GET /v1/certificate-defaults
Read a user's certificate request defaults
- operationId
getCertificateDefaults- 认证
- 登录会话：主控登录后的 Bearer 会话，由客户本人在自己的主控里使用；插件不能要求客户交出会话。
- 所需权限
全部需要：certificates.read
说明（契约原文）
The default certificate type, DNS provider and CA prefilled into a new request. A user without saved defaults reads acme with revision 0. Tenant actors read their own scope; platform actors name the target tenant scope and user.
参数
getCertificateDefaults 参数| 名称 | 位置 | 类型 | 必填 | 说明 |
|---|
target_scope_id | query | string(uuid) | 否 | Required for platform actors; tenant actors may only target their own scope. |
|---|
target_user_id | query | string(uuid) | 否 | Defaults to the authenticated user. |
|---|
响应
getCertificateDefaults 响应| 状态码 | 说明 |
|---|
200 | The user's defaults; ETag carries the revision. 字段：scope_id: string(uuid) user_id: string(uuid) certificate_type: string: acme / uploaded dns_provider_id?: string(uuid) issuer?: string: lets_encrypt / zerossl / google_trust revision: integer(int64) updated_at?: string(date-time) |
|---|
400 | Invalid request or structurally invalid DNS/certificate data. |
|---|
401 | Authentication is required. |
|---|
403 | The active role lacks the required permission. |
|---|
404 | Resource absent or hidden by tenant isolation. |
|---|
500 | Sanitized internal failure. |
|---|
失败时怎么办
400 按字段说明修正参数或请求体再发；不要原样重试。401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。404 资源不存在或不属于当前租户。500 结果未知：先按资源 ID 或列表回读确认，再决定是否用原 Idempotency-Key 重试。
↑ 回到列表
PATCH /v1/certificate-defaults
Save a user's certificate request defaults
- operationId
updateCertificateDefaults- 认证
- 登录会话：主控登录后的 Bearer 会话，由客户本人在自己的主控里使用；插件不能要求客户交出会话。
- 所需权限
全部需要：certificates.manage
说明（契约原文）
Compare-and-set on expected_revision (version_conflict when stale). dns_provider_id must be an enabled provider in the target scope (dns_resource_conflict otherwise). issuer is a known CA that is available now: a CA without platform EAB credentials is refused with certificate_issuer_unavailable (409) when saved, the same check an order create applies; uploaded defaults drop dns_provider_id and issuer. An order that falls back to a default CA whose credentials were removed later is still refused with certificate_issuer_unavailable when it is created.
参数
updateCertificateDefaults 参数| 名称 | 位置 | 类型 | 必填 | 说明 |
|---|
Idempotency-Key | header | string | 是 | — |
|---|
请求体
application/json · 必填：是
updateCertificateDefaults 请求体| 名称 | 类型 | 必填 | 说明 |
|---|
target_scope_id | string(uuid) | 否 | — |
|---|
target_user_id | string(uuid) | 否 | — |
|---|
certificate_type | string: acme / uploaded | 是 | — |
|---|
dns_provider_id | string(uuid) | null(uuid) | 否 | Empty or null clears the default provider. |
|---|
issuer | string: lets_encrypt / zerossl / google_trust / / null | null: lets_encrypt / zerossl / google_trust / / null | 否 | Empty or null uses the platform default. |
|---|
expected_revision | integer(int64) | 是 | — |
|---|
响应
updateCertificateDefaults 响应| 状态码 | 说明 |
|---|
200 | Saved defaults; ETag carries the new revision. 字段：scope_id: string(uuid) user_id: string(uuid) certificate_type: string: acme / uploaded dns_provider_id?: string(uuid) issuer?: string: lets_encrypt / zerossl / google_trust revision: integer(int64) updated_at?: string(date-time) |
|---|
400 | Invalid request or structurally invalid DNS/certificate data. |
|---|
401 | Authentication is required. |
|---|
403 | The active role lacks the required permission. |
|---|
404 | Resource absent or hidden by tenant isolation. |
|---|
409 | Duplicate, referenced, stale, or conflicting idempotent request. |
|---|
500 | Sanitized internal failure. |
|---|
失败时怎么办
400 按字段说明修正参数或请求体再发；不要原样重试。401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。404 资源不存在或不属于当前租户。409 先回读资源当前状态；同一操作重试保持原 Idempotency-Key 和原请求内容。500 结果未知：先按资源 ID 或列表回读确认，再决定是否用原 Idempotency-Key 重试。
↑ 回到列表