---
title: "ACME contract management"
source_url: https://dev.digicert.com/partner-subscriptions-api/acme-contract-management.html
---

Use the ACME Contract Management endpoints to create and manage ACME contracts for automated SSL/TLS certificate provisioning. These endpoints let you create ACME contracts, retrieve contract details, update contract settings, manage SANs, and cancel contracts.

For an overview of the Partner Subscriptions API, see [Partner Subscriptions API](https://dev.digicert.com/md/partner-subscriptions-api.md).

## Why use it?

- Create ACME contracts for automated SSL/TLS certificate provisioning.
- Retrieve ACME contract details, including SANs, organization validation status, auto-renewal status, and contract status.
- Retrieve certificates associated with an ACME contract.
- Update ACME contract organization data and auto-renewal settings.
- Add or remove Subject Alternative Names (SANs) from an ACME contract.
- Manage ACME credentials for an ACME contract.
- Cancel ACME contracts.
- Retrieve the ACME directory URL and External Account Binding (EAB) credentials when creating or regenerating credentials.

## Resource URL

Use the Partner Subscriptions API ACME contract management resource URL to construct ACME Contract Management requests.

```console
https://www.digicert.com/partner-subscription/api/v1/acme/
```

## Authentication and API key scope

ACME Contract Management endpoints require authentication with a subaccount Partner Subscriptions API key.

Include this header to use the subaccount Partner Subscriptions API key in the API request:

```http
X-PARTNER-APIKEY: {{subaccount_partner_api_key}}
```


## Endpoints in this section

<table>
<thead>
<tr>
<th>Method</th>
<th>Endpoint</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>POST</code></td>
<td><code>/acme</code></td>
<td>Create an ACME contract.</td>
</tr>
<tr>
<td><code>GET</code></td>
<td><code>/acme/{acme_contract_id}</code></td>
<td>Get ACME contract details.</td>
</tr>
<tr>
<td><code>PUT</code></td>
<td><code>/acme/{acme_contract_id}</code></td>
<td>Update an ACME contract. This is a full replacement.</td>
</tr>
<tr>
<td><code>PATCH</code></td>
<td><code>/acme/{acme_contract_id}</code></td>
<td>Partially update an ACME contract.</td>
</tr>
<tr>
<td><code>DELETE</code></td>
<td><code>/acme/{acme_contract_id}</code></td>
<td>Cancel an ACME contract.</td>
</tr>
<tr>
<td><code>PUT</code></td>
<td><code>/acme/{acme_contract_id}/sans</code></td>
<td>Add SANs to an ACME contract.</td>
</tr>
<tr>
<td><code>DELETE</code></td>
<td><code>/acme/{acme_contract_id}/sans</code></td>
<td>Remove SANs from an ACME contract.</td>
</tr>
<tr>
<td><code>GET</code></td>
<td><code>/acme/{acme_contract_id}/certificates</code></td>
<td>Retrieve certificates for an ACME contract.</td>
</tr>
<tr>
<td><code>GET</code></td>
<td><code>/acme/{acme_contract_id}/credentials</code></td>
<td>List ACME credentials.</td>
</tr>
<tr>
<td><code>POST</code></td>
<td><code>/acme/{acme_contract_id}/credentials/revoke</code></td>
<td>Revoke all active ACME credentials.</td>
</tr>
<tr>
<td><code>POST</code></td>
<td><code>/acme/{acme_contract_id}/credentials/revoke/{credential_id}</code></td>
<td>Revoke an ACME credential.</td>
</tr>
<tr>
<td><code>POST</code></td>
<td><code>/acme/{acme_contract_id}/credentials/regenerate</code></td>
<td>Regenerate ACME credentials.</td>
</tr>
</tbody>
</table>

## Supported products

The following `product_name_id` values are supported when creating an ACME contract. The product determines the certificate validation type and organization requirements.

### DV products

<table>
<thead>
<tr>
<th><code>product_name_id</code></th>
<th>Product name</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>ssl_dv_rapidssl</code></td>
<td>RapidSSL DV Subscription</td>
</tr>
<tr>
<td><code>ssl_dv_geotrust_flex</code></td>
<td>GeoTrust DV Subscription</td>
</tr>
<tr>
<td><code>ssl_dv_thawte</code></td>
<td>Thawte DV Subscription</td>
</tr>
<tr>
<td><code>wildcard_dv_rapidssl</code></td>
<td>RapidSSL DV Wildcard Subscription</td>
</tr>
</tbody>
</table>

### OV products

<table>
<thead>
<tr>
<th><code>product_name_id</code></th>
<th>Product name</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>ssl_geotrust_truebizid</code></td>
<td>GeoTrust OV Subscription</td>
</tr>
<tr>
<td><code>ssl_thawte_webserver</code></td>
<td>Thawte OV Subscription</td>
</tr>
<tr>
<td><code>ssl_basic</code></td>
<td>Basic OV Subscription</td>
</tr>
<tr>
<td><code>ssl_securesite_flex</code></td>
<td>Secure Site OV Subscription</td>
</tr>
<tr>
<td><code>ssl_securesite_pro</code></td>
<td>Secure Site Pro OV Subscription</td>
</tr>
</tbody>
</table>

### EV products

<table>
<thead>
<tr>
<th><code>product_name_id</code></th>
<th>Product name</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>ssl_ev_geotrust_truebizid</code></td>
<td>GeoTrust EV Subscription</td>
</tr>
<tr>
<td><code>ssl_ev_thawte_webserver</code></td>
<td>Thawte EV Subscription</td>
</tr>
<tr>
<td><code>ssl_ev_basic</code></td>
<td>Basic EV Subscription</td>
</tr>
<tr>
<td><code>ssl_ev_securesite_flex</code></td>
<td>Secure Site EV Subscription</td>
</tr>
<tr>
<td><code>ssl_ev_securesite_pro</code></td>
<td>Secure Site Pro EV Subscription</td>
</tr>
</tbody>
</table>

## Contact requirements when creating or updating organizations

<table>
<thead>
<tr>
<th>Product type</th>
<th>Contact requirements</th>
</tr>
</thead>
<tbody>
<tr>
<td>DV</td>
<td>No organization contacts required.</td>
</tr>
<tr>
<td>OV</td>
<td><code>organization_contact</code> is required. <code>technical_contact</code> is optional.</td>
</tr>
<tr>
<td>EV</td>
<td><code>organization_contact</code> and at least one <code>verified_contact</code> are required. <code>technical_contact</code> is optional.</td>
</tr>
</tbody>
</table>


> **Info**
>
> - For EV products, all verified contacts must include <code>telephone</code> and <code>job_title</code>.
> - Contact information may be required when creating or updating organization details for OV and EV subscriptions. Contact information is accepted in requests but is not returned in ACME contract responses.


## Requests and methods

All ACME Contract Management requests use RESTful URLs and header-based authentication. Where a request body is required, the endpoint accepts JSON data.

ACME Contract Management uses these standard HTTP methods:

- `GET`
- `POST`
- `PUT`
- `PATCH`
- `DELETE`

## Auto-renewal

Use the `auto_renew` parameter to enable or disable automatic renewal of an ACME contract.

When creating an ACME contract, set `auto_renew` to `true` to opt in to automatic renewal. If omitted, `auto_renew` defaults to `false`.

To update the auto-renewal setting after contract creation, use the [Partially update ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/partial-update-acme-contract.md) endpoint. This lets you change `auto_renew` without resubmitting organization details.

## Managing SANs

Use SAN management endpoints to add or remove Subject Alternative Names from an existing ACME contract.

<table>
<thead>
<tr>
<th>Endpoint</th>
<th>Request body fields</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>PUT /acme/{acme_contract_id}/sans</code></td>
<td><code>sans</code></td>
<td>Add domain names to an existing ACME contract.</td>
</tr>
<tr>
<td><code>DELETE /acme/{acme_contract_id}/sans</code></td>
<td><code>sans</code></td>
<td>Remove domain names from an existing ACME contract.</td>
</tr>
</tbody>
</table>

SAN requests use this field:

<table>
<thead>
<tr>
<th>Field</th>
<th>Type</th>
<th>Required</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>sans</code></td>
<td>array[string]</td>
<td>Yes</td>
<td>Array of domain names to add or remove.</td>
</tr>
</tbody>
</table>

## Canceling ACME contracts

Use `DELETE /acme/{acme_contract_id}` to cancel an existing ACME contract.

Canceling a contract permanently deactivates the contract and stops certificate issuance under it.

### Cancellation within 30 days

If the contract is canceled within 30 days of creation, the following actions are irreversible:

- The ACME directory URL associated with the contract becomes inactive.
- ACME clients configured to use the contract can no longer issue or renew certificates.
- SANs associated with the contract are released.
- Eligible SANs are refunded on a per-SAN basis.

### Cancellation outside the 30-day refund window

If the contract is older than 30 days, the endpoint returns `400 Bad Request`.

To disable automatic renewal for an ACME contract outside the 30-day refund window, use the `PATCH /acme/{acme_contract_id}` endpoint to set `auto_renew` to `false`.

## Responses

ACME Contract Management responses return ACME contract data in JSON format.

### Common response codes

<table>
<thead>
<tr>
<th>Status code</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>200 OK</code></td>
<td>Request succeeded and returned ACME contract data.</td>
</tr>
<tr>
<td><code>201 Created</code></td>
<td>ACME contract created successfully.</td>
</tr>
<tr>
<td><code>204 No Content</code></td>
<td>Request succeeded and the response does not include a body.</td>
</tr>
<tr>
<td><code>400 Bad Request</code></td>
<td>The request data is invalid, the contract has been canceled and cannot be modified, or the requested operation is not allowed.</td>
</tr>
<tr>
<td><code>403 Forbidden</code></td>
<td>Access denied.</td>
</tr>
<tr>
<td><code>404 Not Found</code></td>
<td>The ACME contract was not found.</td>
</tr>
</tbody>
</table>

## In this section

- [Create ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/create-acme-contract.md)
- [Update ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/update-acme-contract.md)
- [Partially update ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/partial-update-acme-contract.md)
- [Get ACME contract details](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/get-acme-contract-details.md)
- [Cancel ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/cancel-acme-contract.md)
- [List ACME contract certificates](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/list-acme-contract-certificates.md)
- [Add SANs to ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/add-sans-to-acme-contract.md)
- [Remove SANs from ACME contract](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/remove-sans-from-acme-contract.md)
- [List ACME credentials](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/list-acme-credentials.md)
- [Regenerate ACME credentials](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/regenerate-acme-credentials.md)
- [Revoke all active ACME credentials](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/revoke-all-active-acme-credentials.md)
- [Revoke an ACME credential](https://dev.digicert.com/md/partner-subscriptions-api/acme-contract-management/revoke-an-acme-credential.md)