LitmusEdgeManager 2.31.x API Documentation/Edge Lifecycle Management/Certificates - LE, LEM, LUNS API Docs

Get Certificates

GET {{LEM_URL}}/api/v1/device-certificates?filter=&issuer=&limit=10&order=EXPIRESAFTER_ASC&projectId={{project_id}}&requestedPage=0

Get Certificates

Returns the paginated catalog of device certificates known to LEM with filters (issuer, free text, sort order). Each entry includes device identity + cert metadata (subject, issuer, validity window).

Endpoint

GET {{LEM_URL}}/api/v1/device-certificates?filter=&issuer=&limit=10&order=EXPIRESAFTER_ASC&projectId={{project_id}}&requestedPage=0

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status	When it happens
`400 Bad Request`	Missing or malformed query/body parameter.
`401 Unauthorized`	Missing or invalid credentials.
`403 Forbidden`	Token lacks permission for this operation.
`404 Not Found`	Target entity does not exist.
`5xx`	Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "pageNum": 0,
    "pagesCount": 1,
    "size": 3,
    "totalSize": 3,
    "elements": [
        {
            "id": "d344225d-57b1-4b40-9135-3ef26bf5db6b",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "1a5wiavluwxuhwai5leb1v0hc",
            "deviceName": "litmus-edge-94c6911b9c77",
            "deviceFriendlyName": "Litmus Edge (94:c6:91:1b:9c:77)- SJ office sensor",
            "isOnline": true,
            "subject": "litmus-edge-94c6911b9c77",
            "issuer": "litmus-edge-94c6911b9c77",
            "issuedOn": 1645479540000,
            "expiresAfter": 1866490740000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": true
        },
        {
            "id": "b39eb705-7e97-4542-b571-32e7d038a2cd",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "3y0vcdju38zvqjrlm5lcpm1l",
            "deviceName": "litmus-edge-080027b4a1c8",
            "deviceFriendlyName": "Litmus Edge (08:00:27:b4:a1:c8)",
            "isOnline": false,
            "subject": "litmus-edge-080027b4a1c8",
            "issuer": "litmus-edge-080027b4a1c8",
            "issuedOn": 1728818700000,
            "expiresAfter": 1949743500000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": false
        },
        {
            "id": "0ff8e8dd-ebbc-4992-a557-68b95b9fccef",
            "companyName": "solutions",
            "projectId": "462j1mq70mph31wa100t1yuxa",
            "projectName": "parth",
            "deviceId": "vkrih85ka6fn7zcofirk20vs",
            "deviceName": "litmus-edge-005056b965c2",
            "deviceFriendlyName": "VM",
            "isOnline": true,
            "subject": "litmus-edge-005056b965c2",
            "issuer": "litmus-edge-005056b965c2",
            "issuedOn": 1733861400000,
            "expiresAfter": 1954786200000,
            "origin": "EDGE",
            "authority": "UNKNOWN",
            "online": true
        }
    ]
}

Issue New Certificate

POST {{LEM_URL}}/api/v1/device-certificates/new

Issue New Certificate

Issues a new device certificate from LEM's CA (or another configured authority). The commonName, SAN list, DNS list, and TTL drive the cert contents.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/new

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

{
  "commonName": "litmus-edge-005056b965c2",
  "sansList": ["10.17.3.76"],
  "dnsList": [],
  "ttlDays": 2555,
  "authority": "LOCAL",
  "id": "f548d8a2-7ea6-4443-bf35-e7cde578e72a",
  "projectId": "{{project_id}}",
  "deviceId": "{{edge_device_id}}"
}

Errors

HTTP status	When it happens
`400 Bad Request`	Missing or malformed query/body parameter.
`401 Unauthorized`	Missing or invalid credentials.
`403 Forbidden`	Token lacks permission for this operation.
`404 Not Found`	Target entity does not exist.
`5xx`	Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "commonName": "litmus-edge-005056b965c2",
    "sansList": [
        "10.17.3.76"
    ],
    "dnsList": [],
    "ttlDays": 2555,
    "authority": "LOCAL",
    "id": "f548d8a2-7ea6-4443-bf35-e7cde578e72a",
    "projectId": "{{project_id}}",
    "deviceId": "{{edge_device_id}}"
}

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Reset to Edge Default

POST {{LEM_URL}}/api/v1/device-certificates/reset

Reset to Edge Default

Resets the device's HTTPS certificate to the LE-built-in self-signed cert. Use when a custom cert has expired or broken access.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/reset

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

{
  "projectId": "{{project_id}}",
  "deviceId": "{{edge_device_id}}"
}

Errors

HTTP status	When it happens
`400 Bad Request`	Missing or malformed query/body parameter.
`401 Unauthorized`	Missing or invalid credentials.
`403 Forbidden`	Token lacks permission for this operation.
`404 Not Found`	Target entity does not exist.
`5xx`	Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "projectId": "{{project_id}}",
    "deviceId": "{{edge_device_id}}"
}

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Upload Custom Certificate

POST {{LEM_URL}}/api/v1/device-certificates/user-defined?deviceId={{device_id}}&projectId={{project_id}}

Upload Custom Certificate

Uploads a custom certificate + private key + CA chain bundle to a device. Three multipart parts: certificate, privateKey, caCertificate.

Endpoint

POST {{LEM_URL}}/api/v1/device-certificates/user-defined?deviceId={{device_id}}&projectId={{project_id}}

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

Multipart form-data with three parts:

Form key	Type	Description
`certificate`	file	Leaf certificate (PEM).
`privateKey`	file	Matching private key (PEM).
`caCertificate`	file	CA chain (PEM).

Errors

HTTP status	When it happens
`400 Bad Request`	Missing or malformed query/body parameter.
`401 Unauthorized`	Missing or invalid credentials.
`403 Forbidden`	Token lacks permission for this operation.
`404 Not Found`	Target entity does not exist.
`5xx`	Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.