Repository navigation
Cert Manager API
Accessor: server.certs
Reference: https://docs.tak.gov/api/takserver#tag/cert-manager-admin-api
Admin-side certificate administration: list issued certificates (all, active, expired, replaced, revoked), inspect single records, download PEM copies and revoke or delete certificates. Requires an administrator certificate.
The user-side cert-manager-api tag is deliberately not wrapped. All
four of its operations answer HTTP 403 even for an admin certificate on
the reference server (5.7-RELEASE-43-HEAD, verified 2026-08-25):
| Endpoint | Status |
|---|---|
GET /Marti/api/tls/config |
403 |
GET /Marti/api/tls/makeClientKeyStore |
403 |
POST /Marti/api/tls/signClient |
403 |
POST /Marti/api/tls/signClient/v2 |
403 |
Additionally GET /Marti/api/certadmin/cert/download/{ids} answers HTTP
500 even with valid certificate hashes (use
download_certificate() for single certificates - that one works).
Live tests assert these failures, so if a future server upgrade fixes
them, the tests will fail and we will notice. If you need enrollment on a
server where these work, the TAK client enrollment protocol itself is
well documented in the wild: generate a key pair locally, strip the PEM
headers from the CSR, POST it as octet-stream to
signClient/v2?clientUid=...&version=... and parse the XML response.
async def get_certificates(username: str | None = None) -> tuple[int, Any]Returns all certificates known to the server. Each record carries hash
(the identifier used by every other operation), subjectDn, userDn,
clientUid, serialNumber, issuanceDate, expirationDate,
revocationDate and the raw certificate.
| Parameter | Type | Description |
|---|---|---|
username |
str or None
|
Optional filter by username |
Example:
status, certs = await srv.certs.get_certificates()
for c in certs:
print(c["hash"], c["subjectDn"], c["expirationDate"])async def get_active_certificates() -> tuple[int, Any]
async def get_expired_certificates() -> tuple[int, Any]
async def get_replaced_certificates() -> tuple[int, Any]
async def get_revoked_certificates() -> tuple[int, Any]Each returns (status_code, data) with the filtered certificate list.
Handy for housekeeping scripts, e.g. finding expired certificates to
clean up.
async def get_certificate(hash_id: str) -> tuple[int, Any]Fetches one certificate record by its hash id.
async def download_certificate(hash_id: str) -> tuple[int, Any]Downloads the certificate as PEM text (starts with
-----BEGIN CERTIFICATE-----). Note this is the singular endpoint -
the plural /cert/download/{ids} variant is broken server-side and not
wrapped.
async def delete_certificate(hash_id: str) -> tuple[int, Any]
async def delete_certificates(ids: list[int] | list[str] | str) -> tuple[int, Any]Deletes certificate records from the server's management view. As usual with TAK: prefer revocation over deletion unless you really mean delete.
Warning
The singular delete_certificate() is a silent no-op on the
reference server (5.7-RELEASE-43-HEAD): it answers HTTP 200 but the
record stays (verified live 2026-08-25). Use the batch endpoint
delete_certificates([id]) - that one actually removes records.
Caution
Identifier semantics: the {ids} path parameter of
delete_certificates() and revoke_certificates() takes the
server-side numeric certificate ids (the id field of
get_certificates() entries) - not the hashes. Passing hashes
results in an HTML error page with HTTP 500. Hashes identify records
in all GET operations; numeric ids are required for mutations.
async def revoke_certificates(ids: list[int] | list[str] | str) -> tuple[int, Any]Revokes certificates given as a list of numeric certificate ids (or a
single id). Revoked certificates show up in get_revoked_certificates()
and carry a revocationDate.
Example - revoke and remove the two oldest week-old certificates of a user:
status, certs = await srv.certs.get_certificates(username="someone")
old = [c for c in certs if c["id"] in (71, 72)]
await srv.certs.revoke_certificates([c["id"] for c in old])
await srv.certs.delete_certificates([c["id"] for c in old])