POST	/api/certificates/verify
POST	/api/certificates/issue
GET	/api/certificates/my-certs
GET	/api/certificates
GET	/api/certificates/:id
POST	/api/certificates/:id/revoke

Check-principals: verify cert serial+principal

POST/api/certificates/verify

Agent auth (x-agent-token header, per-host token or legacy AGENT_SHARED_SECRET — see middleware/agentAuth.js). Registered FIRST so it takes priority over /:id for the literal segment. Called per SSH connection by check-principals on target hosts.

Authentication: bearer token.
Permission: any signed-in user.

Request body

Name	Type	Required	Notes
serial	mixed	Yes
principal	string	Yes	At least 1 characters.

curl -X POST "https://shellius.example.com/api/certificates/verify" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "serial": {},
    "principal": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Sign arbitrary public key into a user cert

POST/api/certificates/issue

Direct issuance (API only; the web UI and CLI use access requests). Needs certificates.issue_direct. Issuing for another user additionally needs users.update and the right to manage that user (you can't borrow a stronger user's policy access — F-04).

Authentication: bearer token.
Permission: certificates.issue_direct.

Request body

Name	Type	Required	Notes
userId	string	No
serverId	string	Yes
principals	array	Yes	1–64.
validitySeconds	number	Yes	60–604800.
publicKey	string	Yes
keyId	string	No	At most 255 characters.
certType	string	No	One of USER. Default USER.
extensions	object	No
criticalOptions	object	No
issuedVia	string	No	One of web, tui, api. Default web.

curl -X POST "https://shellius.example.com/api/certificates/issue" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "serverId": "…",
    "principals": [],
    "validitySeconds": 0,
    "publicKey": "…"
  }'

201 Created

{ "success": true, "data": { … } }

Own certificates

GET/api/certificates/my-certs

Authentication: bearer token.
Permission: any signed-in user.

Query parameters

Name	Type	Required	Notes
page	—	No
limit	—	No
status	—	No

curl -X GET "https://shellius.example.com/api/certificates/my-certs" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

List all org certificates

GET/api/certificates

All certs with filters.

Authentication: bearer token.
Permission: certificates.view_all.

Query parameters

Name	Type	Required	Notes
status	string	No
userId	string	No
serverId	string	No
page	number	No	Default 1. At least 1.
limit	number	No	Default 25. 1–100.

curl -X GET "https://shellius.example.com/api/certificates" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Get certificate

GET/api/certificates/:id

Certificates.view_all OR owner of the cert.

Authentication: bearer token.
Permission: any signed-in user; some behaviour depends on certificates.view_all.

Path parameters

Name	Type	Notes
id	string

curl -X GET "https://shellius.example.com/api/certificates/{id}" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Revoke certificate

POST/api/certificates/:id/revoke

Authentication: bearer token.
Permission: certificates.revoke.

Path parameters

Name	Type	Notes
id	string

curl -X POST "https://shellius.example.com/api/certificates/{id}/revoke" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }