OpenWAF issues and renews the edge certificates of every proxied name automatically (ACME). This endpoint lists them, never with their private keys, together with the status of each site.
| Operation | Endpoint |
|---|---|
| List certificates | GET /v1/orgs/{org}/zones/{zone}/certs |
List certificates
GET /v1/orgs/{org}/zones/{zone}/certsLists the TLS certificates of the zone, never with their private keys, with their ACME issuance status, and the certificate status of each proxied site in sites (valid, pending or failed issuance, days left).
Required role: readonly or higher.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
org | path | string (uuid) | Yes | Organization id. Every route checks that it is the token's organization (otherwise 404). |
zone | path | string (uuid) | Yes | Zone id (see List zones). |
Response
200: Returns an object with the fields below.
| Field | Type | Description |
|---|---|---|
items | array of object | |
items[].id | string (uuid) | Id. |
items[].zone_id | string (uuid) | Zone id. |
items[].hostname | string | |
items[].cert_pem | string | |
items[].fingerprint_sha256 | string | SHA-256 fingerprint of the certificate. |
items[].not_after | string (date-time) | End of validity. |
items[].source | string | manual = uploaded by OpenWAF; acme = issued automatically with ACME. One of manual, acme. |
items[].uploaded_by | string | |
items[].created_at | string (date-time) | Creation time. |
items[].issuance | ACMEIssuance | |
sites | array of HostCertStatus |
Example
curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/certs" \
-H "Authorization: Bearer $OPENWAF_TOKEN"import { OpenWAF } from "./openwaf";
const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.listCerts({
zone: "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d"
});from openwaf import OpenWAF
owf = OpenWAF(base_url="https://dash.openwaf.dev") # token from OPENWAF_TOKEN
result = owf.list_certs(zone="6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d")200
{
"items": [
{
"id": "a5614527-0ce6-43be-ad1d-d012b7394867",
"zone_id": "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
"hostname": "www.example.com",
"cert_pem": "example",
"fingerprint_sha256": "example",
"not_after": "2026-10-27T09:30:00Z",
"source": "manual",
"created_at": "2026-10-27T09:30:00Z",
"issuance": {
"name": "example.com",
"names": [],
"state": "pending",
"challenge": "example",
"last_error": "",
"failures": 0,
"next_attempt_at": "2026-10-27T09:30:00Z",
"last_attempt_at": "2026-10-27T09:30:00Z",
"last_success_at": "2026-10-27T09:30:00Z",
"updated_at": "2026-10-27T09:30:00Z"
}
}
],
"sites": [
{
"org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
"zone_id": "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
"zone": "example.com",
"dns_mode": "delegated",
"hostname": "www.example.com",
"state": "valid",
"source": "",
"cert_id": "2e0a4ad6-9d2a-4999-a9cb-f10436c964f5",
"cert_name": "example",
"not_after": "2026-10-27T09:30:00Z",
"days_left": 0,
"challenge": "example",
"last_error": "",
"failures": 0,
"next_attempt_at": "2026-10-27T09:30:00Z",
"last_attempt_at": "2026-10-27T09:30:00Z",
"warning": ""
}
]
}