Overview

CertPilot's control plane exposes 121 endpoints. All but one are under /api/v1 and speak JSON.

https://certpilot.example.com/api/v1

The three callers

The API is used by three quite different kinds of client, and they authenticate in three different ways. This is deliberate: a credential sitting on a screen in a corridor must not be able to do what an operator can, and a host agent must not be able to read the estate.

Caller	Credential	What it can do
A person, or a script acting for one	Authorization: Bearer <jwt>	Everything their role permits
An unattended wall display	X-Display-Token: cpd_…	Read-only, GET only, and never the sensitive paths
A host agent	A signature over the request body	Only the seven agent routes, and nothing else

Start with Authentication, then Roles and permissions.

What is not here

Two things worth knowing before you plan against this API.

There is no revocation endpoint. Both gateways implement revocation, but the core exposes no route for it. DELETE /certificates/:id deletes CertPilot's record and leaves the certificate live at the CA. This is a known gap, not an oversight in this documentation.

There is no rate limiting. The API does not throttle callers. If you are exposing it beyond a trusted network, put something in front of it.

Health

GET /healthz

The only unauthenticated endpoint, and deliberately uninformative — it reports that the process is up and says nothing about the database, the gateways, or anything else an unauthenticated caller has no business learning.

{ "status": "ok", "service": "certpilot-core" }