---
title: "POST /get-pki-certificate"
method: POST
path: "/get-pki-certificate"
tags: ["v2"]
---

# POST /get-pki-certificate

`POST /get-pki-certificate`

## Request body

- GetPKICertificate
  - `alt-names` string — The Subject Alternative Names to be included in the PKI certificate (in a comma-separated list) (if CSR is supplied this flag is ignored and any DNS.* names are taken from it)
  - `cert-issuer-name` string, required — The name of the PKI certificate issuer
  - `common-name` string — The common name to be included in the PKI certificate (if CSR is supplied this flag is ignored and the CSR subject CN is taken)
  - `csr-data-base64` string — Certificate Signing Request contents encoded in base64 to generate the certificate with
  - `extended-key-usage` string — A comma-separated list of extended key usage requests which will be used for certificate issuance. Supported values: 'clientauth', 'serverauth', 'codesigning'. If critical is present the extension will be marked as critical
  - `extra-extensions` string — A json string that defines the requested extra extensions for the certificate
  - `json` boolean — Set output format to JSON
  - `key-data-base64` string — PKI key file contents. If this option is used, the certificate will be printed to stdout
  - `max-path-len` integer — The maximum path length for the generated certificate. -1, means unlimited unless the signing certificate has a maximum path length set
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `ttl` string — Updated certificate lifetime in seconds (must be less than the Certificate Issuer default TTL)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `uri-sans` string — The URI Subject Alternative Names to be included in the PKI certificate (in a comma-separated list) (if CSR is supplied this flag is ignored and any URI.* names are taken from it)

## Response `200`

getPKICertificateResponse wraps response body.

- GetPKICertificateOutput
  - `cert_display_id` string
  - `cert_item_id` integer
  - `data` string
  - `http_challenge_info` HTTPChallengeInfo — HTTPChallengeInfo contains HTTP-01 challenge details for user display
    - `file_content` string
    - `file_path` string
    - `instructions` string
    - `key_auth` string
    - `token` string
  - `parent_cert` string
  - `path` string
  - `reading_token` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)