# Read the mirrored TLS certificate status for a connection's domain

> get connection certificate: reference page for this CustomDomain™ API operation in the secure group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/secure/getConnectionCertificate

## `GET https://api.customdomain.ai/v1/connections/{id}/ssl`

The control-plane's read-mirror of the edge certificate store for this connection's domain. `404` when no certificate is tracked yet.

A widget token must be the connection's end user: a connection that names another end user than the token's `end_user_ref`, or names one while the token names none, answers `403` `token_wrong_end_user` before anything is read or changed, and a connection that names none is any token's. An API key, an app-scoped token and a delegated agent token are not limited by it.

### Authentication

`widgetJWT`, `apiKey`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | Certificate status |
| `401` | Error envelope: {code, title, details}. |
| `403` | `forbidden`: the credential may not do this. `token_wrong_end_user`: a widget token that is not this connection's end user (the connection names another end user than the token's `end_user_ref`, or names one while the token names none); nothing is read or changed, and the answer shows nothing of the connection. Mint the token with the end user's `end_user_ref`. |
| `404` | Error envelope: {code, title, details}. |
| `503` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificate` | object | no |  |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.