Skyrsoft CertOps exposes a REST API under /api/v1 for scripted enrolment and inventory — the
console itself does not use this API; it talks to an internal interface of its own, so the REST
surface exists purely for external scripts and integrations. It is a Pro feature: Free licences
get HTTP 402 even before authentication, and issuing an API key is blocked outright.
How it works
Send an API key in the X-Api-Key header. There is no admin scope: CA creation, revocation, user
management and settings stay console-only, whatever key is presented.
| Scope | Grants |
|---|---|
certops:read |
List and get certificates, devices, templates and CA metadata |
certops:enroll |
Everything in read, plus enrolment and device registration |
Errors use RFC 7807 application/problem+json, with a traceId on every response — 401 for a
missing or invalid key, 403 for insufficient scope or a licence cap, 422 for a request the
template’s policy rejects, 402 where the whole surface is unlicensed.
Endpoint surface
Certificates are read-only from the API — list, detail, PEM, and the full chain; revoking or suspending one stays a console action. Enrolment covers submitting a CSR, having CertOps generate the keypair itself, enrolling a user certificate by UPN, and polling a request by its ID. Devices can be registered and heartbeated the way an agent would. Templates and the active CA are readable for building your own tooling around them.
What automation can drive
POST /api/v1/enrollment takes a CSR and returns a requestId; poll GET /api/v1/enrollment/{id} until it reports Issued rather than resubmitting, which is the API’s own
polling model rather than the retry-the-identical-request pattern SCEP and EST use. POST /api/v1/enrollment/generate has CertOps build the keypair and CSR itself and returns the private
key exactly once, in that same response or the one approval-triggered poll that follows — it is
never stored in recoverable form afterwards.
On the main listener, not a separate port
The API answers on the same HTTPS port as the console. It used to have a dedicated listener
(CertOps:ApiPort, default 5009), described as isolating the API surface — measured, it did
not: routes here are not bound to a listener, so /api/v1 already answered on the console port
regardless, while the extra listener additionally published the admin console, its internal
interface and its login pages on 5009. The listener and the config key are both gone. If a
reverse proxy still points /api/* at a 5009 backend pool, repoint it at the main HTTPS port.
Limits
List endpoints are plain JSON arrays, not a paginated envelope. Filter with query parameters; there is no skip/take paging to page through a large result set.
There is no per-endpoint rate limit on the API today. Size a client’s retry and backoff behaviour accordingly.
Revoking and suspending a certificate are console actions, not API calls. Read the certificate state through the API if you need to; change it through the console.
Reachability cannot be split from the console’s. The API and the admin console answer on the same HTTPS origin, so a network control that lets a partner or service reach the API also lets it reach the console’s own login pages.
A test or generated certificate counts against the licensed-certificate pool while it exists. Revoking it returns the count immediately, so clean up after a sizing test or an integration script rather than letting test certificates accumulate.