API Developer Guidance
This article describes process flows to guide developers in building applications that consume the Atlas APIs.
Issuing Certificates
Follow the below sequence of API calls to issue a certificate, starting with logging into Atlas, then obtaining the certificate, and then confirming the certificate chain of trust.
- POST /login
Using your Atlas API credentials and mTLS certificate, login to get the JWS token for subsequent actions. - GET /validationpolicy
Fetch the list of required and optional fields that are needed to obtain a certificate. - POST /certificates
Using the results of the validation policy, supply the necessary fields to request a new certificate. - GET /certificates/{certificate}
Fetch your issued certificate. If it has been issued, it will be returned; otherwise a status or error will be provided to indicate next steps. - GET /trustchain
Fetch the trust chain for your issued certificate, which will be needed for final configuration and use by the intended application. Without the full chain, the issued certificate may not be trusted by relying parties. It is important to do this for every issuance because issuing CA(s) may change from time to time and having the correct certificate chain prevents service interruption.
Domain Management
If the Atlas product you are issuing certificates from requires domain validation (e.g. SSL/TLS), you will need to follow the below sequence of API calls to validate the domain(s) before issuing certificates. If you attempt to request a certificate prior to domain validation, you will receive an error.
- POST /claims/domains/{domain}
Generate a new ‘claim’ to prove ownership of a domain and receive a claimID for subsequent actions. - POST /claims/domains/{claimID}/<validationmethod>
Using the claimID, select one of three domain validation methods to verify ownership of the domain. Regardless of validation method, an out of band action is needed to update the applicable HTTP or DNS location, or review and process an email. - GET /claims/domains
Fetch the status of your domain claim. You can request certificates once the domain has been validated. - POST /claims/domains/{claimID}/reassert
Renew a domain prior to its expiration using the original claimID. This API will issue you a new token for domain verification.