Secure Endpoints

Secure endpoints are served by the Connect API gateway, not by a separate Secure host.

Secure API - SSL certificates

List secured domains

Partners can retrieve all domains currently Secured under a given applicationId to audit configuration, build admin UIs, and perform maintenance. This endpoint returns a paginated list of all Secure-managed domains for the authenticated application.

GET https://api.goentri.com/ssl
Header "Authorization: [JWT authorization]"
Header "applicationId: [yourApplicationID]"

Headers

Header	Required?	Description
Authorization	Yes	Bearer token (JWT) for authentication.
applicationId	Yes	Your Application ID as set in the dashboard.

Query string parameters

Name	Type	Required?	Default	Description
page	integer	No	0	Zero-based page index (0 = first page).
size	integer	No	50	Max number of items to return (range: 1–200).
status	string	No	—	Filter by secure status: `active` or `inactive`.

Note: status is optional. If omitted, the endpoint returns all secured domains for the application.

Sample response

{
  "items": [
    {
      "domain": "www.example.com",
      "applicationUrl": "my.applicationurl.com",
      "secureStatus": "active"
    },
    {
      "domain": "blog.example.com",
      "applicationUrl": "my.applicationurl.com",
      "secureStatus": "inactive"
    }
  ],
  "total": 2,
  "page": 0,
  "limit": 50,
  "count": 2,
  "pages": 1,
  "nextPage": null,
  "prevPage": null
}

Field definitions

domain (string): Fully qualified domain or subdomain configured via Secure.
applicationUrl (string): Current upstream URL for this domain.
secureStatus (string): active or inactive.
total (integer): Total number of secured domains matching the filter.
page (integer): Current zero-based page index.
limit (integer): Maximum number of items requested per page.
count (integer): Number of items returned.
pages (integer): Total number of pages available.
nextPage (integer | null): Next page index, or null if not applicable.
prevPage (integer | null): Previous page index, or null if not applicable.

Error responses

HTTP	Example Body	When
400	`{ "message": "Invalid 'limit' parameter" }`	Validation errors on query parameters.
401	`{ "message": "Unauthorized" }`	Missing/invalid JWT or `applicationId`.
403	`{ "message": "Forbidden" }`	Authenticated but forbidden for this app.
500	`{ "message": "Internal Server Error" }`	Unexpected server-side error.

Rate limits

This endpoint follows the same global rate limits as other Secure API endpoints.

Example cURL

curl -X GET "https://api.goentri.com/ssl?status=active&size=10&page=0 \
  -H "Authorization: Bearer <JWT>" \
  -H "applicationId: <yourApplicationID>"

Check the domain’s eligibility

GET https://api.goentri.com/ssl?domain=www.example.com&rootDomain=false
Header "Authorization: [JWT authorization]"
Header "applicationId: [yourApplicationID]"

Parameters description

Parameter	Required?	Default	Description
domain	Yes	N/A	The domain name to check
rootDomain	No	false	true if checking the root domain’s eligibilityfalse if checking for the subdomain

Successful response (200 status)

JSON

{
  // Is the domain CNAMEed to the cname_target of the application?
  "eligible": true | false,

  // Is SSL provisioned?
  "sslStatus": "active" | "inactive",

  // Current cnameTarget set on the Dashboard
  "cnameTarget": URL | "",

  // Current cnameTarget value for the domain
  "applicationUrl": URL | ""
}

Possible error responses

Errors are returned as a {message: 'string'} object.

Error message	Status
Domain provided couldn’t be resolved.	400

Provision an SSL certificate

POST https://api.goentri.com/ssl
Header "Authorization: [JWT authorization]"
Header "applicationId: [yourApplicationID]"

Request body

JSON

{
  "domain": "www.example.com",
  "applicationUrl": "my.applicationurl.com", /*Optional*/
  "redirectTo": "shops.example.com" /*Optional*/
}

Parameters description

Parameter	Required?	Default	Description
domain	Yes	N/A	The domain name to check
applicationUrl	No	Configured on Customer’s Dashboard.	Overrides the pre-configured value set on the Dashboard.
redirectTo	No	N/A	Allows you to create a custom redirect policy from the secured domain to any other domain or subdomain.

Successful response (200 status)

JSON

{ "message": "Success" }

Possible error responses

Errors are returned as a {message: 'string'} object. The body never carries anything else, and message is a plain-English explanation of what to fix.

Error message	Status	When
Missing request body, Invalid JSON in request body, or Missing domain in body	400	The body is absent, not valid JSON, or has no `domain`.
Domain does not match with domain passed while creating the token	400	The JWT was created for a different domain.
A certificate cannot be issued for this domain name. Check the domain is spelled correctly and is a public, issuable domain, then try again.	400	A certificate cannot be issued for this name, for example an IP address, a bare TLD, or a `.local` name.
Unauthorized	401	Missing or invalid JWT or `applicationId`.
Domain is blacklisted, Please contact support to know more about this domain.	403	The domain is blocked for this application.
Conflict: Domain is already secured and active. To manage or update this domain, use the appropriate endpoint.	409	The domain is already secured by this application.
Conflict: a certificate provision for this domain is already in progress. Please retry once it has finished.	409	Another request is provisioning the same domain right now. The lock is per domain and shared between Secure and Power, so a Secure provision can block a Power one and vice versa. Retry once it finishes.
Domain ineligible: DNS records (A or CNAME) are not correctly pointed to the Entri target. Please update your DNS and re-verify.	422	The eligibility check found the domain is not pointed to Entri.
We could not validate this domain because our certificate authority could not resolve it. Check that the domain’s nameservers are responding, then try again.	422	The domain’s nameservers did not answer during validation.
A CAA record on this domain stops our certificate authority from issuing a certificate. Remove the CAA record, or contact support for the value to allow, then try again.	422	A CAA record on the domain blocks certificate issuance. Remove it, or ask support which issuer to allow.
Our certificate authority could not reach this domain to validate it. Check that the domain points at Entri and is reachable over HTTP, then try again.	422	The domain could not be reached over HTTP during validation, usually because it does not point to Entri yet.
Precondition Required: You must first verify the domain’s eligibility via a GET request. See: https://developers.entri.com/ssl-provisioning#1-checking-the-domain-eligibility	428	The domain has never been checked with the eligibility endpoint on this page for this application.
Our certificate authority is rate limiting certificate issuance for this domain. Retry after , then try again.	429	Certificate issuance for this domain is rate limited. The message includes the retry time when one is available.
Internal server error	502	Unexpected failure on Entri’s side.
Our certificate authority could not complete this request. This is a temporary problem on their side - please try again in a few minutes.	503	The certificate authority is unavailable or returned a failure Entri could not classify. Retry later.

Renew the SSL certificate

Entri renews the certificates it provisions automatically before they expire. Use this endpoint when you need to trigger that renewal yourself, for example after your customer fixed their DNS records following a domain.secure.certificate_renewal_failed webhook.

POST https://api.goentri.com/ssl/renew
Header "Authorization: [JWT authorization]"
Header "applicationId: [yourApplicationID]"

PUT https://api.goentri.com/ssl with the same body is still accepted and runs the same renewal. New integrations should use POST /ssl/renew.

Request body

JSON

{ "domain": "www.example.com" }

Parameters description

Parameter	Required?	Description
domain	Yes	The secured domain to renew. If the JWT was created for a specific domain, it must match this value.

Requirements

The renewal only runs when all of the following are true. Otherwise the endpoint returns one of the errors listed below without touching the certificate.

The domain is secured by your application and its status is active.
The current certificate expires within the next 30 days.
The domain still points to Entri: subdomains must CNAME to the configured CNAME target, and root domains must resolve to Entri’s A records with no AAAA records present.

Successful response (200 status)

JSON

{ "message": "Certificate renewed successfully" }

Possible error responses

Errors are returned as a {message: 'string'} object.

Error message	Status	When
Missing request body, Invalid JSON in request body, or Missing ‘domain’ in request body	400	The body is absent, not valid JSON, or has no `domain`.
Domain does not match with domain passed while creating the token	400	The JWT was created for a different domain.
Unauthorized	401	Missing or invalid JWT or `applicationId`.
The requested domain was not found. Please ensure your configuration matches the environment, such as development or staging.	404	The domain is not secured by this application.
Conflict: Domain is not active. Only active secure domains can be renewed.	409	The domain’s secure status is `inactive`.
Certificate renewal is only available within 30 days of expiry.	409	The current certificate is still valid for more than 30 days.
Renewal requires your domain to be pointed to Entri. Please verify your DNS records are configured correctly and try again.	422	The DNS check failed. The message names the record that is missing or misconfigured. Entri also sends the `domain.secure.certificate_renewal_failed` webhook.
Internal Server Error	500	Unexpected server-side error.
Failed to renew certificate	502	DNS is correct but the certificate authority request failed. Retry later.

Example cURL

curl -X POST "https://api.goentri.com/ssl/renew" \
  -H "Authorization: Bearer <JWT>" \
  -H "applicationId: <yourApplicationID>" \
  -H "Content-Type: application/json" \
  -d '{"domain": "www.example.com"}'

Deprovision an SSL certificate

DELETE https://api.goentri.com/ssl
Header "Authorization: [JWT authorization]"
Header "applicationId: [yourApplicationID]"

Request body

JSON

{ "domain": "www.example.com" }

Successful response (200 status)

JSON

{ "message": "Success." }

Possible error responses

Errors are returned as a {message: 'string'} object.

Error message	Status
Domain not valid	502
`{detailed error message when deleting the SSL certificate of the domain}`	502

Get Started

Activate Suite

Domain Management

SSL Provisioning

For DNS Providers

DNS Concepts

Entri MCP

Reference

Legal & Security

Resources

Secure Endpoints

Secure API - SSL certificates

List secured domains

Headers

Query string parameters

Sample response

Field definitions

Error responses

Rate limits

Example cURL

Check the domain’s eligibility

Parameters description

Successful response (200 status)

Possible error responses

Provision an SSL certificate

Request body

Parameters description

Successful response (200 status)

Possible error responses

Renew the SSL certificate

Request body

Parameters description

Requirements

Successful response (200 status)

Possible error responses

Example cURL

Deprovision an SSL certificate

Request body

Successful response (200 status)

Possible error responses

​Secure API - SSL certificates

​List secured domains

​Headers

​Query string parameters

​Sample response

​Field definitions

​Error responses

​Rate limits

​Example cURL

​Check the domain’s eligibility

​Parameters description

​Successful response (200 status)

​Possible error responses

​Provision an SSL certificate

​Request body

​Parameters description

​Successful response (200 status)

​Possible error responses

​Renew the SSL certificate

​Request body

​Parameters description

​Requirements

​Successful response (200 status)

​Possible error responses

​Example cURL

​Deprovision an SSL certificate

​Request body

​Successful response (200 status)

​Possible error responses

Secure API - SSL certificates

List secured domains

Headers

Query string parameters

Sample response

Field definitions

Error responses

Rate limits

Example cURL

Check the domain’s eligibility

Parameters description

Successful response (200 status)

Possible error responses

Provision an SSL certificate

Request body

Parameters description

Successful response (200 status)

Possible error responses

Renew the SSL certificate

Request body

Parameters description

Requirements

Successful response (200 status)

Possible error responses

Example cURL

Deprovision an SSL certificate

Request body

Successful response (200 status)

Possible error responses