# List the IdP signing certificates of a connection

`GET /v1/connections/{connection_id}/certificates` · permission `connections:read`

Returns the active signing certificates of the identity provider for an enterprise SAML connection: ID, SHA-256 fingerprint, validity period and source. The certificate itself and its subject (which can hold a person's name or email address) are not returned. A connection has at most 3 active certificates, so the list is not paged: there are no `limit`, `after`, `before` or `order` parameters and `list_metadata` carries no cursor. Deleted certificates are not listed. Reads are not audited.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | path | yes | Enterprise SAML connection ID (`conn_…`). |

## Response

`200 OK`. A SAML connection without SAML configuration returns an empty list.

```json
{
  "data": [
    {"id": "conncert_01j9xq2m4n6p8r0s2t4v6w8y0a", "sha256_fingerprint": "3b0c…", "not_before": "2026-01-01T00:00:00Z", "not_after": "2028-01-01T00:00:00Z", "source": "metadata"}
  ],
  "list_metadata": {"before": null, "after": null}
}
```

| Field | Description |
|---|---|
| `id` | Certificate ID (`conncert_…`); use it to [delete the certificate](delete.md). |
| `sha256_fingerprint` | Lower-case hexadecimal SHA-256 of the DER encoding. Compare it with the fingerprint your identity provider shows. |
| `not_before`, `not_after` | Validity period. A certificate outside it verifies no signature. |
| `source` | `metadata`: added by a metadata URL refresh; `manual`: uploaded or taken from an [imported metadata document](../connections/import-metadata.md). |

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The connection does not exist in this environment or is not an enterprise connection. |
| 409 | `conflict` | The connection is not a SAML connection. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/certificates" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

```bash
keenauth connections certificates list conn_01j9xp6q0r1s5t7v9w1x3y5z7b
```