> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Read ## OpenAPI ````yaml GET /api/v1/cert-manager/ca/internal/{id} openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/cert-manager/ca/internal/{id}: get: tags: - PKI Certificate Authorities operationId: getInternalCertificateAuthorityV1 parameters: - schema: type: string in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: enableDirectIssuance: type: boolean default: true name: type: string id: type: string format: uuid status: type: string enum: - active - disabled - pending-certificate type: type: string enum: - internal configuration: type: object properties: type: type: string enum: - root - intermediate description: The type of CA to create. friendlyName: type: string maxLength: 255 description: A friendly name for the CA. commonName: type: string maxLength: 255 default: '' description: The common name (CN) for the CA. organization: type: string maxLength: 255 default: '' description: The organization (O) for the CA. ou: type: string maxLength: 255 default: '' description: The organization unit (OU) for the CA. country: type: string maxLength: 255 default: '' description: The country name (C) for the CA. province: type: string maxLength: 255 default: '' description: The state of province name for the CA. locality: type: string maxLength: 255 default: '' description: The locality name for the CA. notBefore: type: string description: >- The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format. notAfter: type: string description: >- The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format. maxPathLength: type: number minimum: -1 nullable: true description: >- The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain. keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s description: >- The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA. keySource: type: string enum: - infisical - hsm - aws-kms description: >- Where the CA's signing key is generated and stored. 'infisical' keeps the key in Infisical's KMS; 'hsm' generates and stores the key in the HSM reached through the specified HSM Connector; 'aws-kms' generates the key in AWS KMS through the specified AWS connection, and every signature is made by AWS KMS. hsmConnectorId: type: string format: uuid description: >- The ID of the HSM Connector to generate and store the CA's signing key in. Required when keySource is 'hsm'. hsmKeyLabel: type: string description: >- Deprecated: use externalKeyId, which holds the same key label for HSM-backed CAs. The label of the CA's signing key on the HSM. deprecated: true appConnectionId: type: string format: uuid description: >- The ID of the AWS connection used to create the CA's signing key in AWS KMS and to sign with it. Required when keySource is 'aws-kms'. appConnectionName: type: string description: >- The name of the AWS connection the CA's signing key is reached through. Not user-supplied. hsmConnectorName: type: string description: >- The name of the HSM Connector the CA's signing key is reached through. Not user-supplied. region: type: string enum: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - us-gov-east-1 - us-gov-west-1 - af-south-1 - ap-east-1 - ap-south-1 - ap-south-2 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-southeast-3 - ap-southeast-4 - ca-central-1 - eu-central-1 - eu-central-2 - eu-west-1 - eu-west-2 - eu-west-3 - eu-south-1 - eu-south-2 - eu-north-1 - me-south-1 - me-central-1 - sa-east-1 description: >- The AWS region the CA's signing key is created in. Required when keySource is 'aws-kms', and returned when reading the CA. externalKeyId: type: string description: >- The identifier of the CA's signing key in its key source: the key ARN for AWS KMS, or the key label for HSM. Not user-supplied: the key is created when the CA is created. dn: type: string maxLength: 255 nullable: true parentCaId: type: string format: uuid nullable: true serialNumber: type: string nullable: true activeCaCertId: type: string format: uuid nullable: true crlDistributionPointUrls: type: array items: type: string maxLength: 2048 format: uri maxItems: 4 description: >- Additional CRL Distribution Point URLs (HTTP/HTTPS) embedded in every certificate issued by this CA. Up to 4 URLs; the Infisical-managed CRL endpoint is included by default unless disabled. disableManagedCrlDistributionPointUrl: type: boolean default: false description: >- When set to true, the Infisical-managed CRL endpoint URL will not be embedded in certificates issued by this CA. Only custom CRL Distribution Point URLs (if any) will be included. isOcspEnabled: type: boolean description: >- When set to true, certificates issued by this CA carry the Infisical-managed OCSP responder URL in their Authority Information Access extension, and that responder answers revocation status queries for them. Applies to certificates issued after it is enabled. required: - type - keyAlgorithm additionalProperties: false required: - name - id - status - type - configuration additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.