---
title: "GET /api/v1/pki/certificate-profiles"
method: GET
path: "/api/v1/pki/certificate-profiles"
tags: ["PKI Certificate Profiles"]
---

# GET /api/v1/pki/certificate-profiles

`GET /api/v1/pki/certificate-profiles`

## Query parameters

- `offset` number
- `limit` number
- `search` string
- `enrollmentType` 'api' | 'est' | 'acme' | 'scep'
- `issuerType` 'ca' | 'self-signed'
- `caId` string, uuid
- `applicationId` string, uuid

## Response `200`

Default Response

- object
  - `certificateProfiles` object[], required
    - `id` string, uuid, required
    - `projectId` string, required
    - `caId` string, uuid, nullable
    - `certificatePolicyId` string, uuid, required
    - `slug` string, required
    - `description` string, nullable
    - `enrollmentType` string, required
    - `estConfigId` string, uuid, nullable
    - `apiConfigId` string, uuid, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `acmeConfigId` string, uuid, nullable
    - `issuerType` string
    - `externalConfigs` union
      - object
        - `template` string, required — Certificate template name for Azure AD CS
      - object
        - `template` string, required — Certificate template name for Active Directory Certificate Service
      - object
      - object
      - object
      - object
      - object
      - object
      - object
    - `defaults` object, nullable
      - `ttlDays` number
      - `commonName` string
      - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s'
      - `signatureAlgorithm` 'RSA-SHA256' | 'RSA-SHA384' | 'RSA-SHA512' | 'ECDSA-SHA256' | 'ECDSA-SHA384' | 'ECDSA-SHA512' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s'
      - `keyUsages` string[]
      - `extendedKeyUsages` string[]
      - `basicConstraints` object
        - `isCA` boolean, required
        - `pathLength` number
      - `organization` string
      - `organizationalUnit` string
      - `country` string
      - `state` string
      - `locality` string
      - `subjectAltNames` object[]
        - `type` 'dns_name' | 'ip_address' | 'email' | 'uri' | 'upn', required
        - `value` string, required
      - `domainComponents` string[]
    - `scepConfigId` string, uuid, nullable
    - `certificateAuthority` object
      - `id` string, required
      - `status` string, required
      - `name` string, required
      - `isExternal` boolean
      - `externalType` string, nullable
    - `metrics` object
      - `profileId` string, required
      - `totalCertificates` number, required
      - `activeCertificates` number, required
      - `expiredCertificates` number, required
      - `expiringCertificates` number, required
      - `revokedCertificates` number, required
    - `estConfig` object
      - `id` string, required
      - `disableBootstrapCaValidation` boolean, required
      - `passphrase` string
      - `caChain` string
    - `apiConfig` object
      - `id` string, required
      - `autoRenew` boolean, required
      - `renewBeforeDays` number
    - `acmeConfig` object
      - `id` string, required
      - `directoryUrl` string, required
      - `skipDnsOwnershipVerification` boolean
      - `skipEabBinding` boolean
    - `scepConfig` object
      - `id` string, required
      - `scepEndpointUrl` string, required
      - `raCertificatePem` string, required
      - `raCertExpiresAt` string, date-time, required
      - `includeCaCertInResponse` boolean, required
      - `allowCertBasedRenewal` boolean, required
      - `challengeType` string, required
      - `challengeEndpointUrl` string
      - `dynamicChallengeExpiryMinutes` number
      - `dynamicChallengeMaxPending` number
  - `totalCount` number, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)