Skip to main content
POST
Replace trust anchor

Authorizations

Authorization
string
header
required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Body

application/json
cert_pem
string
required

PEM-encoded X.509 certificate to install as the active Apple Root CA trust anchor.

Example:

"-----BEGIN CERTIFICATE-----\nMIICQzCCAcmgAwIBAgIQ...\n-----END CERTIFICATE-----"

Response

Success response

id
string<uuid>
required
Example:

"9c4e2f7a-8b1d-4e6c-a3f5-2d8b7c9e4f1a"

activated_at
string<date-time>
required
Example:

"2026-02-01T09:05:00Z"