Renew device certificate

POST

/api/v1/devices/{deviceId}/certificates/{certificateId}/renew

curl --request POST \
  --url http://localhost:3000/api/v1/devices/550e8400-e29b-41d4-a716-446655440000/certificates/550e8400-e29b-41d4-a716-446655440001/renew \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "validityDays": 365 }'

• Development
• Production

Extends the expiry of a device certificate. WFM-internal bookkeeping only; does not require the device to re-onboard.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

deviceId

required

string format: uuid

Example

550e8400-e29b-41d4-a716-446655440000

Device UUID

certificateId

required

string format: uuid

Example

550e8400-e29b-41d4-a716-446655440001

Certificate UUID

Request Body^required

Media typeapplication/json

object

validityDays

Number of days to extend the certificate validity from today

number

default: 365 >= 1 <= 3650

Example

365

Responses

200

Certificate renewed successfully

Media typeapplication/json

object

id

required

Unique certificate identifier (UUID)

string format: uuid

deviceId

required

Device ID this certificate belongs to

string format: uuid

fingerprint

required

SHA-256 fingerprint of the certificate

string

subject

required

Certificate subject (Distinguished Name)

string

issuer

required

Certificate issuer (Distinguished Name)

string

notBefore

required

Certificate validity start date

string format: date-time

notAfter

required

Certificate validity end date (expiration)

string format: date-time

revoked

required

Whether the certificate has been revoked

boolean

revokedAt

Date when the certificate was revoked

string format: date-time

revokeReason

Reason for certificate revocation

string

Allowed values: Key compromise CA compromise Affiliation changed Superseded Cessation of operation Certificate hold Other

createdAt

required

Timestamp when the certificate was issued

string format: date-time

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "deviceId": "550e8400-e29b-41d4-a716-446655440001",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "subject": "CN=edge-device-001,O=Margo WFM,OU=Devices",
  "issuer": "CN=Margo Root CA,O=Margo WFM,OU=Certificate Authority",
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2025-01-01T00:00:00Z",
  "revoked": false,
  "revokedAt": "2024-06-01T00:00:00Z",
  "revokeReason": "Key compromise",
  "createdAt": "2024-01-01T00:00:00Z"
}

400

Bad Request - Cannot renew a revoked certificate

401

Unauthorized - Invalid or missing authentication

403

Forbidden - Insufficient permissions (operator or admin)

404

Device or certificate not found