMeDVyVN/dY7Ca8o
x+glgw6MRjh4EQyk9E6v0BU5DaHqvUEhFArloW/t3XCps2Oxd15gqjm0tuEzaXul
6VOM4e7CjQuapG1D4mD6TZwEl9A26eVROiRbsgWMCjSYOrCDxsel873kDJoYv+8E
YxbAxFlzg7RVBI0Th3vUAgawaPjMz7q2xOOYv+L64fI4s0WQFbbrAgMBAAGgLDAq
BgkqhkiG9w0BCQ4xHTAbMBkGA1UdEQQSMBCCDnd3dy5zYW1wbGUub3JnMA0GCSqG
SIb3DQEBCwUAA4IBAQAzegZ0PvLM22mie5eolWC9VHH00s3eazvYYpvzecsfDr9k
-----END CERTIFICATE REQUEST-----'

# Response:
# {
```

--------------------------------

### POST /order/{uuid}/certificate/chain

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve the full certificate chain for an issued certificate order, returned from leaf to root.

```APIDOC
## POST /order/{uuid}/certificate/chain

### Description
Retrieve the full certificate chain for an issued certificate order. Returns certificates from leaf to root.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/order/{uuid}/certificate/chain

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the certificate order.

### Response
#### Success Response (200)
- **array** (string) - List of certificates in the chain (leaf to root).
```

--------------------------------

### Search Certificate Orders

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search for certificate orders using various criteria including status, client, date range, serial number, and tags. The `attribute` field supports wildcard searches.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/orders" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clientReferences": ["cli-123e4567-e89b-12d3-a456-426614174000"],
    "orderStatus": ["ISSUED", "PENDING_AUTH"],
    "startAfter": "2024-01-01T00:00:00Z",
    "startBefore": "2024-12-31T23:59:59Z",
    "attribute": "*example.com*",
    "tags": ["production"],
    "includeCertificateChain": false
  }'
```

--------------------------------

### Issue Certificate with Extended Request

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Performs a synchronous certificate issuance with custom subject DN, SAN extensions, and additional recipients.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/issue" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "productReference": "pma-123e4567-e89b-12d3-a456-426614174000",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAw...\n-----END CERTIFICATE REQUEST-----",
    "overrides": {
      "subjectDN": "c=US,l=Denver,o=Acme Ltd,cn=www.example.com",
      "validity": 1,
      "requestExtensions": {
        "requestDNS": {
          "values": [
            {"dns": "www.example.com", "includeWWWDomain": false},
            {"dns": "api.example.com", "includeBaseDomainForWildcard": true}
          ]
        },
        "requestRFC822": {"values": ["admin@example.com"]},
        "requestIP": {"values": ["192.168.1.100"]}
      }
    },
    "additionalRecipients": [
      {
        "email": "security-team@example.com",
        "recipientType": "ISSUANCE",
        "language": "EN"
      },
      {
        "email": "ops@example.com",
        "recipientType": "RENEWAL",
        "language": "EN"
      }
    ],
    "tags": ["production", "web-server", "team-alpha"],
    "note": "Production web server certificate",
    "publishCertificate": true,
    "synchrone": true,
    "includeCertificateChain": true,
    "acceptTandC": true
  }'
```

--------------------------------

### POST /order/{uuid}/tags

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Update or replace custom tags on a specific certificate order.

```APIDOC
## POST /order/{uuid}/tags

### Description
Replace custom tags/labels on a certificate order for organization and tracking.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/order/{uuid}/tags

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the certificate order.

#### Request Body
- **tags** (array) - Required - List of strings representing the new tags.
```

--------------------------------

### Client Management - Search Clients

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Search for clients accessible to the RA Operator. This endpoint supports wildcard patterns for flexible searching.

```APIDOC
## Search Clients

### Description
Search for clients accessible to the RA Operator. Returns client information including assigned certificate products. Supports wildcard patterns with `?` (single character) and `*` (multiple characters).

### Method
POST

### Endpoint
`/v2/clients`

### Query Parameters
- **search** (string) - Optional - A wildcard pattern to search for client names.

### Request Example
```bash
# Search all clients
curl -X POST "https://api.ra.swisssign.ch/v2/clients" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json"

# Search with wildcard pattern
curl -X POST "https://api.ra.swisssign.ch/v2/clients?search=Company*%20Ltd" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

### Response
#### Success Response (200)
- **uuid** (string) - Unique identifier for the client.
- **name** (string) - Name of the client.
- **description** (string) - Description of the client.
- **products** (array) - List of certificate products associated with the client.
  - **uuid** (string) - Unique identifier for the product.
  - **productName** (string) - Name of the certificate product.
  - **keyGenerationType** (string) - Type of key generation supported (e.g., PKCS10).
  - **keyType** (string) - Type of key (e.g., RSA_2048).

### Response Example
```json
[
  {
    "uuid": "cli-123e4567-e89b-12d3-a456-426614174000",
    "name": "Company XYZ Ltd",
    "description": "Enterprise customer",
    "products": [
      {
        "uuid": "pma-123e4567-e89b-12d3-a456-426614174000",
        "productName": "SSL Silver",
        "keyGenerationType": "PKCS10",
        "keyType": "RSA_2048"
      }
    ]
  }
]
```
```

--------------------------------

### List Additional Recipients for Certificate Order

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Retrieve all additional notification recipients configured for a specific certificate order. Requires a JWT token for authorization.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/list/recipients" \
  -H "Authorization: Bearer $JWT_TOKEN"
```

--------------------------------

### Domain Management API

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Endpoints for registering, retrieving, validating, and deleting domains for pre-validation.

```APIDOC
## POST /v2/client/domain/register

### Description
Register new domains for pre-validation and receive DNS TXT record tokens for domain verification.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/register

### Parameters
#### Request Body
- **domains** (array of strings) - Required - A list of domain names to register.

### Request Example
```json
["example.com", "api.example.com", "*.example.com"]
```

### Response
#### Success Response (200)
- **uuid** (string) - Unique identifier for the domain registration.
- **domain** (string) - The registered domain name.
- **domainUnicode** (string) - The domain name in Unicode format.
- **validated** (boolean) - Indicates if the domain is already validated.
- **validationMethod** (string) - The method used for validation.
- **randomValue** (string) - The DNS TXT record value for verification.
- **randomValueTimeCreated** (string) - Timestamp when the validation token was created.
- **randomValueTimeExpire** (string) - Timestamp when the validation token expires.
- **status** (string) - The current status of the domain registration (e.g., PENDING).
- **randomValueTimeExpired** (boolean) - Indicates if the validation token has expired.

#### Response Example
```json
[
  {
    "uuid": "cld-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "domain": "example.com",
    "domainUnicode": "example.com",
    "validated": false,
    "validationMethod": "cabdns",
    "randomValue": "swisssign-domain-verification=abc123xyz789",
    "randomValueTimeCreated": "2024-01-15T10:00:00Z",
    "randomValueTimeExpire": "2024-01-22T10:00:00Z",
    "status": "PENDING",
    "randomValueTimeExpired": false
  }
]
```

### Additional Information
Add DNS TXT record: `_dnsauth.<domain>` TXT `"<randomValue>"`
```

```APIDOC
## POST /v2/client/domain/{uuid}

### Description
Retrieve details for a specific pre-validated domain reference.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{uuid}

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the domain registration.

### Response
#### Success Response (200)
- Returns a single ClientDNS object with full domain validation details.
```

```APIDOC
## POST /v2/client/domain/{uuid}/validate

### Description
Trigger domain validation check after DNS TXT record has been configured.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{uuid}/validate

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the domain registration.

### Response
#### Success Response (200)
- **uuid** (string) - The unique identifier of the domain registration.
- **domain** (string) - The domain name.
- **validated** (boolean) - Indicates if the domain has been validated.
- **timeValidated** (string) - Timestamp when the domain was validated.
- **validationResult** (string) - The result of the validation check.
- **status** (string) - The current status of the domain (e.g., VALID).

#### Response Example
```json
{
  "uuid": "cld-10877aec-412f-4b96-a5d4-f5f95da8634e",
  "domain": "example.com",
  "validated": true,
  "timeValidated": "2024-01-15T12:00:00Z",
  "validationResult": "DNS TXT record verified successfully",
  "status": "VALID"
}
```
```

```APIDOC
## POST /v2/client/domain/{uuid}/token/reset

### Description
Generate a new random validation token for a domain when the previous token has expired.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{uuid}/token/reset

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the domain registration.

### Response
#### Success Response (200)
- Returns an updated ClientDNS object with new `randomValue` and expiration dates.
```

```APIDOC
## POST /v2/client/domain/{uuid}/token/delete

### Description
Remove the validation token without deleting the domain registration.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{uuid}/token/delete

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the domain registration.

### Response
#### Success Response (200)
- Returns a ClientDNS object with the `randomValue` cleared.
```

```APIDOC
## POST /v2/client/domain/{uuid}/delete

### Description
Remove a pre-validated domain from the client's domain list.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/client/domain/{uuid}/delete

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The unique identifier of the domain registration.

### Response
#### Success Response (204)
- No Content.
```

--------------------------------

### Issue Certificate with Extended Request

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Issue a certificate with full control over subject DN, SAN extensions, additional recipients, and registration documents. Supports synchronous issuance for immediate certificate return.

```APIDOC
## POST /v2/issue

### Description
Issue a certificate with full control over subject DN, SAN extensions, additional recipients, and registration documents. Supports synchronous issuance for immediate certificate return.

### Method
POST

### Endpoint
https://api.ra.swisssign.ch/v2/issue

### Parameters
#### Request Body
- **productReference** (string) - Required - The reference of the product for the certificate.
- **csr** (string) - Required - The Certificate Signing Request in PEM format.
- **overrides** (object) - Optional - Allows overriding default certificate properties.
  - **subjectDN** (string) - Optional - The subject distinguished name for the certificate.
  - **validity** (integer) - Optional - The validity period of the certificate in years.
  - **requestExtensions** (object) - Optional - Extensions to be included in the certificate.
    - **requestDNS** (object) - Optional - DNS names for Subject Alternative Name.
      - **values** (array) - Required - Array of DNS name objects.
        - **dns** (string) - Required - The DNS name.
        - **includeWWWDomain** (boolean) - Optional - Whether to include the www subdomain.
        - **includeBaseDomainForWildcard** (boolean) - Optional - Whether to include the base domain for wildcard certificates.
    - **requestRFC822** (object) - Optional - Email addresses for Subject Alternative Name.
      - **values** (array) - Required - Array of email addresses.
    - **requestIP** (object) - Optional - IP addresses for Subject Alternative Name.
      - **values** (array) - Required - Array of IP addresses.
- **additionalRecipients** (array) - Optional - List of additional recipients for the certificate.
  - **email** (string) - Required - The email address of the recipient.
  - **recipientType** (string) - Required - The type of recipient (e.g., ISSUANCE, RENEWAL).
  - **language** (string) - Required - The language for notifications.
- **tags** (array) - Optional - Tags to associate with the certificate order.
- **note** (string) - Optional - A note for the certificate order.
- **publishCertificate** (boolean) - Optional - Whether to publish the certificate.
- **synchrone** (boolean) - Optional - Whether to issue the certificate synchronously.
- **includeCertificateChain** (boolean) - Optional - Whether to include the certificate chain in the response.
- **acceptTandC** (boolean) - Required - Whether to accept the terms and conditions.

### Request Example
```json
{
  "productReference": "pma-123e4567-e89b-12d3-a456-426614174000",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAw...\n-----END CERTIFICATE REQUEST-----",
  "overrides": {
    "subjectDN": "c=US,l=Denver,o=Acme Ltd,cn=www.example.com",
    "validity": 1,
    "requestExtensions": {
      "requestDNS": {
        "values": [
          {"dns": "www.example.com", "includeWWWDomain": false},
          {"dns": "api.example.com", "includeBaseDomainForWildcard": true}
        ]
      },
      "requestRFC822": {"values": ["admin@example.com"]},
      "requestIP": {"values": ["192.168.1.100"]}
    }
  },
  "additionalRecipients": [
    {
      "email": "security-team@example.com",
      "recipientType": "ISSUANCE",
      "language": "EN"
    },
    {
      "email": "ops@example.com",
      "recipientType": "RENEWAL",
      "language": "EN"
    }
  ],
  "tags": ["production", "web-server", "team-alpha"],
  "note": "Production web server certificate",
  "publishCertificate": true,
  "synchrone": true,
  "includeCertificateChain": true,
  "acceptTandC": true
}
```

### Response
#### Success Response (200)
- **uuid** (string) - The unique identifier for the order.
- **status** (string) - The current status of the order (e.g., ISSUED).
- **certificate** (object) - Details of the issued certificate.
  - **subject** (string) - The certificate subject.
  - **issuer** (string) - The certificate issuer.
  - **serial** (string) - The certificate serial number.
  - **startValidity** (string) - The start date of certificate validity.
  - **endValidity** (string) - The end date of certificate validity.
  - **certificate** (string) - The certificate in PEM format.
- **certificateChain** (array) - An array of certificates forming the certificate chain.

#### Response Example
```json
{
  "uuid": "ord-f0725b50-c533-4802-a844-de57bfb7a80e",
  "status": "ISSUED",
  "certificate": {
    "subject": "CN=www.example.com,O=Acme Ltd,C=US",
    "issuer": "CN=SwissSign SSL CA,O=SwissSign AG,C=CH",
    "serial": "3893409CB666E1F092B7B6F28E1EAF4582AA7F21",
    "startValidity": "2024-01-15T00:00:00Z",
    "endValidity": "2025-01-15T23:59:59Z",
    "certificate": "MIIFjTCCBHWgAwIBAgIU..."
  },
  "certificateChain": [
    "MIIFjTCCBHWgAwIBAgIU...",
    "MIIEtDCCA5ygAwIBAgIQ...",
    "MIIDrzCCApegAwIBAgIQ..."
  ]
}
```
```

--------------------------------

### Certificate Issuance - Issue Certificate with CSR

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Issue a certificate by providing a PEM-encoded Certificate Signing Request (CSR) and the product reference UUID.

```APIDOC
## Issue Certificate with CSR

### Description
Issue a certificate using a Certificate Signing Request (CSR). Provide a PEM-encoded CSR with the product reference UUID.

### Method
POST

### Endpoint
`/v2/issue/csr/{product_uuid}`

### Parameters
#### Path Parameters
- **product_uuid** (string) - Required - The UUID of the certificate product to issue.

#### Request Body
- **CSR** (string) - Required - The PEM-encoded Certificate Signing Request.

### Request Example
```bash
curl -X POST "https://api.ra.swisssign.ch/v2/issue/csr/pma-123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: text/plain" \
  -d '-----BEGIN CERTIFICATE REQUEST-----
MIICijCCAXICAQAwGTEXMBUGA1UEAwwOd3d3LnNhbXBsZS5vcmcwggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCY6+oWhcAadQJ3kuNHZIbujX6yt11MN7RN
YIf1+tCFK/zHlbrekiochGQXHasbbTcAqVPM+atvvPl5BMQO6BW8/RzpKC05WAQL
wM580Qnq7WcOUX+h+tU6v0W/mRF0KyEt2eI7W+J1ec27AYS2SMeDVyVN/dY7Ca8o
x+glgw6MRjh4EQyk9E6v0BU5DaHqvUEhFArloW/t3XCps2Oxd15gqjm0tuEzaXul
6VOM4e7CjQuapG1D4mD6TZwEl9A26eVROiRbsgWMCjSYOrCDxsel873kDJoYv+8E
YxbAxFlzg7RVBI0Th3vUAgawaPjMz7q2xOOYv+L64fI4s0WQFbbrAgMBAAGgLDAq
BgkqhkiG9w0BCQ4xHTAbMBkGA1UdEQQSMBCCDnd3dy5zYW1wbGUub3JnMA0GCSqG
SIb3DQEBCwUAA4IBAQAzegZ0PvLM22mie5eolWC9VHH00s3eazvYYpvzecsfDr9k
-----END CERTIFICATE REQUEST-----'
```

### Response
#### Success Response (200)
- **certificate_uuid** (string) - The UUID of the issued certificate.
- **status** (string) - The status of the certificate issuance request (e.g., 'pending', 'issued').

### Response Example
```json
{
  "certificate_uuid": "cert-123e4567-e89b-12d3-a456-426614174000",
  "status": "pending"
}
```
```

--------------------------------

### Update Certificate Order Tags

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Replace custom tags on a certificate order for organization and tracking. The request body should be a JSON array of strings.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/tags" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '["production", "web-tier", "team-platform", "cmdb-12345"]'
```

--------------------------------

### Authentication - Generate JWT Token

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Generate a JWT token using your username and API key. This token is required for authenticating all subsequent API requests and must be included in the Authorization header.

```APIDOC
## Generate JWT Token

### Description
Generate a JWT token from your username and API key for authenticating all subsequent API requests. The token must be included in the Authorization header of every request.

### Method
POST

### Endpoint
`/v2/jwt/{your-username}`

### Parameters
#### Request Body
- **userSecret** (string) - Required - Your API key.

### Request Example
```bash
curl -X POST "https://api.ra.swisssign.ch/v2/jwt/your-username" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "userSecret=your-api-key"
```

### Response
#### Success Response (200)
- **token** (string) - The generated JWT token.

### Response Example
```json
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```
```

--------------------------------

### Validate Issue Request

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Performs a pre-flight validation of a certificate issuance request without triggering the actual issuance process.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/validate" \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "productReference": "pma-123e4567-e89b-12d3-a456-426614174000",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
    "overrides": {
      "subjectDN": "c=US,o=Acme Ltd,cn=test.example.com"
    }
  }'
```

--------------------------------

### Unpublish Certificate via cURL

Source: https://context7.com/swisssign-ag/raapi/llms.txt

Sends a POST request to the unpublish endpoint using a JWT token for authorization.

```bash
curl -X POST "https://api.ra.swisssign.ch/v2/order/ord-f0725b50-c533-4802-a844-de57bfb7a80e/unpublish" \
  -H "Authorization: Bearer $JWT_TOKEN"
```
Tokens:
Raw