Litmus Edge Manager 3.0.x - Edge Lifecycle: Certificates

Get Certificates

GET {{LEM_URL}}/api/v1/device-certificates?filter=&issuer=&limit=10&order=EXPIRESAFTER_ASC&projectId={{project_id}}&requestedPage=0

Get Certificates

Returns the paginated catalog of device certificates known to LEM with filters (issuer, free text, sort order). Each entry includes device identity + cert metadata (subject, issuer, validity window).

Endpoint

GET {{LEM_URL}}/api/v1/device-certificates?filter=&issuer=&limit=10&order=EXPIRESAFTER_ASC&projectId={{project_id}}&requestedPage=0

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "pageNum": 0,
    "pagesCount": 1,
    "size": 3,
    "totalSize": 3,
    "elements": [
        {
            "id": "d344225d-57b1-4b40-9135-3ef26bf5db6b",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "1a5wiavluwxuhwai5leb1v0hc",
            "deviceName": "litmus-edge-94c6911b9c77",
            "deviceFriendlyName": "Litmus Edge (94:c6:91:1b:9c:77)- SJ office sensor",
            "isOnline": true,
            "subject": "litmus-edge-94c6911b9c77",
            "issuer": "litmus-edge-94c6911b9c77",
            "issuedOn": 1645479540000,
            "expiresAfter": 1866490740000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": true
        },
        {
            "id": "b39eb705-7e97-4542-b571-32e7d038a2cd",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "3y0vcdju38zvqjrlm5lcpm1l",
            "deviceName": "litmus-edge-080027b4a1c8",
            "deviceFriendlyName": "Litmus Edge (08:00:27:b4:a1:c8)",
            "isOnline": false,
            "subject": "litmus-edge-080027b4a1c8",
            "issuer": "litmus-edge-080027b4a1c8",
            "issuedOn": 1728818700000,
            "expiresAfter": 1949743500000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": false
        },
        {
            "id": "0ff8e8dd-ebbc-4992-a557-68b95b9fccef",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "vkrih85ka6fn7zcofirk20vs",
            "deviceName": "litmus-edge-005056b965c2",
            "deviceFriendlyName": "VM",
            "isOnline": true,
            "subject": "litmus-edge-005056b965c2",
            "issuer": "litmus-edge-005056b965c2",
            "issuedOn": 1733861400000,
            "expiresAfter": 1954786200000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": true
        }
    ]
}

Issue New Certificate

POST {{LEM_URL}}/api/v1/device-certificates/new

Issue New Certificate

Issues a new device certificate from LEM's CA (or another configured authority). The commonName, SAN list, DNS list, and TTL drive the cert contents.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/new

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

{
  "commonName": "litmus-edge-005056b965c2",
  "sansList": ["10.17.3.76"],
  "dnsList": [],
  "ttlDays": 2555,
  "authority": "LOCAL",
  "id": "f548d8a2-7ea6-4443-bf35-e7cde578e72a",
  "projectId": "{{project_id}}",
  "deviceId": "{{edge_device_id}}"
}

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "commonName": "litmus-edge-005056b965c2",
    "sansList": [
        "10.17.3.76"
    ],
    "dnsList": [],
    "ttlDays": 2555,
    "authority": "LOCAL",
    "id": "f548d8a2-7ea6-4443-bf35-e7cde578e72a",
    "projectId": "{{project_id}}",
    "deviceId": "{{edge_device_id}}"
}

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Reset to Edge Default

POST {{LEM_URL}}/api/v1/device-certificates/reset

Reset to Edge Default

Resets the device's HTTPS certificate to the LE-built-in self-signed cert. Use when a custom cert has expired or broken access.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/reset

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

{
  "projectId": "{{project_id}}",
  "deviceId": "{{edge_device_id}}"
}

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "projectId": "{{project_id}}",
    "deviceId": "{{edge_device_id}}"
}

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Upload Custom Certificate

POST {{LEM_URL}}/api/v1/device-certificates/user-defined?deviceId={{device_id}}&projectId={{project_id}}

Upload Custom Certificate

Uploads a custom certificate + private key + CA chain bundle to a device. Three multipart parts: certificate, privateKey, caCertificate.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/user-defined?deviceId={{device_id}}&projectId={{project_id}}

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Multipart form-data with three parts:

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

List instance-level CA certificates

GET {{LEM_URL}}/api/v1/ca-certificates/instance

List instance-level CA certificates

Lists the instance-level CA certificates that are distributed to devices so they can validate server certificates. This is the fleet-API view of the instance CA trust store.

Endpoint

GET {{LEM_URL}}/api/v1/ca-certificates/instance

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

A list of instance-level CA certificate records (id, subject, issuer, validity).

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[]

Download instance-level CA certificate PEM

GET {{LEM_URL}}/api/v1/ca-certificates/instance/{{id}}/download

Download instance-level CA certificate PEM

Downloads a single instance-level CA certificate as a PEM file.

Endpoint

GET {{LEM_URL}}/api/v1/ca-certificates/instance/{id}/download

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| id | path | The CA certificate id. |

Response

The certificate in PEM format.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Trigger CA certificate sync to devices

POST {{LEM_URL}}/api/v1/ca-certificates/{{project_id}}/sync

Trigger CA certificate sync to devices

Pushes the current instance CA certificate set to a project's devices, so they pick up newly added or removed CAs. Optionally target specific devices.

Endpoint

POST {{LEM_URL}}/api/v1/ca-certificates/{projectId}/sync

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| projectId | path | Required. Project whose devices to sync. |

Request body

SyncRequest { deviceIds: [string] }. Omit / empty deviceIds to sync all devices in the project.

Response

SyncResponse (sync outcome per device).

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
  "deviceIds": [
    "string"
  ]
}