List the IdP signing certificates of a connection

GET /v1/connections/{connection_id}/certificates · permission connections:read

Returns the active signing certificates of the identity provider for an enterprise SAML connection: ID, SHA-256 fingerprint, validity period and source. The certificate itself and its subject (which can hold a person's name or email address) are not returned. A connection has at most 3 active certificates, so the list is not paged: there are no limit, after, before or order parameters and list_metadata carries no cursor. Deleted certificates are not listed. Reads are not audited.

Request

Field	Type	Required	Description
`connection_id`	path	yes	Enterprise SAML connection ID (`conn_…`).

Response

200 OK. A SAML connection without SAML configuration returns an empty list.

{
  "data": [
    {"id": "conncert_01j9xq2m4n6p8r0s2t4v6w8y0a", "sha256_fingerprint": "3b0c…", "not_before": "2026-01-01T00:00:00Z", "not_after": "2028-01-01T00:00:00Z", "source": "metadata"}
  ],
  "list_metadata": {"before": null, "after": null}
}

Field	Description
`id`	Certificate ID (`conncert_…`); use it to delete the certificate.
`sha256_fingerprint`	Lower-case hexadecimal SHA-256 of the DER encoding. Compare it with the fingerprint your identity provider shows.
`not_before`, `not_after`	Validity period. A certificate outside it verifies no signature.
`source`	`metadata`: added by a metadata URL refresh; `manual`: uploaded or taken from an imported metadata document.

Errors

HTTP	code	When
404	`not_found`	The connection does not exist in this environment or is not an enterprise connection.
409	`conflict`	The connection is not a SAML connection.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/certificates" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth connections certificates list conn_01j9xp6q0r1s5t7v9w1x3y5z7b