Create Tunnel Certificate

Deprecated

POST/v1/organizations/tunnels/{tunnel_id}/certificates

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Anthropic verifies the gateway's server certificate against this CA when it terminates the inner TLS session. The PEM body must contain exactly one X.509 certificate and no private-key material. A tunnel holds at most two non-archived certificates.

Path parameters

tunnel_id: string

ID of the Tunnel.

Headers

"anthropic-beta": array of "mcp-tunnels-2026-05-19"

Required for all Tunnel endpoints.

Body

ca_certificate_pem: string

PEM-encoded X.509 CA certificate. Must contain exactly one certificate and no private-key material.

maxLength8192

Returns

id: string

ID of the Tunnel Certificate.

archived_at: string or null

RFC 3339 datetime string indicating when the certificate was archived, or null if it is not archived.

formatdate-time

created_at: string

RFC 3339 datetime string indicating when the certificate was registered.

formatdate-time

expires_at: string or null

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

formatdate-time

fingerprint: string

The certificate's SHA-256 fingerprint, as a lowercase hex string.

tunnel_id: string

ID of the Tunnel this certificate is registered against.

type: "tunnel_certificate"

Object type. Always tunnel_certificate for Tunnel Certificates.

defaulttunnel_certificate

Create Tunnel Certificate

cURL

curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
    -H 'Content-Type: application/json' \
    -H 'anthropic-version: 2023-06-01' \
    -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
    -d '{
          "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
        }'

{
  "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
  "type": "tunnel_certificate"
}

Returns Examples

{
  "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
  "type": "tunnel_certificate"
}