Export Truststore File

Endpoint

GET /apiops/projects/{projectName}/certificates/truststore/{environmentName}/export-file/

A truststore is a view, not a stored object

Apinizer does not store a truststore. What an environment trusts is whatever certificates were deployed to its workers, and this endpoint reads that back live from the workers. The result is a snapshot of what the environment trusts right now — moving a truststore therefore means moving its certificates, which is exactly what this endpoint and Import Truststore File do in one call each.

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
environmentName	string	Yes	Environment whose truststore is read

Response

Success Response (200 OK)

The response is a ZIP archive of PEM files.

• Content-Type: application/octet-stream
• Content-Disposition: attachment; filename="<environmentName>-truststore.zip"
• One entry per trusted certificate, named after its alias: <alias>.cer

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "Environment (Production) reported no truststore certificate! The workers may be unreachable, or nothing is deployed to them."
}

or

{
  "status": "FAILURE",
  "resultMessage": "Environment (Production) returned 3 truststore certificate(s) but none carried exportable material!"
}

Common Causes

• The environment's workers are unreachable, so nothing could be read
• Nothing is deployed to that environment yet
• The workers listed certificates but returned no material for them

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Capture an Environment's Truststore

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/certificates/truststore/Production/export-file/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output production-truststore.zip

Example 2: Inspect What Was Captured

unzip -l production-truststore.zip
openssl x509 -in partner-ca.cer -noout -subject -dates

Notes and Warnings

• This reads the workers, not the database: if the workers are down or unreachable, the call reports that rather than returning an empty archive.
• It is a snapshot: deploying or removing certificates afterwards changes what the environment trusts. Re-export to see the current state.
• Aliases become file names: a certificate without an alias is written as certificate-1.cer, certificate-2.cer and so on, so nothing is dropped for lacking a name.
• Certificates the workers list without material are skipped and logged; the archive contains only what could actually be written.
• Public material only: a truststore holds certificates, not private keys, so this archive carries nothing secret. That is what makes it safe to hand to another team.

Permissions

• User must have SECRETS + EXPORT_IMPORT permission in the project

Related Documentation

• Import Truststore File - Push a bundle back into an environment
• Get Truststore Certificates - List what an environment trusts, as JSON
• Export Certificate - Download one certificate instead of the whole truststore