DigiCert

Account details via GET /account

Add custom field via POST /account/metadata. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

AuthKey details via GET /account/auth-key

Bulk add fields via POST /account/metadata/bulk. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Configure OIDC SSO via POST /sso/oidc/entity. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Contract details via GET /account/contract

Create AuthKey via POST /account/auth-key. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete AuthKey via DELETE /account/auth-key. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Account: Delete custom field via DELETE /account/metadata/{metadata_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete OIDC SSO configuration via DELETE /sso/oidc/entity. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit custom field via PUT /account/metadata/{metadata_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Guest access URL via GET /account/guest-access

Invite details via GET /account/subaccount/{invite_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes.

List AuthKeys via GET /account/auth-keys

List custom fields via GET /account/metadata

List invites via GET /account/subaccount/invite. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Move orders via POST /account/move-orders/{target_account_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

OIDC SSO configuration details via GET /sso/oidc/entity

Resend invite via PUT /account/subaccount/invite/{invite_id}/send. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

SAML entity details via GET /account/saml-entity

Send invite via POST /account/subaccount/invite. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update account emails via PUT /account. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update account notification settings via PUT /account/settings. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update invite status via PUT /account/subaccount/invite/{invite_id}/status. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update OIDC SSO configuration via PUT /sso/oidc/entity. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update SAML entity via PUT /account/saml-entity/{entity_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

ACME External Account Binding via POST /key/acme-eab. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

ACME External Account Binding new via POST /key/acme-eab/tlm. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Create key via POST /key/user/{user_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit key via PUT /key/{key_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Get key info via GET /key/{key_id}

List API access roles via GET /key/api-roles

List keys via GET /key

Update key status via PUT /key/{key_id}/status. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Check permission via GET /authorization/view_orders

Container permissions via GET /authorization/{permission}/container

List permissions via GET /authorization

Certificates: Add note via POST /certificate/{certificate_id}/note. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Archive certificate via PUT /certificate/{certificate_id}/archive. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Certificate chain via GET /certificate/{certificate_id}/chain. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download certificate via GET /certificate/{certificate_id}/download/platform. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download certificate by format via GET /certificate/{certificate_id}/download/format/{format_type}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download certificate by format (order_id) via GET /certificate/download/order/{order_id}/format/{format_type}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download certificate (order_id) via GET /certificate/download/order/{order_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Email certificate via PUT /certificate/{certificate_id}/sendemail. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List certificate notes via GET /certificate/{certificate_id}/note. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List intermediates via GET /certificate/intermediates

Restore certificate via PUT /certificate/{certificate_id}/unarchive. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Revoke certificate via PUT /certificate/{certificate_identifier}/revoke. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Activate container via PUT /container/{container_id}/activate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Container info via GET /container/{container_id}

Create container via POST /container/{container_id}/children. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Deactivate container via PUT /container/{container_id}/deactivate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit container via PUT /container/{container_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List child containers via GET /container/{container_id}/children

List container organizations via GET /container/{container_id}/order/organization

List container roles via GET /container/{container_id}/role

List containers via GET /container

List templates via GET /container/{container_id}/template

Parent container info via GET /container/{container_id}/parent

Product limits via GET /container/{container_id}/product-limits

Template info via GET /container/{container_id}/template/{template_id}

Update allowed domains via PUT /container/{container_id}/allowed-domain-names. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update organization assignments via PUT /container/{container_id}/organization-assignments. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update renewal notification recipients via PUT /container/{container_id}/settings/additional_renewal_emails. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update user assignments via PUT /container/{container_id}/user-assignments. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Allowlist issuing certificate authority via PUT /ctmonitor/issuer-brand-settings. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Disable CT log monitoring via PUT /ctmonitor/{order_id}/disable. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download certificate (serial number) via GET /ctmonitor/{order_id}/ct-cert/{serial_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Enable CT log monitoring via PUT /ctmonitor/{order_id}/enable. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get allowlisted issuing CA brand details via GET /ctmonitor/issuer-brand-settings. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get CT log details for a certificate via GET /ctmonitor/{order_id}/cert-details/{certificate_serial_number}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get CT log monitoring status via GET /ctmonitor/{order_id}/status. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get CT logs (order ID) via GET /ctmonitor/{order_id}/details. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Activate domain via PUT /domain/{domain_id}/activate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Activate domain locking via PUT /domain/{domain_id}/activate-domain-locking. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Add domain via POST /domain. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Change DCV method via PUT /domain/{domain_id}/dcv/method. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Check CAA (domain lock) via PUT /domain/{domain_id}/caa. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Deactivate domain via PUT /domain/{domain_id}/deactivate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Deactivate domain locking via PUT /domain/{domain_id}/deactivate-domain-locking. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete domain via DELETE /domain/{domain_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Domain emails via GET /domain/{domain_id}/dcv/emails

Domain info via GET /domain/{domain_id}

Expiring domains count via GET /domain/expiration-count

List DCV methods via GET /domain/dcv/method

List domains via GET /domain. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

OV/EV SSL: Check DCV via PUT /domain/{domain_id}/dcv/validate-token. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

OV/EV SSL: Generate DCV token via POST /domain/{domain_id}/dcv/token. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Resend DCV email via PUT /domain/{domain_id}/dcv/emails. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Domains: Submit for validation via POST /domain/{domain_id}/validation. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Domains: Validation details via GET /domain/{domain_id}/validation

Domains: Validation types via GET /domain/validation-type

List balance history via GET /finance/balance-history. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List purchase history via GET /finance/purchase-history. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List replacement benefits via POST /competitive-replacement/certificates. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Price estimate via POST /finance/order-pricing. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Receipt info via GET /finance/receipt/{receipt_id}

Transfer funds via POST /finance/transfer. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

View balance via GET /finance/balance

Voucher price estimate via POST /finance/voucher-pricing. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Add IP restriction via POST /container/{container_id}/ip/rules. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete IP restriction via DELETE /container/{container_id}/ip/rule/{rule_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List IP restrictions via GET /container/{container_id}/ip/rules

DigiCert order ID via GET /oem-migration/{legacy_order_id}/order-id. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Orders: Add note via POST /order/certificate/{order_id}/note. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Additional emails via PUT /order/certificate/{order_id}/additional-emails. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Change CT status via PUT /order/certificate/{order_id}/ct-status. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Change order container via PUT /order/certificate/{order_id}/move-to-container/{container_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Orders: Delete custom field via DELETE /order/certificate/{order_id}/custom-field/{metadata_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Delete note via DELETE /order/certificate/{order_id}/note/{note_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Delete order via DELETE /order/certificate/{order_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Delete renewal message via DELETE /order/certificate/{order_id}/custom-renewal-message. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Duplicate certificate via POST /order/certificate/{order_id}/duplicate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

DV SSL: Change DCV method via PUT /order/certificate/{order_id}/dcv-method. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

DV SSL: Check DCV via PUT /order/certificate/{order_id}/check-dcv. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

DV SSL: Generate DCV token via PUT /order/certificate/{order_id}/dcv-random-value. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

DV SSL: Resend emails via PUT /order/certificate/{order_id}/resend-emails. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Edit custom field value via POST /order/certificate/{order_id}/custom-field. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Edit domains on a pending order or reissue via PUT /order/certificate/{order_id}/dns-names. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Edit guest access (order) via PUT /order/certificate/{order_id}/guest-access. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Edit note via PUT /order/certificate/{order_id}/note/{note_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Email site seal via POST /order/certificate/{order_id}/site-seal/email-seal. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Email validation status via GET /order/certificate/{order_id}/email-validation. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get orders by alternative order ID via GET /order/alternate/{alternative_order_id}. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get VMC or CMC logo via GET /order/certificate/{order_id}/vmc/logo. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List duplicates via GET /order/certificate/{order_id}/duplicate. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List order notes via GET /order/certificate/{order_id}/note. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List orders via GET /order/certificate. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List reissues via GET /order/certificate/{order_id}/reissue. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Basic EV via POST /order/certificate/ssl_ev_basic. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Basic OV via POST /order/certificate/ssl_basic. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order client certificate via POST /order/certificate/{client_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order code signing certificate via POST /order/certificate/{code_signing_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Common Mark Certificate (CMC) via POST /order/certificate/mark_certificate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order document signing certificate via POST /order/certificate/{document_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Document Signing for Employee via POST /order/certificate/ds_org_individual. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Document Signing for Individual via POST /order/certificate/ds_individual. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Document Signing for Organization via POST /order/certificate/ds_org. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order DV SSL via POST /order/certificate/{dv_ssl_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order GeoTrust DV SSL via POST /order/certificate/ssl_dv_geotrust_flex. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order info via GET /order/certificate/{order_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Multi-year Plan via POST /order/certificate/ssl_ev_basic. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order OV/EV SSL via POST /order/certificate/{ssl_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Private SSL via POST /order/certificate/{private_ssl_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order secure email certificate via POST /order/certificate/secure_email_mailbox. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Secure Site EV via POST /order/certificate/ssl_ev_securesite_flex. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Secure Site OV via POST /order/certificate/ssl_securesite_flex. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Secure Site Pro EV SSL via POST /order/certificate/ssl_ev_securesite_pro. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Secure Site Pro SSL via POST /order/certificate/ssl_securesite_pro. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Secure Site SSL via POST /order/certificate/{ssl_certificate_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order SSL (type_hint) via POST /order/certificate/ssl. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order Verified Mark Certificate (VMC) via POST /order/certificate/vmc_basic. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order X9 PKI for TLS via POST /order/certificate/x9_pki. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Reissue certificate via POST /order/certificate/{order_id}/reissue. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Resend order approval email via PUT /order/certificate/{order_id}/order-approval/resend-emails. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Revoke order certificates via PUT /order/certificate/{order_id}/revoke. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Site seal settings via GET /order/certificate/{order_id}/site-seal. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Status change list via GET /order/certificate/status-changes. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>].

Update auto-reissue settings via PUT /order/certificate/{order_id}/auto-reissue. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update CSR via POST /order/certificate/{order_id}/csr. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update order contacts via PUT /order/certificate/{order_id}/contact. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update order status via PUT /order/certificate/{order_id}/status. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update renewal message via PUT /order/certificate/{order_id}/custom-renewal-message. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update renewal notification settings via PUT /order/certificate/{order_id}/renewal-emails/{status}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update site seal settings via PUT /order/certificate/{order_id}/site-seal. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Update VMC or CMC orders via PUT /order/certificate/{order_id}/vmc. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Upload site seal logo via POST /order/certificate/{order_id}/site-seal/logo. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Upload VMC or CMC logo (encoded) via POST /order/certificate/{order_id}/vmc/encoded-logo. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Upload VMC or CMC logo (SVG) via POST /order/certificate/{order_id}/vmc/logo. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Order validation status via GET /order/certificate/{order_id}/validation. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

View KeyLocker signatures via GET /order/certificate/{order_id}/signature-unit. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

View note via GET /order/certificate/{order_id}/note/{note_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Activate organization via PUT /organization/{organization_id}/activate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Create organization via POST /organization. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Deactivate organization via PUT /organization/{organization_id}/deactivate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete organization via DELETE /organization/{organization_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List approvers via GET /organization/potential-approvers

List organizations via GET /organization. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Organization and technical contact info via GET /organization/{organization_id}/contact

Organization info via GET /organization/{organization_id}

Recent organizations via GET /organization/recent

Organizations: Submit for validation via POST /organization/{organization_id}/validation. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update organization and technical contact via PUT /organization/{organization_id}/contact. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Organizations: Validation details via GET /organization/{organization_id}/validation

Organizations: Validation types via GET /organization/validation-type

Certificate format map via GET /product/platform-certformat-mapping

Pricing list via GET /product/pricing

Product info via GET /product/{name_id}

Product list via GET /product

Expiring orders and certificates via GET /report/order/expiring

Order report via GET /report/order. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Request summary via GET /report/request

List requests via GET /request. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Request info via GET /request/{request_id}

Update CSR for a pending reissue request via GET /request/{request_id}/csr

Update request status via GET /request/{request_id}/status

Add or remove funds via POST /account/subaccount/{subaccount_id}/balance. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Balance details via GET /account/subaccount/{subaccount_id}/balance

Cancel unit order via PUT /units/order/{order_id}/cancel. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Create subaccount via POST /account. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Create unit order via POST /units/order. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit subaccount via PUT /account/subaccount/{subaccount_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List subaccount domains via GET /account/subaccount/{subaccount_id}/domain. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List subaccount orders via GET /account/subaccount/order. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List subaccount organizations via GET /account/subaccount/{subaccount_id}/organization. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List subaccount product limits via GET /account/subaccount/{subaccount_id}/product-limits

List subaccount products via GET /account/subaccount/{subaccount_id}/products

List subaccounts via GET /account/subaccount. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List unit orders via GET /units/order. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Set subaccount products via PUT /account/subaccount/{subaccount_id}/products. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Subaccount info via GET /account/subaccount/{subaccount_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes.

Subaccount order info via GET /account/subaccount/order/{order_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Subaccount report via GET /account/subaccount/{subaccount_id}/report

Unit order details via GET /units/order/{order_id}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Add service user via POST /user. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Add user via POST /user. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Change user role via PUT /user/{user_id}/role. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Delete user via DELETE /user/{user_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit service user via PUT /user/{user_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Edit user via PUT /user/{user_id}. This endpoint's URL is shared with another operation and DigiCert tells them apart by the REQUEST BODY, not the address; send the body this tool's schema describes. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List service users via GET /user/api-only. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List users via GET /user. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

Resend create user email via GET /user/{user_id}/resend-create-email

Update container assignments via PUT /user/{user_id}/container-assignments. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

User info via GET /user/{user_id}

Username availability via GET /user/availability/{user_name}

Validate VMC or CMC logo format (encoded) via PUT /util/validate-vmc-encoded-logo. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Validate VMC or CMC logo format (SVG) via PUT /util/validate-vmc-logo. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Cancel voucher code via PUT /voucher/{id}/cancel. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Create voucher order via POST /voucher. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Get voucher order details via GET /voucher/{id}

List all voucher orders via GET /voucher. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.

List codes for voucher order via GET /voucher/{voucher_order_id}/download. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

List used voucher codes via GET /voucher/download/used-codes. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>].

Disable scanning via DELETE /vulnerability-assessment/{order_id}/scan. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Download results via GET /vulnerability-assessment/{order_id}/report/{domain_name}. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Enable scanning via PUT /vulnerability-assessment/{order_id}/scan. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get enabled status via GET /vulnerability-assessment/{order_id}/status. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get notification settings via GET /vulnerability-assessment/{order_id}/notification-settings. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Get scan details via GET /vulnerability-assessment/{order_id}/details. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Rescan domain via PUT /vulnerability-assessment/{order_id}/rescan/{domain}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission. Entitlement-gated: it addresses a purchased certificate, an order, or a scan, so a CertCentral account that has never bought a certificate (or whose organization and domain are not yet validated) cannot exercise it.

Activate webhook via PUT /webhook/{webhook_id}/activate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Create webhook via POST /webhook. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Deactivate webhook via PUT /webhook/{webhook_id}/deactivate. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

List webhooks via GET /webhook

Send challenge token via PUT /webhook/{webhook_id}/send-challenge. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Send test event via POST /webhook/test-endpoint. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Update webhook endpoint via PUT /webhook/{webhook_id}. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Verify challenge token via PUT /webhook/{webhook_id}/check-challenge. A key minted with DigiCert's 'View Only' restriction is refused on this call, and the refusal reads like a bad key rather than a missing permission.

Webhook event logs via GET /webhook/{webhook_id}/event-logs. Every `filters_<property>` argument goes on the wire as the bracketed key DigiCert reads, filters[<property>]. Paged with `offset` (0-based) and `limit`; DigiCert's default and maximum for `limit` differ per endpoint and are stated on that parameter.