---
title: "Get the CSR file to upload to the apple identity console"
method: POST
path: "/tenant/v0/apnscertificates/"
tags: ["tenant_APNs certificate"]
---

# Get the CSR file to upload to the apple identity console

`POST /tenant/v0/apnscertificates/`

⚠️ iOS/iPadOS/tvOS only. This is step 1 of the APNs certificate setup workflow.

Generates a CSR (Certificate Signing Request) file for the tenant's Esper server, returning it as a downloadable .plist binary for upload to Apple's identity portal.

**About Generate APNs CSR**

This endpoint initiates the APNs certificate setup process. The request body is an empty JSON object; no parameters are required. The response is not JSON — it returns a binary application/x-plist file (the CSR) that must be downloaded and uploaded to Apple's Push Certificates Portal to obtain a signed APNs certificate. The signed certificate is then uploaded back to Esper via PUT /api/tenant/v0/apnscertificates/{id}/ to complete the setup. Calling this endpoint also creates a new APNSCertInfo record in CSR_GENERATED state, retrievable by the returned id. Each call generates a new CSR and a new certificate record — do not call this multiple times for the same setup.

**Full APNs Certificate Workflow**

Step 1: (This step) Esper API — POST /api/tenant/v0/apnscertificates/ → downloads the .plist CSR file

Step 2: (Outside of the API workflow) Apple Portal (out-of-band) — log into Apple's Push Certificates Portal, upload the .plist CSR, and download the signed .pem certificate Apple returns

Step 3: Esper API — PUT /api/tenant/v0/apnscertificates/{id}/ → upload the signed cert + Apple ID back to Esper

**Key Fields**

Request body — Empty JSON object ({})

Response — Binary application/x-plist CSR file (download and save; do not attempt to parse as JSON)

The corresponding APNSCertInfo record (with id and state=CSR_GENERATED) is created and retrievable via GET /api/tenant/v0/apnscertificates/

**Common Use Cases**

Starting the APNs certificate setup process for a new tenant or after certificate expiry

Generating a new CSR as part of the annual APNs certificate renewal workflow

**Best Practices**

Do not call this endpoint multiple times for the same setup — each call creates a new record and CSR, which can result in orphaned CSR_GENERATED records

Use the same Apple ID throughout the workflow — the Apple ID used at the Apple portal must match what is submitted in the PUT step

Treat the response as a file download; store the .plist before proceeding to the Apple portal

## Request body

- object

## Response `200`

Created

## Other responses

- `400` — Bad request
- `401` — Authorization information is missing or invalid.
- `500` — Internal server error

---

[API](https://skmtc.net/esper/apis/esper-api-reference.md) · [All operations](https://skmtc.net/esper/apis/esper-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/esper/esper-api-reference/revisions/e1f64cbb488e/schema)