{"openapi":"3.1.0","info":{"title":"CERTInext API v2","description":"RESTful API for CERTInext certificate lifecycle management: issue, track, validate, renew, and revoke certificates programmatically.\n\n> Already have a token? Jump to **[Authentication](#tag/Authentication)**.\n\n## What you'll need\n\n| Term | What it is | Where it comes from | Lifetime |\n|---|---|---|---|\n| **`accountNumber`** | Your account ID, a 10-digit number | CERTInext portal -> top-right **account-name button** | Permanent (per account) |\n| **`clientSecret`** | Long-lived API secret, 32 hex characters (shown in the portal as **Client Secret**) | CERTInext portal -> **Integrations -> APIs -> + Create API Credentials** | Permanent until revoked |\n| **`access_token`** | Short-lived Bearer token used in the `Authorization` header | Returned by `POST /oauth/token` (Step 2) | **1 hour** |\n\n## Getting started\n\n<details open>\n<summary><strong>Step 1: Get your two credentials from the CERTInext portal</strong></summary>\n\nYou need two values to talk to the API. Both come from the CERTInext web portal (the same site where you log in to manage certificates). They are *not* the Bearer token. Step 2 turns them into one.\n\n#### 1a. Find your `accountNumber`\n1. Log in to the CERTInext portal.\n2. In the top-right header, click the **account-name button** (the one showing your organization name).\n3. A popover opens showing **Account Manager** details and your **Account Number**, a 10-digit number, e.g. `<your-account-number>`.\n4. Copy it. This is your `client_id` for Step 2.\n\n#### 1b. Generate a `clientSecret`\n1. From the left navigation, go to **Integrations -> APIs**.\n2. Click **+ Create API Credentials**.\n3. A dialog opens. The form is conditional. Most fields appear only after you pick an **API Type**. Fill in:\n   - **API Type**: pick **REST**. The remaining fields appear.\n   - **Identifier**: a short label such as `QA Postman` or `Production CI` so you can recognize this credential later in the grid.\n   - **User**: pick the user this credential is associated with.\n   - **Auth Type**: **You MUST select `OAuth`** (the second radio button). The default `Access Key` mode is the legacy V1 protocol and will not work with `/api/certinext/v2/**`. Choosing it will give you `403 unauthorized_client` later.\n4. Click **Generate**. The new entry appears in the grid.\n5. Click the **View** link on its row. The modal displays the value as **Client Secret** - a 32-character hex string (e.g. `<your-client-secret>`).\n\n> **Copy the client secret now. It is shown only once.** Save it to a password manager immediately; it cannot be retrieved later. Anyone holding it can act as your account, so if it leaks, return to **Integrations -> APIs**, click **Revoke** on the row, and generate a fresh one.\n\nYou now have both `accountNumber` and `clientSecret`. Continue to Step 2.\n\n</details>\n\n<details>\n<summary><strong>Step 2: Exchange them for a Bearer access token</strong></summary>\n\nScroll down to **Authentication -> `POST /oauth/token`**, click **Try it out**, fill in:\n\n| Field | What to put |\n|---|---|\n| `grant_type` | `client_credentials` |\n| `client_id` | your `accountNumber` from Step 1 |\n| `client_secret` | your `clientSecret` from Step 1 |\n\nClick **Execute**. A green `200 OK` response appears with a JSON body. Copy the value of **`access_token`** (a 43-character string of letters and numbers). That is the Bearer token. It is valid for **1 hour**.\n\n**cURL equivalent** *(test outside Swagger UI without retyping)*:\n```bash\n# Default = Sandbox - US (recommended for first-run integration testing).\n# Switch the host to https://us-api.certinext.io for production cutover.\ncurl -X POST https://sandbox-us-api.certinext.io/oauth/token \\\n  -H 'Content-Type: application/x-www-form-urlencoded' \\\n  -d 'grant_type=client_credentials' \\\n  -d 'client_id={{accountNumber}}' \\\n  -d 'client_secret={{clientSecret}}'\n```\n\n</details>\n\n<details>\n<summary><strong>Step 3: Tell Swagger to use the token</strong></summary>\n\nClick the **Authorize** button at the top-right of this page, paste the `access_token` value into the input box (without the word `Bearer`; Swagger adds it automatically), then confirm and close the dialog.\n\nEvery endpoint on this page is now unlocked. The padlock icon next to each operation will look closed.\n\n</details>\n\n<details>\n<summary><strong>Step 4: Confirm sign-in worked</strong></summary>\n\nOpen **Accounts -> `GET /auth/me`** -> **Try it out** -> **Execute**. You should see a green `200` response with your `accountNumber` and `userId`, confirming both that the token is valid and that the API correctly identified you.\nIf you see a red `401` with a message about an invalid token, the most common cause is pasting the **client secret** from Step 1 instead of the **access token** from Step 2. Copy the right value and try again.\n\n> **Try it:** open **[Current authenticated identity](#/Accounts/me)**.\n\n</details>\n\n<details>\n<summary><strong>Step 5: Place a real order</strong></summary>\n\nPick the certificate family you want (SSL / TLS, Document Signer, or Private PKI) and call its **Create** endpoint. You'll need:\n- A **product code**: look it up first by running **Catalog -> List products**.\n\nThe response includes **next-step links** that point at the follow-up actions for that order (domain validation, submit signing request, accept the agreement, download the certificate). Just call them in the returned order.\n\n> **Pre-built request bodies for every SSL variant.** When you open **SSL/TLS Certificates -> `POST /ssl-certificates`** in this Swagger UI, the request-body **Examples** dropdown carries one ready-to-paste body per variant: `DV`, `DV Wildcard`, `DV UCC`, `DV Wildcard UCC`, `OV`, `OV Wildcard`, `OV UCC`, `OV Wildcard UCC`. Each example name also shows the exact `X-Product-Code` to send. Pick the variant you need, paste the body, set the matching `X-Product-Code` header, and **Execute**.\n\n**Example: SSL/TLS DV for a US site (`example.com`)** (one of the 8 variants the dropdown ships with):\n\n```bash\n# Substitute {{token}} with the access_token from Step 2 and {{productCode}} with\n# the dv-ssl product code returned by GET /catalog/products.\ncurl -X POST https://sandbox-us-api.certinext.io/api/certinext/v2/ssl-certificates \\\n  -H 'Authorization: Bearer {{token}}' \\\n  -H 'Content-Type: application/json' \\\n  -H 'X-Product-Code: {{productCode}}' \\\n  -d '{\n    \"productVariant\": \"dv\",\n    \"emailNotifications\": \"all\",\n    \"requestor\": {\n      \"name\": \"Jane Doe\",\n      \"email\": \"jane@example.com\",\n      \"phone\": \"+14155551234\",\n      \"designation\": \"IT Administrator\"\n    },\n    \"certificate\": {\n      \"domain\": \"example.com\",\n      \"autoSecureWww\": true\n    },\n    \"organization\": {\n      \"country\": \"US\",\n      \"state\": \"CA\",\n      \"locality\": \"San Francisco\"\n    },\n    \"subscription\": { \"validityYears\": 1, \"autoRenew\": true },\n    \"agreement\": { \"signerName\": \"Jane Doe\", \"signerPlace\": \"San Francisco\", \"accepted\": true }\n  }'\n```\n\nWhen you're ready for live US traffic, swap the host for `https://us-api.certinext.io` (the default selection in the Servers dropdown above).\n\n</details>\n\n## Reference\n\n<details>\n<summary><strong>Troubleshooting</strong></summary>\n\n| HTTP | Symptom | What it means |\n|---|---|---|\n| `404` | Not Found from any endpoint | Wrong server picked in the **Servers** dropdown at the top of the page. For US production traffic choose **Production - US**; for first-run testing choose **Sandbox - US**. |\n| `401` | Invalid token | You're sending the wrong value as Bearer. Most often the client secret instead of the minted token. Redo Step 2. |\n| `401` | Token expired | Your token is older than 1 hour. Redo Step 2 to mint a new one. |\n| `401` | Invalid client at sign-in | Your `client_id` or `client_secret` is wrong, or the credential was revoked in the portal. |\n| `401` | Works in Sandbox, fails in Production | Bearer tokens are environment-specific. A token minted against **Sandbox - US** will not work on **Production - US**. Re-mint against the correct server from the Servers dropdown. |\n| `403` | Unauthorized client | The client secret exists but wasn't generated in **OAuth mode**. Go back to **Integrations -> APIs** and generate a new credential with the OAuth option selected. |\n| `5xx` | Server error | Transient infrastructure issue on our side. Wait for a definitive response before retrying - duplicate calls are not de-duplicated. |\n\n</details>\n\n<details>\n<summary><strong>Conventions</strong></summary>\n\n- **Retry safety**: this API does not de-duplicate calls. For `create` / `cancel` / `revoke` actions, wait for a definitive response before retrying; do not assume a timeout means the request did not land.\n- **Phone numbers** use international format with country code, e.g. `+14155551234` (US).\n- **IDs** in URLs and responses are opaque strings: copy them verbatim, don't parse or guess them.\n- **Standard ISO formats throughout**: 8601 timestamps (e.g. `2026-05-08T13:00:00Z` UTC), 3166 country codes (`US`, `CA`, `GB`), 4217 currency codes (`USD`, `EUR`, `INR`).\n- **Errors** include a plain-English description. Internal support codes (`EMS-918` etc.) are written to audit logs only and are not echoed in the response body.\n\n</details>\n\n<details>\n<summary><strong>Certificate families</strong></summary>\n\n| Family | Domain validation needed? | Identity documents needed? | Subscriber Agreement needed? |\n|---|---|---|---|\n| **SSL / TLS** (public-trust certificates for websites; CA/Browser Forum BR-compliant) | Yes | No | Yes |\n| **Document Signer** (PDF / code signing, commonly used for AATL workflows in US enterprises) | No | Yes | Yes |\n| **Private PKI** (certificates from your own private CA) | No | No | No |\n\n</details>\n\n<details>\n<summary><strong>Environments</strong></summary>\n\n| Server | Use it for |\n|---|---|\n| **Production - US** *(default)* | Live US production traffic. Backed by US-anchored CA roots. |\n| **Sandbox - US** | Recommended for first-run integration testing. Same shape as US production but no billing or live issuance. |\n| QA | Internal QA only. Credentials issued by the QA team. |\n| Demo | Demos and trials. |\n| Production - India | Live India production traffic. |\n| Current host | Local / IDE testing. Points at whatever host is serving this Swagger page. |\n\nSwitch the active environment using the **Servers** dropdown at the top of the page. Bearer tokens are minted per-environment and do not cross over.\n\n</details>\n","contact":{"name":"CERTInext Platform Team","email":"support@certinext.io"},"version":"2.0.0"},"servers":[{"url":"https://us-api.certinext.io","description":"Production - US (default for US customers)"},{"url":"https://sandbox-us-api.certinext.io","description":"Sandbox - US (recommended for integration testing)"},{"url":"https://qa-api.certinext.io","description":"QA"},{"url":"https://demo-api.certinext.io","description":"Demo"},{"url":"https://api.certinext.io","description":"Production - India"},{"url":"/WrapperAPI","description":"Current host (local / IDE / on-prem)"}],"security":[{"BearerAuth":[]},{"BearerAuth":[]}],"tags":[{"name":"Authentication","description":"**Start here.** Exchange your `client_id` (account number) and `client_secret` for a 1-hour Bearer access token. Every other endpoint requires this token in the `Authorization` header."},{"name":"Accounts","description":"Verify who you are (`/auth/me`), list the organizations you can issue certificates for, and the billing groups you belong to. Useful as a smoke-test right after authenticating."},{"name":"Catalog","description":"List the certificate products entitled to your account and look up the custom-field requirements for each. The `productCode` you discover here is required by every order-creation endpoint."},{"name":"Domains","description":"Pre-register and validate domains (Domain Control Validation). For SSL/TLS certificates, the domains on your order must be DCV-validated before issuance. You can add domains here in advance or let the order-creation flow add them on the fly."},{"name":"SSL/TLS Certificates","description":"Full lifecycle for public-trust SSL/TLS certificates: DV, OV, EV, wildcard, UCC. Typical flow: **create -> DCV -> submit CSR -> accept agreement -> download**. Use `/cancel` to withdraw before issuance and `/revoke` after. Issuance from US-anchored roots follows the CA/Browser Forum Baseline Requirements."},{"name":"Document Signer Certificates","description":"Lifecycle for individual / organization document-signing certificates. Typical flow: **create -> submit CSR -> accept agreement -> download**. No DCV step (these aren't tied to a domain). Commonly used for Adobe-trusted PDF signing (AATL) and code-signing workflows in US enterprises."},{"name":"Private PKI Certificates","description":"Lifecycle for certificates issued from your private CA hierarchy. No public DCV, no Subscriber Agreement, no documents. Just **create -> submit CSR -> download**."},{"name":"Reports","description":"Read-only historical lookups. Pull your orders report or your billing-ledger statement, with date-range and pagination filters. Safe to call as often as you like; no state change."},{"name":"InCommon Reporting","description":"Program-wide figures across every InCommon institution. Only credentials enabled for InCommon reporting can call these; others get 403."}],"paths":{"/api/certinext/v2/ssl-certificates/{orderId}/csr":{"put":{"tags":["SSL/TLS Certificates"],"summary":"Submit a CSR for the order","description":"Attach a PEM-encoded Certificate Signing Request generated on the subscriber system. Required before the CA can issue the certificate.\n\nSet `attested=true` if the CSR was produced by an attested/HSM-backed key to avoid re-attestation.","operationId":"submitCsr","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CsrSubmitRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}/csr":{"put":{"tags":["Document Signer Certificates"],"summary":"Submit a CSR","description":"Attach a PEM-encoded CSR. Required before the CA can issue the signature certificate.","operationId":"submitCsr_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CsrSubmitRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates/{orderId}/csr":{"put":{"tags":["Private PKI Certificates"],"summary":"Submit a CSR","description":"Attach a PEM-encoded CSR to trigger issuance from the customer CA.","operationId":"submitCsr_2","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CsrSubmitRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/oauth/token":{"post":{"tags":["Authentication"],"summary":"Sign in - exchange your client secret for a Bearer token","description":"**Step 1 of every integration.** Exchange your account number and client secret (generated in the CERTInext portal under **Integration -> API -> REST**, in **OAuth** mode) for a short-lived Bearer access token. The token is what every other endpoint actually checks.\n\n### Fields to fill in\n- **`grant_type`** - pick `client_credentials` (use `refresh_token` only when refreshing an existing token).\n- **`client_id`** - your account number from the portal (a 10-digit number).\n- **`client_secret`** - your client secret from the portal (a 32-character string).\n- **`refresh_token`** - leave empty unless you're refreshing a token.\n- **`scope`** - leave empty (reserved for future use).\n- **`Authorization`** - leave empty. *(Advanced: you can supply credentials here as a Basic auth header instead of in the form fields below - most users won't need this.)*\n\n### What you get back\nA JSON response containing an **`access_token`** value (the Bearer token you actually use), its `expires_in` lifetime in seconds (3600 = 1 hour), and a `refresh_token` you can use later to mint a new access token without re-sending your client secret.\n\n### Next step\nCopy the `access_token` value from the response, click the **Authorize** button at the top-right of this page, and paste it into the input box. Do **not** type the word `Bearer` - Swagger adds it for you. Once that's done, every endpoint on this page is unlocked for the next hour.","operationId":"oauth2Token","parameters":[{"name":"Authorization","in":"header","description":"RFC 6749 §2.3.1 - preferred way to send credentials. Format: `Basic base64(client_id:client_secret)`. If supplied, `client_id` and `client_secret` form parameters are ignored.","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"grant_type":{"type":"string","description":"RFC 6749 grant type. Supported: `client_credentials`, `refresh_token`.","enum":["client_credentials","refresh_token"]},"client_id":{"type":"string","description":"Your account number (the `appCode`). Omit if using HTTP Basic auth."},"client_secret":{"type":"string","description":"Your client secret. Omit if using HTTP Basic auth."},"refresh_token":{"type":"string","description":"Required only when `grant_type=refresh_token`."},"scope":{"type":"string","description":"Optional space-delimited scope list (reserved for future use)."}}}}}},"responses":{"403":{"description":"The client secret exists but was not generated in **OAuth** mode in the portal. Generate a new credential with the OAuth radio button selected. Response `error` field: `unauthorized_client`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuth2ErrorResponse"}}}},"200":{"description":"Token issued. Use `access_token` on every v2 call.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuth2TokenResponse"},"example":{"access_token":"cybsqhmJqxHPC2B3GR2YVsbuViKAjBJz753RGkAmYLU","token_type":"Bearer","expires_in":3600,"refresh_token":"f8e6d1..."}}}},"401":{"description":"Your account number or client secret is wrong (or the credential was revoked in the portal). Response `error` field: `invalid_client`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuth2ErrorResponse"}}}},"400":{"description":"A required field is missing or has an unsupported value. The response `error` field will be one of: `invalid_request`, `unsupported_grant_type`, `invalid_grant`, `invalid_scope`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuth2ErrorResponse"}}}}}}},"/api/certinext/v2/ssl-certificates":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Create an SSL/TLS certificate order","description":"**When to call:** at the start of every new certificate issuance.\n\n**What happens:** the order is created in the CA backend. For OV/EV variants it enters organization vetting; for DV it becomes ready for Domain Control Validation. The response includes `orderId`, `status`, `productVariant`, `domain`, `createdAt`, and `resolvedProductCode`. Use `orderId` on every follow-up call (`/dcv`, `/csr`, `/agreement`, track, cancel, revoke, reissue).\n\n**Product code resolution:** the wrapper picks the right product code from your account's catalog based on `productVariant` (`dv`/`ov`/`ev`) and the shape of `certificate.domain` (wildcard if it starts with `*.`) and `certificate.additionalDomains` (UCC if non-empty). You do not need to manage numeric product codes on the client side.\n\n**Headers (optional):**\n- `X-Product-Code` - explicit override. Set only when you need to disambiguate between multiple matching products in your catalog (e.g. different emSign CA profiles for the same variant).\n\n**Organization Representative (OV only):** by default the order uses the organization's existing representative - you do not need to name anyone. To register a different person instead, set `organization.useNewOrgRepresentative` to `true` and supply `organization.organizationRepresentative` (`name` and `email` are mandatory). Leaving the flag out, or setting it to `false`, uses the existing representative and any `organizationRepresentative` block you send is ignored.\n\nThe order is bound to the person you supply either way. If the organization has already been approved by a Validation Agent, the change to the *organization's* representative of record is **queued for VA review**: the previous representative stays the record holder until approval, and the response returns `organizationRepresentativeStatus: pending-approval` with `pendingOrganizationRepresentative`. Otherwise the swap is immediate and the status is `applied`.\n\n**CSR:** the `csr` field accepts either a Base64-encoded CSR string or the complete PEM-formatted CSR (including the `-----BEGIN CERTIFICATE REQUEST-----` / `-----END CERTIFICATE REQUEST-----` header and footer). It is optional here - if omitted, submit it later via `PUT /{id}/csr`.\n\n**Common errors:** `EMS-915` (no matching product entitled to this account), `EMS-916` (requestor info missing), `EMS-917` (certificate info missing), `EMS-918` (additional info missing).\n\n**Organization Representative errors:** `EMS-1314` (`organizationRepresentative` missing while the flag is true), `EMS-1315` (flag used on a DV or EV order), `EMS-1316` (flag used without a pre-vetted organization), `EMS-1317` (that email is already a representative of this organization - set the flag to `false` to use the existing one), `EMS-1319` / `EMS-1320` (representative name / email missing), `EMS-1321` (representative phone does not contain 6-15 digits; punctuation and a leading `+` are both optional, and the field may be omitted or left blank entirely).","operationId":"create","parameters":[{"name":"X-Product-Code","in":"header","description":"**Optional override.** Normally the wrapper resolves the right product code from your account's catalog based on `productVariant` + whether `certificate.domain` is a wildcard + whether `certificate.additionalDomains` is non-empty. Set this header explicitly to bypass that resolution - useful when your account has multiple matching products under different emSign CA profiles and you want to force a specific one.","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SslOrderCreateRequest"},"examples":{"DV - single domain (X-Product-Code: 842)":{"summary":"DV SSL Certificate","description":"DV - single domain (X-Product-Code: 842)","value":{"productVariant":"dv","emailNotifications":"all","saveAsDraft":false,"requestor":{"name":"John Smith","email":"john@example.com","phone":"+19481081094","designation":"IT Administrator"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"certificate":{"domain":"example.com","autoSecureWww":true},"subscription":{"validityYears":1,"autoRenew":true,"renewBeforeDays":30},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"John Smith","signerPlace":"New York","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"DV - single domain"}},"DV Wildcard (X-Product-Code: 843)":{"summary":"DV SSL Wildcard","description":"DV Wildcard (X-Product-Code: 843)","value":{"productVariant":"dv","saveAsDraft":false,"requestor":{"name":"John Smith","email":"john@example.com","phone":"+19481081094"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"certificate":{"domain":"*.example.com","autoSecureWww":false},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"John Smith","signerPlace":"New York","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"DV Wildcard - covers every direct subdomain of example.com"}},"DV UCC / multi-SAN (X-Product-Code: 844)":{"summary":"DV SSL UCC","description":"DV UCC / multi-SAN (X-Product-Code: 844)","value":{"productVariant":"dv","saveAsDraft":false,"requestor":{"name":"John Smith","email":"john@example.com","phone":"+19481081094"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"certificate":{"domain":"example.com","autoSecureWww":true,"additionalDomains":["shop.example.com","portal.example.com","example.net"]},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"John Smith","signerPlace":"New York","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"DV UCC - multi-SAN, primary + 3 additional domains"}},"DV Wildcard UCC (X-Product-Code: 845)":{"summary":"DV SSL Wildcard UCC","description":"DV Wildcard UCC (X-Product-Code: 845)","value":{"productVariant":"dv","saveAsDraft":false,"requestor":{"name":"John Smith","email":"john@example.com","phone":"+19481081094"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"certificate":{"domain":"*.example.com","autoSecureWww":false,"additionalDomains":["*.example.net","example.com","example.net"]},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"John Smith","signerPlace":"New York","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"DV Wildcard UCC - wildcard primary plus extra wildcard / apex SANs"}},"OV - single domain (X-Product-Code: 846)":{"summary":"OV SSL Certificate","description":"OV - single domain (X-Product-Code: 846)","value":{"productVariant":"ov","emailNotifications":"all","saveAsDraft":false,"groupNumber":"3215269294","requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+14155551234","designation":"PKI Manager"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"organization":{"organizationNumber":"2969772","preVetted":true,"prevettingToken":"pvt_2969772_a1b2c3d4","useNewOrgRepresentative":true,"organizationRepresentative":{"name":"Robin Fields","email":"robin.fields@example.com","phone":"+14155559876","designation":"Head of Infrastructure"}},"certificate":{"domain":"example.com","autoSecureWww":true},"subscription":{"validityYears":1,"autoRenew":true},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"Jane Doe","signerPlace":"San Francisco","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"OV - single domain, pre-vetted organization"}},"OV Wildcard (X-Product-Code: 847)":{"summary":"OV SSL Wildcard","description":"OV Wildcard (X-Product-Code: 847)","value":{"productVariant":"ov","saveAsDraft":false,"groupNumber":"3215269294","requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+14155551234"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"organization":{"organizationNumber":"2969772","preVetted":true,"prevettingToken":"pvt_2969772_a1b2c3d4","useNewOrgRepresentative":true,"organizationRepresentative":{"name":"Robin Fields","email":"robin.fields@example.com","phone":"+14155559876","designation":"Head of Infrastructure"}},"certificate":{"domain":"*.example.com","autoSecureWww":false},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"Jane Doe","signerPlace":"San Francisco","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"OV Wildcard - pre-vetted organization, wildcard primary"}},"OV UCC / multi-SAN (X-Product-Code: 848)":{"summary":"OV SSL UCC","description":"OV UCC / multi-SAN (X-Product-Code: 848)","value":{"productVariant":"ov","saveAsDraft":false,"groupNumber":"3215269294","requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+14155551234"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"organization":{"organizationNumber":"2969772","preVetted":true,"prevettingToken":"pvt_2969772_a1b2c3d4","useNewOrgRepresentative":true,"organizationRepresentative":{"name":"Robin Fields","email":"robin.fields@example.com","phone":"+14155559876","designation":"Head of Infrastructure"}},"certificate":{"domain":"example.com","autoSecureWww":true,"additionalDomains":["shop.example.com","portal.example.com","example.net"]},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"Jane Doe","signerPlace":"San Francisco","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"OV UCC - pre-vetted organization, multi-SAN"}},"OV Wildcard UCC (X-Product-Code: 849)":{"summary":"OV SSL Wildcard UCC","description":"OV Wildcard UCC (X-Product-Code: 849)","value":{"productVariant":"ov","saveAsDraft":false,"groupNumber":"3215269294","requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+14155551234"},"delegation":{"name":"Delegate Smith","email":"delegate@example.com"},"organization":{"organizationNumber":"2969772","preVetted":true,"prevettingToken":"pvt_2969772_a1b2c3d4","useNewOrgRepresentative":true,"organizationRepresentative":{"name":"Robin Fields","email":"robin.fields@example.com","phone":"+14155559876","designation":"Head of Infrastructure"}},"certificate":{"domain":"*.example.com","autoSecureWww":false,"additionalDomains":["*.example.net","example.com","example.net"]},"subscription":{"validityYears":1},"csr":"MIICljCCAX4CAQAwUTEYMBYGA1UEAwwPd3d3LmV4YW1wbGUuY29tMQkwBwYDVQQLDAAxCTAHBgNVBAoMADEJMAcGA1UEBwwAMQkwBwYDVQQIDAAxCTAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZstzgwy2x1MWGVvNv3N02IZ+JoQjF/pzpv7C3F/E0sCv+kIB47jQfnDyu7XN+9qF6cLfasv2ZVG20azzgfudXLH8RmH+VN+Y0ESv0BTEggdJkH3LQkHNL0Bop5O2fjQANaknowSeD+e35R6Oo0Oc5RNSRlSXEWKsUiu5JvByNUVWJhbyIQaNNR9H/fnfgfSEulRuPJ0r4jVCDIt0V7yBV8Gau3yIyUSJ5P6JcEgQUyEhExGXWQoRn97PU7PswEugUkU5APD9oWDHPaWD0B9OCbbmR04BTY9EbrHm4llIkFY6gPVcCBLjhU2ZsFT9BIg9thNxumn0/DQZT4+yTGxWUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAgcN1SFZBeIopqHxVt4F7W3Yll655M6oGlKzCQK9zYwLmhwLqPx1rFSzM1bmlXN6KRwp4Ol0Trkmm6IzwDXDwIhIDjmO/y/wYhADrEFQPs5JABPN+J8lsYulztNk5+J12pY4s1S+aZ8a+Q50Ab4yeze18Fj6bMq5vamNwfxxiHTDvZMiBadio/1vV+2rFXKsdWNKreSLtLg/z3CLe0cqH4dEexo1Lno2WVRG0bvJtVJnch+1u8EXUVwnQuRf9+RdtADbHgzQzV/ctKqj3EY3lfw4wm2/7Eu7BU2BeimvXpKdgqqknyirAnYtfbSVQ/QgAEfg6nurFanHCrj3HDJmIF","agreement":{"signerName":"Jane Doe","signerPlace":"San Francisco","accepted":true},"technicalPointOfContact":{"name":"Tech Contact","phone":"+14155550199","email":"tech.contact@example.com","designation":"Technical Contact"},"recipientEmails":["admin1@example.com","admin2@example.com"],"tags":["department:IT","costCenter:CC-1234"],"remarks":"OV Wildcard UCC - pre-vetted organization, wildcard primary plus mixed SANs"}}}}},"required":true},"responses":{"400":{"description":"Malformed body or missing `X-Product-Code`.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"401":{"description":"Missing or invalid Bearer token.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"422":{"description":"Business-rule validation failed (`EMS-xxx` code in `detail`).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"201":{"description":"Order created. `Location` header points at the order resource.","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/revoke":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Revoke an issued SSL certificate","description":"Permanently marks an issued certificate as revoked with an RFC 5280 reason code (`keyCompromise`, `affiliationChanged`, `superseded`, `cessationOfOperation`, etc.). Revocation is reflected in CRL/OCSP once the CA publishes the next delta.","operationId":"revoke","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SslRevokeRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/reissue":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Reissue an SSL/TLS certificate","description":"Reissue an already-issued certificate. Two modes:\n- `rekey` - supply a new CSR; the existing certificate is replaced.\n- `update-sans` - add SAN domains to the existing certificate.\n\nA reissue creates a **new order** derived from this one (`1984857369` -> `1984857369R001`) and leaves this order as it is. The response `orderId` is that new order - track the reissue on it, not on the order you called against - and `status` is where the new order actually stands: an OV/EV reissue that has to re-run validation comes back `pending-approval` or `pending-organization-verification` rather than issued.\n\nOptionally revoke the previous certificate as part of the reissue by setting `revokePrevious=true` and providing `revokeReason`.","operationId":"reissue","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID returned by create.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReissueRequest"}}},"required":true},"responses":{"201":{"description":"Reissue accepted. `Location` points at the new reissue order.","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Order not found under this account.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"422":{"description":"Business-rule validation failed (e.g. SAN limit exceeded, missing CSR).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/dcv/verify":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Trigger DCV verification for a domain on the order","description":"Call this **after** you have published the challenge artifact (file / DNS record / replied to email). The CA re-checks the artifact; on success the order moves to the next lifecycle state.","operationId":"verifyDcv","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SslDcvVerifyRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/cancel":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Cancel an SSL order","description":"Withdraws an order that has not yet been issued. After issuance, use `/revoke` instead. The order remains visible via `GET /{id}` in `cancelled` status.","operationId":"cancel","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/agreement":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Accept the Subscriber Agreement","description":"Records signer identity, timestamp, and IP for the terms-of-use acceptance. Required for public SSL issuance; the CA will not release the certificate until this is done.","operationId":"acceptAgreement","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgreementAcceptRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/requests/{requestId}/cancel":{"post":{"tags":["SSL/TLS Certificates"],"summary":"Reject a draft request before it becomes an order","description":"Use for `saveAsDraft=true` requests that returned a `requestId` instead of an `orderId`. Once the draft has been promoted to a real order, use `/{orderId}/cancel` instead.","operationId":"rejectRequest","parameters":[{"name":"requestId","in":"path","description":"Opaque draft request ID.","required":true,"schema":{"type":"string"},"example":"req_def456"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates":{"post":{"tags":["Document Signer Certificates"],"summary":"Create a Document Signer certificate order","description":"**When to call:** to start issuing a signature certificate for an individual, an employee (legal person), or an organization (legal entity).\n\n**What happens:** the order is created and enters vetting state.\n\n**Product code resolution:** the wrapper picks the right product code from your account's catalog based on `subjectType` (`natural-person` / `legal-person` / `legal-entity`) and `subscription.validityYears`. You do not need to manage numeric product codes on the client side.\n\n**Headers (optional):**\n- `X-Product-Code` - explicit override. Set only when you need to disambiguate between multiple matching products in your catalog.","operationId":"create_1","parameters":[{"name":"X-Product-Code","in":"header","description":"**Optional override.** The wrapper resolves the product code from your account's catalog based on `subjectType` + `subscription.validityYears`. Set this header explicitly only to disambiguate between multiple matching products.","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignatureOrderCreateRequest"},"examples":{"Natural Person (1-year)":{"description":"Natural Person (1-year)","value":{"subjectType":"natural-person","emailNotifications":"all","requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+19481081094","designation":"Signer"},"subject":{"givenName":"Jane","surname":"Doe","email":"jane@example.com","countryCode":"IN"},"subscription":{"validityYears":1,"autoRenew":false},"agreement":{"signerName":"Jane Doe","signerPlace":"Bangalore","accepted":true}}}}}},"required":true},"responses":{"201":{"description":"Order created. `Location` points at the order resource.","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed body or missing `X-Product-Code`.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"422":{"description":"Business-rule validation failed.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}/revoke":{"post":{"tags":["Document Signer Certificates"],"summary":"Revoke an issued Document Signer certificate","description":"Permanently marks an issued certificate as revoked with an RFC 5280 reason code.","operationId":"revoke_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}/cancel":{"post":{"tags":["Document Signer Certificates"],"summary":"Cancel a Document Signer order","description":"Withdraws an order that has not yet been issued. After issuance, use `/revoke` instead.","operationId":"cancel_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}/agreement":{"post":{"tags":["Document Signer Certificates"],"summary":"Accept the Subscriber Agreement","description":"Records signer identity, timestamp, and IP for the terms-of-use acceptance.","operationId":"acceptAgreement_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgreementAcceptRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki/certificates":{"post":{"tags":["Private PKI Products"],"summary":"Order a Private PKI product certificate","description":"Places an order for the Private PKI product in `productCode`. `subject` carries the CA-profile field values (keys from the fields endpoint); CERTInext validates them against the profile. Follow the order with the existing `/private-pki-certificates/{orderId}` endpoints.","operationId":"create_2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivatePkiProductOrderRequest"},"examples":{"Profile-driven Private PKI":{"description":"Profile-driven Private PKI","value":{"productCode":"810","groupNumber":"9556344722","requestor":{"name":"Ops Team","email":"ops@example.com","phone":"+919876543210"},"subject":{"domainName":"intranet.example.local","additionalDomains":["portal.example.local"],"organizationName":"Example Ltd","countryCode":"IN","state":"Karnataka","locality":"Bengaluru","dnsType":"1"},"subscription":{"validityYears":1},"emailNotifications":"all"}}}}},"required":true},"responses":{"422":{"description":"Validation failed (missing or invalid profile fields, product not available).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"201":{"description":"Order created.","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates":{"post":{"tags":["Private PKI Certificates"],"summary":"Create a Private PKI certificate order","description":"**When to call:** to issue a certificate from your Private PKI CA (Intranet TLS, IGTF Host).\n\n**Product code resolution:** the wrapper picks the right product code from your catalog based on `variant` (`intranet-ssl` / `igtf-host`). You do not need to manage numeric codes client-side.\n\n**Headers (optional):**\n- `X-Product-Code` - explicit override. Set only to disambiguate when multiple matching products exist.\n\n**No DCV, no agreement** - the CA is under your control.","operationId":"create_3","parameters":[{"name":"X-Product-Code","in":"header","description":"**Optional override.** The wrapper resolves the product code from your catalog based on `variant`. Set explicitly only to disambiguate between matching products.","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivatePkiOrderCreateRequest"},"examples":{"Intranet SSL":{"description":"Intranet SSL","value":{"variant":"intranet-ssl","caProfileId":"internal-web-tier","masterProductId":"pki_master_001","hostname":"intranet.example.local","additionalHosts":["portal.example.local"],"emailNotifications":"all","subscription":{"validityYears":1},"requestor":{"name":"Ops Team","email":"ops@example.com","phone":"+19481081094","designation":"Infra"}}}}}},"required":true},"responses":{"400":{"description":"Malformed body or missing `X-Product-Code`.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"422":{"description":"Business-rule validation failed.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"201":{"description":"Order created.","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates/{orderId}/revoke":{"post":{"tags":["Private PKI Certificates"],"summary":"Revoke an issued Private PKI certificate","description":"Revokes a certificate issued from the customer CA with an RFC 5280 reason.","operationId":"revoke_2","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates/{orderId}/cancel":{"post":{"tags":["Private PKI Certificates"],"summary":"Cancel a Private PKI order","description":"Withdraws an order before issuance.","operationId":"cancel_2","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/organizations/{orgNumber}/ca-validations/sslcom":{"get":{"tags":["Accounts"],"summary":"SSL.com validation of an organization","description":"Status per level (OV, EV) with validTill, what is still missing before it can be submitted, and the SSL.com contact.","operationId":"getSslcomValidation","parameters":[{"name":"orgNumber","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]},"post":{"tags":["Accounts"],"summary":"Submit an organization to SSL.com for validation","description":"Body: `levels` ([\"OV\"], [\"EV\"] or both; empty = the organization's default), `subscriberAgreementAccepted` (must be true), optional `adminEmail`, and, only where the organization lacks them, `organizationPhone`, `businessCategoryId`, `registrationNumber`, `contactTitle`. Safe to repeat: a level already requested is skipped.","operationId":"submitSslcomValidation","parameters":[{"name":"orgNumber","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":{"type":"object"}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/organizations/{orgNumber}/ca-validations/sslcom/sync":{"post":{"tags":["Accounts"],"summary":"Refresh an organization's SSL.com validation status","description":"Re-reads the organization from SSL.com and returns the same body as the GET.","operationId":"syncSslcomValidation","parameters":[{"name":"orgNumber","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/itsm/servicenow/events":{"post":{"tags":["service-now-webhook-controller"],"operationId":"events","requestBody":{"content":{"application/json":{"schema":{"type":"string"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JSONObject"}}}}}}},"/api/certinext/v2/domains":{"get":{"tags":["Domains"],"summary":"List domains","description":"Filter / paginate the account's domains. All filter parameters are optional.\n\n`search` performs a case-insensitive **substring** match on the domain name by default (SQL `LIKE '%value%'`): `search=cosmic.ucar.edu` returns every host under that zone (e.g. `cosmic-admin.cosmic.ucar.edu`). To look up a single domain by its full name, add **`exactMatch=true`** - `search=case.edu&exactMatch=true` returns only `case.edu`, not `sub.case.edu`. `groupNumber` restricts the list to domains mapped to that billing group (intersected with your own group access; an unknown group returns 422). `sortBy` is restricted to a whitelist (see DomainSortField); unknown values return 400.","operationId":"list","parameters":[{"name":"filter","in":"query","required":true,"schema":{"$ref":"#/components/schemas/DomainListFilter"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]},"post":{"tags":["Domains"],"summary":"Add a domain","description":"**When to call:** before placing an order for a domain that is not already verified in the account.\n\n**What you get back:**\n- 201 with the new domain id and DCV instructions on success\n- 409 with `existingDomainId` populated when the same domain is already verified in another organization of this account (account-guard, §4.1)\n- 422 with per-perspective `diagnostics` when CAA pre-check disagrees\n\n**Accounts validated by SSL.com:** the response carries `validatedBy: SSLCOM` and `dcv` holds SSL.com's record (`recordName` / `recordValue`, plus `txtToken` or `fileName`/`fileToken`) for the chosen method, with every method SSL.com offers under `dcv.options`. 502 when SSL.com cannot register the domain.\n\n**Choosing the CA (`ca`, optional):** `EMSIGN` or `SSLCOM`. An organization can hold the same domain once per CA; the duplicate check and `mode=renew` use the row of the CA given. `SSLCOM` on an account that does not use SSL.com returns 422. Without `ca` the account decides (SSL.com on an account that uses SSL.com, else emSign), as before.\n\n**`mode=renew` on a domain validated by SSL.com:** SSL.com starts a new validation with new values, `dcvMethod` is selected for it, and the response carries `validatedBy: SSLCOM` and the new record under `dcv`. 502 when SSL.com cannot restart the validation.","operationId":"create_4","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainCreateRequest"},"examples":{"Add example.com via dns-txt":{"description":"Add example.com via dns-txt","value":{"domainName":"example.com","organizationId":"8K9mQ2vR8nP4bL","dcvMethod":"dns-txt","skipCAA":false}}}}},"required":true},"responses":{"201":{"description":"Domain added.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainCreateResponse"}}}},"400":{"description":"Malformed body.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"409":{"description":"Domain already verified in another organization of this account.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"422":{"description":"CAA / DCV pre-check failed; see diagnostics.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"502":{"description":"SSL.com-validated account: SSL.com could not register the domain.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/deactivate":{"post":{"tags":["Domains"],"summary":"Deactivate a domain","description":"Soft-deactivates the domain (sets {@code domainStatus=INACTIVE}). Existing certificates remain valid; future orders for this domain are blocked until it is re-added. Hard-delete is not supported through this API - by design, BR §5.4.1 requires audit retention.\n\n**Domains validated by SSL.com:** same as the Hub's Deactivate - only the CERTInext status changes. The domain stays registered at SSL.com, and emSign never issues for it.","operationId":"deactivate","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv/verify":{"post":{"tags":["Domains"],"summary":"Trigger DCV verification","description":"Runs the per-perspective MPIC verification immediately. On success the domain flips to {@code VERIFIED} and the response carries the diagnostics block. On consensus failure the response is 422 with the same diagnostics block under {@code ProblemDetail.diagnostics}.\n\n**Domains validated by SSL.com** (`validatedBy: SSLCOM`): SSL.com checks the published record from multiple network perspectives (this call waits up to about 15 s for its result). 200 with `validTill` from SSL.com when validated; otherwise 422 with `diagnostics.caStatus` (PENDING, FAILED, UNDER_REVIEW, EXPIRED) and `diagnostics.caMessage` (SSL.com's reason). Optional `optionId` checks a different option from `GET /dcv` (e.g. a parent name). 502 when SSL.com cannot be reached.","operationId":"verifyDcv_1","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DcvVerifyRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/code-signing-certificates":{"post":{"tags":["Code Signing Certificates"],"summary":"Create a Code Signing certificate order","description":"**Product:** resolved from your group's catalog by `productVariant` (`ov` / `ev`); `X-Product-Code` overrides it.\n\n**Organization:** `organization.organizationNumber` for an organization already vetted for your account (`GET /organizations?productVariant=ov|ev`; EV needs an EV-vetted one), or the details of a new organization. EV with a new organization also needs `contractSigner` and `certificateApprover`.\n\n**InCommon accounts:** the order uses one Code Signing order-quota slot of the account and, in per-group mode, of the group; it is refused when none is left.","operationId":"create_5","parameters":[{"name":"X-Product-Code","in":"header","description":"Optional override: a specific Code Signing product code from `GET /catalog/products`.","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CodeSigningOrderCreateRequest"},"examples":{"OV, existing organization":{"description":"OV, existing organization","value":{"productVariant":"ov","groupNumber":"1234567890","organization":{"organizationNumber":"9876543210"},"requestor":{"name":"Jane Doe","email":"jane@example.com","phone":"+919481081094","designation":"Release Engineer"},"agreement":{"signerName":"Jane Doe","signerPlace":"Bangalore","accepted":true}}}}}},"required":true},"responses":{"201":{"description":"Order created. `Location` points at the order resource.","content":{"application/json":{"schema":{"type":"object"}}}},"422":{"description":"Not entitled to the product, or business-rule validation failed.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"403":{"description":"No Code Signing order quota left (InCommon accounts).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/code-signing-certificates/{orderId}/revoke":{"post":{"tags":["Code Signing Certificates"],"summary":"Revoke an issued Code Signing certificate","description":"Permanently revokes the certificate with an RFC 5280 reason code.","operationId":"revoke_3","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/code-signing-certificates/{orderId}/cancel":{"post":{"tags":["Code Signing Certificates"],"summary":"Cancel a Code Signing order","description":"Withdraws an order that has not been issued. After issuance, use `/revoke`.","operationId":"cancel_3","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv/method":{"patch":{"tags":["Domains"],"summary":"Change the DCV method for a domain","description":"Switches the DCV method and returns the freshly-issued challenge. The previous method's tokens are invalidated; verifying again must use the new method.","operationId":"changeDcvMethod","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DcvMethodChangeRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}":{"get":{"tags":["SSL/TLS Certificates"],"summary":"Track an SSL order","description":"Returns the current state of the SSL order, plus enrichment blocks:\n- `orderedBy` - the portal user who actually placed the order (name / email). Matches the **Ordered By** field on the portal's View Order page. Use this to attribute a certificate to a person on your team.\n- `organizationRepresentative` - **OV/EV only.** The Organization Representative of record for the order (name / email / phone / designation) - the same person the portal shows under **Organization Representative Information** on the View Order page. Omitted for DV, which has no organization vetting step.\n- `requestor` - the requestor stored against the order at creation time. **Who this is depends on the order flow**: pre-vetted OV/EV orders have it replaced with the organization's representative, while other flows keep whatever was submitted (usually the ordering user). Because it is ambiguous, don't use it for attribution - prefer `orderedBy` and `organizationRepresentative`. Kept for backward compatibility.\n- `csrSubmitted` - has the CSR been POSTed yet.\n- `subscription` - billing entitlement window (`validityYears`, `endDate`, `status`).\n- `subscriberAgreement` - Subscriber Agreement state (`signed`, `signerName`, `signedAt`, `signedPlace`).\n- `revocation` - RFC 5280 revocation details, populated only when `status = revoked`.\n- `interimDvIssued` - OV/EV only; `true` once the interim DV cert has been issued.\n\nPoll this every 30 - 60 seconds while the CA processes DCV, vetting, and issuance. `status` transitions: `pending-dcv` -> `pending-csr` -> `pending-agreement` -> `pending-approval` -> `issued` (or `cancelled` / `revoked` / `expired`). Stop polling once `status` reaches a terminal state.","operationId":"track","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID returned by create.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"responses":{"404":{"description":"Order not found under this account.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"200":{"description":"Current order state.","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/dcv":{"get":{"tags":["SSL/TLS Certificates"],"summary":"Get the DCV challenge for a domain on the order","description":"Returns the challenge artefact (DNS TXT record value for `dns-txt`, or `.well-known` file token + path for `http-url`) for the chosen Domain Control Validation method. Publish the artefact, then call `POST /{id}/dcv/verify` with the same `method` so the CA re-checks it.\n\nBoth query parameters are optional:\n- `domain` defaults to the order's primary domain (the `certificate.domain` you supplied at create time, also returned by `GET /{orderId}`).\n- `method` defaults to `dns-txt` (BR-recommended). Set to `http-url` for HTTP-based validation.","operationId":"getDcv","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"},{"name":"domain","in":"query","description":"Domain name to fetch DCV challenges for. Optional - defaults to the order's primary domain.","required":false,"schema":{"type":"string"},"example":"example.com"},{"name":"method","in":"query","description":"DCV method (`dns-txt` / `http-url`). Optional - defaults to `dns-txt`.","required":false,"schema":{"type":"string","enum":["dns-txt","http-url"]},"example":"dns-txt"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/ssl-certificates/{orderId}/certificate":{"get":{"tags":["SSL/TLS Certificates"],"summary":"Download the issued certificate","description":"Returns the issued certificate in the format requested via the `Accept` header:\n- `application/json` - JSON envelope with PEM + metadata (serial, validity, thumbprint)\n- `application/x-pem-file` - PEM text\n- `application/pkix-cert` - DER bytes\n\nOnly callable after issuance (`status=issued`).","operationId":"downloadCertificate","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"},{"name":"Accept","in":"header","description":"Response format: JSON / PEM / DER.","required":false,"schema":{"type":"string","enum":["application/json","application/x-pem-file","application/pkix-cert"]}},{"name":"format","in":"query","description":"Convenience override: `pem`, `der`, or `pkcs7` (alias of der). Wins over Accept when set.","required":false,"schema":{"type":"string","enum":["pem","der","pkcs7"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}},"application/x-pem-file":{"schema":{"type":"object"}},"application/pkix-cert":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}":{"get":{"tags":["Document Signer Certificates"],"summary":"Track a Document Signer order","description":"Returns the current state of the order, plus enrichment blocks:\n- `requestor` - who placed the order (name / email / phone / designation).\n- `csrSubmitted` - has the CSR been POSTed yet.\n- `subscription` - billing entitlement window.\n- `subscriberAgreement` - Subscriber Agreement state.\n- `revocation` - populated only when `status = revoked`.\n\nPoll while documents are vetted and the certificate is issued. `status` typically walks `pending-documents` -> `pending-csr` -> `pending-agreement` -> `pending-approval` -> `issued`. Legal Entity certs may also pass through `pending-organization-verification`.","operationId":"track_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/signature-certificates/{orderId}/certificate":{"get":{"tags":["Document Signer Certificates"],"summary":"Download the issued certificate","description":"JSON / PEM / DER via `Accept` header negotiation.","operationId":"downloadCertificate_1","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"},{"name":"Accept","in":"header","required":false,"schema":{"type":"string","default":"application/json"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}},"application/x-pem-file":{"schema":{"type":"object"}},"application/pkix-cert":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/reports/orders":{"get":{"tags":["Reports"],"summary":"Orders report","description":"Filterable, paginated list of orders for the authenticated account. Supports date-range, status, and group filters. Returns `{ orders: [...], page, pageSize, totalResults, totalPages }`.","operationId":"orders","parameters":[{"name":"groupNumber","in":"query","description":"Optional group filter.","required":false,"schema":{"type":"string"},"example":"GRP-001"},{"name":"status","in":"query","description":"Filter by status. Supported values: `issued`, `revoked`, `expired` (certificate state), and `cancelled`, `rejected`, `pending-approval` (order state). `issued` returns generated + downloaded certificates, excluding revoked/expired/cancelled/pending. Other values (e.g. the granular `pending-dcv`/`pending-csr` substates) return 422 with the supported list.","required":false,"schema":{"type":"string","enum":["issued","revoked","expired","cancelled","rejected","pending-approval"]},"example":"issued"},{"name":"from","in":"query","description":"Start date (inclusive). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-01-01"},{"name":"to","in":"query","description":"End date (inclusive). Format: YYYY-MM-DD; the wrapper expands a date-only value to end-of-day before forwarding.","required":false,"schema":{"type":"string"},"example":"2026-12-31"},{"name":"page","in":"query","description":"Page number, 1-based.","required":false,"schema":{"type":"integer","format":"int32","default":1},"example":1},{"name":"size","in":"query","description":"Page size (max 100).","required":false,"schema":{"type":"integer","format":"int32","default":50},"example":50}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/reports/ledger":{"get":{"tags":["Reports"],"summary":"Ledger statement","description":"Billing and balance movements for the authenticated account - paginated. Page is 1-based, matching /reports/orders.","operationId":"ledger","parameters":[{"name":"groupNumber","in":"query","description":"Optional group filter.","required":false,"schema":{"type":"string"},"example":"GRP-001"},{"name":"page","in":"query","description":"Page number, 1-based.","required":false,"schema":{"type":"integer","format":"int32","default":1},"example":1},{"name":"size","in":"query","description":"Page size (max 100).","required":false,"schema":{"type":"integer","format":"int32","default":50},"example":50}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki/products/{productCode}/fields":{"get":{"tags":["Private PKI Products"],"summary":"Certificate fields of a Private PKI product","description":"Returns the fields the product's CA profile defines, in display order. Send each value in `subject` under the field's `key`. `isMandatory` fields are required; a field with `fixedValue` is set by the CA profile; `values` lists the allowed options.","operationId":"fields","parameters":[{"name":"productCode","in":"path","description":"Private product code from GET /catalog/products (category 8).","required":true,"schema":{"type":"string"},"example":810},{"name":"groupNumber","in":"query","description":"Optional group; defaults to your default group.","required":false,"schema":{"type":"string"},"example":9556344722}],"responses":{"404":{"description":"Unknown product.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}},"200":{"description":"Field definitions.","content":{"application/json":{"schema":{"type":"object"}}}},"422":{"description":"Product not available to the group, or no CA profile.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetail"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates/{orderId}":{"get":{"tags":["Private PKI Certificates"],"summary":"Track a Private PKI order","description":"Returns the current state of the order, plus enrichment blocks:\n- `requestor` - who placed the order (name / email / phone / designation).\n- `csrSubmitted` - has the CSR been POSTed yet.\n- `subscription` - billing entitlement window.\n- `subscriberAgreement` - Subscriber Agreement state (when the product requires it).\n- `revocation` - populated only when `status = revoked`.\n\nPrivate PKI orders skip DCV; typical walk is `pending-csr` -> `pending-approval` -> `issued`.","operationId":"track_2","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/private-pki-certificates/{orderId}/certificate":{"get":{"tags":["Private PKI Certificates"],"summary":"Download the issued Private PKI certificate","description":"JSON / PEM / DER via `Accept` header negotiation.","operationId":"downloadCertificate_2","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"},"example":"ord_abc123"},{"name":"Accept","in":"header","required":false,"schema":{"type":"string","default":"application/json"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}},"application/x-pem-file":{"schema":{"type":"object"}},"application/pkix-cert":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/users":{"get":{"tags":["InCommon Reporting"],"summary":"Users","description":"The primary administrator (account owner) of every InCommon institution: user name, email, account name and account number. Sorted by account name; not paged. Institutions without an owner are left out.","operationId":"users","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/trends":{"get":{"tags":["InCommon Reporting"],"summary":"Trends","description":"Counts per week, month or quarter: new issuance, renewals, institutions onboarded, new users. Every period from `from` to `to` is listed, with 0 where nothing happened. `to` defaults to today and `from` to the start of the month of the first onboarding. At most 520 periods.","operationId":"trends","parameters":[{"name":"metric","in":"query","description":"Comma-separated: `new-issuance`, `renewals`, `institutions-onboarded`, `new-users`. Default: all four.","required":false,"schema":{"type":"string"},"example":"new-issuance,renewals"},{"name":"interval","in":"query","description":"`week` (periods start on Monday), `month` (default) or `quarter`.","required":false,"schema":{"type":"string"},"example":"month"},{"name":"from","in":"query","description":"First day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-07-01"},{"name":"to","in":"query","description":"Last day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-31"},{"name":"accountNumber","in":"query","description":"Only this institution.","required":false,"schema":{"type":"string"},"example":4100018832}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/summary":{"get":{"tags":["InCommon Reporting"],"summary":"Program summary","description":"Totals of institutions, users, orders and certificates. `from`/`to` only affect the `*InPeriod` figures, which are 0 when neither is given.","operationId":"summary","parameters":[{"name":"from","in":"query","description":"Period start (inclusive), UTC. Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-01"},{"name":"to","in":"query","description":"Period end (inclusive), UTC. Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-31"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/product-adoption":{"get":{"tags":["InCommon Reporting"],"summary":"Product adoption","description":"How many active InCommon institutions issued each product type, with the certificates issued and the share of active institutions. `from`/`to` limit issuance to a period (by issue date); without them all issuance counts. Deactivated institutions are left out.","operationId":"productAdoption","parameters":[{"name":"from","in":"query","description":"Issued on or after this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-07-01"},{"name":"to","in":"query","description":"Issued on or before this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-31"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/orders":{"get":{"tags":["InCommon Reporting"],"summary":"Orders","description":"Certificate orders for the whole program or one institution, newest first. Not paged. One row per certificate request, so an order with several certificates has several rows. At most 10000 rows; above that the response is 422 - narrow with accountNumber or from/to. Status values match the customer orders report; `pending` marks other in-progress orders. All filters are optional and combine with AND.","operationId":"orders_1","parameters":[{"name":"accountNumber","in":"query","description":"Only this institution's orders.","required":false,"schema":{"type":"string"},"example":4100018832},{"name":"productType","in":"query","description":"`dv`, `ov`, `ev`, `smime`, `code-signing`, `private-pki`, `document-signer` or `other`.","required":false,"schema":{"type":"string"},"example":"ov"},{"name":"status","in":"query","description":"`issued`, `revoked`, `expired`, `cancelled`, `rejected` or `pending-approval`.","required":false,"schema":{"type":"string"},"example":"issued"},{"name":"orderType","in":"query","description":"`new`, `renewal` or `reissue`.","required":false,"schema":{"type":"string"},"example":"renewal"},{"name":"from","in":"query","description":"Ordered on or after this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-01"},{"name":"to","in":"query","description":"Ordered on or before this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-31"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/institutions":{"get":{"tags":["InCommon Reporting"],"summary":"Institutions","description":"One row per InCommon institution: account, legal name, Salesforce account ID / IPEDS ID, status, onboarding date, primary administrator, user, certificate and order counts. Not paged; sorted by account name. All filters are optional and combine with AND.","operationId":"institutions","parameters":[{"name":"onboardedFrom","in":"query","description":"Onboarded on or after this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-07-01"},{"name":"onboardedTo","in":"query","description":"Onboarded on or before this day (UTC). Format: YYYY-MM-DD.","required":false,"schema":{"type":"string"},"example":"2026-10-31"},{"name":"status","in":"query","description":"`active` or `deactivated`.","required":false,"schema":{"type":"string"},"example":"active"},{"name":"salesforceAccountId/ipedsId","in":"query","description":"Exact Salesforce account ID (any case) or IPEDS ID.","required":false,"schema":{"type":"string"},"example":"0015f00000Pq1RsAAD"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/institutions/{accountNumber}":{"get":{"tags":["InCommon Reporting"],"summary":"Institution","description":"One InCommon institution: the institution-list fields plus every administrator (name, email, phone, isPrimary) and certificates by product type. 404 when no InCommon institution has the number.","operationId":"institution","parameters":[{"name":"accountNumber","in":"path","description":"The institution's CERTInext account number.","required":true,"schema":{"type":"string"},"example":4100018832}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/partners/incommon/certificate-statistics":{"get":{"tags":["InCommon Reporting"],"summary":"Certificate statistics","description":"Active, expired and revoked certificates across every InCommon institution, grouped by product type (default) or by institution, most certificates first. Not paged. Groups with no certificates are left out; `totals` is the sum of every row.","operationId":"certificateStatistics","parameters":[{"name":"groupBy","in":"query","description":"`product-type` (default) or `institution`.","required":false,"schema":{"type":"string"},"example":"product-type"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/organizations":{"get":{"tags":["Accounts"],"summary":"List pre-vetted organizations","description":"Pre-vetted organizations may be referenced in OV/EV certificate orders without re-verification. Optionally scope to a specific group. Each organization carries `validationFor` (1 = OV, 2 = EV, 3 = IV). With `productVariant`, only the organizations usable for that SSL variant are returned: `ev` = EV-validated organizations; `ov` = OV- or EV-validated ones.","operationId":"listOrganizations","parameters":[{"name":"groupNumber","in":"query","description":"Optional group filter.","required":false,"schema":{"type":"string"},"example":"GRP-001"},{"name":"productVariant","in":"query","description":"Optional SSL variant filter: ov or ev.","required":false,"schema":{"type":"string"},"example":"ev"},{"name":"validatedBy","in":"query","description":"Optional: SSLCOM returns only the organizations SSL.com certificates may use (the SSL.com OV or EV level for productVariant is VALIDATED and not expired).","required":false,"schema":{"type":"string"},"example":"SSLCOM"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/organizations/{orgNumber}":{"get":{"tags":["Accounts"],"summary":"Get a single organization","description":"Returns organization name, address, representatives, linked domains, and agreement status. On an SSL.com account it also returns `caValidations.sslcom` (OV / EV status and validTill) and `sslcomContact`.","operationId":"getOrganization","parameters":[{"name":"orgNumber","in":"path","description":"Organization number.","required":true,"schema":{"type":"string"},"example":2368754851}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/organizations/business-categories":{"get":{"tags":["Accounts"],"summary":"List business categories","description":"The values `businessCategoryId` accepts when an organization is submitted to SSL.com for EV.","operationId":"businessCategories","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/groups":{"get":{"tags":["Accounts"],"summary":"List billing groups","description":"Every order can be charged to a specific billing group. Use this to discover the `groupNumber` values available to your account.","operationId":"listGroups","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}":{"get":{"tags":["Domains"],"summary":"Get a domain","description":"Returns the full domain row including current DCV instructions and lifecycle dates.","operationId":"view","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv":{"get":{"tags":["Domains"],"summary":"Get DCV instructions for the current method","description":"Returns the DNS TXT record value (for `dns-txt`) or the .well-known file token + path (for `http-url`) appropriate for the domain's current DCV method.\n\n**Domains validated by SSL.com** (`validatedBy: SSLCOM`): the values are read live from SSL.com - `recordName` / `recordValue` / `optionId` for the selected method, every offered method under `options`, and `caStatus`. 502 when SSL.com cannot be reached.","operationId":"getDcv_1","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv/attempts":{"get":{"tags":["Domains"],"summary":"Paginated DCV attempt history","description":"**Domains validated by SSL.com:** SSL.com runs the checks and keeps only its latest result, read live. It is returned as attempt `sslcom-latest` (history has that one row) with `diagnostics.caStatus`, `caMessage` (reason of a failed check), `mpic` and `validTill`. 502 when SSL.com cannot be reached.","operationId":"getDcvAttemptHistory","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"},{"name":"offset","in":"query","description":"Page offset (0-based).","required":false,"schema":{"type":"integer","format":"int32","default":0},"example":0},{"name":"limit","in":"query","description":"Page size (max 50).","required":false,"schema":{"type":"integer","format":"int32","default":20},"example":20}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv/attempts/{attemptId}":{"get":{"tags":["Domains"],"summary":"Get a specific DCV attempt by ID","description":"**Domains validated by SSL.com:** SSL.com runs the checks and keeps only its latest result, read live. It is returned as attempt `sslcom-latest` (history has that one row) with `diagnostics.caStatus`, `caMessage` (reason of a failed check), `mpic` and `validTill`. 502 when SSL.com cannot be reached.","operationId":"getDcvAttemptDetails","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"},{"name":"attemptId","in":"path","description":"Attempt ID (logs_dcvrecords.ID), or `sslcom-latest` for a domain validated by SSL.com.","required":true,"schema":{"type":"string"},"example":12345}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/domains/{domainId}/dcv/attempts/last":{"get":{"tags":["Domains"],"summary":"Get the most recent DCV attempt","description":"Returns the diagnostics block for the most recent DCV attempt - per-perspective results, DNSSEC chain, failure class, and recommended next steps.\n\n**Domains validated by SSL.com:** SSL.com runs the checks and keeps only its latest result, read live. It is returned as attempt `sslcom-latest` (history has that one row) with `diagnostics.caStatus`, `caMessage` (reason of a failed check), `mpic` and `validTill`. 502 when SSL.com cannot be reached.","operationId":"getLastDcvAttempt","parameters":[{"name":"domainId","in":"path","description":"Opaque domain ID.","required":true,"schema":{"type":"string"},"example":"dom_abc123"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/code-signing-certificates/{orderId}":{"get":{"tags":["Code Signing Certificates"],"summary":"Track a Code Signing order","description":"Current state of the order: `status`, organization / agreement verification, requestor, expiry, and revocation details once revoked. `delivery` is always `subscriber-download`.","operationId":"track_3","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/code-signing-certificates/{orderId}/certificate":{"get":{"tags":["Code Signing Certificates"],"summary":"Download the issued certificate (public part)","description":"Available once the subscriber has downloaded the certificate onto the token. The private key never leaves the token. JSON / PEM / DER via `Accept`.","operationId":"downloadCertificate_3","parameters":[{"name":"orderId","in":"path","description":"Opaque order ID.","required":true,"schema":{"type":"string"}},{"name":"Accept","in":"header","required":false,"schema":{"type":"string","default":"application/json"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}},"application/x-pem-file":{"schema":{"type":"object"}},"application/pkix-cert":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/catalog/products":{"get":{"tags":["Catalog"],"summary":"List entitled products","description":"Returns every product (SSL, S/MIME, Document Signer, Private PKI) your account can order. Each entry exposes a stable `productCode` + `productType` + variant metadata - cache these client-side instead of hard-coding regional numeric codes.","operationId":"listProducts","parameters":[{"name":"groupNumber","in":"query","description":"Optional group filter.","required":false,"schema":{"type":"string"},"example":"GRP-001"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/catalog/products/{productCode}/custom-fields":{"get":{"tags":["Catalog"],"summary":"Custom-field definitions for a product","description":"Some products require organization-specific custom fields (e.g. cost-center tags). Call this to discover field IDs, labels, validation rules, and which are mandatory before composing the order body.","operationId":"listCustomFields","parameters":[{"name":"productCode","in":"path","description":"Product code from `GET /catalog/products`.","required":true,"schema":{"type":"string"},"example":842}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}},"/api/certinext/v2/auth/me":{"get":{"tags":["Accounts"],"summary":"Current authenticated identity","description":"Returns the `accountNumber` and `authType` bound to the Bearer token. Useful as a health-check after obtaining a token.","operationId":"me","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"BearerAuth":[]}]}}},"components":{"schemas":{"CsrSubmitRequest":{"type":"object","properties":{"csr":{"type":"string"},"attested":{"type":"boolean"}},"required":["csr"]},"OAuth2ErrorResponse":{"type":"object","properties":{"error":{"type":"string"},"error_description":{"type":"string"},"error_uri":{"type":"string"}}},"OAuth2TokenResponse":{"type":"object","properties":{"access_token":{"type":"string"},"token_type":{"type":"string"},"expires_in":{"type":"integer","format":"int64"},"refresh_token":{"type":"string"},"scope":{"type":"string"}}},"Agreement":{"type":"object","properties":{"signerName":{"type":"string","maxLength":100,"minLength":0},"signerPlace":{"type":"string","maxLength":100,"minLength":0},"accepted":{"type":"boolean"}},"required":["signerName","signerPlace"]},"Contact":{"type":"object","properties":{"name":{"type":"string","maxLength":100,"minLength":0},"email":{"type":"string","maxLength":254,"minLength":0},"phone":{"type":"string","maxLength":30,"minLength":0},"designation":{"type":"string","maxLength":100,"minLength":0}}},"CustomField":{"type":"object","properties":{"fieldId":{"type":"string"},"value":{"type":"string"}},"required":["fieldId","value"]},"Requestor":{"type":"object","properties":{"name":{"type":"string","maxLength":100,"minLength":0},"email":{"type":"string","maxLength":254,"minLength":0},"phone":{"type":"string","maxLength":30,"minLength":0},"designation":{"type":"string","maxLength":100,"minLength":0}},"required":["email","name"]},"SslCertificateInfo":{"type":"object","properties":{"domain":{"type":"string","maxLength":250,"minLength":0},"additionalDomains":{"type":"array","items":{"type":"string","maxLength":250,"minLength":0}},"autoSecureWww":{"type":"boolean"}},"required":["domain"]},"SslOrderCreateRequest":{"type":"object","properties":{"productVariant":{"type":"string","enum":["dv","ov","ev"]},"saveAsDraft":{"type":"boolean"},"requestId":{"type":"string","maxLength":64,"minLength":0},"emailNotifications":{"type":"string","enum":["consent-only","all"]},"groupNumber":{"type":"string","maxLength":64,"minLength":0},"requestor":{"$ref":"#/components/schemas/Requestor"},"delegation":{"$ref":"#/components/schemas/Contact"},"organization":{"$ref":"#/components/schemas/SslOrganizationRef"},"certificate":{"$ref":"#/components/schemas/SslCertificateInfo"},"subscription":{"$ref":"#/components/schemas/Subscription"},"agreement":{"$ref":"#/components/schemas/Agreement"},"csr":{"type":"string"},"remarks":{"type":"string","maxLength":500,"minLength":0},"tags":{"type":"array","items":{"type":"string","maxLength":100,"minLength":0}},"customFields":{"type":"array","items":{"$ref":"#/components/schemas/CustomField"}},"recipientEmails":{"type":"array","items":{"type":"string","maxLength":254,"minLength":0}},"technicalPointOfContact":{"$ref":"#/components/schemas/Contact"}},"required":["certificate","productVariant","requestor"]},"SslOrganizationRef":{"type":"object","properties":{"organizationNumber":{"type":"string","maxLength":64,"minLength":0},"preVetted":{"type":"boolean"},"prevettingToken":{"type":"string","maxLength":64,"minLength":0},"useNewOrgRepresentative":{"type":"boolean"},"organizationRepresentative":{"$ref":"#/components/schemas/SslOrganizationRepresentative"}}},"SslOrganizationRepresentative":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"phone":{"type":"string"},"designation":{"type":"string"},"employeeId":{"type":"string"},"empty":{"type":"boolean"}}},"Subscription":{"type":"object","properties":{"validityYears":{"type":"integer","format":"int32","maximum":3,"minimum":1},"autoRenew":{"type":"boolean"},"renewBeforeDays":{"type":"integer","format":"int32","maximum":365,"minimum":0}}},"FieldError":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"},"rule":{"type":"string"}}},"JSONObject":{"type":"object","additionalProperties":{"type":"object"},"properties":{"empty":{"type":"boolean"}}},"ProblemDetail":{"type":"object","properties":{"type":{"type":"string"},"title":{"type":"string"},"status":{"type":"integer","format":"int32"},"detail":{"type":"string"},"instance":{"type":"string"},"errors":{"type":"array","items":{"$ref":"#/components/schemas/FieldError"}},"existingDomainId":{"type":"string"},"diagnostics":{"type":"object","additionalProperties":{"type":"object"},"properties":{"empty":{"type":"boolean"}}},"tokenExpired":{"type":"boolean"}}},"SslRevokeRequest":{"type":"object","properties":{"reason":{"type":"string","enum":["unspecified","key-compromise","ca-compromise","affiliation-changed","superseded","cessation-of-operation","certificate-hold","remove-from-crl","aa-compromise"]},"note":{"type":"string","maxLength":500,"minLength":0}},"required":["reason"]},"ReissueRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["rekey","update-sans"]},"reason":{"type":"string","maxLength":500,"minLength":0},"csr":{"type":"string"},"additionalDomains":{"type":"array","items":{"type":"string"}},"revokePrevious":{"type":"boolean"},"revokeReason":{"type":"string","enum":["unspecified","key-compromise","ca-compromise","affiliation-changed","superseded","cessation-of-operation","certificate-hold","remove-from-crl","privilege-withdrawn","aa-compromise"]},"revokeAllPriorReissues":{"type":"boolean"}},"required":["mode","reason"]},"SslDcvVerifyRequest":{"type":"object","properties":{"domain":{"type":"string"},"method":{"type":"string","enum":["dns-txt","http-url"]}},"required":["domain","method"]},"CancelRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":500,"minLength":0}}},"AgreementAcceptRequest":{"type":"object","properties":{"agreement":{"$ref":"#/components/schemas/Agreement"}},"required":["agreement"]},"SignatureOrderCreateRequest":{"type":"object","properties":{"subjectType":{"type":"string","enum":["natural-person","legal-person","legal-entity"]},"saveAsDraft":{"type":"boolean"},"requestId":{"type":"string","maxLength":64,"minLength":0},"emailNotifications":{"type":"string","enum":["consent-only","all"]},"groupNumber":{"type":"string","maxLength":64,"minLength":0},"requestor":{"$ref":"#/components/schemas/Requestor"},"delegation":{"$ref":"#/components/schemas/Contact"},"subject":{"$ref":"#/components/schemas/SignatureSubject"},"subscription":{"$ref":"#/components/schemas/Subscription"},"agreement":{"$ref":"#/components/schemas/Agreement"},"csr":{"type":"string"},"remarks":{"type":"string","maxLength":500,"minLength":0},"tags":{"type":"array","items":{"type":"string","maxLength":100,"minLength":0}},"customFields":{"type":"array","items":{"$ref":"#/components/schemas/CustomField"}},"recipientEmails":{"type":"array","items":{"type":"string","maxLength":254,"minLength":0}},"technicalPointOfContact":{"$ref":"#/components/schemas/Contact"}},"required":["requestor","subject","subjectType"]},"SignatureSubject":{"type":"object","properties":{"firstName":{"type":"string","maxLength":100,"minLength":0},"lastName":{"type":"string","maxLength":100,"minLength":0},"email":{"type":"string","maxLength":254,"minLength":0},"phone":{"type":"string","maxLength":30,"minLength":0},"designation":{"type":"string","maxLength":100,"minLength":0},"organizationName":{"type":"string","maxLength":100,"minLength":0},"organizationUnit":{"type":"string","maxLength":100,"minLength":0},"organizationIdentificationNumber":{"type":"string","maxLength":100,"minLength":0},"businessCategory":{"type":"string","maxLength":100,"minLength":0},"identityDocumentType":{"type":"string","maxLength":100,"minLength":0},"identificationNumber":{"type":"string","maxLength":100,"minLength":0},"streetAddress1":{"type":"string","maxLength":200,"minLength":0},"streetAddress2":{"type":"string","maxLength":200,"minLength":0},"locality":{"type":"string","maxLength":100,"minLength":0},"state":{"type":"string","maxLength":100,"minLength":0},"postalCode":{"type":"string","maxLength":20,"minLength":0},"countryCode":{"type":"string","pattern":"^[A-Z]{2}$"}},"required":["email"]},"RevokeRequest":{"type":"object","properties":{"reason":{"type":"string","enum":["unspecified","key-compromise","ca-compromise","affiliation-changed","superseded","cessation-of-operation","certificate-hold","remove-from-crl","privilege-withdrawn","aa-compromise"]},"note":{"type":"string","maxLength":500,"minLength":0}},"required":["reason"]},"PrivatePkiProductOrderRequest":{"type":"object","properties":{"productCode":{"type":"string","maxLength":64,"minLength":0},"saveAsDraft":{"type":"boolean"},"requestId":{"type":"string","maxLength":64,"minLength":0},"emailNotifications":{"type":"string","enum":["consent-only","all"]},"groupNumber":{"type":"string","maxLength":64,"minLength":0},"requestor":{"$ref":"#/components/schemas/Requestor"},"subject":{"type":"object","additionalProperties":{"type":"object"}},"subscription":{"$ref":"#/components/schemas/Subscription"},"csr":{"type":"string"},"remarks":{"type":"string","maxLength":500,"minLength":0},"tags":{"type":"array","items":{"type":"string","maxLength":100,"minLength":0}},"customFields":{"type":"array","items":{"$ref":"#/components/schemas/CustomField"}},"technicalPointOfContact":{"$ref":"#/components/schemas/Contact"}},"required":["productCode","requestor","subject"]},"PrivatePkiOrderCreateRequest":{"type":"object","properties":{"variant":{"type":"string","enum":["intranet-ssl","igtf-host"]},"caProfileId":{"type":"string","maxLength":64,"minLength":0},"masterProductId":{"type":"string","maxLength":64,"minLength":0},"saveAsDraft":{"type":"boolean"},"requestId":{"type":"string","maxLength":64,"minLength":0},"emailNotifications":{"type":"string","enum":["consent-only","all"]},"groupNumber":{"type":"string","maxLength":64,"minLength":0},"requestor":{"$ref":"#/components/schemas/Requestor"},"hostname":{"type":"string","maxLength":253,"minLength":0},"additionalHosts":{"type":"array","items":{"type":"string","maxLength":253,"minLength":0}},"subject":{"$ref":"#/components/schemas/PrivatePkiSubject"},"subscription":{"$ref":"#/components/schemas/Subscription"},"csr":{"type":"string"},"remarks":{"type":"string","maxLength":500,"minLength":0},"tags":{"type":"array","items":{"type":"string","maxLength":100,"minLength":0}},"customFields":{"type":"array","items":{"$ref":"#/components/schemas/CustomField"}},"technicalPointOfContact":{"$ref":"#/components/schemas/Contact"}},"required":["hostname","requestor","variant"]},"PrivatePkiSubject":{"type":"object","properties":{"organizationName":{"type":"string","description":"Organization (O).","maxLength":64,"minLength":0},"organizationUnit":{"type":"string","description":"Organizational unit (OU).","maxLength":64,"minLength":0},"locality":{"type":"string","description":"City / locality (L).","maxLength":64,"minLength":0},"state":{"type":"string","description":"State / province (ST), full name.","maxLength":64,"minLength":0},"postalCode":{"type":"string","description":"Postal code.","maxLength":16,"minLength":0},"countryCode":{"type":"string","description":"ISO 3166-1 alpha-2 country code (C).","pattern":"^[A-Z]{2}$"},"email":{"type":"string","description":"Email address in the subject.","maxLength":254,"minLength":0}}},"DomainCreateRequest":{"type":"object","properties":{"domainName":{"type":"string","description":"Fully-qualified domain name. Wildcards (e.g. *.example.com) are accepted.","example":"example.com","pattern":"^(\\*\\.)?([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,}$"},"organizationId":{"type":"string","description":"Opaque V2 organization ID (the organization that will own the domain).","example":"8K9mQ2vR8nP4bL"},"dcvMethod":{"type":"string","description":"DCV method to use for verification.","enum":["dns-txt","http-url","dns-cname","dns-persist"],"example":"dns-txt"},"skipCAA":{"type":"boolean","description":"Skip CAA pre-check (used by Sectigo / federated import paths). Default false.","example":false},"mode":{"type":"string","description":"Operation mode. 'create' (default) adds a new domain and rejects an existing same-org domain with 409. 'renew' renews an existing, independently-verified (ADN) domain that is expired or within the renewal window; inherited domains cannot be renewed directly.","enum":["create","renew"],"example":"create"},"ca":{"type":"string","description":"Certificate authority the domain is validated by. Optional. 'EMSIGN' adds / renews the organization's emSign domain; 'SSLCOM' adds / renews its SSL.com domain (only on an account that uses SSL.com, otherwise 422). An organization can hold the same domain once per CA. When omitted the account decides: SSL.com on an account that uses SSL.com, else emSign.","enum":["EMSIGN","SSLCOM"],"example":"EMSIGN","pattern":"^(?i)(EMSIGN|SSLCOM)$"}},"required":["dcvMethod","domainName","organizationId"]},"DcvDetails":{"type":"object","properties":{"method":{"type":"string","description":"Active DCV method.","enum":["dns-txt","http-url","dns-cname","dns-persist"]},"fileToken":{"type":"string","description":"Token to drop in the .well-known file (http-url only)."},"fileName":{"type":"string","description":"File path/name to host (http-url only).","example":".well-known/pki-validation/CHALLENGE.txt"},"txtToken":{"type":"string","description":"TXT record value to publish (dns-txt only)."},"tokenExpiry":{"type":"string","format":"date-time","description":"Token expiry in UTC. After this, /verify will reject and a new token must be generated."},"instructions":{"type":"string","description":"Free-form human-readable instruction text from the catalog."},"recordName":{"type":"string","description":"SSL.com domains: where to publish - the DNS record name, or the full URL of the file.","example":"_pki-validation.example.com"},"recordValue":{"type":"string","description":"SSL.com domains: value to publish - the TXT / CNAME value, or the file content."},"optionId":{"type":"string","description":"SSL.com domains: ID of the selected SSL.com option."},"options":{"type":"array","description":"SSL.com domains: every DCV method SSL.com offers for this domain, including the selected one.","items":{"$ref":"#/components/schemas/DcvOption"}},"validatedBy":{"type":"string","description":"CA that validates this domain. Present only for SSLCOM; absent means emSign.","enum":["SSLCOM"]},"caStatus":{"type":"string","description":"SSL.com domains: validation state at SSL.com. The reason for a failed check is returned by POST /dcv/verify, not here, because SSL.com checks once on its own before the record is published.","enum":["PENDING","UNDER_REVIEW","VALIDATED","EXPIRED"]}}},"DcvOption":{"type":"object","properties":{"optionId":{"type":"string","description":"SSL.com option ID."},"method":{"type":"string","description":"DCV method of this option.","enum":["dns-txt","http-url","dns-cname","dns-persist"]},"brMethod":{"type":"string","description":"CA/B Forum BR method number.","example":"3.2.2.4.7"},"recordName":{"type":"string","description":"Where to publish: the DNS record name, or the full URL of the file.","example":"_pki-validation.example.com"},"recordValue":{"type":"string","description":"Value to publish: the TXT / CNAME value, or the file content."},"coversName":{"type":"string","description":"Name this option validates. A parent name also covers its subdomains.","example":"example.com"},"exactName":{"type":"boolean","description":"True when the option validates exactly the requested name."},"expiresAt":{"type":"string","format":"date-time","description":"When SSL.com stops accepting this value (UTC)."}}},"DomainCreateResponse":{"type":"object","properties":{"domainId":{"type":"string","description":"Opaque V2 domain ID. Use it for /domains/{id}/* operations."},"domainName":{"type":"string","description":"Domain name as stored.","example":"example.com"},"organizationId":{"type":"string","description":"Owning organization ID (opaque)."},"status":{"type":"string","description":"Lifecycle status. ACTIVE on a fresh insert.","enum":["ACTIVE","INACTIVE","EXPIRED"]},"dcvStatus":{"type":"string","description":"Current DCV state. PENDING for fresh inserts; VERIFIED if a CAA pre-check + ADN auto-verify succeeded synchronously.","enum":["PENDING","VERIFIED","REJECTED"]},"dcv":{"$ref":"#/components/schemas/DcvDetails","description":"DCV instructions for the chosen method - TXT value for `dns-txt`, file token + path for `http-url`."},"autoVerify":{"type":"string","description":"Async auto-verify hint. `scheduled` -> poll the resource; `noEligibleAncestor` -> manual verify required; `ineligible` -> method is HTTP/wildcard.","enum":["scheduled","noEligibleAncestor","ineligible"]},"validatedBy":{"type":"string","description":"CA that validates this domain. Present only for SSLCOM; absent means emSign.","enum":["SSLCOM"]},"createdAt":{"type":"string","format":"date-time"}}},"DcvVerifyRequest":{"type":"object","properties":{"optionId":{"type":"string","description":"SSL.com domains only: optionId from GET /dcv to check. Omit to check the selected option.","example":"49e7f9e7-c08e-40ba-945d-321a67c0442c"}}},"CodeSigningOrderCreateRequest":{"type":"object","properties":{"productVariant":{"type":"string","enum":["ov","ev"]},"saveAsDraft":{"type":"boolean"},"requestId":{"type":"string","maxLength":64,"minLength":0},"emailNotifications":{"type":"string","enum":["consent-only","all"]},"groupNumber":{"type":"string","maxLength":64,"minLength":0},"requestor":{"$ref":"#/components/schemas/Requestor","description":"Who requests the certificate. Optional with an existing organization: EV always uses the organization's representative, OV fills blanks from it."},"delegation":{"$ref":"#/components/schemas/Contact","description":"Certificate download delegation: this contact receives the download link."},"organization":{"$ref":"#/components/schemas/CodeSigningOrganization"},"contractSigner":{"$ref":"#/components/schemas/Contact","description":"EV with a new organization only: the Contract Signer."},"certificateApprover":{"$ref":"#/components/schemas/Contact","description":"EV with a new organization only: the Certificate Approver."},"agreement":{"$ref":"#/components/schemas/Agreement","description":"Subscriber Agreement acceptance. OV: completes the agreement step at order time, as the Hub does. EV: the agreement is signed by the Contract Signer by email."},"remarks":{"type":"string","maxLength":500,"minLength":0},"tags":{"type":"array","items":{"type":"string","maxLength":100,"minLength":0}},"customFields":{"type":"array","items":{"$ref":"#/components/schemas/CustomField"}},"recipientEmails":{"type":"array","items":{"type":"string","maxLength":254,"minLength":0}}},"required":["organization","productVariant"]},"CodeSigningOrganization":{"type":"object","properties":{"organizationNumber":{"type":"string","description":"Existing (pre-vetted) organization. When set, every other field is ignored: name, address and representatives come from the organization on file.","maxLength":64,"minLength":0},"prevettingToken":{"type":"string","maxLength":64,"minLength":0},"name":{"type":"string","description":"New organization: legal name (certificate O / CN).","maxLength":64,"minLength":0},"organizationUnit":{"type":"string","maxLength":64,"minLength":0},"streetAddress1":{"type":"string","maxLength":100,"minLength":0},"streetAddress2":{"type":"string","maxLength":100,"minLength":0},"locality":{"type":"string","maxLength":64,"minLength":0},"state":{"type":"string","description":"State / province: ISO 3166-2 subdivision code (e.g. `KA`) or the full name.","maxLength":64,"minLength":0},"postalCode":{"type":"string","maxLength":16,"minLength":0},"countryCode":{"type":"string","description":"ISO 3166-1 alpha-2 country code.","maxLength":2,"minLength":2},"email":{"type":"string","maxLength":254,"minLength":0},"businessCategory":{"type":"string","description":"EV only: business category ID (see the Hub's Business Category list).","maxLength":8,"minLength":0},"registrationNumber":{"type":"string","description":"EV only: company registration number.","maxLength":64,"minLength":0},"registrationDate":{"type":"string","description":"EV only: date of incorporation, as the Hub expects it (dd-MM-yyyy).","maxLength":20,"minLength":0},"existing":{"type":"boolean"}}},"DcvMethodChangeRequest":{"type":"object","properties":{"dcvMethod":{"type":"string","description":"New DCV method.","enum":["dns-txt","http-url","dns-cname","dns-persist"]}},"required":["dcvMethod"]},"DomainListFilter":{"type":"object","properties":{"search":{"type":"string","description":"Filter by domain name. By default this is a case-insensitive **substring** match (SQL LIKE '%value%') - e.g. `cosmic.ucar.edu` matches `cosmic-admin.cosmic.ucar.edu` and every other host containing that text. To fetch a single domain by its full name, set `exactMatch=true`, which matches the domain name exactly (`dv.domainName = 'value'`). Omit to list all domains.","example":"cosmic.ucar.edu"},"exactMatch":{"type":"boolean","default":"false","description":"When `true`, `search` is matched **exactly** against the full domain name instead of as a substring - use this to retrieve a single domain by its FQDN (e.g. `search=case.edu&exactMatch=true` returns only `case.edu`, not `sub.case.edu`). Defaults to `false` (substring match). Ignored when `search` is omitted.","example":false},"domainStatus":{"type":"array","items":{"type":"string","enum":["ACTIVE","INACTIVE","EXPIRED"]}},"dcvStatus":{"type":"array","items":{"type":"string","enum":["PENDING","VERIFIED","REJECTED"]}},"dcvMethod":{"type":"array","items":{"type":"string","enum":["dns-txt","http-url","dns-cname","dns-persist"]}},"organizationId":{"type":"string"},"groupNumber":{"type":"string","description":"Restrict the list to domains mapped to this billing group (from GET /groups). The result is intersected with your API key's own group access, so you can only filter by groups you're entitled to - filtering by a group you don't belong to returns no domains. An unknown group number returns 422.","example":6682871792},"validatedBy":{"type":"string","description":"Restrict the list to domains validated by one certificate authority: `SSLCOM` = domains SSL.com validates (the ones SSL.com certificates may use), `EMSIGN` = all other domains. Omit for both.","enum":["SSLCOM","EMSIGN"],"example":"SSLCOM"},"fromDate":{"type":"string","format":"date"},"toDate":{"type":"string","format":"date"},"includePending":{"type":"boolean"},"limit":{"type":"integer","format":"int32"},"offset":{"type":"integer","format":"int32"},"sortBy":{"type":"string"},"sortDir":{"type":"string"}}}},"securitySchemes":{"BearerAuth":{"type":"http","description":"Short-lived Bearer access token (valid for 1 hour) obtained by signing in via **Authentication -> POST /oauth/token**. Paste only the `access_token` value from the response. Do **not** include the word `Bearer` (Swagger adds it automatically). Do **not** paste your client secret here. That is the long-lived secret used to obtain the token, not the token itself.","scheme":"bearer"}}}}