Get the CSR file to upload to the apple identity console

⚠️ iOS/iPadOS/tvOS only. This is step 1 of the APNs certificate setup workflow.

Generates a CSR (Certificate Signing Request) file for the tenant's Esper server, returning it as a downloadable .plist binary for upload to Apple's identity portal.

About Generate APNs CSR

This endpoint initiates the APNs certificate setup process. The request body is an empty JSON object; no parameters are required. The response is not JSON — it returns a binary application/x-plist file (the CSR) that must be downloaded and uploaded to Apple's Push Certificates Portal to obtain a signed APNs certificate. The signed certificate is then uploaded back to Esper via PUT /api/tenant/v0/apnscertificates/{id}/ to complete the setup. Calling this endpoint also creates a new APNSCertInfo record in CSR_GENERATED state, retrievable by the returned id. Each call generates a new CSR and a new certificate record — do not call this multiple times for the same setup.

Full APNs Certificate Workflow

Step 1: (This step) Esper API — POST /api/tenant/v0/apnscertificates/ → downloads the .plist CSR file

Step 2: (Outside of the API workflow) Apple Portal (out-of-band) — log into Apple's Push Certificates Portal, upload the .plist CSR, and download the signed .pem certificate Apple returns

Step 3: Esper API — PUT /api/tenant/v0/apnscertificates/{id}/ → upload the signed cert + Apple ID back to Esper

Key Fields

Request body — Empty JSON object ({})

Response — Binary application/x-plist CSR file (download and save; do not attempt to parse as JSON)

The corresponding APNSCertInfo record (with id and state=CSR_GENERATED) is created and retrievable via GET /api/tenant/v0/apnscertificates/

Common Use Cases

Starting the APNs certificate setup process for a new tenant or after certificate expiry

Generating a new CSR as part of the annual APNs certificate renewal workflow

Best Practices

Do not call this endpoint multiple times for the same setup — each call creates a new record and CSR, which can result in orphaned CSR_GENERATED records

Use the same Apple ID throughout the workflow — the Apple ID used at the Apple portal must match what is submitted in the PUT step

Treat the response as a file download; store the .plist before proceeding to the Apple portal