> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Create certificates > Generate the certificate signing requests (CSRs) Guardian needs for Apple Pay. Guardian creates both an EC **payment processing** CSR and an RSA **merchant identity** CSR and keeps the private keys inside its PCI boundary. Submit each `csr_pem` to Apple in the [Apple Developer](https://developer.apple.com/account/resources/certificates/list) portal, then return the signed certificates with [Upload an Apple Pay certificate](/products/guardian/api-reference/wallet/upload-a-certificate). Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. ## OpenAPI ````yaml /products/guardian/openapi.yaml post /api/wallet/apple-pay/certificates openapi: 3.1.0 info: title: Guardian API version: '1.0' contact: name: Starfish GmbH & Co. KG email: support@hellgate.io url: https://hellgate.io/cpa/guardian license: name: Hellgate API Terms url: https://hellgate.io/terms-and-conditions servers: - url: https://{instance}.{env}.on-hellgate.cloud description: Managed instance of Guardian variables: instance: default: my-instance description: Your unique instance slug, provided during onboarding. env: default: eu1 description: Deployment environment (currently eu1). security: [] tags: - name: pci description: Management of card payment credentials under the ruling of PCI DSS. - name: network description: Management of network tokens and cryptograms for secure transactions. - name: generic description: Management of generic tokens and their schemas for various use cases. - name: metadata description: Inquiries for card metadata based on PAN, PCI tokens, or network tokens. - name: wallet description: >- Management of wallet tokens ingested from device wallets such as Google Pay. - name: apikey description: Management of API keys for service access. - name: webhook description: Management of webhooks for event notifications. - name: types description: Management of types for generic token schemas. paths: /api/wallet/apple-pay/certificates: post: tags: - wallet summary: Create certificates description: > Generate the certificate signing requests (CSRs) Guardian needs for Apple Pay. Guardian creates both an EC **payment processing** CSR and an RSA **merchant identity** CSR and keeps the private keys inside its PCI boundary. Submit each `csr_pem` to Apple in the [Apple Developer](https://developer.apple.com/account/resources/certificates/list) portal, then return the signed certificates with [Upload an Apple Pay certificate](/products/guardian/api-reference/wallet/upload-a-certificate). Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. operationId: wallet_apple_pay_certificate_create responses: '200': description: Success response content: application/json: schema: $ref: '#/components/schemas/apple_pay_certificate_csr_pair' '400': $ref: '#/components/responses/400_BadRequestError' '401': $ref: '#/components/responses/401_UnauthorizedError' '403': $ref: '#/components/responses/403_ForbiddenError' '409': $ref: '#/components/responses/409_ConflictError' security: - bearerAuth: [] - APIKey: [] components: schemas: apple_pay_certificate_csr_pair: title: Apple Pay Certificate Signing Requests type: object description: > Both Apple Pay CSRs to submit to Apple: the EC payment-processing certificate and the RSA merchant-identity certificate. The CSR flow is `self_managed`-only; on Starfish-operated (`sf_operated`) instances the same RSA certificate is surfaced as a platform integrator identity and is managed by Starfish. properties: payment_processing: $ref: '#/components/schemas/apple_pay_certificate_csr' merchant_identity: $ref: '#/components/schemas/apple_pay_certificate_csr' required: - payment_processing - merchant_identity apple_pay_certificate_csr: title: Apple Pay Certificate Signing Request type: object properties: id: example: 6e2d8b4f-1c7a-4d3e-9f5b-8a4c2e6d9b1f type: string format: uuid state: type: string example: pending csr_pem: example: |- -----BEGIN CERTIFICATE REQUEST----- MIICijCCAXICAQAwRTEL... -----END CERTIFICATE REQUEST----- type: string description: PEM-encoded PKCS#10 certificate signing request. registration_order: example: 1 type: integer created_at: example: '2026-02-01T09:10:00Z' type: string format: date-time required: - id - state - csr_pem - registration_order - created_at ErrorGeneric: type: object properties: code: $ref: '#/components/schemas/ErrorStatusCode' classifier: $ref: '#/components/schemas/ErrorClassifier' message: $ref: '#/components/schemas/ErrorMessage' ErrorStatusCode: type: integer description: The corresponding HTTP status code for the error ErrorClassifier: type: string description: Technical code that helps to identify the error ErrorMessage: type: string description: Human readable representation of the error responses: 400_BadRequestError: description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 400 message: The request could not be handle due to invalid data classifier: BAD_REQUEST 401_UnauthorizedError: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 401 message: No valid means of authentication was provided classifier: UNAUTHORIZED 403_ForbiddenError: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 403 message: Not allowed to access this resource or feature classifier: FORBIDDEN 409_ConflictError: description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 409 message: Conflict classifier: CONFLICT securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian. APIKey: type: apiKey name: x-api-key in: header description: >- Deprecated. Long-lived instance API key, sent as `x-api-key`. Existing integrations continue to work, but new ones should use the OAuth2 bearer token instead. ````