Export the private key of a certificate
Returns the PEM-encoded private key of an auto_managed or custom certificate. The key is never part of any other response. Allowed for organization owners and managers and for super admins with an interactive sign-in; API tokens cannot export keys. The body proves the identity of the caller again: password is the current password (an account without one needs a sign-in within the last 10 minutes instead) and, when two-factor authentication is enabled, totpCode is a current authenticator code or an unused recovery code. A missing or wrong factor returns 403 invalid_credentials without saying which one. Limited to 5 attempts per user per hour, failed ones included (429). Every export is recorded in the organization audit log as private_key_export and the organization owners are notified by email. The response is sent with Cache-Control: no-store. The key of an auto_managed certificate changes with every renewal, so an exported copy stops matching the served certificate after the next renewal.
Authorizations
Long-lived API token created via POST /api/api-tokens (returned once in plaintext). A token created with readOnly may only perform safe requests (GET, HEAD, OPTIONS); write requests are rejected on every endpoint.
JWT access token obtained via POST /api/auth/login. Send as: Authorization: Bearer
Parameters
Path Parameters
Organization identifier
certificate identifier
Request Body
Responses
The private key, the domain name and the export time.