# Record intent to issue an edge-managed certificate

> Record intent to issue an edge-managed certificate: CustomDomain™ API reference in the secure group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/secure/provisionConnectionCertificate

## `POST https://api.customdomain.ai/v1/connections/{id}/ssl:provision`

Creates/updates the mirror row as `pending` + managed. The edge performs the actual ACME issuance on first handshake and reports back. Optionally sets `secure_root_domain` so the edge also secures the registrable apex. A domain has one certificate row. Returns 409 when another application tracks that row, unless this connection is the one the edge serves and the row's application serves nothing for the domain, in which case this connection takes the row over.

### Authentication

`widgetJWT`, `apiKey`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Request body (JSON)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `secure_root_domain` | boolean | no | also secure the registrable apex. |

### Responses

| Status | Description |
| --- | --- |
| `202` | Provisioning requested |
| `401` | Error envelope: {code, title, details}. |
| `404` | Error envelope: {code, title, details}. |
| `409` | Error envelope: {code, title, details}. |
| `503` | Error envelope: {code, title, details}. |

### `202` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificate` | object | no |  |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.