---
title: "POST /api/v1/cert-manager/signers/{signerId}/requests"
method: POST
path: "/api/v1/cert-manager/signers/{signerId}/requests"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers/{signerId}/requests

`POST /api/v1/cert-manager/signers/{signerId}/requests`

Open a request to sign with this signer (operator self-serve)

## Path parameters

- `signerId` string, uuid, required

## Request body

- object
  - `justification` string, required
  - `requestedSignings` integer
  - `requestedWindowDuration` string — How long the approval stays usable once it is granted, for example '4h'. The window starts when the request is approved.
  - `scope` object — Optional parameters to scope this approval to (command, signingApplication, signingApplicationHash, hostname, osUsername, ipAddress, dataHash). Every value declared here must match at signing time or the sign call is denied; parameters left out are not restricted. A command must match exactly, apart from whitespace, so a different order of options is a different command. ipAddress is compared against the address the sign call arrives from and dataHash against the digest of the submitted payload, so those two hold even if a caller reports something else. A machine identity that declares a scope without naming ipAddress has it filled in with the address the request arrives from; send null to leave signing unrestricted by address.
    - `command` string
    - `signingApplication` string
    - `signingApplicationHash` string
    - `hostname` string
    - `osUsername` string
    - `ipAddress` string, nullable
    - `dataHash` string

## Response `200`

Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/483aceca65ba/schema)