Cloudflare API | ACM › Custom Trust Store › Custom Origin Trust Store Details

API Reference

Account & User Management

Resource Sharing

AI

Certificate Management

Custom Trust Store

List Custom Origin Trust Store Details

Upload Custom Origin Trust Store

Custom Origin Trust Store Details

Delete Custom Origin Trust Store

Certificate Authorities

Client Certificates

Custom Certificates

Custom Hostnames

Keyless Certificates

MTLS Certificates

Origin CA Certificates

Origin Post Quantum Encryption

Origin TLS Client Auth

Cloudflare One

DNS

Account Custom Nameservers

Domain/Zone Management

IP Addresses

Media

Networking

Magic Cloud Networking

Magic Network Monitoring

Network Interconnects

Observability

Security Center

Radar

Routing & Performance

Rules

Cloud Connector

Managed Transforms

URL Normalization

Security

Schema Validation

Content Scanning

Leaked Credential Checks

Token Validation

Storage & Databases

R2 Data Catalog

Threat Intelligence

Brand Protection

Workers & Pages

Browser Rendering

Durable Objects

Workers For Platforms

Shared

ACM

acm

Custom Trust Store

acm.custom_trust_store

Methods

List Custom Origin Trust Store Details -> V4PagePaginationArray<

CustomTrustStore

>

get/zones/{zone_id}/acm/custom_trust_store

Get Custom Origin Trust Store for a Zone.

Upload Custom Origin Trust Store -> Envelope<

CustomTrustStore

>

post/zones/{zone_id}/acm/custom_trust_store

Add Custom Origin Trust Store for a Zone.

Custom Origin Trust Store Details -> Envelope<

CustomTrustStore

>

get/zones/{zone_id}/acm/custom_trust_store/{custom_origin_trust_store_id}

Retrieves details about a specific certificate in the custom origin trust store, including expiration and subject information.

Security

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example: Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

SSL and Certificates Write SSL and Certificates Read

path Parameters

zone_id: string

(maxLength: 32)

Identifier.

custom_origin_trust_store_id: string

(maxLength: 32)

Identifier.

Response fields

errors: Array<{ code, message, documentation_url, 1 more... }>

messages: Array<{ code, message, documentation_url, 1 more... }>

success: true

Whether the API call was successful.

result:

CustomTrustStore

Optional

Request example

curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/acm/custom_trust_store/$CUSTOM_ORIGIN_TRUST_STORE_ID \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDdjCCAl6gAwIBAgIJAPnMg0Fs+/B0MA0GCSqGSIb3DQEBCwUAMFsx...\n-----END CERTIFICATE-----\n",
    "expires_on": "2122-10-29T16:59:47Z",
    "issuer": "GlobalSign",
    "signature": "SHA256WithRSA",
    "status": "active",
    "updated_at": "2014-01-01T05:20:00Z",
    "uploaded_on": "2014-01-01T05:20:00Z"
  }
}

Delete Custom Origin Trust Store -> Envelope<{ id }>

delete/zones/{zone_id}/acm/custom_trust_store/{custom_origin_trust_store_id}

Removes a CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted.

Domain types

CustomTrustStore = { id, certificate, expires_on, 5 more... }

Total TLS

acm.total_tls

Methods

Total TLS Settings Details -> Envelope<{ certificate_authority, enabled, validity_period }>

get/zones/{zone_id}/acm/total_tls

Get Total TLS Settings for a Zone.

Enable Or Disable Total TLS -> Envelope<{ certificate_authority, enabled, validity_period }>

post/zones/{zone_id}/acm/total_tls

Set Total TLS Settings or disable the feature for a Zone.

Enable Or Disable Total TLS -> Envelope<{ certificate_authority, enabled, validity_period }>

post/zones/{zone_id}/acm/total_tls

Set Total TLS Settings or disable the feature for a Zone.

Domain types

CertificateAuthority = "google" | "lets_encrypt" | "ssl_com"

The Certificate Authority that Total TLS certificates will be issued through.