Request and Response Conventions
The conventions on this page apply to all CodeSign Secure API endpoints unless an endpoint states otherwise.
Base URL
All endpoint paths in this reference are relative to https://<your domain>/api/. CodeSign Secure uses HTTPS port 443 by default. If your server uses another HTTPS port, include it, for example https://<your domain>:8443/api/.
Request Parameters
Endpoints receive their input in one of the following ways. The endpoint pages list the parameters and where each is located.
| Located In | Description |
|---|
| Path | Part of the endpoint path, for example {certificateName} in /certificate_manage/certificateDetailsByName/{certificateName}/. |
| Query | Appended to the URL, for example /reports/certificate_report?from_date=2026-01-01&to_date=2026-01-31. Array values are comma-separated, for example environment_id=1,2. URL-encode values that contain spaces or special characters. |
| Body (JSON) | A JSON object sent with POST, PUT, or PATCH requests. |
| Form data | Fields sent as multipart/form-data, used for file uploads. |
Filtering
Several list endpoints accept a filters query parameter: a JSON array of {"field": .., "operator": .., "value": ..} objects, all of which must match. The fields and operators each endpoint accepts are listed under its filters parameter. URL-encode the value, for example:
curl -G "https://<your domain>/api/certificate_manage/certificates" \
-H "Authorization: Bearer <token>" \
--data-urlencode 'filters=[{"field": "<field>", "operator": "<operator>", "value": "<value>"}]'
Endpoints that accept filters: GET /certificate_manage/certificates, GET /project_manage/basic/, GET /reports/certificate_report, GET /reports/daily-log, GET /reports/daily-log/export, GET /reports/log_report, GET /reports/signing_report, GET /signing_request/signing_request_approval/{approvalUser_id}/.
Responses
Successful requests return JSON: the requested records, or the record after a change. Error responses carry a short message in a JSON object:
{
"message": "Token Expired"
}
A few endpoints, such as the ones that validate verification codes, return the message under detail instead of message.
HTTP Status Codes
| Status Code | Description |
|---|
| 200 | Request processed. The body carries the requested records or the record after the change. |
| 201 | The operation completed. |
| 400 | The request could not be processed. The message names the reason, for example a client certificate that isn't recognised or isn't available to this account. |
| 403 | The access token has expired. Get a new token and retry. Signing requests also return 403 when an approval was rejected or timed out. |
| 440 | Authentication failed. The Authorization header is missing or malformed, the token is invalid, or its session is no longer active. |
| 450 | The appliance licence is missing or has expired. Contact your administrator. |
| 460 | The account is locked or has been deleted. Any active session is ended at the same time. |
| 480 | The account's role does not carry the permission this endpoint requires. |
| 490 | A verification code is required before this decision can be recorded. Request one, validate it, then retry. |
| 491 | The verification code supplied is incorrect. |
| 492 | The verification code has expired. Request a new one. |
| 500 | The request could not be completed. The response carries a short message; the full cause is recorded in the appliance log. |
Trailing Slashes
Call endpoints exactly as they are written in this reference, including any trailing slash.
