How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
SmallStep

SmallStep PKI Architecture API

Manage certificate authorities and provisioners

Documentation Provider Profile APIs.io OpenAPI GitHub

SmallStep PKI Architecture API is one of 6 APIs that SmallStep publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include PKI Architecture. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 13 operations across 8 paths, and defines 35 schemas. It is described by OpenAPI 3.2.0, at version 2025-01-01.

Requests are made against a single base URL, https://gateway.smallstep.com/api.

13 operations 8 paths 35 schemas 3 DELETE5 GET5 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
2025-01-01
Base URL
https://gateway.smallstep.com/api
Authentication
HTTP Bearer, Mutual TLS
Contact
Smallstep Support
License
Apache 2.0
Resource Areas
1

Authentication & Security 2

SmallStep PKI Architecture API declares 2 security schemes for authenticating requests. It accepts HTTP bearer tokens (JWT). It requires mutual TLS (mtls). By default, every request must be authenticated.

  • mtls — Use a client certificate issued by a trusted root to get short-lived bearer tokens with the step CLI.

Paths & Operations 13

Across 8 paths, the API surfaces 13 operations — 3 DELETE, 5 GET, 5 POST. Each is listed below with its method, path, parameters, and response codes.

PKI Architecture 13

Manage certificate authorities and provisioners

GET
/authorities
List Authorities
GetAuthorities 3 params → 200400401403500
POST
/authorities
Create New Authority
PostAuthorities 3 params body → 201400401403409412422500
POST
/authorities/csr
Create New Authority CSR
PostAuthoritiesCsr 3 params body → 201400401403409412500
DELETE
/authorities/{authorityDomainOrID}
Delete Authority
DeleteAuthority 4 params → 204400401403422500
GET
/authorities/{authorityDomainOrID}
Get Authority
GetAuthority 4 params → 200400401403404500
GET
/authorities/{authorityID}/provisioners
List Authority Provisioners
ListAuthorityProvisioners 4 params → 200400401403404500
POST
/authorities/{authorityID}/provisioners
Create Authority Provisioner
PostAuthorityProvisioners 4 params body → 201400401403404409422500
DELETE
/authorities/{authorityID}/provisioners/{provisionerNameOrID}
Delete Provisioner
DeleteProvisioner 5 params → 204400401403422500
GET
/authorities/{authorityID}/provisioners/{provisionerNameOrID}
Get Provisioner
GetProvisioner 5 params → 200400401403404500
POST
/authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks
Create Provisioner Webhook
PostWebhooks 5 params body → 201400401403404409412422
DELETE
/authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks/{webhookNameOrID}
Delete Provisioner Webhook
DeleteWebhook 6 params → 204400401403422500
GET
/authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks/{webhookNameOrID}
Get Provisioner Webhook
GetWebhook 6 params → 200400401403404500
POST
/authorities/{authorityID}/root
Post Authority External Root
PostAuthorityRoot 4 params body → 200400401403404500

Schemas 35

The contract defines 35 schemas that model the data the API accepts and returns. The most detailed are provisionerClaims (12 properties), provisionerWebhook (11 properties), scepProvisioner (10 properties), distinguishedName (10 properties). Each schema is shown below with its type and property counts.

x5cProvisioner
object
A [provisioner](https://smallstep.com/docs/step-ca/provisioners/x5c---x509-certificate) that authenticates a certificate request with an existing X.509 certifi…
1 property 1 required
azureAudience
string
Defaults to https://management.azure.com/ but it can be changed if necessary.
azureTenantID
string
The Azure account tenant ID for this provisioner. This ID is the Directory ID available in the Azure Active Directory properties.
awsProvisioner
object
The [AWS provisioner](https://smallstep.com/docs/step-ca/provisioners/aws) grants a certificate to an Amazon EC2 instance using the Instance Identity Document.
4 properties 1 required
awsAccounts
array
The list of AWS account IDs that are allowed to use an AWS cloud provisioner.
gcpDisableCustomSANs
boolean
By default custom SANs are valid, but if this option is set to true only the SANs available in the instance identity document will be valid, these are the DNS…
azureResourceGroups
array
The list of resource group names that are allowed to use this provisioner.
distinguishedName
object
Name used in X.509 certificates
10 properties
azureProvisioner
object
The [Azure provisioner](https://smallstep.com/docs/step-ca/provisioners/azure) grants certificates to Microsoft Azure instances using the managed identities to…
5 properties 2 required
scepProvisioner
object
The [SCEP provisioner](https://smallstep.com/docs/step-ca/provisioners/scep) grants certificates to clients using the SCEP protocol. This type is currently exp…
10 properties
acmeAttestationProvisioner
object
A [provisioner](https://smallstep.com/docs/step-ca/provisioners/acme) that enables automation with the [device-attest-01 challenge of the ACME protocol](https:…
4 properties 1 required
provisioner
[Provisioners](https://smallstep.com/docs/step-ca/provisioners/) are methods of using the CA to get certificates with different modes of authorization.
nameConstraints
object
X.509 certificate name constraints.
9 properties
acmeProvisioner
object
A [provisioner](https://smallstep.com/docs/step-ca/provisioners/acme) that enables automation with the [ACME protocol](https://smallstep.com/docs/step-ca/acme-…
3 properties 2 required
awsDisableCustomSANs
boolean
By default custom SANs are valid, but if this option is set to true only the SANs available in the instance identity document will be valid. These are the priv…
instanceAge
string
The maximum age of an instance that should be allowed to obtain a certificate. Limits certificate issuance to new instances to mitigate the risk of credential-…
authorityType
string
One of the available authority types
provisionerOptions
object
Options that apply when issuing certificates with this provisioner.
3 properties
provisionerClaims
object
A set of constraints configuring how this provisioner can be used to issue certificates.
12 properties
gcpProjectIDs
array
The list of project identifiers that are allowed to use a GCP cloud provisioner.
error
object
1 property 1 required
x509Issuer
object
A customized X.509 issuer for an authority.
6 properties 2 required
provisionerWebhook
object
A [webhook](https://smallstep.com/docs/step-ca/webhooks/) to call when a certificate request is being processed.
11 properties 4 required
newAuthorityCsr
object
Body of a request to create a new X.509 advanced authority with an external root.
4 properties 3 required
authority
object
An X.509 authority hosted by Smallstep.
9 properties 5 required
gcpProvisioner
object
The [GCP provisioner](https://smallstep.com/docs/step-ca/provisioners/gcp) grants a certificate to a Google Compute Engine instance using its identity token. A…
5 properties
jwkProvisioner
object
A [provisioner](https://smallstep.com/docs/step-ca/provisioners/jwk) that uses public-key cryptography to sign and validate a JSON Web Token (JWT).
2 properties 1 required
oidcProvisioner
object
A [provisioner](https://smallstep.com/docs/step-ca/provisioners/oauthoidc-single-sign-on) that is configured to trust and accept an OAuth provider's ID tokens…
8 properties 3 required
sshOptions
object
Options that apply when issuing SSH certificates
2 properties
gcpServiceAccounts
array
The list of service accounts that are allowed to use a GCP cloud provisioner.
azureDisableCustomSANs
boolean
By default custom SANs are valid, but if this option is set to true only the SANs available in the token will be valid, in Azure only the virtual machine name…
x509Options
object
Options that apply when issuing X.509 certificates.
2 properties
authorityCsr
object
A certificate signing request for an X.509 advanced authority with an external root.
3 properties 3 required
basicAuth
object
Configures provisioner webhook requests to include an Authorization header with these credentials. Optional for EXTERNAL webhook servers; not allowed with host…
2 properties 2 required
newAuthority
object
The body of a request to create a new authority.
7 properties 4 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

smallstep-pki-architecture-api-openapi.yml Raw ↑

Other APIs SmallStep publishes across the network.

SmallStep Authentication API
AE Profile APIs.io
SmallStep Certificates API
AE Profile APIs.io
SmallStep Credentials API
AE Profile APIs.io
SmallStep Device Inventory API
AE Profile APIs.io
SmallStep Protect API
AE Profile APIs.io
#PKI Architecture
← Back to S APIs
API Details
ID
smallstep:smallstep-pki-architecture-api
Base URL
https://gateway.smallstep.com/api
Docs
https://smallstep.com/docs/platform/smallstep-api/
Provider
SmallStep
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=smallstep-pki-architecture-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/smallstep-pki-architecture-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of SmallStep PKI Architecture API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.