Read your inventory
Every certificate NextPKI knows about, with issuer, validity and where it
was last seen. Filter by organisation. See
GET /v1/certificates.
NextPKI for developers
One inventory across every certificate authority, and renewal you never have to remember.
NextPKI is a control plane over the certificate authorities you already use. It keeps one inventory of every TLS and S/MIME certificate in your estate - whoever issued it - and renews them over your existing CA accounts or a private NextPKI CA.
Trigger a renewal
Submit a CSR, get a renewal request. Your private key never leaves your
host - NextPKI only ever sees the CSR. See
POST /v1/certificates/{id}/renew.
Find what you forgot
The discovery sensor sweeps your own network and finds the expired certificate on the appliance nobody remembers owning.
Audit the agent
The sensor runs inside your network, so its source is published for review - source available, not open source. Read exactly what it sends, and build it yourself. See licensing.
Where to start
Section titled “Where to start”If you want to talk to the API, go to the quickstart - it takes
one token and one curl. If you are wiring up a new integration, read
core concepts first: tenants, organisations and the renewal state
machine are the three things worth understanding before you write code.
What is not here yet
Section titled “What is not here yet”This documentation covers the v1 public API, which is deliberately narrow: read your inventory and request renewals. Issuing brand-new certificates, managing domains and driving the private CA are not exposed publicly yet. If you need one of those, say so - the roadmap is driven by what integrators actually ask for.