List this tenant's certificate versions with their state and validity
Returns every enrolled version of the authenticated tenant, newest first, with its status (DRAFT, ACTIVE or RETIRED), the certificate's identity and validity window, and currentlyValid, which answers whether the version could sign right now. Object keys and secret references are deliberately absent: they are the internal storage layout of the signing boundary and there is nothing a caller can do with them.
Returns every enrolled version of the authenticated tenant, newest first, with its status (DRAFT, ACTIVE or RETIRED), the certificate's identity and validity window, and currentlyValid, which answers whether the version could sign right now. Object keys and secret references are deliberately absent: they are the internal storage layout of the signing boundary and there is nothing a caller can do with them.
Authorization
bearerAuth Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/v2/certificates" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "2.0", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "certificates": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "version": 1, "environment": "BETA", "status": "DRAFT", "certificateId": "93038071-4553-48f6-8780-c7262cd9be88", "sha256": "string", "serialNumber": "string", "issuerName": "string", "subjectRuc": "string", "notBefore": "2019-08-24T14:15:22Z", "notAfter": "2019-08-24T14:15:22Z", "currentlyValid": true, "revokedAt": "2019-08-24T14:15:22Z", "validationMethod": "BETA_AUTHENTICATED", "createdAt": "2019-08-24T14:15:22Z", "activatedAt": "2019-08-24T14:15:22Z", "retiredAt": "2019-08-24T14:15:22Z", "activation": { "activationId": "a606ed3b-704a-4227-aa5c-f71d4aee9a1f", "status": "PENDING", "responseCode": "string", "responseMessage": "string", "failureCode": "string", "requestedAt": "2019-08-24T14:15:22Z", "finishedAt": "2019-08-24T14:15:22Z" } } ]}Mint the next signing secret version POST POST
Creates the next secret version and switches signing to it immediately; there is no overlap window, so install the new secret before rotating. The new secret is returned exactly once. A replay of the same Idempotency-Key answers 200 with replay=true and no secret; if the value was lost, rotate again with a new key.
Enrol a signing certificate and its SOL credentials as a DRAFT version POST POST
Uploads the four secrets a Peruvian issuer needs: the PKCS#12 certificate (base64), its password, and the SOL user and password of the SUNAT secondary user. All four together, because a certificate signs the XML and the SOL credentials authenticate sendBill: one without the other cannot submit anything. The upload is validated BEFORE it is stored — the PFX must open with the supplied password, the certificate subject RUC must be this company's RUC, the validity window must cover now, and the declared environment must be the one the company is enrolled for — and only then sealed. The new version is created in DRAFT and signs NOTHING until POST /api/v2/certificates/{id}/activation. The certificate and the passwords are never stored in plaintext, never logged and never returned; only the sealed envelopes reach storage, and only their digests reach the database. A repeated Idempotency-Key answers 200 with replay=true and the version the first call produced, without re-sealing anything; the same key with a different certificate is a 409.