Claude Platform Docs

Certificates

Create Tunnel Certificate
beta.tunnels.certificates.create(tunnel_id, **kwargs) -> BetaTunnelCertificate
POST/v1/tunnels/{tunnel_id}/certificates

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Get Tunnel Certificate
beta.tunnels.certificates.retrieve(certificate_id, **kwargs) -> BetaTunnelCertificate
GET/v1/tunnels/{tunnel_id}/certificates/{certificate_id}

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

List Tunnel Certificates
beta.tunnels.certificates.list(tunnel_id, **kwargs) -> SyncPageCursor[BetaTunnelCertificate]
GET/v1/tunnels/{tunnel_id}/certificates

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Archive Tunnel Certificate
beta.tunnels.certificates.archive(certificate_id, **kwargs) -> BetaTunnelCertificate
POST/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Models
class BetaTunnelCertificate: type: "tunnel_certificate"; id; archived_at; ... # 4 more

A CA certificate attached to a tunnel.

type: Literal["tunnel_certificate"]
id: str

Unique identifier for the certificate, prefixed with tcrt_.

archived_at: Optional[datetime]

RFC 3339 datetime string indicating when the certificate was archived. Null if it is still in the trusted set.

formatdate-time
created_at: datetime

RFC 3339 datetime string indicating when the certificate was registered.

formatdate-time
expires_at: Optional[datetime]

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

formatdate-time
fingerprint: str

Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

tunnel_id: str

ID of the tunnel the certificate is registered against.