[API] Deploy certificates on Android hosts by marko-lisica · Pull Request #35156 · fleetdm/fleet

marko-lisica · 2025-11-04T16:15:27Z

Related to:

Deploy/delete certificates on Android hosts via UI/API #30876

Added a section for adding certificates in the REST API documentation.

sgress454 · 2025-11-11T19:43:55Z

+### Add certificate
+
+Add certificate to deploy to the all hosts on the team. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.
+
+`POST /api/v1/fleet/certificates`
+
+#### Parameters
+
+| Name     | Type    | In   | Description                                 |
+| -------- | ------- | ---- | ------------------------------------------- |
+| name   | string | body | **Required.** The name of the certificate. Name can be used as certificate alias to reference in configuration profiles. |
+| team      | string  | query | _Available in Fleet Premium_. The team ID to add profiles to. |
+| certificate_authority_id   | integer | body | **Required.** The certificate authority (CA) ID to issue certificate from. Currently, only custom SCEP CA is supported. To get ID use [List certificate authorities](#list-certificate-authorities-cas). |
+| subject_name       | string | body |**Required** The certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.".    |


This is an end-user endpoint, but the parent ticket is exclusively targeting GitOps. I think we need a /spec endpoint in the contributor API that we can use to upload multiple certificates at once, like the "apply labels" endpoint:

fleet/docs/Contributing/reference/api-for-contributors.md

Lines 2144 to 2183 in 86b80e2

### Apply labels

Adds the supplied labels to Fleet. Each label requires the `name`, and `label_membership_type` properties.

If the `label_membership_type` is set to `dynamic`, the `query` property must also be specified with the value set to a query in SQL syntax.

If the `label_membership_type` is set to `manual`, the `hosts` property must also be specified with the value set to a list of hostnames.

`POST /api/v1/fleet/spec/labels`

#### Parameters

| Name | Type | In | Description |

| ----- | ---- | ---- | ------------------------------------------------------------------------------------------------------------- |

| specs | list | path | A list of the label to apply. Each label requires the `name`, `query`, and `label_membership_type` properties |

#### Example

`POST /api/v1/fleet/spec/labels`

##### Request body

```json

{

"specs": [

{

"name": "Ubuntu",

"description": "Filters Ubuntu hosts",

"query": "SELECT 1 FROM os_version WHERE platform = 'ubuntu';",

"label_membership_type": "dynamic"

},

{

"name": "local_machine",

"description": "Includes only my local machine",

"label_membership_type": "manual",

"hosts": ["snacbook-pro.local"]

}

]

}

```

sgress454 · 2025-11-11T19:45:25Z

+### List certificates
+
+List certificate added to Fleet with [Add certificate](#add-certificate).
+
+`GET /api/v1/fleet/certificates`
+
+#### Parameters
+
+| Name      | Type    | In   | Description                                                    |
+| ----------| ------- | ---- | -------------------------------------------------------------- |
+| team      | string  | query | _Available in Fleet Premium_. The team ID to filter profiles. |
+| page      | integer | query | Page number of the results to fetch.                          |
+| per_page  | integer | query | Results per page.                                             |
+
+#### Example
+
+`GET /api/v1/fleet/certificates`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "certificates": [
+    {
+      "id": 1,
+      "name": "wifi-certificate",
+      "certificate_authority_id": "1",
+      "certificate_authority_name": "PRODUCTION_SCEP_SERVER",
+      "created_at": "2025-11-04T00:00:00Z",
+    },
+    {
+      "id": 2,
+      "name": "vpn-certificate",
+      "certificate_authority_id": "1",
+      "certificate_authority_name": "PRODUCTION_SCEP_SERVER",
+      "created_at": "2025-11-04T00:00:00Z",
+    }  
+  ],
+  "meta": {
+    "has_next_results": false,
+    "has_previous_results": false
+  }
+}
+```
+


Is this used anywhere in #35198? If not can we cut if for scope?

Actually we probably need something like this for GitOps, but more likely another /spec endpoint.

sgress454 · 2025-11-13T18:41:54Z

+  "created_at": "2025-11-04T00:00:00Z",
+  "id": 1,
+  "name": "wifi-certificate",
+  "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",


If host_uuid is included in the request, the $FLEET_VAR_* tokens should be replaced with actual values from the host.

ksykulev · 2025-11-19T17:18:31Z

Just to be specific, here are the ends points I made as in #35788
GET /api/latest/fleet/certificates
GET /api/latest/fleet/certificates/:id
POST /api/latest/fleet/spec/certificates
DELETE /api/latest/fleet/spec/certificates

rachaelshaw · 2025-11-26T19:07:17Z


+### Add certificate
+
+Add certificate to deploy to the all hosts on the team. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.


Suggested change

Add certificate to deploy to the all hosts on the team. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.

Add certificate to deploy to a host. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.

Add 'Add certificate' section to REST API docs

4db8579

Added a section for adding certificates in the REST API documentation.

marko-lisica temporarily deployed to Docker Hub November 4, 2025 16:15 — with GitHub Actions Inactive

added certificate endpoints and updated request_certificate endpoint

cf95751

marko-lisica temporarily deployed to Docker Hub November 4, 2025 16:29 — with GitHub Actions Inactive

marko-lisica mentioned this pull request Nov 4, 2025

Deploy/delete certificates on Android hosts via UI/API #30876

Closed

55 tasks

update

a033af7

marko-lisica temporarily deployed to Docker Hub November 4, 2025 18:02 — with GitHub Actions Inactive

update

31417e1

marko-lisica had a problem deploying to Docker Hub November 4, 2025 18:16 — with GitHub Actions Error

update

7f12007

marko-lisica temporarily deployed to Docker Hub November 4, 2025 18:17 — with GitHub Actions Inactive

marko-lisica commented Nov 5, 2025

View reviewed changes

Comment thread docs/REST API/rest-api.md Outdated

Apply suggestion from @marko-lisica

d939458

marko-lisica temporarily deployed to Docker Hub November 5, 2025 09:25 — with GitHub Actions Inactive

marko-lisica marked this pull request as ready for review November 5, 2025 10:26

marko-lisica requested a review from rachaelshaw as a code owner November 5, 2025 10:26

noahtalerman mentioned this pull request Nov 10, 2025

Deploy certificates on Android hosts via GitOps #35198

Closed

36 tasks

sgress454 reviewed Nov 11, 2025

View reviewed changes

sgress454 reviewed Nov 13, 2025

View reviewed changes

rachaelshaw added the ~api-or-yaml-design Used for pull requests (PRs) with proposed API and YAML changes label Nov 17, 2025

marko-lisica mentioned this pull request Nov 20, 2025

[YAML/API] Deploy certificates on Android hosts via GitOps #35270

Merged

rachaelshaw reviewed Nov 26, 2025

View reviewed changes

marko-lisica closed this Nov 27, 2025

ksykulev mentioned this pull request Dec 1, 2025

Support generate-gitops for android certificates #36457

Merged

2 tasks

Navigation Menu

Uh oh!

[API] Deploy certificates on Android hosts - #35156

[API] Deploy certificates on Android hosts#35156
marko-lisica wants to merge 6 commits into
docs-v4.78.0from
30876-api-docs-changes

marko-lisica commented Nov 4, 2025

Uh oh!

Uh oh!

sgress454 Nov 11, 2025

Uh oh!

sgress454 Nov 11, 2025

Uh oh!

sgress454 Nov 11, 2025

Uh oh!

sgress454 Nov 13, 2025

Uh oh!

ksykulev commented Nov 19, 2025 •

edited

Loading

Uh oh!

rachaelshaw Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	### Apply labels

	Adds the supplied labels to Fleet. Each label requires the `name`, and `label_membership_type` properties.

	If the `label_membership_type` is set to `dynamic`, the `query` property must also be specified with the value set to a query in SQL syntax.

	If the `label_membership_type` is set to `manual`, the `hosts` property must also be specified with the value set to a list of hostnames.

	`POST /api/v1/fleet/spec/labels`

	#### Parameters

	\| Name \| Type \| In \| Description \|
	\| ----- \| ---- \| ---- \| ------------------------------------------------------------------------------------------------------------- \|
	\| specs \| list \| path \| A list of the label to apply. Each label requires the `name`, `query`, and `label_membership_type` properties \|

	#### Example

	`POST /api/v1/fleet/spec/labels`

	##### Request body

	```json
	{
	"specs": [
	{
	"name": "Ubuntu",
	"description": "Filters Ubuntu hosts",
	"query": "SELECT 1 FROM os_version WHERE platform = 'ubuntu';",
	"label_membership_type": "dynamic"
	},
	{
	"name": "local_machine",
	"description": "Includes only my local machine",
	"label_membership_type": "manual",
	"hosts": ["snacbook-pro.local"]
	}
	]
	}
	```


		### Add certificate

		Add certificate to deploy to the all hosts on the team. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.

	Add certificate to deploy to the all hosts on the team. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.
	Add certificate to deploy to a host. Fleet currently supports adding certificates for Android that are issued from custom [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate authority.

Uh oh!

Conversation

marko-lisica commented Nov 4, 2025

Uh oh!

Uh oh!

sgress454 Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

sgress454 Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

sgress454 Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

sgress454 Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

ksykulev commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rachaelshaw Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ksykulev commented Nov 19, 2025 •

edited

Loading