# Create certs

URL: https://docs.hanzo.ai/docs/openapi/iam/post-iam-certs

> Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before a rotation.

`POST /v1/iam/certs`

> [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                        |
| ------------- | -------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/iam/certs`    |
| **Method**    | `POST`                                 |
| **Operation** | `post_iam_certs`                       |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY` |

Adds a signing certificate your applications can verify tokens against
— the call you make to stage the next one before a rotation. A name already
used in your organization is refused.

It registers the certificate's IDENTITY: its name (which is the JWKS `kid`),
its algorithm, its expiry. Key material does not travel this way and cannot:
the private key is not part of the Cert's JSON, so it is neither served here
nor accepted here. It is supplied to the process by the deployment, under the
name registered here (internal/keyring). Staging a rotation is therefore two
halves — this call names the key, and the deployment provides it.

## Request

20 fields, body `application/json` (required).

| Field              | In   | Type               | Required | Description |
| ------------------ | ---- | ------------------ | -------- | ----------- |
| `accessKey`        | body | string             | —        |             |
| `accessSecret`     | body | string             | —        |             |
| `account`          | body | string             | —        |             |
| `bitSize`          | body | integer (int64)    | —        |             |
| `certificate`      | body | string             | —        |             |
| `createdAt`        | body | string (date-time) | —        |             |
| `createdTime`      | body | string             | —        |             |
| `cryptoAlgorithm`  | body | string             | —        |             |
| `deleted`          | body | boolean            | —        |             |
| `displayName`      | body | string             | —        |             |
| `domainExpireTime` | body | string             | —        |             |
| `expireInYears`    | body | integer (int64)    | —        |             |
| `expireTime`       | body | string             | —        |             |
| `id`               | body | string             | —        |             |
| `name`             | body | string             | —        |             |
| `owner`            | body | string             | —        |             |
| `provider`         | body | string             | —        |             |
| `scope`            | body | string             | —        |             |
| `type`             | body | string             | —        |             |
| `updatedAt`        | body | string (date-time) | —        |             |

## Response

| Status    | Body            | Meaning           |
| --------- | --------------- | ----------------- |
| `200`     | iam.Cert        | ok                |
| `202`     | Approval        | held for approval |
| `default` | problem-details | refused           |

`200` body — 20 fields.

| Field              | In   | Type               | Always | Description |
| ------------------ | ---- | ------------------ | ------ | ----------- |
| `accessKey`        | body | string             | —      |             |
| `accessSecret`     | body | string             | —      |             |
| `account`          | body | string             | —      |             |
| `bitSize`          | body | integer (int64)    | —      |             |
| `certificate`      | body | string             | —      |             |
| `createdAt`        | body | string (date-time) | —      |             |
| `createdTime`      | body | string             | —      |             |
| `cryptoAlgorithm`  | body | string             | —      |             |
| `deleted`          | body | boolean            | —      |             |
| `displayName`      | body | string             | —      |             |
| `domainExpireTime` | body | string             | —      |             |
| `expireInYears`    | body | integer (int64)    | —      |             |
| `expireTime`       | body | string             | —      |             |
| `id`               | body | string             | —      |             |
| `name`             | body | string             | —      |             |
| `owner`            | body | string             | —      |             |
| `provider`         | body | string             | —      |             |
| `scope`            | body | string             | —      |             |
| `type`             | body | string             | —      |             |
| `updatedAt`        | body | string (date-time) | —      |             |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo iam certs create
```

**SDK**

**.ts**

```ts
import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postIamCerts({ accessKey: "<accessKey>", accessSecret: "<accessSecret>" });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).post_iam_certs(access_key="<accessKey>", access_secret="<accessSecret>")
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.IamAPI.PostIamCerts(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::post_iam_certs(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new IamApi(client).postIamCerts();
```

**HTTP**

```bash
curl -X POST https://api.hanzo.ai/v1/iam/certs \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "accessKey": "<accessKey>",
       "accessSecret": "<accessSecret>"
     }'
```

**MCP**

MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_iam_applications"
         }
       }
     }'
```

---

[IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)