---
title: "POST /api/v1/projects/{projectId}/certificates/search"
method: POST
path: "/api/v1/projects/{projectId}/certificates/search"
tags: ["PKI Certificates"]
---

# POST /api/v1/projects/{projectId}/certificates/search

`POST /api/v1/projects/{projectId}/certificates/search`

Search and filter certificates within a project.

## Path parameters

- `projectId` string, required

## Request body

- object
  - `friendlyName` string — The friendly name of the certificate to filter by.
  - `commonName` string — The common name of the certificate to filter by.
  - `offset` number — The offset to start from. If you enter 10, it will start from the 10th certificate.
  - `limit` number — The number of certificates to return.
  - `forPkiSync` boolean — Retrieve only certificates available for PKI sync.
  - `search` string — Search by SAN, CN, certificate ID, or serial number.
  - `status` string — Filter by certificate status.
  - `profileIds` string[] — Filter by certificate profile IDs.
  - `fromDate` string, date-time — Filter certificates created from this date.
  - `toDate` string, date-time — Filter certificates created until this date.
  - `metadata` object[] — Filter by metadata key-value pairs. Each entry should have a key (required) and optionally a value to match against.
    - `key` string, required
    - `value` string
  - `extendedKeyUsage` string — Filter by extended key usage. Only certificates containing this EKU will be returned (e.g. 'codeSigning', 'serverAuth').
  - `keyAlgorithm` union — Filter by key algorithm (e.g. 'RSA_2048', 'EC_prime256v1').
    - string
    - string[]
  - `signatureAlgorithm` string — Filter by signature algorithm (e.g. 'RSA-SHA256', 'ECDSA-SHA256').
  - `keySizes` number[] — Filter by key sizes in bits (e.g. [2048, 4096]).
  - `caIds` string[] — Filter by certificate authority IDs.
  - `enrollmentTypes` string[] — Filter by enrollment types (e.g. 'api', 'est', 'acme', 'scep').
  - `source` union — Filter by certificate source ('issued', 'discovered', 'imported').
    - string
    - string[]
  - `notAfterFrom` string, date-time — Filter certificates expiring on or after this date.
  - `notAfterTo` string, date-time — Filter certificates expiring on or before this date.
  - `notBeforeFrom` string, date-time — Filter certificates issued on or after this date.
  - `notBeforeTo` string, date-time — Filter certificates issued on or before this date.
  - `applicationId` string, uuid — Filter to certificates issued through a specific Application.
  - `applicationIds` string[] — Filter to certificates issued through any of the supplied Applications.
  - `sortBy` 'notAfter' | 'notBefore' | 'createdAt' | 'commonName' | 'keyAlgorithm' | 'status' — Column to sort by (e.g. 'notAfter', 'notBefore', 'commonName').
  - `sortOrder` 'asc' | 'desc' — Sort direction: 'asc' or 'desc'.

## Response `200`

Default Response

- object
  - `certificates` object[], required
    - `id` string, uuid, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `caId` string, uuid, nullable
    - `status` string, required
    - `serialNumber` string, required
    - `friendlyName` string, required
    - `commonName` string, required
    - `notBefore` string, date-time, required
    - `notAfter` string, date-time, required
    - `revokedAt` string, date-time, nullable
    - `revocationReason` number, nullable
    - `altNames` string, nullable
    - `caCertId` string, uuid, nullable
    - `certificateTemplateId` string, uuid, nullable
    - `keyUsages` string[], nullable
    - `extendedKeyUsages` string[], nullable
    - `projectId` string, required
    - `pkiSubscriberId` string, uuid, nullable
    - `profileId` string, uuid, nullable
    - `renewBeforeDays` number, nullable
    - `renewedFromCertificateId` string, uuid, nullable
    - `renewedByCertificateId` string, uuid, nullable
    - `renewalError` string, nullable
    - `keyAlgorithm` string, nullable
    - `signatureAlgorithm` string, nullable
    - `subjectOrganization` string, nullable
    - `subjectOrganizationalUnit` string, nullable
    - `subjectCountry` string, nullable
    - `subjectState` string, nullable
    - `subjectLocality` string, nullable
    - `fingerprintSha256` string, nullable
    - `fingerprintSha1` string, nullable
    - `isCA` boolean, nullable
    - `pathLength` number, nullable
    - `source` string, nullable
    - `discoveryMetadata` unknown
    - `externalMetadata` unknown
    - `applicationId` string, uuid, nullable
    - `keySource` string
    - `hsmConnectorId` string, uuid, nullable
    - `hsmKeyLabel` string, nullable
    - `hsmPublicKeySpki` unknown
    - `subjectDomainComponents` string, nullable
    - `hasPrivateKey` boolean, required
    - `caName` string, nullable
    - `profileName` string, nullable
    - `enrollmentType` string, nullable
    - `applicationName` string, nullable
  - `totalCount` number, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)