---
title: "Upload the webhook client certificate"
canonical: "https://bird.com/docs/api/reference/submit-workspace-webhook-client-certificate"
---

# Upload the webhook client certificate

`POST /v1/workspace/webhook-client-certificate/certificate`

Uploads the certificate that your certificate authority signed for the waiting signing request. It replaces the certificate in use. Test sends use the new certificate at once. Deliveries can keep presenting the previous one for up to a few minutes, so keep accepting both until then. Without a waiting signing request, this returns 409. A certificate that does not match the key of the signing request, has no `clientAuth` extended key usage or is outside its validity period returns an error. So does an intermediate certificate that is not a CA certificate in its validity period that signed the certificate before it. If webhook mTLS is not enabled for this workspace, this returns 422.

## Servers

- `https://{region}.platform.bird.com`: Regional API endpoint. Use the host for the region your organization is hosted in. Official Bird SDKs and the CLI select it automatically from your API key, so you rarely need to set it by hand.
  - `region`: `us1`, `eu1`. Default: `us1`. The region your organization's data is hosted in.
- `https://platform.bird.com`: Region-independent endpoint for authentication and account administration.
- `http://localhost:8080`: Local development.

## Authentication

Use one authentication option:

- `BearerAuth`: HTTP bearer authentication. Pass the API key as a bearer token in the `Authorization` header. Workspace
keys use `bk_{region}_*`; organization master keys use `bm_{region}_*`.
The prefix identifies the region and selects the
API endpoint. Official Bird SDKs and the CLI derive the region from the key.

- `CookieAuth`: Send `bird_session` in cookie. Session cookie set after signing in to the Bird dashboard. The cookie
value is an opaque session token; no session data is stored in the cookie
itself.

## Code samples

**cURL**

```sh
curl -X POST "https://us1.platform.bird.com/v1/workspace/webhook-client-certificate/certificate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "certificate_chain": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n"
  }'
```

Examples: [cURL](/docs/api/reference/submit-workspace-webhook-client-certificate.curl.md)

## Example response `200`

```json
{
  "state": "disabled",
  "crl_check": "disabled",
  "certificate": {
    "subject": "CN=bird-webhooks,O=Example Inc.",
    "issuer": "CN=Example Client CA,O=Example Inc.",
    "serial_number": "4f2a91c0d3",
    "fingerprint_sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
  },
  "signing_request": {
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...\n-----END CERTIFICATE REQUEST-----\n"
  }
}
```

## Header parameters

- `Idempotency-Key` (string, optional)

  Client-supplied key. On operations supporting request deduplication, a retained
  response is replayed for duplicate requests with the same key within the
  idempotency window (3 hours by default). This protection requires a workspace,
  organization, or staff-account scope. User-only and unscoped unauthenticated operations,
  streams, and operations with a separate replay contract do not use this
  response replay.

  On a supported operation, if idempotency protection is unavailable before execution, the API returns
  `503 IdempotencyUnavailable` (E01033) without executing this attempt. Retry with
  backoff using the same key and request. An operation that takes effect before
  its response is retained can still execute again on retry.

  Two distinct 409 errors signal misuse:

  - `request_in_progress` (E01004): The same key is currently being
    processed by a concurrent request. Wait briefly and retry. The lock expires within 30 seconds.
  - `idempotency_key_reuse` (E01005): The same key has already completed
    against a different request body or method. Generate a new key.

  Recommended key format is `<event-type>/<entity-id>` (for example `welcome-user/usr_abc123`).
- `X-Workspace-Id` (string, optional): Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.
- `X-Organization-Id` (string, optional): Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

## Request body

- `certificate_chain` (string, required): PEM-encoded certificates, the signed certificate first, then any intermediate certificates.

## Response body

- `state` (string, required)

  Whether client certificates are off (`disabled`), checked while the previous behavior stays available (`evaluating`), or required (`enforced`).

  Possible values: `disabled`, `evaluating`, `enforced`
- `crl_check` (string, required)

  How a certificate chain is checked against the certificate revocation list (CRL) that each certificate names. With `full_chain`, the leaf certificate and each intermediate certificate below the trusted root are checked. A certificate that names no CRL is not checked.

  Possible values: `disabled`, `full_chain`
- `certificate` (nullable object, required): The certificate in use. `null` until you upload one.
- `certificate.subject` (string, required): The distinguished name of the certificate.
- `certificate.issuer` (string, required): The distinguished name of the certificate authority that signed it.
- `certificate.serial_number` (string, required): The serial number, in lowercase hexadecimal.
- `certificate.fingerprint_sha256` (string, required): The SHA-256 fingerprint of the certificate, in lowercase hexadecimal.
- `certificate.not_before` (string, required): Start of the validity period.
- `certificate.not_after` (string, required): End of the validity period.
- `signing_request` (nullable object, required): The signing request that waits for a signed certificate. `null` when none waits.
- `signing_request.csr` (string, required): The PEM-encoded PKCS #10 certificate signing request.
- `signing_request.created_at` (string, required): When we created the signing request.
- `updated_at` (nullable string, required): When the certificate or its state last changed. `null` until the first change.

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)