> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ilyama.golain.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue an MQTT TLS client certificate for a device

> Generates a device key pair and CSR, signs a broker-compatible client certificate via the
cert worker, and returns PEM material once. Re-issue is rejected while a certificate is
already linked to the device (HTTP 409).




## OpenAPI

````yaml /api-reference/ilyama.v1.json post /projects/{project_id}/fleets/{fleet_id}/devices/{device_id}/mqtt_certificate
openapi: 3.1.0
info:
  description: >
    Generation-ready starter contract for ilyama's HTTP API.

    This is intentionally scoped to stable routes already mounted in
    services/apis

    so frontend clients can begin integrating against the rewrite immediately.
  title: ilyama Core API
  version: 0.1.0
servers:
  - url: /core/api/v1
security:
  - bearerAuth: []
tags:
  - name: Certificates (HTTP)
  - name: Device JITR
  - name: Device RPC
  - name: Devices
  - name: Edge replication
  - name: Fleets
  - name: Integrations
  - name: MDM
  - name: Notification Event Registry
  - name: Notifications
  - name: OTA
  - name: Observability & data
  - name: Organizations
  - name: Project settings
  - name: Projects
  - name: Projects — Email Templates
  - name: Projects — Notification Subscriptions
  - name: Projects — Status
  - name: System
  - name: Tickets & workflows
  - name: Webhooks
paths:
  /projects/{project_id}/fleets/{fleet_id}/devices/{device_id}/mqtt_certificate:
    post:
      tags:
        - Fleets
      summary: Issue an MQTT TLS client certificate for a device
      description: >
        Generates a device key pair and CSR, signs a broker-compatible client
        certificate via the

        cert worker, and returns PEM material once. Re-issue is rejected while a
        certificate is

        already linked to the device (HTTP 409).
      operationId: issueDeviceMQTTCertificate
      parameters:
        - in: path
          name: project_id
          required: true
          schema:
            format: uuid
            type: string
        - in: path
          name: fleet_id
          required: true
          schema:
            format: uuid
            type: string
        - in: path
          name: device_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IssueDeviceMQTTCertificateRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssueDeviceMQTTCertificateResponse'
          description: Certificate issued
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
          description: Invalid key algorithm or device is not MQTT-enabled
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
          description: Device not found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
          description: Device already has a certificate
      security:
        - bearerAuth: []
          orgIdHeader: []
components:
  schemas:
    IssueDeviceMQTTCertificateRequest:
      additionalProperties: false
      description: >-
        Optional body; omit or send an empty object to use the default algorithm
        (rsa).
      properties:
        key_algorithm:
          $ref: '#/components/schemas/DeviceKeyAlgorithm'
      type: object
    IssueDeviceMQTTCertificateResponse:
      properties:
        data:
          $ref: '#/components/schemas/IssueDeviceMQTTCertificateData'
        ok:
          enum:
            - 1
          type: integer
      required:
        - ok
        - data
      type: object
    ErrorEnvelope:
      properties:
        detail:
          type: string
        message:
          oneOf:
            - type: string
            - type: object
        ok:
          enum:
            - 0
          type: integer
      required:
        - ok
        - message
        - detail
      type: object
    DeviceKeyAlgorithm:
      default: rsa
      description: Key algorithm for MQTT device client certificate CSR generation.
      enum:
        - rsa
        - ecdsa
      type: string
    IssueDeviceMQTTCertificateData:
      description: >-
        PEM material returned once at issuance; the private key is not stored
        server-side.
      properties:
        caCertificatePem:
          type: string
        certificateId:
          format: uuid
          type: string
        certificatePem:
          type: string
        privateKeyPem:
          type: string
      required:
        - certificateId
        - privateKeyPem
        - certificatePem
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http
    orgIdHeader:
      in: header
      name: ORG-ID
      type: apiKey

````