Skip to main content
POST
Attach an additional certificate to an HTTPS listener
Requires the IAM action loadbalancer:AttachListenerCertificate. See LOADBALANCER permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Path Parameters

id
string
required
Example:

"4e1f8c2a-9b3d-4f6e-8a1c-2d5e7f9a0b3c"

listener_id
string
required
Example:

"e1f2a3b4-c5d6-4789-e0f1-a2b3c4d5e6f7"

Body

application/json
certificate
string
required

The certificate to serve, by CRN, UUID or exact account-scoped name. Certificate CRNs require an empty region. The listener stores a reference — no key material is sent here, and the replicas fetch it from the certificate service under their own identity.

Example:

"crn:certificate::my-account:certificate/prod-web"

is_default
boolean
default:false

When true, demote whatever's currently default and promote this cert in the same transaction.

Example:

true

Response

Attached

certificate
object
required
Example: