GET Templates

The GET /Templates operation retrieves one or more templates from Keyfactor Command. Query parameters support filtering using defined criteria, control over pagination by specifying the page number and return limit, and customization of sorting based on specified fields and order. On success, the operation returns HTTP 200 OK with  details about the specified templates.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/certificate_templates/read/

Table 973: GET Templates Input Parameters

Name In Description
QueryString Query

A string containing a query to limit the results (for example, field1 -eq value1 AND field2 -gt value2). The default is to return all records. Fields available for querying through the API for the most part match those that appear in the Keyfactor Command Management Portal search dropdowns for the same feature. For querying guidelines, refer to: Searching Certificate Templates. The query fields supported for this operation are:

  • ConfigurationTenant

    Complete or partial matches with the Configuration Tenant name.

  • DisplayName

    Complete or partial matches with the name of the template Display Name.

  • ForestRoot

    Complete or partial matches with the forest location.

    Note:  This search term has been deprecated and may be removed in a future release.

  • FriendlyName

    Complete or partial matches with the Keyfactor Command friendly name of the template.

  • HasPrivateKeyRetention

    Private Key Retention is selected for this template (true/false).

  • Id

    Numeric matches with the Keyfactor Command reference ID for the template.

  • IsDefaultTemplate

    The template is one of the Microsoft default templates (true/false). This is helpful to filter in or out any Microsoft built-in templates that you didn't create.

  • ShortName

    Complete or partial matches with the template Short Name.

Tip:  To filter out all the built-in Active Directory templates and display only your custom templates, use the following query:
IsDefaultTemplate -eq "false"
PageReturned Query An integer that specifies how many multiples of the returnLimit to skip and offset by before returning results, to enable paging. The default is 1.
ReturnLimit Query An integer that specifies how many results to return per page. The default is 50. Very large values can result in long processing time.
SortField Query

A string containing the property by which the results should be sorted. Fields available for sorting through the API include:

  • AllowedEnrollmentTypes

  • AllowOneClickRenewals

  • CommonName

  • ConfigurationTenant

  • ForestRoot

  • FriendlyName

  • Id

  • KeyArchival

  • KeyRetention

  • KeyRetentionDays

  • KeyUsage

  • Oid

  • RequiresApproval

  • TemplateName

  • UseAllowedRequesters

Available sort fields are affected by the query provided in QueryString. The default sort field is CommonName.
SortAscending Query An integer that sets the sort order on the returned results. A value of 0 sorts results in ascending order while a value of 1 sorts results in descending order. The default is ascending.

Table 974: GET Templates Response Data

Name Description
Allow One Click Renewals A Boolean indicating whether One-Click Renewal will be allowed for certificate renewals requested with this template (True or False).

To use One-Click Renewal for certificates, the Allow One-Click Renewals option must be turned on in both the certificate templates and CAs to which you want one-click renewal to apply (see Certificate Templates, HTTPS CAs - Advanced Tab or DCOM CAs - Advanced Tab ). For more information about one-click renewals, see Renew/Reissue.

Allowed Enrollment Types

An integer indicating the type of enrollment allowed for the certificate template.

Note:  This parameter is considered deprecated and may be removed in a future release.

These values are populated based on configurations made for the default enrollment policy. ClosedShow allowed enrollment type details.
Allowed Requesters

An array of strings containing the list of Keyfactor Command security roles—as strings—that have been granted enroll permission on the template.

The Allowed Requesters list at the template level has been replaced by the Associated Roles list at the enrollment pattern level (see POST Enrollment Patterns) and are populated based on configurations made for the default enrollment policy.

Note:  This parameter is considered deprecated and may be removed in a future release.
Common Name

A string representing the short name (common name) of the certificate template. For a template created using a Microsoft management tool, this will be the Microsoft template name, which typically does not contain spaces. For templates associated with an EJBCA CA, the name is usually constructed using the format end entity profile name_certificate profile name. If the end entity profile and certificate profile share the same name, only the end entity profile name is used. This field is populated based on information retrieved from the CA and is not configurable.
Configuration Tenant

A string indicating the configuration tenant of the template. For Microsoft templates, this field is populated from Active Directory. For EJBCA templates, this field is populated from the Keyfactor Command CA record. The field is not configurable.
Display Name A string indicating the Keyfactor Command display name of the template. If a template friendly name is configured, this is used as the display name. If not, the template name is used. The display name appears in the dropdowns for PFX enrollment, CSR enrollment, and CSR generation. The display name is a generated field and is not directly configurable.
Enrollment Fields

An array of objects containing custom enrollment fields. This data is configured at the enrollment pattern level (see POST Enrollment Patterns).

Note:  This parameter is considered deprecated and may be removed in a future release.
Extended Key Usages

An array of objects containing the extended key usage information for the template. This field is populated from the CA and is not configurable. ClosedShow extended key usage details.
Forest Root

A string indicating the forest root of the template. For Microsoft templates, this field is populated from Active Directory and is not configurable.

Note:  The ForestRoot has been replaced by the ConfigurationTenant but is retained for backwards compatibility.
Friendly Name

A string indicating the Keyfactor Command friendly name of the template.

Note:  This parameter is considered deprecated and may be removed in a future release.
Id An integer indicating the ID of the template in Keyfactor Command.
IsEphemeral A Boolean that sets whether the template is ephemeral. If set to True, during a CA synchronization, certificates associated with an ephemeral template will be skipped. The default is False. See Templates:Details Tab.
Key Archival

A Boolean indicating whether the template has been configured with the key archival setting in Active Directory (True or False). This is a reference field and is not configurable.
Key Retention

A string indicating the key retention type used to store private keys in Keyfactor Command for certificates enrolled with this template. ClosedShow key retention details.
Key Retention Days

An integer indicating the number of days a certificate’s private key will be retained in Keyfactor Command before being scheduled for deletion, if private key retention is turned on.

KeyTypes A string containing a comma-delimited list of the key sizes and types supported for the template returned from the CA as they are displayed in the Management Portal templates grid. Possible values include RSA 2048, ECC P-384, Ed25519, and Ed448.
Key Usage

An integer indicating the total key usage of the certificate. Key usage is stored in Keyfactor Command as a single value made up of a combination of values. ClosedShow value details.

For example, a value of 160 would represent a key usage of digital signature with key encipherment. A value of 224 would add nonrepudiation to those.
Manageability

New enum field in the templates DB table, Manageability, which displays the manageability setting on a template, which are determined algorithmically based on the situation when the template is imported.

  • If set to None (0), when Keyfactor Command syncs templates in, it'll ignore that template (not a common situation).

  • Read (1) allows for the ability to read information on templates. All the templates imported into Keyfactor Command implicitly have had that level of manageability. With this setting, the View on CA and Copy on CA buttons would be enabled on the certificates template page.

  • Read/Write (3) allows for the ability to manage the templates on the EJBCA server through Keyfactor Command. Set If there is a one-to-one match with EndEntity Profile and Template. With this setting, the Edit on CA, and the View on CA and Copy on CA, buttons would be enabled on the certificate template page.
Oid A string containing the object ID of the template. For Microsoft templates, this field is populated from Active Directory. For EJBCA templates, this field is generated within Keyfactor Command as an object identifier, but does not follow official OID conventions. The field is not configurable.
Requires Approval

A Boolean indicating whether the template has been configured with the Microsoft CA certificate manager approval option active (True or False).

Important:  Any templates that are configured on the Microsoft CA Issuance Requirements tab for CA certificate manager approval cannot be used for enrollment and associated alerting in Keyfactor Command without configuring private key retention. Any of the active private key retention settings (settings other than none as described for KeyRetention) will allow a template requiring manager approval to work with Keyfactor Command PFX and CSR enrollment.

Figure 509: Microsoft Issuance Requirements on a Template for Manager Approval
Template Name

A string containing the name of the template. For a template created using a Microsoft management tool, this will be the Microsoft template display name. For a template generated for an EJBCA CA, this will be built using a naming scheme of end entity profile name (certificate profile name). This field is populated based on information retrieved from the CA and is not configurable.
Template Regexes

An array of objects containing individual template-level regular expressions against which to validate the subject data. This data is configured at the enrollment pattern level (see POST Enrollment Patterns) and will be populated based on the default enrollment pattern.

Note:  This parameter is considered deprecated and may be removed in a future release.

ClosedShow template RegEx details.

Use Allowed Requesters

A Boolean that indicates whether the Restrict Allowed Requesters option should be turned on (True) or not (False).

The Restrict Allowed Requesters option at the template level has been replaced by the Use AD Permissions option at the enrollment pattern level (see POST Enrollment Patterns).

Note:  This parameter is considered deprecated and may be removed in a future release.
Tip:  See the Keyfactor APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility, which allows you to call API operations and view results. It is primarily intended for validation, testing, and workflowClosed A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development, and also serves as an interactive supplement to this API documentation. You can access it from the help menu () in the Management Portal.