GraphQL API
The Certificate Manager GraphQL API gives you programmatic access to your entire machine identity infrastructure through a single endpoint. Unlike REST, GraphQL lets you request exactly the data you need and traverse related objects in one call — no over-fetching, no chaining requests.
Endpoint: https://api.venafi.cloud/graphql
If you haven't worked with GraphQL before, start with the Introduction to GraphQL guide. It covers the core concepts — queries, mutations, types, and fields — and walks you through making your first request.
Quick Links
- Getting Started — Learn GraphQL concepts, authenticate, and make your first query
- Interactive Playground — Build and test queries in your browser
- REST API — Prefer REST? The Certificate Manager SaaS REST API is also available
What You Can Do
The API covers the full Certificate Manager feature set. Here are the key domains:
Certificates
Manage the complete certificate lifecycle — search, inspect, revoke, retire, recover, and delete certificates.
| Queries | Mutations |
|---|---|
| certificates — List all certificates with pagination | revokeCertificate — Revoke by fingerprint |
| certificate — Get a single certificate by fingerprint | retireCertificates — Retire one or more certificates |
| searchCertificates — Search with filters and aggregates | deleteCertificates — Delete retired certificates |
| certificateRequest — Get a certificate request | recoverCertificates — Recover retired certificates |
Cloud Providers & Keystores
Connect and manage cloud infrastructure — AWS, Azure, and GCP providers, keystores, and machine identities.
| Queries | Mutations |
|---|---|
| cloudProviders — List cloud providers | createCloudProvider — Add a cloud provider |
| cloudKeystores — List cloud keystores | createCloudKeystore — Add a cloud keystore |
| cloudMachineIdentities — List machine identities | provisionToCloudKeystore — Provision a certificate |
Code Signing
Manage code signing configuration, signing keys, and projects.
| Queries | Mutations |
|---|---|
| codeSignConfiguration — Get signing config | createCodeSignSigningKey — Create a signing key |
| codeSignSigningKeys — List signing keys | createCodeSignProject — Create a project |
| codeSignProjects — List projects | deleteCodeSignProject — Delete a project |
Compliance
Create and manage compliance policies, evaluate compliance, and view findings.
| Queries | Mutations |
|---|---|
| compliancePolicy — Get a policy | createCompliancePolicy — Create a policy |
| compliancePoliciesSummary — Policy summary | updateCompliancePolicy — Update a policy |
| searchCompliancePolicies — Search policies | evaluateCompliancePolicy — Run evaluation |
ACME Servers
Manage Automated Certificate Management Environment (ACME) servers for automated certificate issuance.
| Queries | Mutations |
|---|---|
| searchACMEServers — Search ACME servers | createACMEServer — Create an ACME server |
| updateACMEServer — Update an ACME server |
Users, Teams & Access
Manage users, teams, service accounts, and access controls.
| Queries | Mutations |
|---|---|
| searchUsers — Search users | updateUserAccountType — Change account type |
| teams — List teams | addTeamMembers — Add members to a team |
| serviceAccounts — List service accounts | removeTeamMembers — Remove members |
Notifications & Integrations
Configure notification routing, PagerDuty and Zoom integrations, and external email recipients.
| Queries | Mutations |
|---|---|
| integrations — List integrations | createPagerDutyIntegration — Create a PagerDuty integration |
| notificationRoutingConfiguration — Get routing config | createNotificationRouter — Create a router |
Authentication
All requests require an API key passed via the tppl-api-key HTTP header. See the Authentication guide for details on obtaining and using your key.
curl -X POST https://api.venafi.cloud/graphql \
-H "Content-Type: application/json" \
-H "tppl-api-key: YOUR_API_KEY" \
-d '{"query": "{ certificates(first: 5) { nodes { id name } } }"}'
Schema at a Glance
| Category | Count |
|---|---|
| Queries | 73 |
| Mutations | 75 |
| Object types | 288 |
| Input types | 206 |
| Enums | 92 |
| Unions | 16 |
| Custom scalars | 15 |
Browse the full Queries, Mutations, and Types reference in the sidebar, or start with the Getting Started guide and the Interactive Playground.