Repository Public
1---2title: Certificates3url: https://platform.claude.com/docs/en/api/beta/tunnels/certificates4---56# Certificates78## Create Tunnel Certificate910**POST** `/v1/tunnels/{tunnel_id}/certificates`1112The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.1314Registers a public CA certificate on a tunnel. Anthropic verifies the gateway's server certificate against this CA when it terminates the inner TLS session. A tunnel holds at most two non-archived certificates.1516### Path parameters1718- `tunnel_id: string`1920### Headers2122- `"anthropic-beta": optional array of AnthropicBeta`2324 Optional header to specify the beta version(s) you want to use.2526 - `string`2728 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`2930 - `"message-batches-2024-09-24"`3132 - `"prompt-caching-2024-07-31"`3334 - `"computer-use-2024-10-22"`3536 - `"computer-use-2025-01-24"`3738 - `"pdfs-2024-09-25"`3940 - `"token-counting-2024-11-01"`4142 - `"token-efficient-tools-2025-02-19"`4344 - `"output-128k-2025-02-19"`4546 - `"files-api-2025-04-14"`4748 - `"mcp-client-2025-04-04"`4950 - `"mcp-client-2025-11-20"`5152 - `"dev-full-thinking-2025-05-14"`5354 - `"interleaved-thinking-2025-05-14"`5556 - `"code-execution-2025-05-22"`5758 - `"extended-cache-ttl-2025-04-11"`5960 - `"context-1m-2025-08-07"`6162 - `"context-management-2025-06-27"`6364 - `"model-context-window-exceeded-2025-08-26"`6566 - `"skills-2025-10-02"`6768 - `"fast-mode-2026-02-01"`6970 - `"output-300k-2026-03-24"`7172 - `"user-profiles-2026-03-24"`7374 - `"user-profiles-2026-08-18"`7576 - `"user-profiles-2026-09-04"`7778 - `"advisor-tool-2026-03-01"`7980 - `"managed-agents-2026-04-01"`8182 - `"cache-diagnosis-2026-04-07"`8384 - `"dreaming-2026-04-21"`8586 - `"thinking-token-count-2026-05-13"`8788 - `"server-side-fallback-2026-06-01"`8990 - `"server-side-fallback-2026-07-01"`9192 - `"fallback-credit-2026-06-01"`9394 - `"fallback-credit-2026-07-01"`9596 - `"agent-memory-2026-07-22"`9798 - `"mid-conversation-tool-changes-2026-07-01"`99100 - `"compact-2026-01-12"`101102 - `"computer-use-2025-11-24"`103104 - `"mcp-tunnels-2026-06-22"`105106 - `"structured-outputs-2025-11-13"`107108 - `"task-budgets-2026-03-13"`109110 - `"thinking-display-updates-2026-08-18"`111112 - `"ce-user-management-2026-07-13"`113114 - `"mid-conversation-output-config-2026-07-01"`115116 - `"thinking-binding-controls-2026-08-01"`117118 - `"mid-conversation-system-clear-at-2026-08-21"`119120 - `"compact-2026-09-04"`121122- `"anthropic-workspace-id": optional string`123124### Body parameters125126- `ca_certificate_pem: string`127128 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and no private-key material. Maximum 8KB.129130 maxLength: 8192131132### Returns133134- `BetaTunnelCertificate object`135136 A CA certificate attached to a tunnel.137138 - `type: "tunnel_certificate"`139140 - `id: string`141142 Unique identifier for the certificate, prefixed with `tcrt_`.143144 - `archived_at: string or null`145146 A timestamp in RFC 3339 format147148 format: date-time149150 - `created_at: string`151152 A timestamp in RFC 3339 format153154 format: date-time155156 - `expires_at: string or null`157158 A timestamp in RFC 3339 format159160 format: date-time161162 - `fingerprint: string`163164 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.165166 - `tunnel_id: string`167168 ID of the tunnel the certificate is registered against.169170### Example171172```bash173curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \174 -H 'Content-Type: application/json' \175 -H 'anthropic-version: 2023-06-01' \176 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \177 -H "X-Api-Key: $ANTHROPIC_API_KEY" \178 -d '{179 "ca_certificate_pem": "ca_certificate_pem"180 }'181```182183#### Response (200)184185```json186{187 "id": "id",188 "archived_at": "2019-12-27T18:11:19.117Z",189 "created_at": "2019-12-27T18:11:19.117Z",190 "expires_at": "2019-12-27T18:11:19.117Z",191 "fingerprint": "fingerprint",192 "tunnel_id": "tunnel_id",193 "type": "tunnel_certificate"194}195```196197## Get Tunnel Certificate198199**GET** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}`200201The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.202203Fetches a tunnel certificate by ID.204205### Path parameters206207- `tunnel_id: string`208209- `certificate_id: string`210211### Headers212213- `"anthropic-beta": optional array of AnthropicBeta`214215 Optional header to specify the beta version(s) you want to use.216217 - `string`218219 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`220221 - `"message-batches-2024-09-24"`222223 - `"prompt-caching-2024-07-31"`224225 - `"computer-use-2024-10-22"`226227 - `"computer-use-2025-01-24"`228229 - `"pdfs-2024-09-25"`230231 - `"token-counting-2024-11-01"`232233 - `"token-efficient-tools-2025-02-19"`234235 - `"output-128k-2025-02-19"`236237 - `"files-api-2025-04-14"`238239 - `"mcp-client-2025-04-04"`240241 - `"mcp-client-2025-11-20"`242243 - `"dev-full-thinking-2025-05-14"`244245 - `"interleaved-thinking-2025-05-14"`246247 - `"code-execution-2025-05-22"`248249 - `"extended-cache-ttl-2025-04-11"`250251 - `"context-1m-2025-08-07"`252253 - `"context-management-2025-06-27"`254255 - `"model-context-window-exceeded-2025-08-26"`256257 - `"skills-2025-10-02"`258259 - `"fast-mode-2026-02-01"`260261 - `"output-300k-2026-03-24"`262263 - `"user-profiles-2026-03-24"`264265 - `"user-profiles-2026-08-18"`266267 - `"user-profiles-2026-09-04"`268269 - `"advisor-tool-2026-03-01"`270271 - `"managed-agents-2026-04-01"`272273 - `"cache-diagnosis-2026-04-07"`274275 - `"dreaming-2026-04-21"`276277 - `"thinking-token-count-2026-05-13"`278279 - `"server-side-fallback-2026-06-01"`280281 - `"server-side-fallback-2026-07-01"`282283 - `"fallback-credit-2026-06-01"`284285 - `"fallback-credit-2026-07-01"`286287 - `"agent-memory-2026-07-22"`288289 - `"mid-conversation-tool-changes-2026-07-01"`290291 - `"compact-2026-01-12"`292293 - `"computer-use-2025-11-24"`294295 - `"mcp-tunnels-2026-06-22"`296297 - `"structured-outputs-2025-11-13"`298299 - `"task-budgets-2026-03-13"`300301 - `"thinking-display-updates-2026-08-18"`302303 - `"ce-user-management-2026-07-13"`304305 - `"mid-conversation-output-config-2026-07-01"`306307 - `"thinking-binding-controls-2026-08-01"`308309 - `"mid-conversation-system-clear-at-2026-08-21"`310311 - `"compact-2026-09-04"`312313- `"anthropic-workspace-id": optional string`314315### Returns316317- `BetaTunnelCertificate object`318319 A CA certificate attached to a tunnel.320321 - `type: "tunnel_certificate"`322323 - `id: string`324325 Unique identifier for the certificate, prefixed with `tcrt_`.326327 - `archived_at: string or null`328329 A timestamp in RFC 3339 format330331 format: date-time332333 - `created_at: string`334335 A timestamp in RFC 3339 format336337 format: date-time338339 - `expires_at: string or null`340341 A timestamp in RFC 3339 format342343 format: date-time344345 - `fingerprint: string`346347 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.348349 - `tunnel_id: string`350351 ID of the tunnel the certificate is registered against.352353### Example354355```bash356curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \357 -H 'anthropic-version: 2023-06-01' \358 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \359 -H "X-Api-Key: $ANTHROPIC_API_KEY"360```361362#### Response (200)363364```json365{366 "id": "id",367 "archived_at": "2019-12-27T18:11:19.117Z",368 "created_at": "2019-12-27T18:11:19.117Z",369 "expires_at": "2019-12-27T18:11:19.117Z",370 "fingerprint": "fingerprint",371 "tunnel_id": "tunnel_id",372 "type": "tunnel_certificate"373}374```375376## List Tunnel Certificates377378**GET** `/v1/tunnels/{tunnel_id}/certificates`379380The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.381382Lists the certificates registered on a tunnel. Archived certificates are excluded unless include_archived is set.383384### Path parameters385386- `tunnel_id: string`387388### Query parameters389390- `include_archived: optional boolean`391392 Whether to include archived certificates in the results. Defaults to false.393394- `limit: optional number`395396 Maximum number of certificates to return per page. Defaults to 20, maximum 1000.397398 format: int32399400- `page: optional string`401402 Opaque pagination cursor from a previous `list_tunnel_certificates` response.403404### Headers405406- `"anthropic-beta": optional array of AnthropicBeta`407408 Optional header to specify the beta version(s) you want to use.409410 - `string`411412 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`413414 - `"message-batches-2024-09-24"`415416 - `"prompt-caching-2024-07-31"`417418 - `"computer-use-2024-10-22"`419420 - `"computer-use-2025-01-24"`421422 - `"pdfs-2024-09-25"`423424 - `"token-counting-2024-11-01"`425426 - `"token-efficient-tools-2025-02-19"`427428 - `"output-128k-2025-02-19"`429430 - `"files-api-2025-04-14"`431432 - `"mcp-client-2025-04-04"`433434 - `"mcp-client-2025-11-20"`435436 - `"dev-full-thinking-2025-05-14"`437438 - `"interleaved-thinking-2025-05-14"`439440 - `"code-execution-2025-05-22"`441442 - `"extended-cache-ttl-2025-04-11"`443444 - `"context-1m-2025-08-07"`445446 - `"context-management-2025-06-27"`447448 - `"model-context-window-exceeded-2025-08-26"`449450 - `"skills-2025-10-02"`451452 - `"fast-mode-2026-02-01"`453454 - `"output-300k-2026-03-24"`455456 - `"user-profiles-2026-03-24"`457458 - `"user-profiles-2026-08-18"`459460 - `"user-profiles-2026-09-04"`461462 - `"advisor-tool-2026-03-01"`463464 - `"managed-agents-2026-04-01"`465466 - `"cache-diagnosis-2026-04-07"`467468 - `"dreaming-2026-04-21"`469470 - `"thinking-token-count-2026-05-13"`471472 - `"server-side-fallback-2026-06-01"`473474 - `"server-side-fallback-2026-07-01"`475476 - `"fallback-credit-2026-06-01"`477478 - `"fallback-credit-2026-07-01"`479480 - `"agent-memory-2026-07-22"`481482 - `"mid-conversation-tool-changes-2026-07-01"`483484 - `"compact-2026-01-12"`485486 - `"computer-use-2025-11-24"`487488 - `"mcp-tunnels-2026-06-22"`489490 - `"structured-outputs-2025-11-13"`491492 - `"task-budgets-2026-03-13"`493494 - `"thinking-display-updates-2026-08-18"`495496 - `"ce-user-management-2026-07-13"`497498 - `"mid-conversation-output-config-2026-07-01"`499500 - `"thinking-binding-controls-2026-08-01"`501502 - `"mid-conversation-system-clear-at-2026-08-21"`503504 - `"compact-2026-09-04"`505506- `"anthropic-workspace-id": optional string`507508### Returns509510- `data: array of BetaTunnelCertificate`511512 List of certificates, ordered by created_at descending.513514 - `type: "tunnel_certificate"`515516 - `id: string`517518 Unique identifier for the certificate, prefixed with `tcrt_`.519520 - `archived_at: string or null`521522 A timestamp in RFC 3339 format523524 format: date-time525526 - `created_at: string`527528 A timestamp in RFC 3339 format529530 format: date-time531532 - `expires_at: string or null`533534 A timestamp in RFC 3339 format535536 format: date-time537538 - `fingerprint: string`539540 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.541542 - `tunnel_id: string`543544 ID of the tunnel the certificate is registered against.545546- `next_page: string or null`547548 Pagination cursor for the next page, or null if no more results.549550### Example551552```bash553curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \554 -H 'anthropic-version: 2023-06-01' \555 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \556 -H "X-Api-Key: $ANTHROPIC_API_KEY"557```558559#### Response (200)560561```json562{563 "data": [564 {565 "id": "id",566 "archived_at": "2019-12-27T18:11:19.117Z",567 "created_at": "2019-12-27T18:11:19.117Z",568 "expires_at": "2019-12-27T18:11:19.117Z",569 "fingerprint": "fingerprint",570 "tunnel_id": "tunnel_id",571 "type": "tunnel_certificate"572 }573 ],574 "next_page": "next_page"575}576```577578## Archive Tunnel Certificate579580**POST** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`581582The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.583584Archives a tunnel certificate, removing it from the set Anthropic trusts for the tunnel. The certificate record is retained. Archiving the last non-archived certificate is permitted; the tunnel rejects MCP traffic until a new certificate is added.585586### Path parameters587588- `tunnel_id: string`589590- `certificate_id: string`591592### Headers593594- `"anthropic-beta": optional array of AnthropicBeta`595596 Optional header to specify the beta version(s) you want to use.597598 - `string`599600 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`601602 - `"message-batches-2024-09-24"`603604 - `"prompt-caching-2024-07-31"`605606 - `"computer-use-2024-10-22"`607608 - `"computer-use-2025-01-24"`609610 - `"pdfs-2024-09-25"`611612 - `"token-counting-2024-11-01"`613614 - `"token-efficient-tools-2025-02-19"`615616 - `"output-128k-2025-02-19"`617618 - `"files-api-2025-04-14"`619620 - `"mcp-client-2025-04-04"`621622 - `"mcp-client-2025-11-20"`623624 - `"dev-full-thinking-2025-05-14"`625626 - `"interleaved-thinking-2025-05-14"`627628 - `"code-execution-2025-05-22"`629630 - `"extended-cache-ttl-2025-04-11"`631632 - `"context-1m-2025-08-07"`633634 - `"context-management-2025-06-27"`635636 - `"model-context-window-exceeded-2025-08-26"`637638 - `"skills-2025-10-02"`639640 - `"fast-mode-2026-02-01"`641642 - `"output-300k-2026-03-24"`643644 - `"user-profiles-2026-03-24"`645646 - `"user-profiles-2026-08-18"`647648 - `"user-profiles-2026-09-04"`649650 - `"advisor-tool-2026-03-01"`651652 - `"managed-agents-2026-04-01"`653654 - `"cache-diagnosis-2026-04-07"`655656 - `"dreaming-2026-04-21"`657658 - `"thinking-token-count-2026-05-13"`659660 - `"server-side-fallback-2026-06-01"`661662 - `"server-side-fallback-2026-07-01"`663664 - `"fallback-credit-2026-06-01"`665666 - `"fallback-credit-2026-07-01"`667668 - `"agent-memory-2026-07-22"`669670 - `"mid-conversation-tool-changes-2026-07-01"`671672 - `"compact-2026-01-12"`673674 - `"computer-use-2025-11-24"`675676 - `"mcp-tunnels-2026-06-22"`677678 - `"structured-outputs-2025-11-13"`679680 - `"task-budgets-2026-03-13"`681682 - `"thinking-display-updates-2026-08-18"`683684 - `"ce-user-management-2026-07-13"`685686 - `"mid-conversation-output-config-2026-07-01"`687688 - `"thinking-binding-controls-2026-08-01"`689690 - `"mid-conversation-system-clear-at-2026-08-21"`691692 - `"compact-2026-09-04"`693694- `"anthropic-workspace-id": optional string`695696### Returns697698- `BetaTunnelCertificate object`699700 A CA certificate attached to a tunnel.701702 - `type: "tunnel_certificate"`703704 - `id: string`705706 Unique identifier for the certificate, prefixed with `tcrt_`.707708 - `archived_at: string or null`709710 A timestamp in RFC 3339 format711712 format: date-time713714 - `created_at: string`715716 A timestamp in RFC 3339 format717718 format: date-time719720 - `expires_at: string or null`721722 A timestamp in RFC 3339 format723724 format: date-time725726 - `fingerprint: string`727728 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.729730 - `tunnel_id: string`731732 ID of the tunnel the certificate is registered against.733734### Example735736```bash737curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \738 -X POST \739 -H 'anthropic-version: 2023-06-01' \740 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \741 -H "X-Api-Key: $ANTHROPIC_API_KEY"742```743744#### Response (200)745746```json747{748 "id": "id",749 "archived_at": "2019-12-27T18:11:19.117Z",750 "created_at": "2019-12-27T18:11:19.117Z",751 "expires_at": "2019-12-27T18:11:19.117Z",752 "fingerprint": "fingerprint",753 "tunnel_id": "tunnel_id",754 "type": "tunnel_certificate"755}756```757758## Domain types759760### Beta Tunnel Certificate761762- `BetaTunnelCertificate object`763764 A CA certificate attached to a tunnel.765766 - `type: "tunnel_certificate"`767768 - `id: string`769770 Unique identifier for the certificate, prefixed with `tcrt_`.771772 - `archived_at: string or null`773774 A timestamp in RFC 3339 format775776 format: date-time777778 - `created_at: string`779780 A timestamp in RFC 3339 format781782 format: date-time783784 - `expires_at: string or null`785786 A timestamp in RFC 3339 format787788 format: date-time789790 - `fingerprint: string`791792 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.793794 - `tunnel_id: string`795796 ID of the tunnel the certificate is registered against.797