The certificate versions this company has enrolled
ADMIN and above. Status and validity only: no storage location and no secret, because this route reads through the same repository the machine surface uses and that repository cannot read an envelope's location at all.
ADMIN and above. Status and validity only: no storage location and no secret, because this route reads through the same repository the machine surface uses and that repository cannot read an envelope's location at all.
Authorization
consoleSession Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.
In: cookie
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/certificates" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "console.1", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda", "certificates": [ {} ]}The request and error log GET GET
The read that exists so a rejected comprobante does not become an email to support. One entry per SUNAT attempt -- retries are never collapsed -- plus operations that never reached SUNAT at all, each with the verbatim response code and description, the transport classification, and the PUBLIC prefix of the credential that started it. The free-form operations.result jsonb is deliberately NOT published: nothing bounds what a future workflow writes into it.
Enrol a new certificate version POST POST
ADMIN and above, which is the floor ADR 0016 point 7 sets for companies and the one 000060 already applies to minting a credential that carries certificates:manage. Takes the four secrets SUNAT needs: the PKCS#12, its password, and the SOL user and password that authenticate the submission. None of them touches a database connection — they cross the signing service binding and are sealed there. The result is a DRAFT that signs nothing; whatever certificate is signing today keeps signing until an activation probe is accepted by SUNAT.