CertSecure Documentation
  • Overview
    • About CertSecure Manager
    • Documentation Guide
  • Reference Guide
    • Header Bar
      • CertSecure Documentation
      • Swagger API
      • Profile Section
      • Search
    • Dashboard
      • Key Performance Indicators
      • Expiring Certificates
      • CA metrics
      • Key Strength
      • Signing Algorithm
      • Certificate Risk Report Profile
      • PKI Posture Management
      • NDES Health Information
    • AI Assistant
      • Chat
      • Configuration
      • Usage Report
    • Inventory
      • Overview
        • Overall
        • CertSecure
      • Template Management
        • Switch Templates
        • Exclusion List
        • Alert Templates
        • Certificate Templates
      • Template Categories
    • Discovery
      • Inventory
      • Scan Config
      • Cloud Config
      • Vault Config
      • Discovery Analytics
      • Scan Details
      • Discovery Ingestion
    • Reports
    • Utilities
      • ACME
      • Tasks
      • Integrations
        • Renewal Manager
        • Load Balancers
        • Discovery Agents
        • CLI Tool
        • Key Management
        • SEIM Tools
        • DevOps Tools
        • Ansible Automation Platform
      • NDES
      • Azure Key Vault
      • API Tokens
    • Enrollment
      • Certificate Request
      • Generate CSR
      • Enroll CSR
      • Generate Certificate
      • Import Certificate
      • Bulk Certificate Generation
      • Manage Policies
      • Organization Details
    • Administration
      • Users
      • Roles and permission
      • Certificate Authorities
      • Departments
    • Miscellaneous
      • Logging
      • Service Setup
        • Zoom
        • Zendesk
      • Settings
        • Configure Realms
        • Schedule Alerts
        • Metrics
        • Web Branding
        • About License
  • Setup & Architecture
    • Identity and Access Control
    • Architecture
    • Installation
      • Pre-requisites
      • Windows
      • Linux
      • Docker
    • Upgrade
      • Windows
      • Docker
  • Release Notes
    • Releases for 2026
      • v3.4.0
      • v3.3.1
      • v3.3.0
    • Releases for 2025
      • v3.2.0
      • v3.1.0
    • Releases for 2024
      • v3.0.0
  • Workflow
    • Approval Workflow
  • API Reference
    • Getting Started
    • Authorizing Requests
    • Securing API Access
    • Request and Response Conventions
    • Endpoint Reference
      • Health
      • API Token Management
      • CA Management
      • Templates
      • Certificate Enrollment
      • Inventory
      • Certificate Discovery
      • Tasks
      • Watcher Groups
      • Alerts
      • Reports
      • Logs
      • Monitoring
      • Scheduling
      • SMTP
      • ACME
      • Azure Key Vault
      • Google Cloud (GCP)
      • HashiCorp Vault
      • EJBCA
      • ServiceNow
  • Integration Guide
    • Renewal Manager
      • Workflow
      • Setup
      • Troubleshooting
      • IIS
      • Apache
      • Tomcat
      • Nginx
      • MSSQL
      • MongoDB
      • Oracle
      • Cloudflare
      • AudioCodes
      • Cisco ISE
      • Palo Alto PAN-OS
      • Cisco ACI
    • Load Balancer
      • F5
        • Workflow
        • Setup
        • Onboarding
        • UI Guide
        • Troubleshooting
      • NetScaler
        • Workflow
        • Setup
        • UI Guide
        • Troubleshooting
    • Certificate Authorities
      • ACME CAs
      • AWS
      • DigiCert Connector
      • EJBCA
      • GlobalSign
      • GoDaddy
      • HashiCorp Vault PKI
      • Microsoft AD CS
      • Sectigo
      • Sectigo-PS
    • Ansible Automation Platform
    • Azure Key Vault
  • Discovery Agent Setup Guide

Certificate Discovery

The Certificate Discovery endpoints manage scan configurations (network, cloud, and vault), start discovery scans, and return scan details, discovered certificates, analytics, and scan reports.

For the corresponding user interface, refer to the Discovery section.

Endpoints

Method Endpoint Description
GET /CertDiscovery/agent-logs Discovery agent logs.
GET /CertDiscovery/analytics Discovery analytics.
GET /CertDiscovery/cloud_config Get cloud discovery config.
POST /CertDiscovery/cloud_config Create cloud discovery config.
PUT /CertDiscovery/cloud_config Update cloud discovery config.
DELETE /CertDiscovery/cloud_config Delete cloud discovery config.
GET /CertDiscovery/discovery_config Get discovery configuration.
POST /CertDiscovery/discovery_config Create discovery configuration.
PUT /CertDiscovery/discovery_config Update discovery configuration.
DELETE /CertDiscovery/discovery_config Delete discovery configuration.
GET /CertDiscovery/inventory Discovery inventory.
POST /CertDiscovery/scan Start discovery scan.
GET /CertDiscovery/scan-details Get scan details.
GET /CertDiscovery/scan-report Get scan report.
POST /CertDiscovery/scan-report Start report generation.
GET /CertDiscovery/scan-report-download Download scan report.
GET /CertDiscovery/scan-report-status Scan report status.
GET /CertDiscovery/vault_config Get vault discovery config.
POST /CertDiscovery/vault_config Create vault discovery config.
PUT /CertDiscovery/vault_config Update vault discovery config.
DELETE /CertDiscovery/vault_config Delete vault discovery config.
GET /CertDiscovery/agent-logs

Returns the task logs reported by discovery agents.

Request Parameters

Name Located In Type Required Description
agentID Query string No ID of the discovery agent.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/agent-logs" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Logs.
GET /CertDiscovery/analytics

Returns analytics for the certificates found by discovery scans. Returns 202 while discovery data is still being synchronized.

Request Parameters

Name Located In Type Required Description
scan_name Query string No Name of the discovery scan.
type Query string No -
value Query string No -
page Query integer No Page number to return.
count Query integer No Number of records to return per page.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/analytics" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Analytics.
GET /CertDiscovery/cloud_config

Returns the cloud discovery configurations. Secrets are masked.

Request Parameters

Name Located In Type Required Description
cloud_provider Query string No Cloud provider: AWS, Azure, or GCP.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/cloud_config" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 The configuration is returned.
POST /CertDiscovery/cloud_config

Creates a cloud discovery configuration with the credentials for AWS, Azure, or GCP.

Request Body (multipart/form-data)

Field Type Required Description
config_name string Yes Name of the configuration.
cloud_provider string Yes AWS, Azure or GCP.
client_id string No -
tenant_id string No -
client_secret string No -
subscription_id string No -
access_key_id string No -
secret_access_key string No -
region string No -

Example Request

curl -X POST "https://<certsecure-backend-url>/CertDiscovery/cloud_config" \
  -H "Authorization: Bearer <token>" \
  -F "config_name=<config_name>" \
  -F "cloud_provider=<cloud_provider>"

Responses

Status Code Description
200 The resource was created.
PUT /CertDiscovery/cloud_config

Updates a cloud discovery configuration.

Request Body (multipart/form-data)

Field Type Required Description
config_name string Yes Name of the configuration.
cloud_provider string Yes Cloud provider: AWS, Azure, or GCP.

Example Request

curl -X PUT "https://<certsecure-backend-url>/CertDiscovery/cloud_config" \
  -H "Authorization: Bearer <token>" \
  -F "config_name=<config_name>" \
  -F "cloud_provider=<cloud_provider>"

Responses

Status Code Description
200 The resource was updated.
DELETE /CertDiscovery/cloud_config

Deletes a cloud discovery configuration.

Request Parameters

Name Located In Type Required Description
config_name Query string Yes Name of the configuration.
cloud_provider Query string No Cloud provider: AWS, Azure, or GCP.

Example Request

curl -X DELETE "https://<certsecure-backend-url>/CertDiscovery/cloud_config?config_name=<config_name>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 The resource was deleted.
GET /CertDiscovery/discovery_config

Returns the discovery scan configurations.

Request Parameters

Name Located In Type Required Description
scan_type Query string No -
name Query string No Name of the resource.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/discovery_config" \
  -H "Authorization: Bearer <token>"

Example Response

[
    {
        "Scan Name": "datacenter-network-scan",
        "Scan Type": "network"
    }
]

Responses

Status Code Description
200 The configuration is returned.
POST /CertDiscovery/discovery_config

Creates a discovery scan configuration for a network, certificate store, cloud, or vault scan.

Request Body (multipart/form-data)

Field Type Required Description
name string Yes Name of the resource.
scan_type string No -
target_type string No -
urls string No -
start_ipaddress string No -
end_ipaddress string No -
subnet string No -
port_type string No -
ports string No -
store_type string No -
hosts string No -
store_path string No -
pfx_password string No -
cloud_provider string No Cloud provider: AWS, Azure, or GCP.
services string No -
cloud_config_name string No -
vault_provider string No Vault provider, for example HashiCorp.
vault_config_name string No -

Example Request

curl -X POST "https://<certsecure-backend-url>/CertDiscovery/discovery_config" \
  -H "Authorization: Bearer <token>" \
  -F "name=<name>"

Responses

Status Code Description
200 The resource was created.
400 Invalid or missing request parameters.
409 A scan job with the supplied name already exists.
PUT /CertDiscovery/discovery_config

Updates a discovery scan configuration.

Request Body (multipart/form-data)

Field Type Required Description
name string Yes Name of the resource.
scan_type string No -

Example Request

curl -X PUT "https://<certsecure-backend-url>/CertDiscovery/discovery_config" \
  -H "Authorization: Bearer <token>" \
  -F "name=<name>" \
  -F "scan_type=<scan_type>"

Responses

Status Code Description
200 The resource was updated.
400 Invalid or missing request parameters.
DELETE /CertDiscovery/discovery_config

Deletes a discovery scan configuration.

Request Parameters

Name Located In Type Required Description
scan_type Query string No -
name Query string Yes Name of the resource.

Example Request

curl -X DELETE "https://<certsecure-backend-url>/CertDiscovery/discovery_config?name=<name>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 The resource was deleted.
404 Scan job not found.
GET /CertDiscovery/inventory

Returns the certificates found by discovery scans, one page at a time.

Request Parameters

Name Located In Type Required Description
taskID Query integer No ID of the task created for the operation.
page Query integer No Page number to return.
count Query integer No Number of records to return per page.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/inventory" \
  -H "Authorization: Bearer <token>"

Example Response

{
    "count": 1,
    "certs": [
        {
            "Scan Name": "datacenter-network-scan",
            "Host": "10.0.0.17",
            "Port": "443",
            "Subject": "app.example.com",
            "Issuer": "Example Issuing CA",
            "Serial Number": "7000000010ef86655e5171c50e",
            "Not Before": "05/01/2026, 19:07:19 UTC+0000",
            "Not After": "04/26/2028, 23:44:13 UTC+0000",
            "Public Key Algorithm": "rsaEncryption",
            "Public Key Size": "2048",
            "Signature Algorithm": "sha256WithRSAEncryption",
            "Certificate Type": "Third Party",
            "CA Certificate": "False"
        }
    ]
}

Responses

Status Code Description
200 Certificates.
POST /CertDiscovery/scan

Starts a discovery scan, on demand or on a schedule, on the selected discovery agent.

Request Body (multipart/form-data)

Field Type Required Description
name string Yes Scan config name.
agent_name string No Name of the discovery agent that runs the scan.
on_demand string No -
schedule string No -
interval string No -

Example Request

curl -X POST "https://<certsecure-backend-url>/CertDiscovery/scan" \
  -H "Authorization: Bearer <token>" \
  -F "name=<name>"

Responses

Status Code Description
200 Scan started.
400 Missing agent_name or agent not compatible with the scan job.
409 Discovery agent is not online to schedule the scan.
GET /CertDiscovery/scan-details

Get scan details. Fetch scan tasks filtered by scan name and/or status. At least one filter is required.

Note: At least one of scan_name or scan_status is required.

Request Parameters

Name Located In Type Required Description
scan_name Query string No Name of the discovery scan.
scan_status Query string No Allowed values: scheduled, pending, active, complete.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/scan-details" \
  -H "Authorization: Bearer <token>"

Example Response

{
    "Error": "At least one of 'scan_name' or 'scan_status' is required to get scan details"
}

Responses

Status Code Description
200 Scan details.
GET /CertDiscovery/scan-report

Returns the report of a discovery scan.

Request Parameters

Name Located In Type Required Description
scan_name Query string Yes Name of the discovery scan.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/scan-report?scan_name=<scan_name>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Report.
POST /CertDiscovery/scan-report

Starts generating the report of a discovery scan and returns a job ID.

Request Parameters

Name Located In Type Required Description
scan_name Query string Yes Name of the discovery scan.

Example Request

curl -X POST "https://<certsecure-backend-url>/CertDiscovery/scan-report?scan_name=<scan_name>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Job started.
GET /CertDiscovery/scan-report-download

Downloads a generated scan report.

Request Parameters

Name Located In Type Required Description
jobId Query string Yes ID of the report job returned when report generation was started.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/scan-report-download?jobId=<jobId>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Report file.
GET /CertDiscovery/scan-report-status

Returns the status of a scan report job.

Request Parameters

Name Located In Type Required Description
jobId Query string Yes ID of the report job returned when report generation was started.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/scan-report-status?jobId=<jobId>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 Status.
GET /CertDiscovery/vault_config

Returns the vault discovery configurations. Secrets are masked.

Request Parameters

Name Located In Type Required Description
vault_provider Query string No Vault provider, for example HashiCorp.

Example Request

curl -X GET "https://<certsecure-backend-url>/CertDiscovery/vault_config" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 The configuration is returned.
POST /CertDiscovery/vault_config

Creates a vault discovery configuration, for example for HashiCorp Vault.

Request Body (multipart/form-data)

Field Type Required Description
config_name string Yes Name of the configuration.
vault_provider string Yes Vault provider, for example HashiCorp.
vault_url string No -
namespace string No -
auth_method string No -
role_id string No -
secret_id string No -
token string No -
pki_mounts string No -

Example Request

curl -X POST "https://<certsecure-backend-url>/CertDiscovery/vault_config" \
  -H "Authorization: Bearer <token>" \
  -F "config_name=<config_name>" \
  -F "vault_provider=<vault_provider>"

Responses

Status Code Description
200 The resource was created.
PUT /CertDiscovery/vault_config

Updates a vault discovery configuration.

Request Body (multipart/form-data)

Field Type Required Description
config_name string Yes Name of the configuration.
vault_provider string Yes Vault provider, for example HashiCorp.

Example Request

curl -X PUT "https://<certsecure-backend-url>/CertDiscovery/vault_config" \
  -H "Authorization: Bearer <token>" \
  -F "config_name=<config_name>" \
  -F "vault_provider=<vault_provider>"

Responses

Status Code Description
200 The resource was updated.
DELETE /CertDiscovery/vault_config

Deletes a vault discovery configuration.

Request Parameters

Name Located In Type Required Description
config_name Query string Yes Name of the configuration.
vault_provider Query string No Vault provider, for example HashiCorp.

Example Request

curl -X DELETE "https://<certsecure-backend-url>/CertDiscovery/vault_config?config_name=<config_name>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code Description
200 The resource was deleted.
On this Page:
Support Privacy Policy Terms of Service

Copyright 2026 Encryption Consulting LLC. All rights reserved.