Claude Platform Docs

List Tunnel Certificates

$client->beta->tunnels->certificates->list(string tunnelID, ?bool includeArchived, ?int limit, ?string page, ?list<AnthropicBeta> betas, ?string workspaceID): PageCursor<TunnelCertificate>
GET/v1/tunnels/{tunnel_id}/certificates
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Lists the certificates registered on a tunnel. Archived certificates are excluded unless include_archived is set.

Parameters
tunnelID: string⁠Path parameter

ID of the tunnel (tnl_...).

includeArchived?: optional bool⁠Query parameter

Whether to include archived certificates in the results. Defaults to false.

limit?: optional int⁠Query parameter

Maximum number of certificates to return per page. Defaults to 20, maximum 1000.

page?: optional string⁠Query parameter

Opaque pagination cursor from a previous list_tunnel_certificates response.

betas?: optional list<AnthropicBeta>⁠Header parameter

This endpoint is in beta: requests must send mcp-tunnels-2026-06-22 in this header.

workspaceID?: optional string⁠Header parameter

Optional header to select the Workspace for this request. The value is a Workspace ID (for example, wrkspc_011CZkZaBF1tNoB5wlCeusgy).

Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace.

Returns
class TunnelCertificate { $type = 'tunnel_certificate'; $id; $archivedAt; /* 4 more */ }
"tunnel_certificate" type
string id

Unique identifier for the certificate, prefixed with tcrt_.

?\Datetime archivedAt

RFC 3339 datetime string indicating when the certificate was archived. Null if it is still in the trusted set.

\Datetime createdAt

RFC 3339 datetime string indicating when the certificate was registered.

?\Datetime expiresAt

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

string fingerprint

Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

string tunnelID

ID of the tunnel the certificate is registered against.

List Tunnel Certificates
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->beta->tunnels->certificates->list(
  'tunnel_id',
  includeArchived: true,
  limit: 0,
  page: 'page',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
  workspaceID: 'wrkspc_011CZkZaBF1tNoB5wlCeusgy',
);

var_dump($page);
Returns Examples
Response 200
{
  "data": [
    {
      "id": "id",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "created_at": "2019-12-27T18:11:19.117Z",
      "expires_at": "2019-12-27T18:11:19.117Z",
      "fingerprint": "fingerprint",
      "tunnel_id": "tunnel_id",
      "type": "tunnel_certificate"
    }
  ],
  "next_page": "next_page"
}