REST API client endpoints

The client endpoints under /rhui/api/v1/client/ list repository labels and generate client entitlement certificates and configuration RPMs. All client endpoints require HTTP Basic authentication or a rhuiSessionId cookie.

Table 1. Client endpoints
Endpoint Description

GET /rhui/api/v1/client/labels

List repository labels for client certificate creation.

POST /rhui/api/v1/client/cert

Generate a client entitlement certificate.

POST /rhui/api/v1/client/rpm

Generate a client configuration RPM.

GET /rhui/api/v1/client/labels

Returns the same repository labels as rhui-manager client labels: entitlement labels from valid, non-expired Red Hat content certificates on the RHUA, sorted by label. These labels are used with client entitlement certificate creation and can differ from deployed repository ids.

Returns 200 with a ClientLabelsResponse object (application/json). The 401, 500, and 503 common codes also apply.

POST /rhui/api/v1/client/cert

Creates a client entitlement certificate, in the same way as rhui-manager client cert. The required fields map to the CLI options --repo_label, --name, --days, and --dir. Label resolution matches the CLI (Red Hat entitlement prefix match and custom-repo_id labels). Unknown labels yield HTTP 400.

Table 2. Request body: ClientCertRequest (application/json)
Field Type Required Description

repo_labels

array of string

Yes

Repository or entitlement labels to include (CLI --repo_label). Matching follows the CLI: Red Hat entitlement label prefix, or custom-repo_id for custom entitlements.

name

string

Yes

Certificate base name (CLI --name); used for name.crt and name.key.

days

integer

Yes

Number of days the certificate will be valid (CLI --days).

dir

string

Yes

Absolute directory on the RHUA where the certificate will be stored (CLI --dir). Must start with /, already exist, and be writable.

Returns 201 with a ClientCertResponse object (application/json). Common response codes also apply.

POST /rhui/api/v1/client/rpm

Creates a client configuration RPM. When entitlement_certfile and entitlement_cert_keyfile are both supplied, those files are used and certificate generation is skipped; in that case repo_labels must not be set. Otherwise, the endpoint behaves like rhui-manager client rpm --cert: it generates an entitlement certificate from repo_labels, when supplied, and builds the RPM under dir. Without a supplied certificate pair, at least one of repo_labels or unprotected_repos must be a non-empty array. Unknown or invalid labels or repositories yield HTTP 400.

Table 3. Request body: ClientRpmRequest (application/json)
Field Type Required Description

dir

string

Yes

Absolute path on the RHUA where the client RPM will be generated. Must start with /, already exist as a directory, and be writable.

rpm_name

string

Yes

RPM package name (RPM naming rules).

repo_labels

array of string

No

Content certificate entitlement labels to include in a newly generated certificate. Must not be set when entitlement_certfile or entitlement_cert_keyfile are supplied.

unprotected_repos

array of string

No

Unprotected custom repository ids to include in the client configuration.

entitlement_certfile

string

No

Absolute path to an existing entitlement certificate (.crt). Must be paired with entitlement_cert_keyfile; both files must be readable.

entitlement_cert_keyfile

string

No

Absolute path to the private key for entitlement_certfile. Must be paired with entitlement_certfile; both files must be readable.

rpm_release

string

No

Release of the generated RPM package.

rpm_version

string

No

Version of the generated RPM package.

days

integer

No

Number of days the generated entitlement certificate will be valid. Ignored when entitlement_certfile or entitlement_cert_keyfile are supplied.

proxy

string

No

Optional proxy URL or string for yum repository files.

ca_cert

string

No

Full path to the CDS SSL CA certificate. Defaults to ssl_ca_crt in rhui-tools.conf.

omit_repo_sslcacert

boolean

No

When true, omit sslcacert from rh-cloud.repo and omit ca.crt from the RPM. Use when CDS TLS uses a publicly trusted certificate.

Returns 201 with a ClientRpmResponse object (application/json). Common response codes also apply.

Table 4. Common response codes
Number Description Response

201

Client configuration RPM created — application/json

ClientRpmResponse

400

Invalid request — application/json

Error

401

Authentication required or invalid credentials — application/json

Error

500

Unexpected internal error — application/json

Error

503

Required session signing configuration is missing or invalid — application/json

Error