--- title: "Private trust stack reference" description: "Look up identifiers, response structures, authentication methods, and endpoints used by the solution." source_url: https://dev.digicert.com/solutions/private-trust-stack/reference.html --- # Private trust stack reference Look up identifiers, response structures, authentication methods, and endpoints used by the solution. Use this reference to trace identifiers across DigiCert® Account Manager, DigiCert® Private CA, DigiCert® Device Trust Manager, and DigiCert® Software Trust Manager. It also identifies response structures, authentication methods, and API-specific request formats. ## Implementation status and saved values Record non-secret resource IDs and references to entries in your approved secret manager. Never record API tokens, passcodes, or private-key values in this status record. Use the linked phase checkpoint to determine whether a phase is complete. | Checkpoint | Workstream | Completion evidence | Values to retain | Next step | |-------|-------|---------------------|----------------------|--------------------------| | [Establish the account foundation](https://dev.digicert.com/md/solutions/private-trust-stack/phase-1-account-foundation.md#phase-1-checkpoint) | Shared foundation | Service identity with limited roles and matching client certificate verified. | `account_id`, `organization_id`, service-user and credential IDs, secret-manager references for `service_api_token` and `client.key` | [Prepare the private trust domain](https://dev.digicert.com/md/solutions/private-trust-stack/phase-2-private-trust-anchor.md) | | [Prepare the private trust domain](https://dev.digicert.com/md/solutions/private-trust-stack/phase-2-private-trust-anchor.md#phase-2-checkpoint) | Shared foundation | CA assignments, certificate paths, and approved root fingerprint verified. | CA IDs, `root-ca.pem`, workload issuing-CA certificates | [Configure the device certificate infrastructure](https://dev.digicert.com/md/solutions/private-trust-stack/phase-3-device-infrastructure.md) and [configure and test private code signing](https://dev.digicert.com/md/solutions/private-trust-stack/phase-5-code-signing.md) in either order or in parallel. | | [Configure the device certificate infrastructure](https://dev.digicert.com/md/solutions/private-trust-stack/phase-3-device-infrastructure.md#phase-3-checkpoint) | Device identity | Eligible template, division, profile, and policy verified. | `division_id`, `device_certificate_profile_id`, `certificate_policy_id` | [Enroll and verify a device](https://dev.digicert.com/md/solutions/private-trust-stack/phase-4-device-enrollment.md) | | [Enroll and verify a device](https://dev.digicert.com/md/solutions/private-trust-stack/phase-4-device-enrollment.md#phase-4-checkpoint) | Device identity | Passcode enrollment, key match, and device certificate path verified. | Authentication, passcode, group, request, and device-certificate IDs | [Configure and test private code signing](https://dev.digicert.com/md/solutions/private-trust-stack/phase-5-code-signing.md) if code signing is incomplete. Otherwise, [operate this solution](https://dev.digicert.com/md/solutions/private-trust-stack/operate.md). | | [Configure and test private code signing](https://dev.digicert.com/md/solutions/private-trust-stack/phase-5-code-signing.md#phase-5-checkpoint) | Code signing | Signing certificate path and returned signature verified. | Template, profile, keypair, certificate, and signature IDs | [Configure the device certificate infrastructure](https://dev.digicert.com/md/solutions/private-trust-stack/phase-3-device-infrastructure.md) if device identity is incomplete. Otherwise, [operate this solution](https://dev.digicert.com/md/solutions/private-trust-stack/operate.md). | ## Cross-product data flow | Data | Created or selected in | Used in | Format and handling | |------|------------------------|-------------|---------------------| | `account_id` | Account Manager account list | All setup phases | UUID selected from the account response array. | | `organization_id` | Account Manager organization list | Software Trust Manager private trust certificate profile | UUID for an active organization in `account_id`. | | `service_user_id` | Account Manager create-user response | Credential administration and audit | UUID. It is not an authentication secret. | | `api_token_id` | Create-user response `api_token.id` | Credential removal and audit | UUID for the returned-once service API token. | | `service_api_token` | Create-user response `api_token.token` | Setup calls authenticated with an API token and Software Trust Manager multi-factor authentication | Secret API token that is returned once. Send it in the `x-api-key` header. It is not an OAuth bearer token. | | `client_auth_certificate_id` | Account Manager create-client-authentication-certificate response | Credential removal and audit | UUID for the credential created with the service user identified by `service_user_id`. | | `client.crt`, `client.key` | Account Manager client authentication certificate creation | Software Trust Manager keypair creation and signing | Generate the private key locally and submit only its certificate signing request (CSR). Protect the PEM private key as a secret. | | `root_ca_id` | DigiCert Private CA `GET /ca` | CA certificate download | Identifier selected from the active root CA record. | | `root-ca.pem` | DigiCert Private CA CA-download operation | Relying-party trust stores and path validation | Trust anchor. Validate the fingerprint before distribution. | | `device_ica_id` | Active intermediate from the DigiCert Private CA `GET /ca` operation | Device Trust Manager certificate policy | Identifier selected from the active device issuing-CA record. | | `signing_ica_id` | Active intermediate from the DigiCert Private CA `GET /ca` operation | Software Trust Manager private trust certificate profile | Identifier selected from the active signing issuing-CA record. It can equal `device_ica_id` when your public key infrastructure (PKI) policy permits a shared issuer. | | `device-issuing-ca.pem` | DigiCert Private CA CA-download operation | Device certificate-path construction | Device intermediate certificate. Do not install it as the trust anchor. | | `signing-issuing-ca.pem` | DigiCert Private CA CA-download operation | Signing certificate-path construction | Signing intermediate certificate. Do not install it as the trust anchor. | | `device_certificate_template_id` | Device Trust Manager certificate-template list | Device certificate profile | UUID specific to Device Trust Manager. The template must require the client authentication extended key usage (EKU) and support this request's key and subject sources. | | `code_signing_certificate_template_id` | Software Trust Manager certificate-template list | Private trust certificate profile in the same product | UUID specific to Software Trust Manager. The template must be active, custom, available to the account, and require `code_signing`. | | `primary_rendezvous_zone_id` | Device Trust Manager rendezvous-zone list `records[].id` | Device Trust Manager division creation | UUID for an enabled zone assigned to the account with `is_primary_usage: true`. | | `division_id` | Device Trust Manager division list `records[].id` | Device profile, policy, and group | UUID. The create response does not supply this ID directly. | | `device_certificate_profile_id` | Device Trust Manager create-profile response | Device Trust Manager certificate policy | UUID. | | `certificate_policy_id` | Device Trust Manager create-policy response | Group assignment and enrollment | `IOT_` in the API examples. | | `authentication_policy_id` | Device Trust Manager create-authentication-policy response | Passcode and group policy assignment | UUID. | | `passcode_id` | Device Trust Manager create-passcode response | Credential removal | UUID. | | `passcode` | Client-supplied create-passcode value | Request-certificate `x-passcode` header | Secret. The create response might include it, so protect the complete response and continue using the original secret-store value. | | `device_group_id` | Device Trust Manager group list `records[].id` | Device certificate request | UUID required by this solution to apply the group authentication override. | | `certificate_request_id` | Device Trust Manager certificate-issuance response | Approval polling, troubleshooting, and audit correlation | Identifier for the device certificate request. | | `device_certificate_id` | Device Trust Manager certificate-issuance response | Approved-certificate download, inventory, and lifecycle operations | Identifier for the issued device certificate. | | `signing_profile_id` | Software Trust Manager create-profile response | Signing-certificate generation | UUID. | | `keypair_id` | Software Trust Manager create-keypair response | Certificate generation and signing paths | UUID. Keypair creation requires an API token and mutual TLS (mTLS). | | `signing_certificate_id` | Software Trust Manager certificate-generation response | Certificate identification and lifecycle tracking | Identifier for the private code-signing certificate. | | `signature_id` | Software Trust Manager sign response | Request identification and retained validation evidence | Identifier for the returned signature operation. | ## Response structures | Operation | Response structure | |-----------|--------------------| | Account Manager list accounts | Top-level JSON array. | | Account Manager list organizations | Top-level JSON array. | | Account Manager list roles | Object keyed by Manager, each containing a role array. | | DigiCert Private CA list CAs | Object with pagination metadata. CA records are in `items`, but the API reference does not document pagination parameters. Stop without selecting a CA when `total` differs from the number of returned items. | | Device Trust Manager list certificate templates | Paginated object. Templates are in `records`; `offset` is the index of the first record. | | Software Trust Manager list certificate templates | Paginated object. Templates are in `items`; `offset` is the page index. | | Device Trust Manager list divisions | Paginated object. Divisions are in `records`; `offset` is the index of the first record. | | Device Trust Manager list device groups | Paginated object. Groups are in `records`; `offset` is the index of the first record. | | Device Trust Manager create division or group | Response with status information but no resource ID. Retrieve the new ID by listing resources and selecting the exact name. | | Device Trust Manager create certificate policy | Object with the created policy in `certificate_policy`. | ## Authentication matrix | API operations | Host | Headers | Client certificate | |-----------------|------|---------|--------------------| | Account Manager setup | Tenant host | API token in `x-api-key` | No | | DigiCert Private CA setup | Tenant host | API token in `x-api-key` | No | | Device Trust Manager administrative setup | Tenant host | API token in `x-api-key` | No | | Device certificate request using passcode | Tenant host | `x-passcode`. Omit `x-api-key`. | No | | Software Trust Manager profile and certificate setup | Tenant host | API token in `x-api-key` | No for the operations in the current API reference. | | Software Trust Manager keypair creation and signing | `clientauth.` tenant host | API token in `x-api-key` | Yes. The certificate and key must belong to the identity associated with the API token. | ## Endpoint quick reference The examples use this host: ```text https://demo.one.digicert.com ``` | Method | Full path | Phase | |--------|-----------|-------| | GET | `/account/api/v1/account` | 1 | | GET | `/account/api/v1/role` | 1 | | GET | `/account/api/v1/organization` | 1 | | POST | `/account/api/v1/user` | 1 | | POST | `/account/api/v1/client-auth-certificate` | 1 | | GET | `/certificate-authority/api/v1/ca` | 2 | | POST | `/certificate-authority/api/v1/ca/{ica_id}/accounts` | 2 | | GET | `/certificate-authority/api/v1/ca/{ca_id}/download?format=pem` | 2 | | GET | `/devicetrustmanager/certificate-configuration-service/api/v1/certificate-template` | 3 | | GET | `/devicetrustmanager/api/v4/rendezvous-zone` | 3 | | POST | `/devicetrustmanager/api/v4/division` | 3 | | GET | `/devicetrustmanager/api/v4/division` | 3 | | POST | `/devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile` | 3 | | POST | `/devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy` | 3 | | POST | `/devicetrustmanager/authentication-service/api/v1/authentication-policy` | 4 | | POST | `/devicetrustmanager/authentication-service/api/v1/passcode` | 4 | | POST | `/devicetrustmanager/api/v4/device-group` | 4 | | GET | `/devicetrustmanager/api/v4/device-group` | 4 | | POST | `/devicetrustmanager/certificate-issuance-service/api/v2/certificate` | 4 | | GET | `/devicetrustmanager/certificate-issuance-service/api/v2/certificate-request/{certificate_request_id}/status` | 4 | | POST | `/devicetrustmanager/certificate-issuance-service/api/v2/certificate/{certificate_id}/download-approved-certificate` | 4 | | GET | `/signingmanager/api/v1/certificate-templates` | 5 | | POST | `/signingmanager/api/v1/certificate-profiles` | 5 | | POST | `/signingmanager/api/v1/keypairs` | 5 | | POST | `/signingmanager/api/v1/keypairs/{keypair_id}/certificates` | 5 | | POST | `/signingmanager/api/v1/keypairs/{keypair_id}/sign` | 5 | For Software Trust Manager keypair creation and signing, change the host to: ```text https://clientauth.demo.one.digicert.com ``` ## API-specific request formats ### Select a template from the correct product Use the template endpoint in the product that creates the profile: | Product | Response structure | Required checks for this manual | |----------|--------------------|---------------------------------| | Device Trust Manager | `GET /devicetrustmanager/certificate-configuration-service/api/v1/certificate-template` → `records` | Exact name, `ACTIVE`, `custom`, X.509 end-entity certificate, target-account access, `client_authentication`, RSA-2048 through `key_types` or the `key_gen` range, user-supplied common name, and required client authentication EKU. | | Software Trust Manager | `GET /signingmanager/api/v1/certificate-templates` → `items` | Exact name, `ACTIVE`, `CUSTOM`, `TEST`, target-account access, `code_signing`, and required code-signing EKU. | The DigiCert Private CA `GET /template` operation returns a third template resource. You cannot use its IDs in Device Trust Manager or Software Trust Manager profile requests. ### Device Trust group policy assignment ```json { "policy_id": "IOT_", "assignment_name": "Private device bootstrap certificate", "type": "bootstrapCertificate", "auth_policy_id": "", "status": "ACTIVE" } ``` ### Device Trust server-side certificate request ```json { "certificate_policy_id": "IOT_", "device_group_id": "", "certificate_profile_attributes": [ { "id": "subject.common_name", "value": "device-001.example.internal" } ], "server_side_key_gen": true, "key_type": "rsa_2048", "private_key_format": "pem", "private_key_syntax": "pkcs8", "response_with_certificate_only": false, "include_certificate_chain": true, "split_certificate_response": true } ``` ### Software Trust private trust certificate profile The current API request uses this format: ```json { "profile_type": "CA_PROFILE", "ca_certificate_profile_request": { "certificate_template_id": "", "profile": "TEST", "body": [], "organization": { "id": "" }, "ca": { "id": "" } } } ``` ## Related pages - [Operate and maintain the solution](https://dev.digicert.com/md/solutions/private-trust-stack/operate.md). - [Troubleshoot failed runs or requests with uncertain results](https://dev.digicert.com/md/solutions/private-trust-stack/troubleshoot.md). - [Return to the solution overview](https://dev.digicert.com/md/solutions/private-trust-stack.md).