> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Upload an SSL certificate
> POST /custom-domain/{pk}/ssl-certificate/
Uploads an issued SSL certificate for a domain and activates it, on the **Management API** host (`api.scanova.io`), authenticated with your raw Management API key.
```
POST https://api.scanova.io/custom-domain/{pk}/ssl-certificate/
Authorization: 401f7ac837da42b97f613d789819ff93537bee6a
```
Enterprise-only. Requires the `CUSTOM_DOMAIN_CUSTOM_SSL` quota, which is granted manually — no self-serve plan includes it. Requires a prior CSR — see [Create an SSL certificate request](/api-reference/management-api/custom-domain/certificate-request-create).
The domain's `id`.
The issued certificate, PEM-encoded.
The certificate authority's intermediate chain, PEM-encoded, if your CA provides one separately.
```bash cURL theme={null}
curl -X POST "https://api.scanova.io/custom-domain/42/ssl-certificate/" \
-H "Authorization: 401f7ac837da42b97f613d789819ff93537bee6a" \
-H "Content-Type: application/json" \
-d '{
"certificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
"certificate_chain": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
}'
```
```json 200 theme={null}
{
"detail": "Certificate activated.",
"status": "ISSUED",
"expires_at": "2026-12-08T00:00:00Z"
}
```
Scanova validates the certificate against the domain and the CSR's key, imports it into AWS ACM, and links it to serve live traffic — this is fully automated, with no manual review step. Three outcomes are possible:
* **`200`** — validated, imported, and activated. Traffic on this domain now serves with the new certificate.
* **`202`** — imported into ACM but not yet issued; not linked to serve traffic yet. Check back shortly.
* **`207` Multi-Status** — issued, but linking it to serve traffic failed; Scanova's support team is notified automatically and will follow up.
`400` if there's no CSR for this domain yet, the certificate doesn't match the domain or the CSR's key, or AWS ACM rejects the import (the error message is included in the response).
## Related
* [Get SSL certificate status](/api-reference/management-api/custom-domain/ssl-certificate-retrieve) — check status after uploading.
* [Create an SSL certificate request](/api-reference/management-api/custom-domain/certificate-request-create) — the CSR required before uploading.
* [Management API overview](/api-reference/management-api/overview) — the auth scheme and quota rules that apply to this endpoint.
## OpenAPI
````yaml api-reference/openapi/management-api.json POST /custom-domain/{pk}/ssl-certificate/
openapi: 3.1.0
info:
title: Scanova Management API (v2)
description: >-
The complete Scanova Management API — every endpoint available at
api.scanova.io (QR codes, folders, tags, leads, forms, analytics, plans,
shared users & roles), plus the token-creation and usage-stats endpoints
used to authenticate against it. Every path and request/response shape below
was verified live against a real API key and the actual running backend
(Phase 7, 2026-08-16) — not guessed from reading urls.py alone.
version: 2.0.0
servers:
- url: https://api.scanova.io
description: Management API — QR/folder/tag/lead/form/analytics/plans endpoints
security:
- apiKeyAuth: []
paths:
/custom-domain/{pk}/ssl-certificate/:
post:
summary: Upload an SSL certificate
description: >-
Requires a prior CSR (see Create an SSL certificate request). Validates
the certificate against the domain and the CSR's key, imports it into
AWS ACM, and links it for serving traffic. A `202` means ACM accepted
the import but hasn't finished issuing; a `207` means activation partly
failed and support was notified automatically.
operationId: uploadSslCertificate
parameters:
- name: pk
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
example:
certificate: '-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----'
certificate_chain: '-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----'
responses:
'200':
description: Certificate validated, imported, and activated for serving traffic.
content:
application/json:
example:
detail: Certificate activated.
status: ISSUED
expires_at: '2026-12-08T00:00:00Z'
'202':
description: >-
Certificate imported into ACM but not yet issued; not linked to
serve traffic yet.
content:
application/json:
example:
detail: Certificate imported but not yet issued. Check back shortly.
'207':
description: >-
Certificate issued but linking it to serve traffic failed; support
has been notified automatically.
content:
application/json:
example:
detail: >-
Certificate issued, but activation needs manual follow-up. Our
team has been notified.
'400':
description: >-
No CSR exists for this domain yet, the certificate doesn't match the
domain/CSR key, or AWS ACM rejected the import (error message
included).
components:
securitySchemes:
apiKeyAuth:
type: apiKey
in: header
name: Authorization
description: >-
Send your Management API key as the raw value of the Authorization
header — no "Bearer " or "Token " prefix, and no other characters.
Example: `Authorization: 401f7ac837da42b97f613d789819ff93537bee6a`. A
header containing more than one space-separated part is rejected
outright. Requests also require the request's Host header to be the
management API host (e.g. api.scanova.io) — the same key sent to the
regular API host will not authenticate.
````