- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
API Token Management
The API Token Management endpoints create, refresh, list, revoke, and delete the API tokens that are used to authenticate to the CertSecure Manager API.
For the corresponding user interface, refer to the Utilities > API Tokens section.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /delete_api_token | Delete API token. |
| GET | /generate_api_token | Generate API token. |
| GET | /get_api_token | List API tokens. |
| GET | /get_api_token_info | Get API token info. |
| GET | /revoke_api_token | Revoke API token. |
GET /delete_api_token
Permanently deletes a revoked API token.
Note: A token must be revoked with GET /revoke_api_token before it can be deleted.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
token_id |
Query | string | Yes | Name (identifier) of the API token. |
Example Request
curl -X GET "https://<certsecure-backend-url>/delete_api_token?token_id=<token_id>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | The resource was deleted. |
| 400 | Token not revoked. |
| 404 | Token not found. |
GET /generate_api_token
Generates a new API token, or refreshes an existing token when refresh is set to true.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
token_id |
Query | string | Yes | Token name / identifier. |
expiry |
Query | integer | No | Validity in days. |
trust |
Query | string | No | Trusted IPs / origins. |
role |
Query | string | No | - |
notes |
Query | string | No | - |
refresh |
Query | string | No | true to refresh existing token. |
Example Request
curl -X GET "https://<certsecure-backend-url>/generate_api_token?token_id=<token_id>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Token created. |
| 400 | Invalid parameters. |
| 401 | Unauthorized. |
GET /get_api_token
Lists the API tokens visible to the caller, with their status, validity, refresh setting, and creator.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
role |
Query | string | No | - |
Example Request
curl -X GET "https://<certsecure-backend-url>/get_api_token" \
-H "Authorization: Bearer <token>"Example Response
[
{
"Token_id": "automation-token",
"type": "API",
"Status": "Active",
"Refresh": true,
"Trust": false,
"ExpiryDays": 30,
"Created_by": "[email protected]",
"Created_on": "09/01/2026 18:07:13",
"Valid_till": "10/01/2026 18:07:13",
"Notes": "",
"Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}
]Responses
| Status Code | Description |
|---|---|
| 200 | Tokens. |
GET /get_api_token_info
Returns the details of one API token.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
token_id |
Query | string | Yes | Name (identifier) of the API token. |
Example Request
curl -X GET "https://<certsecure-backend-url>/get_api_token_info?token_id=<token_id>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Token info. |
| 404 | The resource was not found. |
GET /revoke_api_token
Revokes an API token so that it can no longer be used. A token must be revoked before it can be deleted.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
token_id |
Query | string | Yes | Name (identifier) of the API token. |
Example Request
curl -X GET "https://<certsecure-backend-url>/revoke_api_token?token_id=<token_id>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Revoked. |
| 404 | Token not found. |