Skip to content

Create internal user cert

POST/smime/users/internal

Email Management API · SMIME

Create certificate for internal user and enable S/MIME for him/her.

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

emailstring (email)required
Email address of the user.
Must be 3–255 characters long.
certExpiryDatestring (date)
Certificate expiry date in YYYY-MM-DD (ISO 8601) format. Default: 20 years from the current date. Earliest allowed date - Tomorrow. Latest allowed date - 20 years from today. Provide either certExpiryDate or certValidityPeriod. If both are provided, the API will use whichever results in the shorter validity period.
Must match the pattern ^\d{4}-\d{2}-\d{2}$. Must be at most 10 characters long.
certValidityPeriodinteger
The certificate validity duration in years, starting from the current date. Default: 20 years, minimum: 1 year, maximum: 20 years.
Must be ≥ 1 and ≤ 20.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/email/v1/smime/users/internal" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"email\": \"john.doe@sophos.com\",
  \"certExpiryDate\": \"2028-12-31\",
  \"certValidityPeriod\": 3
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/email/v1/smime/users/internal",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'email': 'john.doe@sophos.com',
    'certExpiryDate': '2028-12-31',
    'certValidityPeriod': 3},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "email": "john.doe@sophos.com",
  "certExpiryDate": "2028-12-31",
  "certValidityPeriod": 3
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/email/v1/smime/users/internal" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/email/v1/smime/users/internal", strings.NewReader(`{
  "email": "john.doe@sophos.com",
  "certExpiryDate": "2028-12-31",
  "certValidityPeriod": 3
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/email/v1/smime/users/internal", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "email": "john.doe@sophos.com",
  "certExpiryDate": "2028-12-31",
  "certValidityPeriod": 3
}),
});
const data = await response.json();
console.log(data);

Responses

201 — Certificate created successfully.

Response fields

emailstring (email)required
Email address of the user.
Must be 3–255 characters long.
userNamestringrequired
Name of the user.
Must be at most 255 characters long.
associatedCertificatesInfoarray of objectrequired
List of certificates associated with the user.
Information about certificates associated with a user.
Show child attributesHide child attributes
fingerprintstringrequired
SHA-256 fingerprint of the certificate.
Must match the pattern ^[a-fA-F0-9]{64}$. Must be exactly 64 characters long.
certificateDetailsobjectrequired
Detailed information about a certificate.
Show child attributesHide child attributes
issuerstringrequired
Certificate issuer distinguished name.
Must be at most 255 characters long.
validFromstring (date-time)required
Certificate validity start date.
expiresAtstring (date-time)required
Certificate validity end date.
originstringrequired
Indicates how the certificate was obtained.
Must be one of: created, uploaded, extracted, unknown.

Errors

Status Meaning
400 Invalid request.
401 Authentication required.
403 Authorization required.
422 User already exists with two associated certificates.
500 Internal server error.
503 Server Unavailable.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "email": "john.doe@sophos.com",
  "userName": "John Doe",
  "associatedCertificatesInfo": [
    {
      "fingerprint": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "certificateDetails": {
        "issuer": "C=UK,O=Sophos Limited,CN=Sophos Root CA",
        "validFrom": "2024-12-31T14:25:09Z",
        "expiresAt": "2029-12-31T18:30:12Z",
        "origin": "created"
      }
    }
  ]
}

See the guide for a narrative walkthrough of this API.