Search Certificates

venafi_tpp.search_certificates

ActionBusiness appsconnection required

Calls the Venafi TLS Protect Datacenter API with the connection's credentials.

Search the certificate inventory by folder, attribute or expiry.

Ask about Venafi TLS Protect Datacenter All Venafi TLS Protect Datacenter nodes Provider API docs ↗

Connection

Required: Yes — the node will not save without one
Auth type: Custom
Providers: Venafi TLS Protect Datacenter
Secret shape: {"username": "…", "password": "…"} or {"access_token": "…"}
Config it needs: base_url, client_id, scope
Resolved by: config.connection_id, else node.connection_id

Configuration

5 fields, none required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
parent_dn_recursive Search this policy folder and everything beneath it.	string	No	—	—	\VED\Policy
filters Further Venafi filters as query parameters, such as {"CN": "www.acme.com", "ValidToLess": "2026-12-31T00:00:00.0000000Z"}.	object	No	—	—	{"CN":"www.acme.com","ValidToLess":"2026-12-31T00:00:00.0000000Z"}
optional_fields Extra certificate attributes to include on each row, comma separated: Issuer, KeyAlgorithm, KeySize and Subject.	string	No	—	—	Issuer,KeyAlgorithm,KeySize,Subject
limit How many certificates to return; Venafi returns 100 when this is blank.	number	No	100	≥ 1	—
offset How many matching certificates to skip, for paging through the results.	number	No	0	≥ 0	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "filters": {
    "CN": "www.acme.com",
    "ValidToLess": "2026-12-31T00:00:00.0000000Z"
  },
  "limit": 100,
  "offset": 0,
  "optional_fields": "Issuer,KeyAlgorithm,KeySize,Subject",
  "parent_dn_recursive": "\\VED\\Policy"
}

Output

One shape.

result

Field	Type	Example
items The certificates on this page.	array	—
count How many certificates this page carried.	number	—
total_count How many certificates matched in total.	number	—
data_range The range this page covers, as Venafi words it.	string	—
items[].DN Distinguished Name of the certificate object.	string	—
items[].Guid GUID of the certificate object.	string	—
items[].Name Name of the certificate object.	string	—
items[].ParentDn Policy folder the certificate object lives in.	string	—
items[].SchemaClass The object's class, normally 'X509 Server Certificate'.	string	—
items[].CreatedOn When the object was created, as an ISO 8601 stamp.	string	—
items[].X509.CN Common Name on the issued certificate.	string	—
items[].X509.Issuer Distinguished Name of the issuing authority.	string	—
items[].X509.Serial Serial number of the issued certificate.	string	—
items[].X509.Thumbprint SHA-1 thumbprint of the issued certificate.	string	—
items[].X509.ValidFrom Start of the certificate's validity window.	string	—
items[].X509.ValidTo End of the certificate's validity window.	string	—
items[].X509.SANS Subject alternative names, grouped by type.	object	—

{
  "count": 0,
  "data_range": "",
  "items": [
    {
      "CreatedOn": "",
      "DN": "",
      "Guid": "",
      "Name": "",
      "ParentDn": "",
      "SchemaClass": "",
      "X509": {
        "CN": "",
        "Issuer": "",
        "SANS": {},
        "Serial": "",
        "Thumbprint": "",
        "ValidFrom": "",
        "ValidTo": ""
      }
    }
  ],
  "total_count": 0
}

Related Venafi TLS Protect Datacenter nodes

See Search Certificates run in a workflow.

In a technical demo we add the Venafi TLS Protect Datacenter connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales