Docs / API reference

Certificates API

Fetch an issued certificate, and the public endpoints anyone can use to verify one independently. See the certificates guide for what a certificate actually claims and why the chain matters.

Read the certificates guide
GET/certificate/:userIdBearer token

Returns the certificate already issued for a user's completed deletion. Re-fetched, not re-signed — repeated calls return byte-identical output.

NameInTypeRequiredDescription
userIdpathstringYesThe user whose deletion certificate you're retrieving.
GET/public-keyNone — public

Returns the current signing key as a PEM-encoded public key.

GET/.well-known/jwks.jsonNone — public

Returns the current set of verification keys in standard JWKS format — covers every currently-valid key version, keyed by kid.

GET/certificate-chain/by-hash/:hashNone — public

Returns the certificate whose own hash matches :hash, for walking the chain backward toward the genesis certificate.

NameInTypeRequiredDescription
hashpathstringYesThe sha256 hash of the certificate to look up.
  • 404 if no certificate with that hash was ever issued.
Keep reading

The hash chain, what a certificate claims, and how verification actually works.

Certificates →