Skip to main content
POST
Issue Device Certificate

Authorizations

X-API-Key
string
header
required

PromptGuard API key for developer endpoints. Keys start with pg_live_ and are created in the dashboard.

Body

application/json

A Device asks for its certificate. Unknown fields are refused, not ignored.

csr
string
required

PEM PKCS#10 for an EC P-256 key, signed by that key with ECDSA-SHA256. Only its public key is used.

key_protection
enum<string>
required

Where the private key lives: secure_enclave | tpm | software

Available options:
secure_enclave,
tpm,
software
os_user
string
required

The OS account the key belongs to: the Windows SID or the macOS user's UUID

Required string length: 1 - 128
Pattern: ^[^\x00-\x1f\x7f]+$
crl_distribution_point
string
required

Where the agent serves the returned revocation list: http://127.0.0.1:/.crl or http://[::1]:/.crl

Maximum string length: 160

Response

The live certificate again: its CSR was sent before

A Device certificate, the root it chains to and the list that says it is not revoked.

certificate
string
required

The Device certificate, PEM. The authority.

serial
string
required

Lowercase hex, no separators

not_before
string<date-time>
required
not_after
string<date-time>
required
renew_after
string<date-time>
required

Issue time plus half the validity

permitted_dns_names
string[]
required

The certificate's permitted dNSName subtrees, as it carries them

root
DeviceCertificateRoot · object
required
revocation_list
DeviceCertificateRevocationList · object
required