Upload a certificate
Return the signed certificate chain Apple issued for a CSR created with Create Apple Pay certificates. Once uploaded, the certificate moves to active and becomes the one Guardian uses to decrypt payloads and authenticate to Apple.
curl --request POST \
--url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"signed_cert_chain": "-----BEGIN CERTIFICATE-----\nMIIEhTCCBCugAwIBAgII...\n-----END CERTIFICATE-----"
}
'import requests
url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload"
payload = { "signed_cert_chain": "-----BEGIN CERTIFICATE-----
MIIEhTCCBCugAwIBAgII...
-----END CERTIFICATE-----" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
signed_cert_chain: '-----BEGIN CERTIFICATE-----\nMIIEhTCCBCugAwIBAgII...\n-----END CERTIFICATE-----'
})
};
fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'signed_cert_chain' => '-----BEGIN CERTIFICATE-----
MIIEhTCCBCugAwIBAgII...
-----END CERTIFICATE-----'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload"
payload := strings.NewReader("{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}"
response = http.request(request)
puts response.read_body{
"id": "4f8a2c6e-3b9d-4a1f-8e7c-5d2b9f4a6e8c",
"state": "active",
"registration_order": 1,
"created_at": "2026-02-01T09:10:00Z",
"expires_at": "2028-02-01T09:00:00Z",
"activated_at": "2026-02-03T10:00:00Z",
"retired_at": null,
"disabled_at": null
}{
"code": 401,
"message": "No valid means of authentication was provided",
"classifier": "UNAUTHORIZED"
}{
"code": 403,
"message": "Not allowed to access this resource or feature",
"classifier": "FORBIDDEN"
}{
"code": 404,
"message": "The requested resource was not found.",
"classifier": "NOT_FOUND"
}{
"code": 409,
"message": "Conflict",
"classifier": "CONFLICT"
}{
"code": 422,
"classifier": "VALIDATION_ERROR",
"message": "Validation error",
"validation_errors": [
{
"path": "json-path",
"message": "human readable error message"
}
]
}Authorizations
JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.
Path Parameters
The ID of the certificate the CSR was issued for.
Body
PEM-encoded signed certificate chain from Apple.
"-----BEGIN CERTIFICATE-----\nMIIEhTCCBCugAwIBAgII...\n-----END CERTIFICATE-----"
Response
Success response
"4f8a2c6e-3b9d-4a1f-8e7c-5d2b9f4a6e8c"
pending, active, retired, disabled "active"
1
"2026-02-01T09:10:00Z"
"2028-02-01T09:00:00Z"
"2026-02-03T10:00:00Z"
null
null
curl --request POST \
--url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"signed_cert_chain": "-----BEGIN CERTIFICATE-----\nMIIEhTCCBCugAwIBAgII...\n-----END CERTIFICATE-----"
}
'import requests
url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload"
payload = { "signed_cert_chain": "-----BEGIN CERTIFICATE-----
MIIEhTCCBCugAwIBAgII...
-----END CERTIFICATE-----" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
signed_cert_chain: '-----BEGIN CERTIFICATE-----\nMIIEhTCCBCugAwIBAgII...\n-----END CERTIFICATE-----'
})
};
fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'signed_cert_chain' => '-----BEGIN CERTIFICATE-----
MIIEhTCCBCugAwIBAgII...
-----END CERTIFICATE-----'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload"
payload := strings.NewReader("{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates/{id}/upload")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"signed_cert_chain\": \"-----BEGIN CERTIFICATE-----\\nMIIEhTCCBCugAwIBAgII...\\n-----END CERTIFICATE-----\"\n}"
response = http.request(request)
puts response.read_body{
"id": "4f8a2c6e-3b9d-4a1f-8e7c-5d2b9f4a6e8c",
"state": "active",
"registration_order": 1,
"created_at": "2026-02-01T09:10:00Z",
"expires_at": "2028-02-01T09:00:00Z",
"activated_at": "2026-02-03T10:00:00Z",
"retired_at": null,
"disabled_at": null
}{
"code": 401,
"message": "No valid means of authentication was provided",
"classifier": "UNAUTHORIZED"
}{
"code": 403,
"message": "Not allowed to access this resource or feature",
"classifier": "FORBIDDEN"
}{
"code": 404,
"message": "The requested resource was not found.",
"classifier": "NOT_FOUND"
}{
"code": 409,
"message": "Conflict",
"classifier": "CONFLICT"
}{
"code": 422,
"classifier": "VALIDATION_ERROR",
"message": "Validation error",
"validation_errors": [
{
"path": "json-path",
"message": "human readable error message"
}
]
}