# Ban a PKI certificate (/docs/apis/management/trust-stores/BanPkiTrustStoreCertificate)

`POST /truststores/pki/{trust_store_id}/banned_certificates`

Creates a banned certificate entry in the specified PKI trust store, preventing certificates matching the provided identifier from being trusted during mTLS authentication.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `trust_store_id` (path) (string, required) The unique identifier of the trust store.

## Request body

JSON, required. The request payload used to ban a certificate.

- `type` (string, default "thumbprint") Specifies the identifier type used to ban the certificate. One of: `thumbprint`, `serial_number`, `subject`.
- `value` (string, required) The certificate identifier value used for banning.
- `reason` (string) The reason explaining why the certificate was banned.

## Response body

`200`, JSON. The certificate was banned successfully

Returns `BannedCertificate`.

- `id` (string, required) The unique identifier of the banned certificate entry.
- `type` (string, required) Specifies the identifier type used to ban the certificate. One of: `thumbprint`, `serial_number`, `subject`.
- `value` (string, required) The certificate identifier value used for banning.
- `reason` (string) The reason explaining why the certificate was banned.
- `creation_time` (integer, required, date-time) Specifies the time at which the certificate was banned (in Epoch).

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `402` Payment Required
  Same body as `400`.
- `403` Forbidden
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var trustStoreId = "9qVBxPQiZqtUsBOykavK6";

var requestBody = new BanTrustStoreCertificateRequest
  {
    Type = BannedCertificateType.Thumbprint,
    Value = "F1FB4FD68F15DAA29A0B935B2759986A92898030F1FB4FD68F15DAA29A0B935B",
    Reason = "Privilege withdrawn",
  };


var result = await apiClient.TrustStores.BanPkiTrustStoreCertificateAsync(trustStoreId, requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const trustStoreId = '9qVBxPQiZqtUsBOykavK6';

const requestBody = {
  type: 'thumbprint',
  value: 'F1FB4FD68F15DAA29A0B935B2759986A92898030F1FB4FD68F15DAA29A0B935B',
  reason: 'Privilege withdrawn'
};

const result = apiClient.trustStores.banPkiTrustStoreCertificate(trustStoreId, requestBody);
```