---
title: "Get the current mablnet peer-CA trust bundle for this environment"
method: GET
path: "/link/mablnet/peer-ca"
tags: ["LinkMablnet"]
---

# Get the current mablnet peer-CA trust bundle for this environment

`GET /link/mablnet/peer-ca`

Returns the X.509 root certificate(s) every mablnet client should trust as peer-CA roots when verifying mabl-side Host certs during the peer-to-peer QUIC TLS handshake. Per-environment global: the same bundle for every caller in a deployment. Bundle bytes come from the deployment's published trust bundle — the same anchors Link Router loads on startup. More than one anchor may be present: a root rotation publishes the incoming anchor alongside the outgoing one, and callers should trust every certificate in the bundle.
The bundle is **non-secret** — X.509 root certificates are public artefacts by definition; protection here is integrity, not confidentiality. Auth is required for attribution / rate-limiting / audit, not because the bytes are sensitive.
Conditional refetch: callers send their last-known ETag as `If-None-Match` on each poll. The server returns `304 Not Modified` (no body) when the bundle is unchanged. The current ETag is mirrored in both the standard `ETag` header and the mabl-specific `x-mabl-entity-version` header (the latter survives upstream gzip-Vary stripping).

## Headers

- `If-None-Match` string

## Response `200`

Current bundle returned in body; current ETag in headers.

- MablnetPeerCa — Mablnet deployment trust material. The `pem` field carries the concatenated X.509 root certificate(s) every mablnet client uses as trust anchors when verifying peer Host certs during the QUIC TLS handshake. Suitable for direct consumption by `CertificateFactory.generateCertificates(InputStream)` or any standard PEM parser. The optional `operator_public_key` carries the deployment's operator-token Ed25519 public key, so a Host can verify operator-command tokens (and admit the operator interface) without a separate fetch. It rides this response because it is the same kind of artifact — a deployment-wide, non-secret mablnet trust root — and folds into this response's ETag, so a key rotation invalidates the conditional-GET cache.
  - `pem` string, required — Concatenated PEM-encoded X.509 trust anchor(s). Multiple `BEGIN CERTIFICATE` blocks back-to-back when the deployment has more than one root in its CAS pool (e.g. during a CA rotation window when both the outgoing and incoming roots need to be trusted).
  - `operator_public_key` string — Base64-encoded X.509 SubjectPublicKeyInfo of the deployment's operator-token Ed25519 public key. A Host registers the `mablnet-operator` command service (and verifies per-command operator tokens) against this key. Absent when the deployment has no operator-token signing key configured — in that case the Host runs without the operator interface.

## Other responses

- `304` — Bundle unchanged since the supplied If-None-Match. Empty body; ETag headers still present.
- `401` — User not authenticated
- `403` — User not authorized
- `404` — No trust bundle is published for this deployment — either the environment is not configured for mablnet, or the bundle has not been written yet. Distinguish this from a mistyped path by the error body. Deliberately not a 5xx: the server is up and answering, and 503 is a status the proxies in front of the api own.
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)