---
title: "POST /api/v1/pki/ca"
method: POST
path: "/api/v1/pki/ca"
tags: ["PKI Certificate Authorities"]
---

# POST /api/v1/pki/ca

`POST /api/v1/pki/ca`

Create CA

## Request body

- object
  - `projectSlug` string, required — Slug of the project to create the CA in.
  - `type` 'root' | 'intermediate', required — The type of CA to create.
  - `friendlyName` string — A friendly name for the CA.
  - `commonName` string, required — The common name (CN) for the CA.
  - `organization` string, required — The organization (O) for the CA.
  - `ou` string, required — The organization unit (OU) for the CA.
  - `country` string, required — The country name (C) for the CA.
  - `province` string, required — The state of province name for the CA.
  - `locality` string, required — The locality name for the CA.
  - `notBefore` string — The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `notAfter` string — The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `maxPathLength` number — The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.
  - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s' — The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA.
  - `requireTemplateForIssuance` boolean — Whether or not certificates for this CA can only be issued through certificate templates.

## Response `200`

Default Response

- object
  - `ca` object, required
    - `id` string, uuid, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `projectId` string, required
    - `status` string, required
    - `enableDirectIssuance` boolean
    - `name` string, required
    - `parentCaId` string, uuid, nullable
    - `type` string, required
    - `friendlyName` string, required
    - `organization` string, required
    - `ou` string, required
    - `country` string, required
    - `province` string, required
    - `locality` string, required
    - `commonName` string, required
    - `dn` string, required
    - `serialNumber` string, nullable
    - `maxPathLength` number, nullable
    - `keyAlgorithm` string, required
    - `activeCaCertId` string, uuid, nullable
    - `crlDistributionPointUrls` string[], nullable
    - `disableManagedCrlDistributionPointUrl` boolean
    - `requireTemplateForIssuance` boolean
    - `notAfter` string
    - `notBefore` string

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)