# Certificates Object

> Source: https://truto.one/docs/api-reference/unified-cloud-infrastructure-api/certificates/

Schema for the `Certificates` resource in **Unified Cloud Infrastructure API**.

## Properties

- **`id`** _(string, required)_
  Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
- **`provider_id`** _(string)_
  The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
- **`provider`** _(string)_
  Which cloud this object was read from.
  Allowed: `aws`, `azure`, `gcp`
- **`account`** _(string)_
  The account, subscription or project this object belongs to.
- **`region`** _(string)_
  Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
- **`native_type`** _(string)_
  The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
- **`tags`** _(object)_
  Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
- **`collected_at`** _(string)_
  When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
- **`updated_at`** _(string)_
  When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`created_at`** _(string)_
  When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`unreadable_fields`** _(array<object>)_
  Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
  - **`field`** _(string)_
    The property on this resource that could not be read.
  - **`reason`** _(string)_
    Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
    Allowed: `not_supported_by_provider`, `not_configured`, `permission_denied`, `not_collected`, `collection_error`, `partially_collected`, `available_on_get`
  - **`detail`** _(string)_
    Explanation of the reason, where one adds anything.
- **`remote_data`** _(object)_
  Raw data returned from the remote API call.
- **`domain_name`** _(string)_
  The primary domain name (subject CN).
- **`subject_alternative_names`** _(array<string>)_
  Subject alternative names. On the list at most the first 100 - see unreadable_fields.
- **`status`** _(string)_
  Status, normalised. failed also covers a validation that timed out (on AWS: VALIDATION_TIMED_OUT). provider_status has the provider's value verbatim.
  Allowed: `pending_validation`, `issued`, `inactive`, `expired`, `revoked`, `failed`, `unknown`
- **`provider_status`** _(string)_
  The provider's own status, verbatim (on AWS: PENDING_VALIDATION, ISSUED, INACTIVE, EXPIRED, VALIDATION_TIMED_OUT, REVOKED, FAILED).
- **`issuance`** _(string)_
  provider_issued: a public certificate issued and renewed by the provider. imported: a certificate the customer imported (no managed renewal). private_ca: issued by a private CA the customer runs.
  Allowed: `provider_issued`, `imported`, `private_ca`
- **`key_algorithm`** _(string)_
  The key algorithm, verbatim (on AWS: RSA_2048, EC_prime256v1, ...).
- **`signature_algorithm`** _(string)_
  The signature algorithm, verbatim (e.g. SHA256WITHRSA). Read on GET only.
- **`not_before`** _(string)_
  Start of validity.
- **`expires_at`** _(string)_
  End of validity (NotAfter).
- **`in_use`** _(boolean)_
  Whether any provider resource uses the certificate.
- **`in_use_by`** _(array<string>)_
  Provider ids (ARNs) of the resources using it. Read on GET only.
- **`renewal_eligible`** _(boolean)_
  Whether the provider can renew the certificate by itself (on AWS: RenewalEligibility ELIGIBLE). Verbatim in remote_data.
- **`renewal_status`** _(string)_
  The provider's managed renewal, normalised. pending: renewal is queued (on AWS: PENDING_AUTO_RENEWAL). Read on GET only; null when no renewal has run. provider_renewal_status has the value verbatim.
  Allowed: `pending`, `pending_validation`, `succeeded`, `failed`, `unknown`
- **`provider_renewal_status`** _(string)_
  The provider's managed-renewal status, verbatim (on AWS: PENDING_AUTO_RENEWAL, PENDING_VALIDATION, SUCCESS, FAILED). Read on GET only; null when no renewal has run.
- **`exported`** _(boolean)_
  Whether the private key has been exported.
- **`export_enabled`** _(boolean)_
  Whether the certificate may be exported with its private key.
- **`managing_service`** _(string)_
  The provider service that manages the certificate and its renewal, verbatim (on AWS: CLOUDFRONT). Null when the customer manages it.

## Methods

- [GET /unified/cloud-infrastructure/certificates/{id}](/docs/api-reference/unified-cloud-infrastructure-api/certificates/get) — Get Certificates
- [GET /unified/cloud-infrastructure/certificates](/docs/api-reference/unified-cloud-infrastructure-api/certificates/list) — List Certificates