Tunnel Certificates

Create Tunnel Certificate

Deprecated

POST/v1/organizations/tunnels/{tunnel_id}/certificates

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

List Tunnel Certificates

Deprecated

GET/v1/organizations/tunnels/{tunnel_id}/certificates

Get Tunnel Certificate

Deprecated

GET/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}

Archive Tunnel Certificate

Deprecated

POST/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive

Models

BetaOrganizationTunnelCertificate object{ type, id, archived_at, 4 more }

type: "tunnel_certificate"

Object type. Always tunnel_certificate for Tunnel Certificates.

defaulttunnel_certificate

id: string

ID of the Tunnel Certificate.

archived_at: string or null

RFC 3339 datetime string indicating when the certificate was archived, or null if it is not archived.

formatdate-time

created_at: string

RFC 3339 datetime string indicating when the certificate was registered.

formatdate-time

expires_at: string or null

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

formatdate-time

fingerprint: string

The certificate's SHA-256 fingerprint, as a lowercase hex string.

tunnel_id: string

ID of the Tunnel this certificate is registered against.