---
title: "POST /generate-ca"
method: POST
path: "/generate-ca"
tags: ["v2"]
---

# POST /generate-ca

`POST /generate-ca`

## Request body

- GenerateCA — GenerateCA is a command that creates a new PKI CA and Intermediate issuers
  - `alg` string
  - `allowed-domains` string, required — A list of the allowed domains that clients can request to be included in the certificate (in a comma-delimited list)
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `extended-key-usage` string — A comma sepereted list of extended key usage for the intermediate (serverauth / clientauth / codesigning)
  - `json` boolean — Set output format to JSON
  - `key-type` string
  - `max-path-len` integer — The maximum number of intermediate certificates that can appear in a certification path
  - `pki-chain-name` string, required — PKI chain name
  - `protection-key-name` string — The name of a key that used to encrypt the secrets values (if empty, the account default protectionKey key will be used)
  - `split-level` integer — The number of fragments that the item will be split into
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `ttl` string, required — The maximum requested Time To Live for issued certificate by default in seconds, supported formats are s,m,h,d
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication

## Response `200`

generateCAResponse wraps response body.

- GenerateCAOutput
  - `intermediate_certificate_name` string
  - `intermediate_issuer_name` string
  - `intermediate_key_name` string
  - `root_certificate_name` string
  - `root_issuer_name` string
  - `root_key_name` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/revisions/0ceb25634501/schema)