Filter Trust Rollout Status

Get Filtered Certificate Rotation Status with Node-Level Details

Retrieves the certificate rotation status with node-level detail for specific verticals and/or node statuses. This is the primary endpoint for diagnosing rotation failures.

When to use: Use this endpoint after GET /trust/trust-rollout-status reveals that a rotation has COMPLETED_WITH_FAILURES or is still IN_ROTATION with pending nodes. Filter by vertical and status to retrieve the exact list of nodes (with error messages) that require attention.

Filter Behavior:

vertical_names: Restricts results to the specified verticals. Values must match the TrustRolloutStatusVerticalKey enum. Obtain valid values from vertical_key fields in GET /trust/trust-rollout-status.
include_status: Restricts node-level detail to nodes in the specified states (SUCCESS, FAILED, PENDING). Only matching nodes are populated in success_nodes, failed_nodes, or pending_nodes.
If the request body is omitted, the response is equivalent to GET /trust/trust-rollout-status (summary-level data, no node detail).

Important: Node-level detail is only available for certain verticals (e.g., BAREMETALSECURITY, SENSOR). Other verticals (NSX, AVI, SSP, LH) always return empty node arrays - their status is limited to START_SUCCESSFUL or FAILED_TO_START_ROTATION.

Chaining:

Call GET /trust/trust-rollout-status to identify the overall status and which verticals have failed_node_count > 0 in their status_summary.
Call this endpoint with those vertical keys and include_status: ["FAILED"] to retrieve node-level error details for remediation.

Notes:

Returns 400 if vertical_names contains values not in the TrustRolloutStatusVerticalKey enum, or if include_status contains values outside of SUCCESS, FAILED, PENDING.
Verticals not matching the filter are excluded entirely from the response.

Request

URI

POST

https://{api_host}/ssp/trust/trust-rollout-status

COPY

Request Body

TrustRolloutStatusFilterRequest of type(s) application/json

Optional

Show optional properties

{
    "vertical_names": [
        {}
    ],
    "include_status": [
        {}
    ]
}

{
    "vertical_names": [
        "string"
    ],
    "include_status": [
        "string"
    ]
}

array of string

vertical_names

Required

List of vertical keys to include in the detailed node-level response. Values must match the TrustRolloutStatusVerticalKey enum. Obtain valid values for the current deployment from the vertical_key fields in the GET /trust/trust-rollout-status response. Invalid values cause a 400 response.

array of string

include_status

Required

List of node rotation statuses to include in the node-level detail arrays. Only nodes whose update_status matches one of the provided values will be returned in success_nodes, failed_nodes, or pending_nodes. Invalid values cause a 400 response.

Enumeration: SUCCESS, FAILED, PENDING

Authentication

This operation uses the following authentication methods.

Responses

200

OK - Returns the certificate rotation status with node-level details for the specified filter.

Returns TrustRolloutStatus of type(s) application/json

{
    "rollout_type": "string",
    "informational_messages": [
        "string"
    ],
    "progress_percent": 0,
    "vertical_status": [
        {
            "vertical_key": "string",
            "rollout_result": "string",
            "status_summary": {
                "success_node_count": 0,
                "failed_node_count": 0,
                "pending_node_count": 0
            },
            "success_nodes": [
                {
                    "node_display_name": "string",
                    "node_id": "string",
                    "error_message": "string",
                    "update_status": "string"
                }
            ],
            "failed_nodes": [
                {
                    "node_display_name": "string",
                    "node_id": "string",
                    "error_message": "string",
                    "update_status": "string"
                }
            ],
            "pending_nodes": [
                {
                    "node_display_name": "string",
                    "node_id": "string",
                    "error_message": "string",
                    "update_status": "string"
                }
            ]
        }
    ],
    "overall_status": "string",
    "start_time": 0
}

string

rollout_type

Optional

Identifies which certificate is being rotated in this workflow run.

PLATFORM_CA - The platform root CA certificate is being renewed and all certificates signed by that CA are being re-issued and distributed across all verticals. Triggered automatically by the platform when the root CA is near expiration, or initiated via the Trust Management UI. This is the most common rotation type.
INGRESS - The external-facing ingress (TLS) certificate is being rotated. Initiated via the Trust Management UI only, when a new CA-signed ingress certificate is applied. Affects inbound connections to the SSP platform from external clients.

The active rollout_type is returned in TrustRolloutStatus.rollout_type.

Enumeration: INGRESS, PLATFORM_CA

array of string

informational_messages

Optional

Human-readable log of key events during the rotation workflow, ordered chronologically. Useful for understanding the sequence of steps taken and diagnosing issues. These messages are also visible in the SSP Trust Management UI.

integer

progress_percent

Optional

Approximate percentage of the rotation workflow that has completed, ranging from 0 to 100. Updated continuously during an active rotation. This value is an estimate based on both rotation steps and participant node completion counts and may not increase linearly.

array of object

vertical_status

Optional

Per-vertical breakdown of certificate rotation status. Each entry corresponds to one platform component (vertical) participating in the rotation. The vertical_key in each entry is a valid input for vertical_names in the POST /trust/trust-rollout-status filter request.

string

overall_status

Optional

The aggregate status of the entire certificate rotation workflow across all participating verticals.

SCHEDULED - Rotation is queued but has not started yet.
IN_ROTATION - Rotation is actively in progress; do not call DELETE /trust/trust-rollout-status while in this state.
COMPLETED_SUCCESSFULLY - All verticals and all nodes successfully rotated their certificates. Safe to call DELETE to reset.
COMPLETED_WITH_FAILURES - The rotation finished but one or more nodes failed. Use POST /trust/trust-rollout-status with include_status: ["FAILED"] to retrieve failure details before calling DELETE to reset.

Enumeration: IN_ROTATION, COMPLETED_SUCCESSFULLY, COMPLETED_WITH_FAILURES, SCHEDULED

integer As int64 As int64

start_time

Optional

Unix epoch timestamp in milliseconds when the certificate rotation workflow began execution. Use this to correlate rotation events with platform logs.

400

Bad Request - The filter criteria are malformed. This occurs when:

A vertical_names value is not one of the valid TrustRolloutStatusVerticalKey enum values (BAREMETALSECURITY, SENSOR, SSP, LH, NSX, AVI).
An include_status value is not one of SUCCESS, FAILED, or PENDING.

Returns Error of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

401

Unauthorized

Returns Unauthorized of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

403

Forbidden

Returns Forbidden of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

412

Precondition Failed

Returns PreconditionFailed of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

428

Precondition Required

Returns PreconditionRequired of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

429

Too Many Requests

Returns TooManyRequests of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

Code Samples

COPY

                    curl -X POST -H 'Authorization: <value>' -H 'Content-Type: application/json' -d '{"vertical_names":["string"],"include_status":["string"]}' https://{api_host}/ssp/trust/trust-rollout-status

On This Page

Description

Request

Request Body

Authentication

Response

200 Response Body

Errors

Certificates Operations

GET

Get Trust Rollout Status

POST

Filter Trust Rollout Status

DELETE

Clear Trust Rollout Status