Public API Reference

This page is a consolidated reference for every public (non-admin) HTTP endpoint served by Akāmu. Public endpoints do not require operator authentication — they are accessed by ACME clients, relying parties, and peer nodes.

Multi-CA routing. Most ACME and MTC endpoints are registered at both /acme/{path} and /acme/{ca_id}/{path}. The first form resolves to the default CA; the second addresses a specific CA by its configured id. The tables below use the notation /acme[/{ca_id}]/{path}.

CRL/OCSP routes use /ca[/{ca_id}]/{path} with the same convention.

ACME Core (RFC 8555)

All ACME endpoints (except nonces and certificate download via GET) require JWS-authenticated POST requests per RFC 8555 §6.2. For supported JWS algorithms, EAB wire format, and challenge type details, see ACME Protocol Reference.

STAR (RFC 8739)

STAR orders are created through new-order with the auto-renewal object. The directory’s meta.auto-renewal field advertises min-lifetime, max-duration, and allow-certificate-get capabilities.

Renewal Info — ARI (RFC 9773)

The cert_id is the base64url-encoded SHA-256 hash of the certificate’s DER encoding. The response includes a suggested renewal window.

Delegated Issuance (RFC 9115)

MTC Transparency Log

All MTC endpoints return 404 Not Found when MTC logging is disabled for the resolved CA. These are read-only, unauthenticated endpoints.

For configuration and operational details, see Merkle Tree Certificate Log.

Tree state

GET /acme[/{ca_id}]/mtc/tree-size — Response:

{ "treeSize": 42 }

GET /acme[/{ca_id}]/mtc/root — Response:

{ "treeSize": 42, "rootHash": "a1b2c3..." }

Inclusion proof

Response:

{
  "leafIndex": 7,
  "treeSize": 42,
  "proof": [
    { "hash": "a1b2..." },
    { "hash": "c3d4..." }
  ]
}

Certificate retrieval

Both return Content-Type: application/pkix-cert with an X-MTC-Version header. The landmark endpoint returns 503 Service Unavailable with a Retry-After header when the landmark certificate is not yet available.

Landmarks

GET /acme[/{ca_id}]/mtc/landmarks — Response:

[
  { "sequenceNo": 1, "treeSize": 100, "createdAt": 1700000000 },
  { "sequenceNo": 2, "treeSize": 200, "createdAt": 1700086400 }
]

GET /acme[/{ca_id}]/mtc/landmark-list — text/plain response in spec §3.4 format:

{last_seq_no} {count}
{tree_size_newest}
...
{tree_size_oldest}
0

Consistency and subtree proofs

GET /acme[/{ca_id}]/mtc/consistency-proof — Response:

{
  "fromSize": 10,
  "toSize": 42,
  "fromRoot": "a1b2...",
  "toRoot": "c3d4..."
}

GET /acme[/{ca_id}]/mtc/subtree-root — The start parameter must be aligned to BIT_CEIL(end - start) per §4.3.1. Response:

{
  "start": 0,
  "end": 16,
  "rootHash": "a1b2..."
}

Revoked ranges

Response: JSON array of [start, end] pairs:

[[5, 8], [20, 22]]

C2SP tlog-tiles API

These endpoints implement the C2SP tlog-tiles specification.

The checkpoint and cosignature endpoints return text/plain in C2SP signed-note format. The origin line uses the OID-based format oid/1.3.6.1.4.1.{trust_anchor_id}.0.{log_number}. Both require mtc.trust_anchor_id to be configured; they return 503 otherwise.

Full tiles are served with Cache-Control: public, max-age=86400; partial tiles use Cache-Control: no-store. Entry bundles (tile/entries/…) are not served (returns 501 Not Implemented).

EAB Identity

This endpoint has no per-CA variant. Authentication is via Kerberos (SPNEGO Authorization: Negotiate header or X-Remote-User from a trusted reverse proxy). Returns deterministic EAB credentials derived via HKDF-SHA-256 from the configured eab_master_secret and the authenticated principal.

For details, see EAB and Kerberos Authentication.

CRL and OCSP

These endpoints are unauthenticated and serve revocation information to relying parties. For operational details, see CRL and OCSP.

Email Webhook (RFC 8823)

HMAC-authenticated (not JWS). Request body is capped at 64 KiB. Used by the email-reply-00 challenge type to receive validation confirmations from an email gateway.

Gossip Sync

CMS SignedData-authenticated (ECDSA P-256 with pinned peer certificate). Used for multi-node cluster replication. For setup details, see Cluster Setup and Gossip.