# Tunnel Certificates ## Create Tunnel Certificate ### Path parameters ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## List Tunnel Certificates ### Path parameters ### Query parameters ### Headers ### Returns ### Example #### Response (200) ## Get Tunnel Certificate ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Archive Tunnel Certificate ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Domain types ### Beta Organization Tunnel Certificate
The whole hunk
832 lines, new page
/
lines
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Tunnel Certificates
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates
---
# Tunnel Certificates
## Create Tunnel Certificate
**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Register a public CA certificate for the tunnel.
Anthropic verifies the gateway's server certificate against this CA
when it terminates the inner TLS session. The PEM body must contain
exactly one X.509 certificate and no private-key material. A tunnel
holds at most two non-archived certificates.
### Path parameters
- `tunnel_id: string`
ID of the Tunnel.
### Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
### Body parameters
- `ca_certificate_pem: string`
PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
no private-key material.
maxLength: 8192
### Returns
- `BetaOrganizationTunnelCertificate object`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
}'
```
#### Response (200)
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
## List Tunnel Certificates
**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the certificates registered on a tunnel.
Archived certificates are excluded unless `include_archived` is set.
### Path parameters
- `tunnel_id: string`
ID of the Tunnel.
### Query parameters
- `include_archived: optional boolean`
Include archived certificates in the results. Archived certificates are
excluded by default.
default: false
- `limit: optional number`
Maximum number of certificates to return.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
A tunnel has at most two active certificates, so this list is not
paginated.
### Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
Cut at 300 lines. The page has the rest.