compute

POST `/v1/certificates/orders/{orderId}/submit`

Buy the certificate. This spends money.

身份验证

请将 API 密钥作为 bearer 令牌发送。该密钥必须具有 billing.payment.manage 权限；缺少该权限的密钥将被拒绝并返回 403 状态码，而非 404。

此端点不需要组织 ID。您的密钥已用于识别其所属的组织，且响应范围也仅限于该组织。

免费试用

将尖括号中的内容替换为您自己的值，并将键占位符替换为您仪表板中的一个键。

curl -X POST https://api.zinndigital.com/v1/certificates/orders/{orderId}/submit \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "csr_pem": <string> }'

已登录？您仪表板中的 API 控制台会自动填入您真实的组织 ID 和您自己的密钥，并针对实时 API 运行请求，以便您查看实际的响应。在 API 控制台中打开此端点

详细信息

⛔⛔ **This is the call that charges.** It is a separate endpoint from the one that creates the order precisely so a client cannot buy while a form is half filled in. ⛔⛔ **The CSR is required and is checked three times** — here, in the service and in the driver. That is not belt-and-braces: the authority accepts an order **without** one, charges for it, and issues nothing. Two such orders were created against our own account on 2026-08-29 by a probe reading validation errors, and the giveaway is how unlike a purchase they look — no common name, no issue date (`docs/272` §9). ⭐ A customer-generated CSR is the better path and the one to encourage: the private key then never leaves their machine. Answers `503` when the authority could not be reached — in which case the order is recorded and reconciled rather than lost. Requires `billing.payment.manage`.

参数

名称	类型	必填	内容简介
`orderId (path)`	`Uuid`	是	The order's id, as `listCertificateOrders` reports it. Ours (UUIDv7).

请求正文

名称	类型	必填	内容简介
`csr_pem`	`string`	是	The certificate signing request, PEM. ⛔ Required. Without it the authority has nothing to sign and the order is billed and permanently unusable.

响应

名称	类型	必填	内容简介
`id`	`Uuid`	是	UUIDv7 identifier — sortable by creation time (docs/02 §8).
`product_code`	`string`	是	The stable machine key (`positive_ssl`). ⛔ Match on this, never on `product_name` — the name is the certificate authority's marketing string and can be corrected without the pro…
`product_name`	`string`	是	What the customer reads — the authority's own product name (`PositiveSSL`, `S/MIME Personal`, `Unified Communications Certificate (UCC)`). ⛔ Never a translation key: these are t…
`state`	`string<pending, awaiting_validation, issued, cancelled, failed, expired>`	是	⛔⛔ `awaiting_validation` means PAID AND NOT ISSUED. The authority charges at order time and then waits for the customer to prove they control the domain. It is deliberately…
`common_name`	`string`	是	The primary domain on the certificate.
`domains`	`string[]`	是	Additional names (SANs). Empty for a single-domain product.
`period_years`	`integer`	是	—
`price_minor`	`integer`	是	What the customer is charged, frozen at order. A copy rather than a join, so an operator repricing the catalogue cannot move an existing bill.
`currency`	`string`	是	—
`validation_instructions`	`string`	是	What the customer must still do, in the authority's own words. ⭐ Carried as text rather than parsed: every authority words it differently, and a half-parsed instruction is worse…
`certificate_pem`	`string`	是	The issued certificate. ⭐ Public by nature — it is served to every visitor of the site — which is why it is returned here while its private key never is: a customer-generate…
`chain_pem`	`string`	是	—
`message`	`string`	是	Why it failed or was cancelled, in a sentence the customer reads.
`ordered_at`	`string`	是	—
`issued_at`	`string`	是	—
`expires_at`	`string`	是	—
`days_until_expiry`	`integer`	是	Whole days until `expires_at`, negative once it has lapsed. ⛔ `null` and `0` are DIFFERENT answers and a client must not collapse them: `null` means we could not read an expiry…
`renewable`	`boolean`	是	Whether to offer a re-order now — issued, inside the 30-day window, and with no renewal already in flight. ⛔ Computed here rather than left to a client to derive from `expires_a…
`free_alternative_exists`	`boolean`	是	Whether Let's Encrypt issues this kind of certificate for nothing. Carried onto the renewal prompt for the same reason it is on the buy screen: say so before asking somebody…
`renewal_of`	`Uuid`	是	The order this one renews, so a client can show the chain.
`last_reminded_at`	`string`	是	When the renewal sweep last REACHED this order — which is not the same as when it last emailed about it. ⛔ The sweep stamps this for every row it reaches **including the ones it…

此端点可能返回的错误

401 · 403 · 404 · 422 · 429 · 503

POST /v1/certificates/orders/{orderId}/submit