---
title: "POST /create-pki-cert-issuer"
method: POST
path: "/create-pki-cert-issuer"
tags: ["v2"]
---

# POST /create-pki-cert-issuer

`POST /create-pki-cert-issuer`

## Request body

- CreatePKICertIssuer
  - `allow-any-name` boolean — If set, clients can request certificates for any CN
  - `allow-copy-ext-from-csr` boolean — If set, will allow copying the extra extensions from the csr file (if given)
  - `allow-subdomains` boolean — If set, clients can request certificates for subdomains of the allowed domains
  - `allowed-domains` string — A list of the allowed domains that clients can request to be included in the certificate (in a comma-delimited list)
  - `allowed-extra-extensions` string — A json string containing the allowed extra extensions for the pki cert issuer
  - `allowed-ip-sans` string — A list of the allowed CIDRs for ips that clients can request to be included in the certificate as part of the IP Subject Alternative Names (in a comma-delimited list)
  - `allowed-uri-sans` string — A list of the allowed URIs that clients can request to be included in the certificate as part of the URI Subject Alternative Names (in a comma-delimited list)
  - `auto-renew` boolean — Automatically renew certificates before expiration
  - `ca-target` string — The name of an existing CA target to attach this PKI Certificate Issuer to, required in Public CA mode
  - `client-flag` boolean — If set, certificates will be flagged for client auth use
  - `code-signing-flag` boolean — If set, certificates will be flagged for code signing use
  - `country` string — A comma-separated list of countries that will be set in the issued certificate
  - `create-private-crl` boolean — Set this to allow the issuer will expose a CRL endpoint in the Gateway
  - `create-private-ocsp` boolean — Set this to enable an OCSP endpoint in the Gateway and include its URL in AIA
  - `create-public-crl` boolean — Set this to allow the cert issuer will expose a public CRL endpoint
  - `create-public-ocsp` boolean — Set this to enable a public OCSP endpoint and include its URL in AIA (served by UAM and includes account id)
  - `critical-key-usage` string — Mark key usage as critical [true/false]
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `destination-path` string — A path in which to save generated certificates
  - `disable-wildcards` boolean — If set, generation of wildcard certificates will be disabled.
  - `enable-acme` boolean — If set, the cert issuer will support the acme protocol
  - `expiration-event-in` string[] — How many days before the expiration of the certificate would you like to be notified.
  - `gw-cluster-url` string — The GW cluster URL to issue the certificate from. Required in Public CA mode, to allow CRLs on private CA, or to enable ACME
  - `is-ca` boolean — If set, the basic constraints extension will be added to certificate
  - `item-custom-fields` object — Additional custom fields to associate with the item
  - `json` boolean — Set output format to JSON
  - `key-usage` string — key-usage
  - `locality` string — A comma-separated list of localities that will be set in the issued certificate
  - `max-path-len` integer — The maximum path length for the generated certificate. -1, means unlimited
  - `metadata` string — Deprecated - use description
  - `name` string, required — PKI certificate issuer name
  - `not-enforce-hostnames` boolean — If set, any names are allowed for CN and SANs in the certificate and not only a valid host name
  - `not-require-cn` boolean — If set, clients can request certificates without a CN
  - `ocsp-ttl` string — OCSP NextUpdate window for OCSP responses (min 10m). Supports s,m,h,d suffix.
  - `organizational-units` string — A comma-separated list of organizational units (OU) that will be set in the issued certificate
  - `organizations` string — A comma-separated list of organizations (O) that will be set in the issued certificate
  - `postal-code` string — A comma-separated list of postal codes that will be set in the issued certificate
  - `protect-certificates` boolean — Whether to protect generated certificates from deletion
  - `province` string — A comma-separated list of provinces that will be set in the issued certificate
  - `scheduled-renew` integer — Number of days before expiration to renew certificates
  - `server-flag` boolean — If set, certificates will be flagged for server auth use
  - `signer-key-name` string — A key to sign the certificate with, required in Private CA mode
  - `street-address` string — A comma-separated list of street addresses that will be set in the issued certificate
  - `tag` string[] — List of the tags attached to this key
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `ttl` string, required — The maximum requested Time To Live for issued certificates, in seconds. In case of Public CA, this is based on the CA target's supported maximum TTLs
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication

## Response `200`

createPKICertIssuerResponse wraps response body.

- CreatePKICertIssuerOutput
  - `name` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)