Adds a signing certificate your applications can verify tokens against — the…
Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before a rotation.
POST /v1/iam/certs
| Address | https://api.hanzo.ai/v1/iam/certs |
| Method | POST |
| Operation | post_iam_certs |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before a rotation. A name already used in your organization is refused.
It registers the certificate's IDENTITY: its name (which is the JWKS kid),
its algorithm, its expiry. Key material does not travel this way and cannot:
the private key is not part of the Cert's JSON, so it is neither served here
nor accepted here. It is supplied to the process by the deployment, under the
name registered here (internal/keyring). Staging a rotation is therefore two
halves — this call names the key, and the deployment provides it.
Request
20 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
accessKey | body | string | — | |
accessSecret | body | string | — | |
account | body | string | — | |
bitSize | body | integer | — | |
certificate | body | string | — | |
createdAt | body | string (date-time) | — | |
createdTime | body | string | — | |
cryptoAlgorithm | body | string | — | |
deleted | body | boolean | — | |
displayName | body | string | — | |
domainExpireTime | body | string | — | |
expireInYears | body | integer | — | |
expireTime | body | string | — | |
id | body | string | — | |
name | body | string | — | |
owner | body | string | — | |
provider | body | string | — | |
scope | body | string | — | |
type | body | string | — | |
updatedAt | body | string (date-time) | — |
Response
| Status | Body | Meaning |
|---|---|---|
200 | iam.Cert | ok |
200 body — 20 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
accessKey | body | string | — | |
accessSecret | body | string | — | |
account | body | string | — | |
bitSize | body | integer | — | |
certificate | body | string | — | |
createdAt | body | string (date-time) | — | |
createdTime | body | string | — | |
cryptoAlgorithm | body | string | — | |
deleted | body | boolean | — | |
displayName | body | string | — | |
domainExpireTime | body | string | — | |
expireInYears | body | integer | — | |
expireTime | body | string | — | |
id | body | string | — | |
name | body | string | — | |
owner | body | string | — | |
provider | body | string | — | |
scope | body | string | — | |
type | body | string | — | |
updatedAt | body | string (date-time) | — |
Failure carries the platform error shape — see Errors.
Examples
hanzo iam certs createimport { Configuration, IamApi } from 'hanzoai';
const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postIamCerts({ accessKey: "<accessKey>", accessSecret: "<accessSecret>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).post_iam_certs(access_key="<accessKey>", access_secret="<accessSecret>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.IamAPI.PostIamCerts(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, iam_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = iam_api::post_iam_certs(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new IamApi(client).postIamCerts();curl -X POST https://api.hanzo.ai/v1/iam/certs \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"accessKey": "<accessKey>",
"accessSecret": "<accessSecret>"
}'The door reaches iam through the iam tool, which names its 75 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "list__well_known_jwks"
}
}
}'How is this guide?