Approve a request
const url = 'https://example.com/api/certs/requests/example/approve';const options = { method: 'POST', headers: { 'X-Ssoossh-Key-Secret': '<X-Ssoossh-Key-Secret>', 'Content-Type': 'application/json' }, body: '{}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/api/certs/requests/example/approve \ --header 'Content-Type: application/json' \ --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>' \ --data '{}'Session-authed and CSRF-guarded. Publishes a signing job; the certificate reaches the client over its own SSE stream, not in this response.
Approving a service-type request requires a body naming which of the approver’s own service accounts the certificate is for; that account becomes the certificate principal. Other types take no body.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The certificate request’s UUID
Request Body
Section titled “Request Body”Service-account selection (service-type requests only)
object
Service-account selection (service-type requests only)
object
Extensions is the approver’s chosen certificate extension set, for service-type requests only and ignored for others.
Absent (JSON null, or the field omitted) means the approver made no choice and the requester’s own set stands — which is what an approval nobody touched sends, so configuring cert_options.service.extensions cannot by itself change the outcome of an untouched approval. An empty array is a different thing: a deliberate “no extensions”, which is legitimate here in a way an empty Principals is not.
Bounded by cert_options.service.extensions server-side. The selection replaces the requested set and then goes through the same ceiling intersection every request does, so naming something outside the ceiling drops it rather than granting it.
NotificationEmail optionally points every notification about the resulting enrollment at one address instead of fanning out to every holder of the service account. Service-type requests only; ignored for others. Empty means fan out, which is the default.
Approval is where this belongs because it is the moment the approver is already deciding what the enrollment is for: a team alias entered here reaches the people who run the job rather than the one person who clicked approve. It stays editable afterwards.
Example generated
{}Responses
Section titled “Responses”Queued for signing
object
object
Status is always “signing” today — included so the response shape can carry more without a breaking change later.
Example generated
{ "data": { "status": "example" }, "error": "example"}Malformed body, or a service-type approval that names no service account
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}No valid session
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Bound to another user, refused by the type’s require condition, a service account the approver is not associated with, or a cross-origin call
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}No such request
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Already decided: denied, or approved and signing or signed
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Expired before it was decided
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}