> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getsales.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get SSL certificate

> One certificate by sid: status, issuer, validity, the last_error token, and the HTTP-01 challenge while an attempt is in flight. Poll it after issue or renew until challenge is null.

Contract:
- MCP tool `get_ssl_certificate`, registry package `mcp.id/ssl_certificates`, mount `id.partner`.
- Operation `get`, response envelope `get`.
- Flags: read only.



## OpenAPI

````yaml /api-reference/id/openapi.yaml get /api/ssl-certificates/{sid}
openapi: 3.0.3
info:
  title: 'GetSales public contract: gs.service.id'
  description: >-
    The identity service: the signed-in account, its workspaces and their
    members, the sessions and the gtm-api workspaces a team reaches; the API
    keys, OAuth clients and standing consents; the Paddle billing of the pool a
    buyer holds (catalog, subscriptions, transactions, payment methods); the
    partner's surface (white label brands, their clients, the shares handed to
    workspaces, the certificates behind the brand domains); and the notification
    feed.


    GENERATED. This document is projected from the Zod MCP tool registry in
    `product/mcp/gs.mcp` (one tool per public endpoint, 1:1). Do not edit it by
    hand; edit the tool definition and regenerate with `pnpm openapi:public`.


    Surface: the public `/api` contract of `gs.service.id`, 88 operations. This
    is the only OpenAPI document the platform publishes. Internal (`/internal`)
    and health endpoints are deliberately absent: they are not part of any
    contract, they can change without notice, and the service source is their
    only description.


    Conventions:

    - Auth is a bearer JWT, optionally narrowed by the `Team-SID` header.

    - Every success body is an MCP envelope: `success: true` plus one typed
    `operation` shape (`search`, `get`, `create`, `update`, `delete`, `metrics`,
    `group_by`, `action`), and a `meta` block with `trace_id` for support.

    - Every failure is the same `McpError` envelope with a code from a fixed
    16-code taxonomy, so a client maps errors once.

    - Lists page with `page_size` (0 to 500, default 50) plus an opaque forward
    `cursor`; `page_size: 0` returns counts only.

    - On `GET` and `DELETE`, object-valued query parameters (`filter`, `sort`)
    travel as JSON text and array-valued ones repeat as `name[]=value`.

    - The MCP-only `_meta` field (usage analytics) never reaches the backend and
    is not part of this contract.
  version: '1.0'
  contact:
    name: GetSales
    url: https://getsales.io
    email: support@getsales.io
  license:
    name: Proprietary
    url: https://getsales.io/terms
servers:
  - url: https://beta.getsales.io/id/v1
    description: >-
      Production (the gateway path on the beta ring; the origin is provisioned
      per DEPLOY_MAP.md)
security:
  - BearerJwt: []
    TeamSid: []
tags:
  - name: api_keys
    description: Registry package `mcp.id/api_keys`, served on MCP mount `id.access`.
  - name: billing_payment_methods
    description: >-
      Registry package `mcp.id/billing_payment_methods`, served on MCP mount
      `id.billing`.
  - name: billing_products
    description: >-
      Registry package `mcp.id/billing_products`, served on MCP mount
      `id.billing`.
  - name: billing_subscriptions
    description: >-
      Registry package `mcp.id/billing_subscriptions`, served on MCP mount
      `id.billing`.
  - name: billing_transactions
    description: >-
      Registry package `mcp.id/billing_transactions`, served on MCP mount
      `id.billing`.
  - name: credit_lots
    description: Registry package `mcp.id/credit_lots`, served on MCP mount `id.billing`.
  - name: credit_transactions
    description: >-
      Registry package `mcp.id/credit_transactions`, served on MCP mount
      `id.billing`.
  - name: gtm_connections
    description: >-
      Registry package `mcp.id/gtm_connections`, served on MCP mount
      `id.identity`.
  - name: notifications
    description: >-
      Registry package `mcp.id/notifications`, served on MCP mount
      `id.notifications`.
  - name: oauth_authorizations
    description: >-
      Registry package `mcp.id/oauth_authorizations`, served on MCP mount
      `id.access`.
  - name: oauth_clients
    description: Registry package `mcp.id/oauth_clients`, served on MCP mount `id.access`.
  - name: sessions
    description: Registry package `mcp.id/sessions`, served on MCP mount `id.identity`.
  - name: ssl_certificates
    description: >-
      Registry package `mcp.id/ssl_certificates`, served on MCP mount
      `id.partner`.
  - name: subscription_allocations
    description: >-
      Registry package `mcp.id/subscription_allocations`, served on MCP mount
      `id.partner`.
  - name: team_members
    description: Registry package `mcp.id/team_members`, served on MCP mount `id.identity`.
  - name: teams
    description: Registry package `mcp.id/teams`, served on MCP mount `id.identity`.
  - name: user_profiles
    description: >-
      Registry package `mcp.id/user_profiles`, served on MCP mount
      `id.identity`.
  - name: users
    description: Registry package `mcp.id/users`, served on MCP mount `id.identity`.
  - name: whitelabel_clients
    description: >-
      Registry package `mcp.id/whitelabel_clients`, served on MCP mount
      `id.partner`.
  - name: whitelabels
    description: Registry package `mcp.id/whitelabels`, served on MCP mount `id.partner`.
  - name: workspace_profiles
    description: >-
      Registry package `mcp.id/workspace_profiles`, served on MCP mount
      `id.identity`.
paths:
  /api/ssl-certificates/{sid}:
    get:
      tags:
        - ssl_certificates
      summary: Get SSL certificate
      description: >-
        One certificate by sid: status, issuer, validity, the last_error token,
        and the HTTP-01 challenge while an attempt is in flight. Poll it after
        issue or renew until challenge is null.


        Contract:

        - MCP tool `get_ssl_certificate`, registry package
        `mcp.id/ssl_certificates`, mount `id.partner`.

        - Operation `get`, response envelope `get`.

        - Flags: read only.
      operationId: get_ssl_certificate
      parameters:
        - name: sid
          in: path
          required: true
          description: SSL certificate sid (id_sc_...).
          schema:
            type: string
            minLength: 18
            maxLength: 18
            pattern: ^id_sc_
            description: SSL certificate sid (id_sc_...).
      responses:
        '200':
          description: '`get` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetSslCertificateResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
components:
  schemas:
    GetSslCertificateResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
            - true
        operation:
          type: string
          enum:
            - get
        item:
          type: object
          properties:
            sid:
              type: string
              description: Certificate sid (id_sc_...).
            team_sid:
              type: string
              description: The reseller team (ts_tm_...).
            domain:
              type: string
              description: The brand's host, lowercase FQDN.
            status:
              type: string
              enum:
                - pending
                - challenge
                - active
                - failed
                - expired
              description: >-
                pending = registered; challenge = a first issuance in flight;
                active = serving; failed; expired. A renewal of an active row
                keeps active.
            challenge:
              type: object
              nullable: true
              properties:
                type:
                  type: string
                  enum:
                    - http-01
                  description: The one challenge type served.
                token:
                  type: string
                  description: The ACME token the platform serves at well_known_path.
                key_authorization:
                  type: string
                  description: The key authorization the CA expects there.
                well_known_path:
                  type: string
                  description: The path the CA fetches on the domain.
                cname_target:
                  type: string
                  description: The platform host the domain's CNAME must point at.
                expires_at:
                  type: string
                  nullable: true
                  description: ISO 8601 UTC when the authorization lapses at the CA.
              required:
                - type
                - token
                - key_authorization
                - well_known_path
                - cname_target
                - expires_at
              description: >-
                The attempt in flight (first issuance or renewal); null when
                none.
            issuer:
              type: string
              nullable: true
              description: The CA that issued the serving certificate; null until one did.
            issued_at:
              type: string
              nullable: true
              description: ISO 8601 UTC; null until issued.
            expires_at:
              type: string
              nullable: true
              description: >-
                ISO 8601 UTC the serving certificate lapses; renewed 30 days
                ahead.
            last_error:
              type: string
              nullable: true
              description: >-
                Why the last attempt failed, as a token: domain_not_pointed (fix
                the CNAME), domain_validation_failed (CAA or other DNS),
                issuance_unavailable (our side or the CA, contact support). null
                = none.
            created_by:
              type: object
              properties:
                actor_type:
                  type: string
                  enum:
                    - user
                    - support
                    - api_key
                    - system
                    - agent
                actor_sid:
                  type: string
                  nullable: true
                team_sid:
                  type: string
                actor_name:
                  type: string
                  nullable: true
                  description: >-
                    The OAuth client that acted ("Claude", "n8n"); null for a
                    user, an API key or a system job.
                oauth_client_sid:
                  type: string
                  nullable: true
                  description: The acting OAuth client (id_oc_*); null off the OAuth path.
                reason:
                  type: string
                  nullable: true
                  description: >-
                    Why a system actor wrote the row (snapshot_capture_job,
                    ...); null otherwise.
                permissions:
                  type: object
                  additionalProperties: {}
                  description: >-
                    Internal audit context: the grant set the actor held at
                    write time. Not a contract.
                cluster_id:
                  type: integer
                  nullable: true
                  description: 'Internal audit context: the cluster that served the write.'
                trace_id:
                  type: string
                  nullable: true
                  description: >-
                    Internal audit context: the trace id of the request that
                    wrote the row.
              required:
                - actor_type
                - actor_sid
                - team_sid
                - permissions
              description: Who registered the domain (the brand's activation).
            created_at:
              type: string
              description: ISO 8601 UTC.
            updated_at:
              type: string
              description: ISO 8601 UTC.
            deleted_at:
              type: string
              nullable: true
              description: ISO 8601 UTC; null = live.
          required:
            - sid
            - team_sid
            - domain
            - status
            - challenge
            - issuer
            - issued_at
            - expires_at
            - last_error
            - created_by
            - created_at
            - updated_at
            - deleted_at
        included:
          type: object
          additionalProperties: {}
        includes:
          type: array
          items:
            type: string
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type: string
              nullable: true
              description: >-
                The team this call ran in (the token team, or the team_sid
                override). Null when unauthenticated; absent from pre-2026-08-20
                backends.
            actor_type:
              type: string
              nullable: true
              description: >-
                user | agent | api_key | system. Null when unauthenticated;
                absent from pre-2026-08-20 backends.
          required:
            - trace_id
            - span_id
            - timestamp
            - duration_ms
      required:
        - success
        - operation
        - item
        - included
        - includes
        - meta
    McpError:
      type: object
      properties:
        success:
          type: boolean
          enum:
            - false
        error:
          type: object
          properties:
            code:
              type: string
              enum:
                - validation_failed
                - nothing_to_update
                - not_found
                - relation_not_found
                - invalid_transition
                - limit_exceeded
                - payment_required
                - duplicate_rejected
                - conflict
                - delete_blocked
                - unauthorized
                - forbidden
                - rate_limited
                - internal_error
                - service_unavailable
                - not_implemented
            message:
              type: string
            recoverable:
              type: boolean
            suggestion:
              type: string
            field_errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: object
                  properties:
                    rule:
                      type: string
                    message:
                      type: string
                  required:
                    - rule
                    - message
            blockers:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: >-
                      Machine-readable blocker type (active_flow, pending_tasks,
                      …).
                  severity:
                    type: string
                    enum:
                      - hard
                      - soft
                    description: >-
                      hard = external action required; soft = acknowledge is
                      enough.
                  description:
                    type: string
                  entity_sid:
                    type: string
                    nullable: true
                  count:
                    type: integer
                  resolution:
                    type: string
                    description: 'Hard: tool name to call. Soft: code for acknowledge[].'
                  resolution_hint:
                    type: string
                required:
                  - type
                  - severity
                  - description
                  - entity_sid
                  - resolution
                  - resolution_hint
            context:
              type: object
              additionalProperties: {}
          required:
            - code
            - message
            - recoverable
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type: string
              nullable: true
              description: >-
                The team this call ran in (the token team, or the team_sid
                override). Null when unauthenticated; absent from pre-2026-08-20
                backends.
            actor_type:
              type: string
              nullable: true
              description: >-
                user | agent | api_key | system. Null when unauthenticated;
                absent from pre-2026-08-20 backends.
          required:
            - trace_id
            - span_id
            - timestamp
            - duration_ms
      required:
        - success
        - error
  responses:
    McpClientError:
      description: >-
        MCP error envelope. `error.code` is one of validation_failed,
        nothing_to_update, not_found, relation_not_found, invalid_transition,
        limit_exceeded, payment_required, duplicate_rejected, conflict,
        delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
    McpServerError:
      description: >-
        MCP error envelope with `error.code` internal_error or
        service_unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
  securitySchemes:
    BearerJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Access token issued by gs.service.id. Its `access_identity` claim
        carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is
        authoritative.
    TeamSid:
      type: apiKey
      in: header
      name: Team-SID
      description: >-
        Team scope for tokens that do not carry one. Ignored when the token
        already names a team.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.