{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/dnsmint-com/json-schema/dnsmint-com-managed-certificate-schema.json",
  "title": "ManagedCertificate",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/dnsmint-com-api-openapi.json#/components/schemas/ManagedCertificate",
  "type": "object",
  "properties": {
    "certificate": {
      "type": "string",
      "description": "PEM chain, leaf first."
    },
    "private_key": {
      "type": "string",
      "description": "PKCS#8 PEM. Present only on managed, where we generated it - our copy is encrypted at rest under a key separate from every other secret we store, and is replaced at every renewal. Absent on csr, because you hold that key and we never had it."
    },
    "privateKey": {
      "type": "string",
      "description": "Deprecated spelling, still accepted. Use `private_key`.",
      "deprecated": true
    },
    "names": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "expires_at": {
      "type": "string",
      "format": "date-time"
    },
    "expiresAt": {
      "type": "string",
      "format": "date-time",
      "deprecated": true,
      "description": "Deprecated spelling, still accepted. Use `expires_at`."
    },
    "ca": {
      "type": "string",
      "enum": [
        "letsencrypt",
        "google"
      ],
      "description": "Which CA signed this certificate. The issuer, not the preference on the hostname - a renewal can land on a different CA than the original request asked for."
    },
    "issuer": {
      "type": "string",
      "description": "The CA's display name, for a log line or a status page."
    },
    "mode": {
      "type": "string",
      "enum": [
        "csr",
        "managed"
      ],
      "description": "The hostname's certificate mode, so a client can tell whether private_key should be there."
    }
  }
}