## ACME accounts (`acme-accounts`)

CA accounts used for automatic issuance (Let's Encrypt, ZeroSSL). Registered with the CA on first issuance.

Authentication: User (some parameters admin only) · Docs: https://www-demo.kuxitong.com/en/docs/api/acme-accounts

### GET `/api/v2/acme-accounts`

List ACME accounts · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `sort` | string |  | Sort fields, comma-separated; prefix `-` for descending, e.g. `-created_at,id` |
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |
| `ca` | string |  | Only list accounts of this CA. Values: ["lets","zerossl"] |

```sh
curl "https://panel.example.com/api/v2/acme-accounts" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/acme-accounts`

Create ACME account · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `api_key` | string |  | Mask of the ZeroSSL REST API key (`****abcd`); empty = not set. The key is stored encrypted and never returned in plaintext. |
| `ca` | string | Yes | CA that issues certificates: lets = Let's Encrypt; zerossl = ZeroSSL. Values: ["lets","zerossl"] |
| `directory` | string |  | ACME directory URL; empty = the CA's URL in the controller's acme.directories (the production URL by default). |
| `eab_hmac` | string |  | Masked (last 4 chars shown as `****abcd` when 16+ chars, otherwise `********`); plaintext is never returned. |
| `eab_kid` | string |  | EAB key ID (used by ZeroSSL). |
| `email` | string |  | Email |
| `enabled` | boolean |  | Whether enabled |
| `name` | string | Yes | Name |
| `recheck` | boolean |  | When true, re-check the stored API key; on success the account becomes usable again and certificates waiting on it are retried immediately. |

```sh
curl -X POST "https://panel.example.com/api/v2/acme-accounts" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ca":"zerossl","eab_hmac":"${EAB_HMAC}","eab_kid":"kid-example","name":"zerossl-main"}'
```

### GET `/api/v2/acme-accounts/{id}`

Get ACME account · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/acme-accounts/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PUT `/api/v2/acme-accounts/{id}`

Update ACME account · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `api_key` | string |  | Mask of the ZeroSSL REST API key (`****abcd`); empty = not set. The key is stored encrypted and never returned in plaintext. |
| `ca` | string | Yes | CA that issues certificates: lets = Let's Encrypt; zerossl = ZeroSSL. Values: ["lets","zerossl"] |
| `directory` | string |  | ACME directory URL; empty = the CA's URL in the controller's acme.directories (the production URL by default). |
| `eab_hmac` | string |  | Masked (last 4 chars shown as `****abcd` when 16+ chars, otherwise `********`); plaintext is never returned. |
| `eab_kid` | string |  | EAB key ID (used by ZeroSSL). |
| `email` | string |  | Email |
| `enabled` | boolean |  | Whether enabled |
| `name` | string | Yes | Name |
| `recheck` | boolean |  | When true, re-check the stored API key; on success the account becomes usable again and certificates waiting on it are retried immediately. |

```sh
curl -X PUT "https://panel.example.com/api/v2/acme-accounts/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ca":"zerossl","eab_hmac":"${EAB_HMAC}","eab_kid":"kid-example","name":"zerossl-main"}'
```

### DELETE `/api/v2/acme-accounts/{id}`

Delete ACME account · Authentication: User (some parameters admin only)

```sh
curl -X DELETE "https://panel.example.com/api/v2/acme-accounts/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

ACME accounts object:

| Field | Type | Required | Description |
|---|---|---|---|
| `api_checked_at` | string |  | Time the API key was last checked. (read-only) |
| `api_error` | string |  | Last account-level error from checking the API key or issuing with it. (read-only) |
| `api_key` | string |  | Mask of the ZeroSSL REST API key (`****abcd`); empty = not set. The key is stored encrypted and never returned in plaintext. (read-only) |
| `api_state` | string |  | API key state: none = not set; ok = usable; blocked = account-level error (quota reached, unpaid, key rejected; retried after 6 hours or after a successful recheck); error = the key cannot be decrypted and must be re-entered. Values: ["none","ok","blocked","error"] (read-only) |
| `ca` | string |  | CA that issues certificates: lets = Let's Encrypt; zerossl = ZeroSSL. Values: ["lets","zerossl"] |
| `created_at` | string |  | Created at (read-only) |
| `directory` | string |  | ACME directory URL; empty = the CA's URL in the controller's acme.directories (the production URL by default). |
| `eab_hmac` | string |  | Masked (last 4 chars shown as `****abcd` when 16+ chars, otherwise `********`); plaintext is never returned. |
| `eab_kid` | string |  | EAB key ID (used by ZeroSSL). |
| `email` | string |  | Email |
| `enabled` | boolean |  | Whether enabled |
| `id` | integer |  | Record ID (read-only) |
| `last_error` | string |  | Last error (read-only) |
| `name` | string |  | Name |
| `recheck` | boolean |  | When true, re-check the stored API key; on success the account becomes usable again and certificates waiting on it are retried immediately. |
| `status` | string |  | new = not registered yet; registered = registered with the CA; error = registration failed (see last_error). Values: ["new","registered","error"] (read-only) |
| `tenant_id` | integer |  | Owning tenant; null = platform account. (read-only) |
| `updated_at` | string |  | Updated at (read-only) |