Partner Subscriptions API

The Partner Subscriptions API lets you manage partner subscriptions accounts, API keys, ACME contracts, emergency contact emails, account reporting, and billing account links.

What you can do

• Manage API keys: List API keys, get API key details, create API keys for subaccounts, and activate or deactivate API keys.
• Manage ACME contracts: Create, retrieve, update, partially update, cancel, manage SANs, and manage ACME credentials for automated SSL/TLS certificate provisioning.
• Manage accounts: Create subaccounts, manage emergency contact email addresses, and configure account settings.
• View reporting: Retrieve ACME contract reporting grouped by subaccount.
• Link billing: Link a CertCentral billing account to a partner subscriptions account.

Authentication

All Partner Subscriptions API endpoints require authentication with a partner subscriptions API key.

Include this header in each request:

X-PARTNER-APIKEY: {your_api_key}

Some endpoints require additional authentication:

Base URL and resource paths

To construct API requests, the Partner Subscriptions API uses a single base URL and resource-specific endpoint paths.

Base URL

https://www.digicert.com/partner-subscription/api/v1

Partner Subscriptions API accounts and API keys

The Partner Subscriptions API supports parent accounts and subaccounts. API keys are scoped to the account that owns them, and some endpoints require a parent account API key while others require a subaccount API key.

Include this header to use the parent Partner Subscriptions API key in the API request:

X-PARTNER-APIKEY: {{partner_api_key}}

Include this header to use the subaccount Partner Subscriptions API key in the API request:

X-PARTNER-APIKEY: {{subaccount_partner_api_key}}

Important considerations

• Only parent accounts can create subaccounts. Subaccounts cannot create their own subaccounts.
• Only parent accounts can access account reporting. Subaccounts receive a 403 Forbidden response for /account/reporting.
• PUT /acme/{acme_contract_id} is a full replacement. For OV and EV contracts, organization is required. If auto_renew is omitted, it resets to false.
• PATCH /acme/{acme_contract_id} is a partial update. Only the fields included in the request body are updated. Omitted fields retain their current values.
• Changing organization information affects validation. For OV and EV ACME contracts, changing organization details rejects existing validation for that organization and can affect multiple ACME contracts that use the same organization details.
• Emergency contact emails must remain configured. You cannot remove all emergency contact email addresses from an account.
• Billing fallback applies. If a subaccount does not have a linked DigiCert CertCentral® billing account, it uses the parent account billing account.
• Review the endpoint authorization requirements before making a request. Some endpoints require a parent account API key, while others require a subaccount API key.
• ACME contract endpoints require a subaccount Partner Subscriptions API key. Parent account API keys are not accepted for ACME contract operations.

Common operations

Error responses

The API uses standard HTTP status codes to indicate success or failure. Error responses include a JSON body with additional details.