Get Database Certificate

GET

databases

{id}

credentials

certificate

Get Database Certificate

curl --request GET \
  --url https://api.vertracloud.app/v1/databases/{id}/credentials/certificate \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vertracloud.app/v1/databases/{id}/credentials/certificate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.vertracloud.app/v1/databases/{id}/credentials/certificate"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vertracloud.app/v1/databases/{id}/credentials/certificate"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "response": {
    "crt": "-----BEGIN CERTIFICATE-----\nMIID1TCCAr2gAwIBAgIUe7z...\n-----END CERTIFICATE-----",
    "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQE...\n-----END PRIVATE KEY-----",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "ca": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "p12": "MIIJqQIBAzCCCW8GCSqGSIb3DQEHAaCCCWAEgglc..."
  }
}

string

required

The ID of the database to retrieve the certificate for.

Response

The response is a JSON object containing the PEM-encoded certificate components for TLS connection to the database, plus the CA and a PKCS#12 bundle when the database has them.

object

The certificate details for secure database connections.

Show Toggle object

string

The client certificate. Use it with key for TLS client authentication.

string

The private key for the client certificate. Use it with crt for TLS client authentication.

string

A single PEM file with the client private key, the client certificate and the CA certificate, in that order. Use it where a driver wants one combined client file; to verify the server’s certificate chain, use the CA part.

string

The CA certificate (PEM) that signs the database server certificate, on its own. Use it to verify the server’s certificate chain. Absent on older databases; the CA is still the last part of pem.

string

The client identity as PKCS#12, encoded in base64, with an empty password. Decode it to a .p12 file for drivers that only accept a PKCS#12 identity, such as Prisma 6. Absent on older databases.

{
  "response": {
    "crt": "-----BEGIN CERTIFICATE-----\nMIID1TCCAr2gAwIBAgIUe7z...\n-----END CERTIFICATE-----",
    "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQE...\n-----END PRIVATE KEY-----",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "ca": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "p12": "MIIJqQIBAzCCCW8GCSqGSIb3DQEHAaCCCWAEgglc..."
  }
}

Usage

Every engine requires TLS and the client certificate. Save each field to a file:

Field	Save as	Contains
`crt`	`certificate.crt`	Client certificate
`key`	`certificate.key`	Client private key
`pem`	`certificate.pem`	Client key + client certificate + the CA that signs the server
`ca`	`ca.pem`	The CA that signs the server (when present)
`p12`	`certificate.p12` (decode the base64 first)	Client identity as PKCS#12, empty password (when present)

Use ca.pem (or certificate.pem, which ends with the same CA) as the CA file and, for MongoDB, certificate.pem as the certificate-key file. Use certificate.crt + certificate.key as the client certificate, or certificate.p12 where the driver only accepts a PKCS#12 identity (Prisma 6, with an empty password). The port is unique per database — read it from Get Database. Commands and driver examples for each engine are in How do I connect to each engine?.

Error Responses

string

The error code indicating the reason for failure. Possible values:

AUTH_TOKEN_MISSING, API_KEY_INVALID, SESSION_REVOKED: The Authorization header is missing, the API key is invalid, or the dashboard session was revoked (401).
API_KEY_IP_DENIED, API_KEY_SCOPE_DENIED: The API key is used from an IP outside its allowlist, or it lacks the scope the route requires (403).
ACCESS_DENIED: The resource belongs to another account, or you lack the workspace permission for it (403).
DATABASE_NOT_FOUND_OR_FORBIDDEN: The specified database does not exist or the user lacks access.
FAILED_TO_GET_CERTIFICATE: Failed to retrieve the certificate.

string

A descriptive message providing additional details about the error.

{
  "code": "ACCESS_DENIED"
}

{
  "code": "DATABASE_NOT_FOUND_OR_FORBIDDEN"
}

{
  "code": "FAILED_TO_GET_CERTIFICATE"
}

Last modified on October 28, 2026

Get Database Certificate

curl --request GET \
  --url https://api.vertracloud.app/v1/databases/{id}/credentials/certificate \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vertracloud.app/v1/databases/{id}/credentials/certificate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.vertracloud.app/v1/databases/{id}/credentials/certificate"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vertracloud.app/v1/databases/{id}/credentials/certificate"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "response": {
    "crt": "-----BEGIN CERTIFICATE-----\nMIID1TCCAr2gAwIBAgIUe7z...\n-----END CERTIFICATE-----",
    "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQE...\n-----END PRIVATE KEY-----",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "ca": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUT...\n-----END CERTIFICATE-----",
    "p12": "MIIJqQIBAzCCCW8GCSqGSIb3DQEHAaCCCWAEgglc..."
  }
}

Overview

Endpoints

Get Database Certificate

Response

Usage

Error Responses

​Response

​Usage

​Error Responses

Response

Usage

Error Responses