Claude Platform Docs

Certificates

Create Tunnel Certificate
$client->beta->tunnels->certificates->create(string tunnelID, string caCertificatePEM, ?list<AnthropicBeta> betas, ?string workspaceID): TunnelCertificate
POST/v1/tunnels/{tunnel_id}/certificates
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Get Tunnel Certificate
$client->beta->tunnels->certificates->retrieve(string certificateID, string tunnelID, ?list<AnthropicBeta> betas, ?string workspaceID): TunnelCertificate
GET/v1/tunnels/{tunnel_id}/certificates/{certificate_id}
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

List Tunnel Certificates
$client->beta->tunnels->certificates->list(string tunnelID, ?bool includeArchived, ?int limit, ?string page, ?list<AnthropicBeta> betas, ?string workspaceID): PageCursor<TunnelCertificate>
GET/v1/tunnels/{tunnel_id}/certificates
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Archive Tunnel Certificate
$client->beta->tunnels->certificates->archive(string certificateID, string tunnelID, ?list<AnthropicBeta> betas, ?string workspaceID): TunnelCertificate
POST/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Models
class TunnelCertificate { $type = 'tunnel_certificate'; $id; $archivedAt; /* 4 more */ }
"tunnel_certificate" type
string id

Unique identifier for the certificate, prefixed with tcrt_.

?\Datetime archivedAt

RFC 3339 datetime string indicating when the certificate was archived. Null if it is still in the trusted set.

\Datetime createdAt

RFC 3339 datetime string indicating when the certificate was registered.

?\Datetime expiresAt

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

string fingerprint

Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

string tunnelID

ID of the tunnel the certificate is registered against.