Mint or rotate the assisted-claiming CA

POST 
/v1/admin/claiming/ca

Signs and publishes the claiming CA with the KMS signing key, using the stored configuration (or defaults). Mint-once: the first call mints and a repeat reports the existing CA unchanged with 200. Pass {"force": true} to rotate - replacing the published CA, which leaves every certificate already issued by the previous CA unverifiable against it. There is no delete.

This is the step that turns claiming on after the claim stacks are deployed. Only super admin users can access this endpoint.

Request

Responses

200

CA already present (unchanged)

201

CA minted or rotated

400

Bad request

401

Unauthorized - Invalid or missing authentication

403

Forbidden - User does not have permission to access the resource

500

Internal server error