---
title: "POST /api/v1/cert-manager/signers"
method: POST
path: "/api/v1/cert-manager/signers"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers

`POST /api/v1/cert-manager/signers`

Create a code signing signer

## Request body

- object
  - `name` string, required
  - `description` string
  - `caId` string, uuid
  - `commonName` string
  - `certificateTtlDays` integer
  - `certificateRenewBeforeDays` integer, nullable
  - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1'
  - `certificateId` string, uuid
  - `certificate` object
    - `keySource` 'infisical' | 'hsm'
    - `hsmConnectorId` string, uuid
  - `externalConfiguration` union
    - object
      - `caType` 'digicert', required
      - `reissueFromExternalOrderId` string — Reissue into this existing DigiCert order instead of placing a new order (reuses the subscription slot).
    - object
      - `caType` 'adcs', required
      - `template` string — The AD CS certificate template this signer requests when issuing (e.g. a code-signing template).
  - `approvalPolicyId` string, uuid
  - `members` object[]
    - `kind` 'user' | 'identity' | 'group', required
    - `id` string, uuid, required
    - `role` string, required
  - `approvalPolicy` object
    - `steps` object[], required
      - `stepNumber` integer, required
      - `name` string, nullable
      - `requiredApprovals` integer, required
      - `approverUserIds` string[]
      - `approverGroupIds` string[]
    - `constraints` object
      - `maxSignings` integer, nullable
      - `maxWindowDuration` string, nullable

## Response `200`

Default Response

- object
  - `id` string, uuid, required
  - `name` string, required
  - `description` string, nullable
  - `status` string
  - `certificateId` string, uuid, nullable
  - `approvalPolicyId` string, uuid, nullable
  - `lastSignedAt` string, date-time, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `caId` string, uuid, nullable
  - `commonName` string, nullable
  - `certificateTtlDays` number, nullable
  - `certificateRenewBeforeDays` number, nullable
  - `certificateFailureReason` string, nullable
  - `keyAlgorithm` string
  - `externalCaConfig` unknown

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/eb99006a0bd7/schema)