Certificates
Read-only, platform-operator-only: which certificates the certificate authority has issued, their validity, and the certificate hierarchy's health. Requires the platform-operator role, checked against the caller's own bearer token — unrelated to any organization role, and never customer-facing.
2 endpoints
Lists issued certificates across the whole platform.
get/v1/platform/certificatesRequires a bearer token
Requires the platform-operator role — a customer's role in their own
organization grants no access here, since certificates are not scoped
to any one organization's console. Cursor-paginated: pass the previous
page's nextCursor back as cursor to fetch the next page; omit
cursor for the first page.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| organizationId | query | string | Restricts the listing to certificates attributed to this organization. This process does not resolve or validate the id itself — reading it requires the platform-operator role, not membership in the named organization (see the description on this whole resource for why). |
| chargingStationId | query | string | Restricts the listing to certificates issued to this charging station. |
| profile | query | CertificateProfileParam | One of v2gLeafIso2, v2gLeafIso20, contract, provisioning,
chargingStation. |
| status | query | CertificateStatusParam | One of current, superseded, revoked, expired. |
| selfAssignedProviderIdOnly | query | boolean | Restrict to contract certificates issued under a self-assigned EMAID provider identifier. |
| cursor | query | string | An opaque cursor from a previous page's nextCursor response
field; omit for the first page. |
| limit | query | integer<int32> | Certificates per page, capped at 100. Defaults to 50. |
Responses
| Status | Body | Description |
|---|---|---|
| 200 | ListCertificatesResponse | A page of issued certificates across the whole platform |
| 400 | ErrorBody | An unrecognised or malformed query parameter |
| 401 | ErrorBody | Missing, invalid, or expired bearer token |
| 403 | ErrorBody | The caller's token does not carry the platform-operator role |
| 429 | ErrorBody | The caller has exceeded its request budget. error is rateLimited. Wait Retry-After seconds before retrying — a prior successful response's own RateLimit-Remaining/RateLimit-Reset headers show this coming before it happens. |
| 500 | ErrorBody | An unexpected internal error. error is always internalError; message is deliberately the fixed string "an unexpected error occurred", never the real cause, which is logged server-side instead of being returned to the caller. |
Returns the certificate hierarchy's health.
get/v1/platform/certificates/hierarchy-healthRequires a bearer token
Reports any sub-CA whose validity ends before certificates it has signed, and when a CRL was last published. Requires the platform-operator role — a customer's role in their own organization grants no access here, since the certificate hierarchy is not scoped to any one organization's console.
Responses
| Status | Body | Description |
|---|---|---|
| 200 | HierarchyHealthResponse | The certificate hierarchy's health |
| 401 | ErrorBody | Missing, invalid, or expired bearer token |
| 403 | ErrorBody | The caller's token does not carry the platform-operator role |
| 429 | ErrorBody | The caller has exceeded its request budget. error is rateLimited. Wait Retry-After seconds before retrying — a prior successful response's own RateLimit-Remaining/RateLimit-Reset headers show this coming before it happens. |
| 500 | ErrorBody | An unexpected internal error. error is always internalError; message is deliberately the fixed string "an unexpected error occurred", never the real cause, which is logged server-side instead of being returned to the caller. |