| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/certificate-assets | List active certificate assets | Session |
| POST | /v1/certificate-assets | Upload a certificate and private key | Session |
| GET | /v1/certificate-assets/{asset_id} | Get a certificate asset and its public versions | Session |
| DELETE | /v1/certificate-assets/{asset_id} | Soft-delete an unreferenced certificate asset | Session |
| GET | /v1/certificate-assets/{asset_id}/bindings | List current site bindings for one certificate asset | Session |
| POST | /v1/certificate-assets/{asset_id}/bindings | Bind an active version to a tenant site | Session |
| DELETE | /v1/certificate-assets/{asset_id}/bindings/{site_id} | Append an immutable site unbind fact | Session |
| POST | /v1/certificate-assets/{asset_id}/versions/{version_id}/activate | Atomically activate one immutable certificate version | Session |
| POST | /v1/certificate-assets/{asset_id}/versions/{version_id}/revoke | Revoke one certificate version | Session |
Contract file：api/control-certificate-assets.openapi.yaml