Homarr
Manage trusted certificates

Ensure a named custom root CA certificate without overwriting

POST/api/certificates/root

Accept one currently valid self-signed PEM root CA (64 KiB maximum). Identical bytes are idempotent; different existing bytes return CONFLICT. Requires admin permission.

Authorization

apikey
ApiKey<token>

API key which can be obtained in the Homarr administration dashboard

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/certificates/root" \  -H "Content-Type: application/json" \  -d '{    "fileName": "string",    "certificate": "string"  }'
{  "created": true,  "certificate": {    "fileName": "string",    "sha256": "string",    "fingerprint256": "string",    "ca": true,    "validFrom": "string",    "validTo": "string"  }}

Inspect a named custom root CA certificate

Return public metadata or null when absent. Requires admin permission. Does not return PEM contents.

Proxy an integration API request using saved credentials

REST access to integration_request, Homarr's most powerful MCP tool. Call any API endpoint on a supported saved integration using its authentication and trusted certificates. Features not implemented in Homarr can still be used through this API or MCP if the upstream API supports them. Supply exactly one selector: integrationId, integrationName or integrationKind. Requires full integration access; DELETE also requires confirmed=true after user confirmation. Paths append to the saved URL. HTTP 200 can contain upstream errors: inspect ok, status and data. Limits: 10 KiB body, 16 KiB headers, 1 MiB response, 15 seconds. See https://homarr.dev/docs/management/api#call-any-integration-api-endpoint for the full contract.