from line 1
1---
2title: Create Tunnel Certificate
3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/create
4---
1# Create Tunnel Certificate
52
6## Create Tunnel Certificate
3**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`
74
8**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`
5**Deprecated**
96
107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
118
from line 13
1613exactly one X.509 certificate and no private-key material. A tunnel
1714holds at most two non-archived certificates.
1815
19### Path Parameters
16## Path parameters
2017
2118- `tunnel_id: string`
2219
2320 ID of the Tunnel.
2421
25### Header Parameters
22## Headers
2623
2724- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
2825
2926 Required for all Tunnel endpoints.
3027
31 - `"mcp-tunnels-2026-05-19"`
28## Body parameters
3229
33### Body Parameters
34
3530- `ca_certificate_pem: string`
3631
3732 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
3833 no private-key material.
3934
40### Returns
35 maxLength: 8192
4136
37## Returns
38
4239- `id: string`
4340
4441 ID of the Tunnel Certificate.
from line 45
4845 RFC 3339 datetime string indicating when the certificate was archived, or
4946 `null` if it is not archived.
5047
48 format: date-time
49
5150- `created_at: string`
5251
5352 RFC 3339 datetime string indicating when the certificate was registered.
5453
54 format: date-time
55
5556- `expires_at: string or null`
5657
5758 RFC 3339 datetime string indicating when the certificate expires, or
5859 `null` if it does not expire.
5960
61 format: date-time
62
6063- `fingerprint: string`
6164
6265 The certificate's SHA-256 fingerprint, as a lowercase hex string.
from line 72
6972
7073 Object type. Always `tunnel_certificate` for Tunnel Certificates.
7174
72 - `"tunnel_certificate"`
75 default: tunnel_certificate
7376
74### Example
77## Example
7578
76```http
79```bash
7780curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
7881 -H 'Content-Type: application/json' \
7982 -H 'anthropic-version: 2023-06-01' \
from line 86
8386 }'
8487```
8588
86#### Response
89### Response (200)
8790
8891```json
8992{
No line in this hunk matches that.