Create an mTLS configuration

Stores a certificate signed against the CSR from GET /v1/webhooks_settings/mtls_csr and returns its id, which is then set on a webhook as webhookMtlsId. The private key the certificate was issued for is derived from the certificate, so it is never named by the caller.

Re-uploading a certificate already stored returns the existing id rather than creating a second configuration, so several webhooks can share one certificate.

A certificate that was not issued for a private key this workspace holds is rejected with a 400.

Endpoint Permissions: Owner, Admin, Non-Signing Admin.

POST

webhooks_settings

mtls

TypeScript

const response: Promise<FireblocksResponse<WebhookMtlsConfig>> = fireblocks.webhooksV2.createWebhookMtlsConfig(webhooksV2ApiCreateWebhookMtlsConfigRequest);

curl --request POST \
  --url https://api.fireblocks.io/v1/webhooks_settings/mtls \
  --header 'Content-Type: application/json' \
  --data '
{
  "signedCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "name": "Production gateway 2026"
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    signedCert: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
    name: 'Production gateway 2026'
  })
};

fetch('https://api.fireblocks.io/v1/webhooks_settings/mtls', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/webhooks_settings/mtls",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'signedCert' => '-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----',
    'name' => 'Production gateway 2026'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/webhooks_settings/mtls"

	payload := strings.NewReader("{\n  \"signedCert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n  \"name\": \"Production gateway 2026\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/webhooks_settings/mtls")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"signedCert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n  \"name\": \"Production gateway 2026\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "44fcead0-7053-4831-a53a-df7fb90d440f",
  "signedCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "expiresAt": 1726108200000,
  "createdAt": 1694572200000,
  "updatedAt": 1726108200000,
  "name": "Production gateway 2026"
}

{
  "message": "<string>",
  "code": 123
}

Headers

Idempotency-Key

string

A unique identifier for the request. If the request is sent multiple times with the same idempotency key, the server will return the same response as the first request. The idempotency key is valid for 24 hours.

Body

application/json

signedCert

string

required

Signed client certificate PEM, issued for the CSR from GET /v1/webhooks_settings/mtls_csr. The private key it belongs to is derived from the certificate itself.

Example:

"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"

name

string

A label for this mTLS configuration, to tell several certificates apart. Letters, digits and spaces only.

Maximum string length: 255

Pattern: ^[a-zA-Z0-9 ]*$

Example:

"Production gateway 2026"

Response

The stored mTLS configuration

A signed client certificate stored for the workspace, and the id a webhook references to use it. Several webhooks may share one configuration, so replacing the certificate here switches all of them at once.

string<uuid>

required

The unique identifier of the mTLS configuration, to be set on a webhook.

Example:

"44fcead0-7053-4831-a53a-df7fb90d440f"

signedCert

string

required

The signed client certificate PEM.

Example:

"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"

expiresAt

integer<int64>

required

When the certificate itself expires, in milliseconds since the epoch.

Example:

1726108200000

createdAt

integer<int64>

required

When the certificate was uploaded, in milliseconds since the epoch.

Example:

1694572200000

updatedAt

integer<int64>

required

When this configuration was last changed, in milliseconds since the epoch. Differs from createdAt once the certificate has been replaced or the configuration renamed.

Example:

1726108200000

name

string

The label given to this mTLS configuration.

Example:

"Production gateway 2026"

⌘I

TypeScript

const response: Promise<FireblocksResponse<WebhookMtlsConfig>> = fireblocks.webhooksV2.createWebhookMtlsConfig(webhooksV2ApiCreateWebhookMtlsConfigRequest);

curl --request POST \
  --url https://api.fireblocks.io/v1/webhooks_settings/mtls \
  --header 'Content-Type: application/json' \
  --data '
{
  "signedCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "name": "Production gateway 2026"
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    signedCert: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
    name: 'Production gateway 2026'
  })
};

fetch('https://api.fireblocks.io/v1/webhooks_settings/mtls', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/webhooks_settings/mtls",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'signedCert' => '-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----',
    'name' => 'Production gateway 2026'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/webhooks_settings/mtls"

	payload := strings.NewReader("{\n  \"signedCert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n  \"name\": \"Production gateway 2026\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/webhooks_settings/mtls")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"signedCert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n  \"name\": \"Production gateway 2026\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "44fcead0-7053-4831-a53a-df7fb90d440f",
  "signedCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "expiresAt": 1726108200000,
  "createdAt": 1694572200000,
  "updatedAt": 1726108200000,
  "name": "Production gateway 2026"
}

{
  "message": "<string>",
  "code": 123
}

Introduction

Errors & Statuses

Data Objects

API Endpoints

Create an mTLS configuration

Headers

Body

Response