Tunnel Certificates changedapi/admin/mcp_tunnels/tunnel_certificates
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+98added
Lines−49removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Tunnel Certificates
3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates
4---
5
61# Tunnel Certificates
72
83## Create Tunnel Certificate
94
10**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`
5**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`
116
7**Deprecated**
8
129**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
1310
1411Register a public CA certificate for the tunnel.
from line 15
1815exactly one X.509 certificate and no private-key material. A tunnel
1916holds at most two non-archived certificates.
2017
21### Path Parameters
18### Path parameters
2219
2320- `tunnel_id: string`
2421
2522 ID of the Tunnel.
2623
27### Header Parameters
24### Headers
2825
2926- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
3027
3128 Required for all Tunnel endpoints.
3229
33 - `"mcp-tunnels-2026-05-19"`
30### Body parameters
3431
35### Body Parameters
36
3732- `ca_certificate_pem: string`
3833
3934 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
4035 no private-key material.
4136
37 maxLength: 8192
38
4239### Returns
4340
4441- `id: string`
from line 47
5047 RFC 3339 datetime string indicating when the certificate was archived, or
5148 `null` if it is not archived.
5249
50 format: date-time
51
5352- `created_at: string`
5453
5554 RFC 3339 datetime string indicating when the certificate was registered.
5655
56 format: date-time
57
5758- `expires_at: string or null`
5859
5960 RFC 3339 datetime string indicating when the certificate expires, or
6061 `null` if it does not expire.
6162
63 format: date-time
64
6265- `fingerprint: string`
6366
6467 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 74
7174
7275 Object type. Always `tunnel_certificate` for Tunnel Certificates.
7376
74 - `"tunnel_certificate"`
77 default: tunnel_certificate
7578
7679### Example
7780
78```http
81```bash
7982curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
8083 -H 'Content-Type: application/json' \
8184 -H 'anthropic-version: 2023-06-01' \
from line 88
8588 }'
8689```
8790
88#### Response
91#### Response (200)
8992
9093```json
9194{
from line 104
101104
102105## Get Tunnel Certificate
103106
104**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`
107**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`
105108
109**Deprecated**
110
106111**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
107112
108113Retrieve a single certificate registered on a tunnel by ID.
109114
110### Path Parameters
115### Path parameters
111116
112117- `tunnel_id: string`
113118
from line 122
117122
118123 ID of the Tunnel Certificate.
119124
120### Header Parameters
125### Headers
121126
122127- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
123128
124129 Required for all Tunnel endpoints.
125130
126 - `"mcp-tunnels-2026-05-19"`
127
128131### Returns
129132
130133- `id: string`
from line 139
136139 RFC 3339 datetime string indicating when the certificate was archived, or
137140 `null` if it is not archived.
138141
142 format: date-time
143
139144- `created_at: string`
140145
141146 RFC 3339 datetime string indicating when the certificate was registered.
142147
148 format: date-time
149
143150- `expires_at: string or null`
144151
145152 RFC 3339 datetime string indicating when the certificate expires, or
146153 `null` if it does not expire.
147154
155 format: date-time
156
148157- `fingerprint: string`
149158
150159 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 166
157166
158167 Object type. Always `tunnel_certificate` for Tunnel Certificates.
159168
160 - `"tunnel_certificate"`
169 default: tunnel_certificate
161170
162171### Example
163172
164```http
173```bash
165174curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
166175 -H 'anthropic-version: 2023-06-01' \
167176 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
168177```
169178
170#### Response
179#### Response (200)
171180
172181```json
173182{
from line 192
183192
184193## List Tunnel Certificates
185194
186**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`
195**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`
187196
197**Deprecated**
198
188199**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
189200
190201List the certificates registered on a tunnel.
from line 202
191202
192203Archived certificates are excluded unless `include_archived` is set.
193204
194### Path Parameters
205### Path parameters
195206
196207- `tunnel_id: string`
197208
198209 ID of the Tunnel.
199210
200### Query Parameters
211### Query parameters
201212
202213- `include_archived: optional boolean`
203214
from line 215
204215 Include archived certificates in the results. Archived certificates are
205216 excluded by default.
206217
218 default: false
219
207220- `limit: optional number`
208221
209222 Maximum number of certificates to return.
210223
224 default: 20, maximum: 1000, minimum: 1
225
211226- `page: optional string`
212227
213228 A tunnel has at most two active certificates, so this list is not
214229 paginated.
215230
216### Header Parameters
231### Headers
217232
218233- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
219234
220235 Required for all Tunnel endpoints.
221236
222 - `"mcp-tunnels-2026-05-19"`
223
224237### Returns
225238
226- `data: array of object { id, archived_at, created_at, 4 more }`
239- `data: array of object`
227240
228241 - `id: string`
229242
from line 247
234247 RFC 3339 datetime string indicating when the certificate was archived, or
235248 `null` if it is not archived.
236249
250 format: date-time
251
237252 - `created_at: string`
238253
239254 RFC 3339 datetime string indicating when the certificate was registered.
240255
256 format: date-time
257
241258 - `expires_at: string or null`
242259
243260 RFC 3339 datetime string indicating when the certificate expires, or
244261 `null` if it does not expire.
245262
263 format: date-time
264
246265 - `fingerprint: string`
247266
248267 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 274
255274
256275 Object type. Always `tunnel_certificate` for Tunnel Certificates.
257276
258 - `"tunnel_certificate"`
277 default: tunnel_certificate
259278
260279- `next_page: string or null`
261280
from line 282
263282
264283### Example
265284
266```http
285```bash
267286curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
268287 -H 'anthropic-version: 2023-06-01' \
269288 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
270289```
271290
272#### Response
291#### Response (200)
273292
274293```json
275294{
from line 309
290309
291310## Archive Tunnel Certificate
292311
293**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`
312**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`
294313
314**Deprecated**
315
295316**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
296317
297318Archive a certificate, removing it from the set Anthropic trusts for this tunnel.
from line 321
300321certificate is permitted; the tunnel rejects MCP traffic until a new
301322certificate is added.
302323
303### Path Parameters
324### Path parameters
304325
305326- `tunnel_id: string`
306327
from line 331
310331
311332 ID of the Tunnel Certificate.
312333
313### Header Parameters
334### Headers
314335
315336- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
316337
317338 Required for all Tunnel endpoints.
318339
319 - `"mcp-tunnels-2026-05-19"`
320
321340### Returns
322341
323342- `id: string`
from line 348
329348 RFC 3339 datetime string indicating when the certificate was archived, or
330349 `null` if it is not archived.
331350
351 format: date-time
352
332353- `created_at: string`
333354
334355 RFC 3339 datetime string indicating when the certificate was registered.
335356
357 format: date-time
358
336359- `expires_at: string or null`
337360
338361 RFC 3339 datetime string indicating when the certificate expires, or
339362 `null` if it does not expire.
340363
364 format: date-time
365
341366- `fingerprint: string`
342367
343368 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 375
350375
351376 Object type. Always `tunnel_certificate` for Tunnel Certificates.
352377
353 - `"tunnel_certificate"`
378 default: tunnel_certificate
354379
355380### Example
356381
357```http
382```bash
358383curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
359384 -X POST \
360385 -H 'anthropic-version: 2023-06-01' \
from line 386
361386 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
362387```
363388
364#### Response
389#### Response (200)
365390
366391```json
367392{
from line 400
375400}
376401```
377402
378## Domain Types
403## Domain types
379404
380405### Tunnel Certificate Create Response
381406
382- `TunnelCertificateCreateResponse object { id, archived_at, created_at, 4 more }`
407- `TunnelCertificateCreateResponse object`
383408
384409 - `id: string`
385410
from line 415
390415 RFC 3339 datetime string indicating when the certificate was archived, or
391416 `null` if it is not archived.
392417
418 format: date-time
419
393420 - `created_at: string`
394421
395422 RFC 3339 datetime string indicating when the certificate was registered.
396423
424 format: date-time
425
397426 - `expires_at: string or null`
398427
399428 RFC 3339 datetime string indicating when the certificate expires, or
400429 `null` if it does not expire.
401430
431 format: date-time
432
402433 - `fingerprint: string`
403434
404435 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 442
411442
412443 Object type. Always `tunnel_certificate` for Tunnel Certificates.
413444
414 - `"tunnel_certificate"`
445 default: tunnel_certificate
415446
416447### Tunnel Certificate Retrieve Response
417448
418- `TunnelCertificateRetrieveResponse object { id, archived_at, created_at, 4 more }`
449- `TunnelCertificateRetrieveResponse object`
419450
420451 - `id: string`
421452
from line 457
426457 RFC 3339 datetime string indicating when the certificate was archived, or
427458 `null` if it is not archived.
428459
460 format: date-time
461
429462 - `created_at: string`
430463
431464 RFC 3339 datetime string indicating when the certificate was registered.
432465
466 format: date-time
467
433468 - `expires_at: string or null`
434469
435470 RFC 3339 datetime string indicating when the certificate expires, or
436471 `null` if it does not expire.
437472
473 format: date-time
474
438475 - `fingerprint: string`
439476
440477 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 484
447484
448485 Object type. Always `tunnel_certificate` for Tunnel Certificates.
449486
450 - `"tunnel_certificate"`
487 default: tunnel_certificate
451488
452489### Tunnel Certificate List Response
453490
454- `TunnelCertificateListResponse object { id, archived_at, created_at, 4 more }`
491- `TunnelCertificateListResponse object`
455492
456493 - `id: string`
457494
from line 499
462499 RFC 3339 datetime string indicating when the certificate was archived, or
463500 `null` if it is not archived.
464501
502 format: date-time
503
465504 - `created_at: string`
466505
467506 RFC 3339 datetime string indicating when the certificate was registered.
468507
508 format: date-time
509
469510 - `expires_at: string or null`
470511
471512 RFC 3339 datetime string indicating when the certificate expires, or
472513 `null` if it does not expire.
473514
515 format: date-time
516
474517 - `fingerprint: string`
475518
476519 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 526
483526
484527 Object type. Always `tunnel_certificate` for Tunnel Certificates.
485528
486 - `"tunnel_certificate"`
529 default: tunnel_certificate
487530
488531### Tunnel Certificate Archive Response
489532
490- `TunnelCertificateArchiveResponse object { id, archived_at, created_at, 4 more }`
533- `TunnelCertificateArchiveResponse object`
491534
492535 - `id: string`
493536
from line 541
498541 RFC 3339 datetime string indicating when the certificate was archived, or
499542 `null` if it is not archived.
500543
544 format: date-time
545
501546 - `created_at: string`
502547
503548 RFC 3339 datetime string indicating when the certificate was registered.
504549
550 format: date-time
551
505552 - `expires_at: string or null`
506553
507554 RFC 3339 datetime string indicating when the certificate expires, or
508555 `null` if it does not expire.
509556
557 format: date-time
558
510559 - `fingerprint: string`
511560
512561 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 568
519568
520569 Object type. Always `tunnel_certificate` for Tunnel Certificates.
521570
522 - `"tunnel_certificate"`
571 default: tunnel_certificate
523572
No line in this hunk matches that.