Issue a connector certificate
⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/tunnels/{tunnel_id}/certificatesSign a certificate signing request for a connector on a tunnel in mtls mode. Your private key stays on your own host: you send the CSR, Syntic returns the signed certificate and its chain.
For how this fits into a full workflow, see MCP tunnels.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <key>: a private inference key (sk_live_...). See Authentication. |
syntic-beta | Yes, while in preview | mcp-tunnels-2026-12-01. Without it the call fails with 400 beta_required. See Versioning. |
Content-Type | Yes | application/json |
Idempotency-Key | No | Up to 255 characters. Retrying with the same key within 24 hours returns the first result instead of acting twice. See Idempotency. |
Path parameters
| Parameter | Type | Description |
|---|---|---|
tunnel_id | string | The tunnel id, starting with tnl_. |
Body parameters
| Parameter | Type | Required | Notes |
|---|---|---|---|
csr | string | Yes | PEM-encoded PKCS #10 request; RSA 2048+ or ECDSA P-256/P-384. |
Response
201 Created, Content-Type: application/json
{
"id": "tcert_01JCE9K1M3P5R7T9V1X3",
"type": "tunnel_certificate",
"tunnel_id": "tnl_01JCE4G6J8L0N2Q4S6U8",
"subject": "CN=erp-onprem-connector-1",
"serial": "4A:91:0C:7E:22:5B",
"fingerprint_sha256": "b2:7e:…:91",
"not_before": "2026-11-05T10:00:00Z",
"not_after": "2027-02-03T10:00:00Z",
"status": "active",
"certificate_pem": "-----BEGIN CERTIFICATE-----\nMIID…\n-----END CERTIFICATE-----",
"chain_pem": "-----BEGIN CERTIFICATE-----\nMIIF…\n-----END CERTIFICATE-----"
}| Field | Type | Description |
|---|---|---|
not_after | string | Certificates are valid for 90 days. Issue the next one before this date. |
status | string | active, expired or revoked. |
certificate_pem | string | Install next to the connector’s private key. |
chain_pem | string | The issuing chain. |
Examples
curl -sS "https://app.syntic.ai/v1/tunnels/tnl_01JCE4G6J8L0N2Q4S6U8/certificates" \
-H "Authorization: Bearer $SYNTIC_API_KEY" \
-H "syntic-beta: mcp-tunnels-2026-12-01" \
-H "Idempotency-Key: 8d6f0c1e-4b2a-4a57-9f0e-2f1d3c4b5a69" \
-H "Content-Type: application/json" \
-d '{
"csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIC…\n-----END CERTIFICATE REQUEST-----"
}'Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 400 | invalid_request_error | invalid_csr | Not a PEM CSR, or a weak key. |
| 400 | invalid_request_error | wrong_auth_mode | The tunnel uses token. |
| 404 | not_found_error | tunnel_not_found | No tunnel with this id in the key’s workspace. |
| 401 | authentication_error | invalid_api_key | The key is missing, unknown, revoked or expired. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?