---
title: List Tunnel Certificates
url: https://platform.claude.com/docs/en/api/cli/beta/tunnels/certificates/list
---

# List Tunnel Certificates

`$ ant beta:tunnels:certificates list`

**GET** `/v1/tunnels/{tunnel_id}/certificates`

The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.

Lists the certificates registered on a tunnel. Archived certificates are excluded unless include_archived is set.

## Parameters

- `--tunnel-id: string` (path parameter)

  ID of the tunnel (`tnl_...`).

- `--include-archived: optional boolean` (query parameter)

  Whether to include archived certificates in the results. Defaults to false.

- `--limit: optional number` (query parameter)

  Maximum number of certificates to return per page. Defaults to 20, maximum 1000.

  format: int32

- `--page: optional string` (query parameter)

  Opaque pagination cursor from a previous `list_tunnel_certificates` response.

- `--beta: optional array of AnthropicBeta` (header parameter)

  Optional header to specify the beta version(s) you want to use.

- `--workspace-id: optional string` (header parameter)

  Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).

  Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace.

## Returns

- `BetaListTunnelCertificatesResponse: object`

  The tunnel's certificates.

  - `data: array of BetaTunnelCertificate`

    List of certificates, ordered by created_at descending.

    - `type: "tunnel_certificate"`

    - `id: string`

      Unique identifier for the certificate, prefixed with `tcrt_`.

    - `archived_at: string`

      RFC 3339 datetime string indicating when the certificate was archived. Null if it is still in the trusted set.

      format: date-time

    - `created_at: string`

      RFC 3339 datetime string indicating when the certificate was registered.

      format: date-time

    - `expires_at: string`

      RFC 3339 datetime string indicating when the certificate expires, or `null` if it does not expire.

      format: date-time

    - `fingerprint: string`

      Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

    - `tunnel_id: string`

      ID of the tunnel the certificate is registered against.

  - `next_page: string`

    Pagination cursor for the next page, or null if no more results.

## Example

```bash
ant beta:tunnels:certificates list \
  --api-key my-anthropic-api-key \
  --tunnel-id tunnel_id
```

### Response (200)

```json
{
  "data": [
    {
      "id": "id",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "created_at": "2019-12-27T18:11:19.117Z",
      "expires_at": "2019-12-27T18:11:19.117Z",
      "fingerprint": "fingerprint",
      "tunnel_id": "tunnel_id",
      "type": "tunnel_certificate"
    }
  ],
  "next_page": "next_page"
}
```