What is not available yet
Documentation that only describes what works wastes your time. These are the gaps that will affect an integration, listed so you can design around them or tell us they matter.
The big one: you cannot download a certificate
Section titled “The big one: you cannot download a certificate”The v1 API returns metadata only. There is no endpoint that returns a certificate’s PEM or DER bytes, and no endpoint that returns the chain.
That means an automated renewal cannot be completed end-to-end through the API:
you can open a renewal, watch it reach issued, and read the new certificate’s
identifier - but you cannot fetch the certificate to install it. See
deploy a renewed certificate for what to do
instead.
This is the most consequential gap in v1. If it blocks an integration, saying so carries more weight than any other request on this page.
Not in the v1 API
Section titled “Not in the v1 API”| Missing | Workaround today |
|---|---|
| Downloading a certificate or chain | Console, or fetch from the CA directly |
| Issuing a new certificate | Renew an existing one, or order in the Console |
| Managing domains | Console, Settings → Domains |
| Managing connectors | Console, Settings → Connectors |
| Managing sensors and bootstrap tokens | Console, Settings → Bootstrap tokens |
| Reading alerts | Email alerts, or derive from not_after yourself |
| Reading the audit log | Console, /audit |
| Private CA issuance | Operator tooling only |
| Webhooks | Poll - see pagination and caching |
| Server-side expiry filter | Fetch and filter locally |
| Idempotency keys on renewal creation | Check /v1/requests before retrying |
| Org-scoped tokens | Separate tenants, if you need hard isolation |
Planned, in rough order
Section titled “Planned, in rough order”Hosting the MCP server - the MCP server and the
OAuth authorization server behind it are built and tested. What is
missing is a public endpoint: mcp.nextpki.com is not serving yet, which also means
the ChatGPT and claude.ai connectors cannot be verified end to end, because both
fetch metadata and redirect from the outside. You can run the server locally against
the public API today.
CA account sync - import what you already manage in your CA accounts as a discovery source. The provider registry already carries the capability flag; the synchronisation does not run yet.
Internal ACME server - RFC 8555 against the private CA with mandatory EAB, so certbot, acme.sh, Caddy and Traefik can get internal certificates with no NextPKI-specific code. For internal mTLS automation this is the interesting one.
HTTP OCSP responder - a served endpoint rather than command-line responses.
Sensor relay - report through an internal proxy so hosts without outbound access can still be scanned. See network requirements.
Sensor gaps
Section titled “Sensor gaps”The Rust sensor is a rewrite of an older Go agent that is still ahead in places:
| Missing | Consequence |
|---|---|
| Certificate filters by issuer or subject | Appliance certificates - Ubiquiti, Synology, printers - clutter the inventory. Exclude the ranges instead |
| IPv6 discovery | v6-only hosts are not found. CIDR expansion is IPv4 |
| HTTP/2 and HTTP/3 detection | Everything non-mail is reported as PROTOCOL_HTTPS, though the wire format reserves the other two |
| Configuration file | Long target lists live on the command line |
| Separate timeouts | One --probe-timeout-ms covers connect and handshake |
How this list changes
Section titled “How this list changes”Priority follows real demand. A specific request from someone with a live deployment moves an item; speculation does not. For commercial CA connectors in particular, a customer with an existing account at that CA is what unblocks the partner conversation.
The changelog records what actually shipped.