Venafi Integration

Machine identity management for TLS certificates across cloud and on-premises systems. Connect Venafi events to the tools your engineering teams already use. Start with Watch Venafi Events, then follow with Download a Certificate or Get a Certificate to automate the next step.

Explore Documentation

3-day trialCancel anytimeUp to 10 minutes quick set up

GDPR
Data Encryption
2FA
Local Data Region

Supported triggers and actions for Venafi integration

Triggers can detect changes in Venafi and run actions that can create, search or modify data inside Venafi automatically [3] — exactly how you set them.

Watch Venafi EventsTriggers when Venafi sends an event, such as a certificate nearing expiry.
Download a CertificateDownloads a certificate in PEM or DER format.
Get a CertificateReturns a single certificate with its details and installations.
Get a Certificate InstallationReturns a single certificate installation.
Get a Certificate RequestReturns a single certificate request.
Get a Certificate Request ApprovalReturns the approval request and approver outcomes of a certificate request.
Get a Certificate Request Approval RuleReturns a single approval rule for certificate requests.
Get a Certificate Revocation Approval RuleReturns a single approval rule for certificate revocations.
Get a Credential Manager ConfigurationReturns a single credential manager configuration.
Get a MachineReturns a single machine.
Get a Machine IdentityReturns a single machine identity.
Get an ApplicationReturns a single application.
Get an Application Auto-Renewal ConfigurationReturns the certificate auto-renewal configuration of an application.
Get an Application Basic Discovery ConfigurationReturns the Basic Discovery configuration of an application.
Get an Application by NameReturns a single application found by its name.
Get an Issuing TemplateReturns a single certificate issuing template.
Get an Issuing Template by AliasReturns the issuing template assigned to an application under an alias.
Get a PluginReturns a single plugin.
Get a Private Key ImportReturns the status and results of a certificate and private key import.
Get a ServiceReturns a single discovery or key generation service.
Get a Service AccountReturns a single service account.
Get a Shared CredentialReturns a single shared credential.
Get a TagReturns a single tag found by its name.
Get a TeamReturns a single team.
Get a UserReturns a single user.
Get a User by UsernameReturns a single user found by their username.
Get Machine Discovery ResultsReturns the latest discovery results of a machine.
Get the Auto-Renewal ConfigurationReturns the company-wide certificate auto-renewal configuration.
Get the Auto-Renewal StatusReturns the status of the current and previous auto-renewal runs.
Get the Current User AccountReturns the user, API key, and company details of this connection.
Get the Expiration Report ConfigurationReturns the certificate expiration report configuration.
Get the Inventory Monitoring ConfigurationReturns the certificate expiration monitoring configuration.
List ApplicationsRetrieves a list of applications.
List Certificate InstallationsRetrieves a list of certificate installations.
List Certificate Request Approval RulesRetrieves every approval rule for certificate requests.
List Certificate RequestsRetrieves a list of certificate requests.
List Certificate Revocation Approval RulesRetrieves every approval rule for certificate revocations.
List CertificatesRetrieves a list of certificates in your inventory.
List ConnectorsRetrieves the connectors of your company.
List Credential Manager ConfigurationsRetrieves the credential manager configurations of your company.
List Disabled PluginsRetrieves the plugins disabled for your company.
List Issuing TemplatesRetrieves a list of certificate issuing templates.
List Machine IdentitiesRetrieves a list of machine identities.
List MachinesRetrieves a list of machines.
List PluginsRetrieves the plugins available to your company.
List Service AccountsRetrieves the service accounts you have access to.
List Service Account ScopesRetrieves the scopes you can grant to service accounts.
List ServicesRetrieves a list of discovery and key generation services.
List Shared CredentialsRetrieves the shared credentials of your company.
List TagsRetrieves every tag in your company.
List Tag ValuesRetrieves the values of a tag.
List TeamsRetrieves the teams of your company.
List UsersRetrieves users that match the given filters.
List Values for All TagsRetrieves the values of every tag.
Search Certificate InstallationsRetrieves certificate installations that match a search expression.
Search Certificate RequestsRetrieves certificate requests that match a search expression.
Search CertificatesRetrieves certificates that match a search expression.
Search Machine IdentitiesRetrieves machine identities that match a search expression.
Search MachinesRetrieves machines that match a search expression.
Abort Machine Batch ProvisioningStops the active batch provisioning run of a machine.
Abort Machine DiscoveryStops the active discovery run of a machine.
Add a MachineCreates a machine for a machine plugin.
Add a Machine IdentityAdds a machine identity to a machine.
Add an ApplicationCreates an application.
Add an Issuing TemplateCreates a certificate issuing template.
Add a ServiceCreates a discovery or key generation service.
Add a TeamCreates a team.
Add Credential Manager ConfigurationsAdds one or more credential manager configurations.
Add Shared CredentialsAdds one or more shared credentials.
Add Team MembersAdds users to a team as members.
Add Team OwnersAdds users to a team as owners.
Approve or Reject a Certificate RequestApproves or rejects a certificate request that is waiting for approval.
Approve or Reject Certificate RequestsApproves or rejects several certificate requests that are waiting for approval.
Count Tagged ObjectsReturns how many objects carry each of the given tags.
Create a Certificate RequestRequests a new or renewed certificate for an application.
Create a Certificate Request Approval RuleCreates an approval rule for certificate requests.
Create a Certificate Revocation Approval RuleCreates an approval rule for certificate revocations.
Create a ConnectorCreates a connector that delivers events to a webhook, Slack, or Microsoft Teams.
Create a Local PluginCreates a custom plugin for your company only.
Create an Application InvitationCreates a short-lived link that invites new owners to an application.
Create a Service AccountCreates a service account for machine-to-machine authentication.
Create a TagCreates a tag with optional values.
Create Tags in BulkCreates several tags with optional values in one call.
Create Tag ValuesAdds values to a tag.
Delete a Certificate Request Approval RuleDeletes an approval rule for certificate requests.
Delete a Certificate Revocation Approval RuleDeletes an approval rule for certificate revocations.
Delete a ConnectorDeletes a connector so it stops delivering events.
Delete a Credential Manager ConfigurationDeletes a credential manager configuration.
Delete a Local PluginDeletes a custom plugin owned by your company.
Delete a MachineDeletes a machine.
Delete a Service AccountDeletes a service account and invalidates its credentials.
Delete a Shared CredentialDeletes a single shared credential.
Delete a TagDeletes a tag.
Delete a Tag ValueDeletes one value from a tag.
Delete a TeamDeletes a team.
Delete Retired CertificatesPermanently deletes a set of retired certificates from the inventory.
Delete Shared CredentialsDeletes a set of shared credentials.
Delete Tags in BulkDeletes several tags or tag values in one call.
Disable a PluginDisables a plugin for your company.
Import CertificatesAdds raw certificates to your certificate inventory.
Import Certificates with Private KeysImports certificates together with their private keys.
Make an API CallPerforms an arbitrary authorized API call.
Recover CertificatesRestores a set of retired certificates, including their previous versions.
Remove a Machine IdentityDeletes a machine identity.
Remove an ApplicationDeletes an application.
Remove an Issuing TemplateDeletes a certificate issuing template.
Remove a Plugin DisablementEnables a plugin again for your company.
Remove a ServiceDeletes a discovery or key generation service.
Remove Team MembersRemoves members from a team.
Remove Team OwnersRemoves owners from a team.
Resubmit a Certificate RequestResubmits an existing certificate request.
Retire CertificatesRetires a set of certificates.
Run Expiration Reports NowStarts the certificate expiration report job right away.
Run the Auto-Renewal Check NowStarts the certificate auto-renewal check right away.
Start a Machine Identity WorkflowStarts a workflow, such as a connection test, for a machine identity.
Start a Machine WorkflowStarts a workflow on a machine.
Synchronize Issuing Template DomainsReloads the domain list from the certificate authority into issuing templates.
Test a Credential Manager ConnectionTests the connection to a privileged access management system through VSatellites.
Test a Machine ConnectionStarts a connection test workflow for machine connection details.
Test a Saved Credential Manager ConfigurationTests the connection of a saved credential manager configuration.
Test a Shared CredentialTests access to a shared credential.
Update a Certificate Request Approval RuleUpdates an approval rule for certificate requests.
Update a Certificate Revocation Approval RuleUpdates an approval rule for certificate revocations.
Update a ConnectorUpdates the filter and target of a connector.
Update a Credential Manager ConfigurationUpdates an existing credential manager configuration.
Update a Local PluginUpdates a custom plugin owned by your company.
Update a MachineUpdates selected details of a machine.
Update a Machine IdentityUpdates selected details of a machine identity.
Update an ApplicationReplaces all details of an application.
Update an Application Auto-Renewal ConfigurationUpdates the certificate auto-renewal configuration of an application.
Update an Issuing TemplateReplaces all details of a certificate issuing template.
Update a ServiceUpdates selected properties of a service.
Update a Service AccountUpdates selected fields of a service account.
Update a Service Account OCI TokenRegenerates the OCI registry token of a service account.
Update a Shared CredentialUpdates an existing shared credential.
Update a TeamUpdates the name, role, or matching rules of a team.
Update a User Account TypeChanges whether a user is a web or API account.
Update a User Local LoginEnables or disables local login for a user.
Update a User Password ExpirationSets whether a user must change their password at next login.
Update Certificate Application AssignmentsAdds, replaces, or removes application assignments for a set of certificates.
Update Service Account CredentialsExtends the credential lifetime of a service account.
Update Tag AssignmentsReplaces, adds, or removes tags on certificates, installations, or applications.
Update the Auto-Renewal ConfigurationUpdates the company-wide certificate auto-renewal configuration.
Update the Expiration Report ConfigurationUpdates the certificate expiration report configuration.
Update the Inventory Monitoring ConfigurationUpdates the certificate expiration monitoring configuration.
Update the Inventory Monitoring SchedulerRestarts the inventory monitoring scheduler, optionally running it now.
Update User RolesChanges the roles assigned to a user.
Validate a Certificate RequestChecks a proposed certificate request against its issuing template without submitting it.
Validate Certificate InstallationsRequests TLS validation for a set of certificate installations.
Validate CertificatesRequests TLS validation for a set of certificates.

How to integrate Venafi in automation workflow?

3 simple steps to make your Venafi connected with other apps in automation workflows on WEXTL. Up to 10 minutes integration set up.

STEP 1

Select Venafi in workflow

Pick Venafi app in the workflow builder [4] - just one click to select the app.

STEP 2

Connect Venafi

When prompted, authorize access to Venafi in WEXTL once. Venafi credentials are encrypted and never shared with WEXTL. Authorization will be reused in any future API calls [3].

WEXTL wants to integrate with your Venafi account. Approve?

STEP 3

Build a workflow

Build your workflow with Venafi yourself or with WEXTL® AI Builder. Connect Venafi to any available integrations [5], or use HTTP node to go beyond them.

Venafi

How Venafi connects and integrates with WEXTL

Save and approve your credentials once — WEXTL® stores authorization information encrypted and reuses the authentication whenever Venafi app is called in workflows. That allows your developer tools automations to run without your attention, per defined schedule [7]. Explore documentation [6] for a detailed list of fields that Venafi supports.

Full Venafi API documentation

The following table illustrates what fields Venafi integration require during authorization flow inside our workflow builder [4].

Demonstration of Venafi connection step inside WEXTL Workflow Builder [4].

Field	Type	Help
RegionRequired	select	The region your TLS Protect Cloud tenant lives in. It is shown in the address of the web console.
API KeyRequired	password	Your API key. In the console, open your user menu, choose Preferences, and copy the key from the API Keys tab.

Connect Venafi to popular apps on WEXTL

Enter a name of the other app you want to sync with Venafi below. Click on selected app to explore integration options with Venafi. If the app you search for is not available in WEXTL yet, you can use HTTP node [10] instead to integrate it directly.

Example automation with Venafi integration

Select Watch Venafi Events trigger from Venafi - this will be a starting point in your automation. Whenever event happens in Venafi, workflow will start [7] from Watch Venafi Events node.

Search for Add a Machine, connect it as the next step of integration sequence. You can use filters between Watch Venafi Events and Add a Machine, so only important data pass from Watch Venafi Events to the next step. WEXTL gives you full control over the process of Venafi automation. All parts of workflow are visible on the canvas [4].

Venafi on WEXTL has 150 modules for creating developer tools automations. Explore Venafi documentation for more.

Venafi

Watch Venafi Events

Contentful

Performs action

Contentful

Triggers

Venafi

Add a Machine

Demonstration of how visual Venafi automation [6] looks in WEXTL.

Frequently asked questions

Common questions about automating Venafi in your workflows.

Venafi has 1 trigger, including "Watch Venafi Events". Triggers are start points of the workflow, and automations may start from them.

Integration has 149 actions, including "Download a Certificate", "Get a Certificate", and "Get a Certificate Installation", and more. Refer to our Venafi Documentation for detailed inputs and outputs.

No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but our customers do that in rare cases [4].

Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.

The Venafi integration on WEXTL runs directly on its vendor public API — every field name, authentication method, and rate limit is controlled by Venafi official API and covered in documentation [3]. WEXTL handles the request signing and pagination for you.

Absolutely. Where Venafi provides native webhooks, you can use instant triggers to eliminate polling delay. For custom webhooks, WEXTL offers Custom Webhook node, so you can start automation whenever Venafi or any other service sends event to webhook URL.

WEXTL is an AI-first visual canvas. The platform allows you to describe automation in plain text — and AI will wire nodes for Venafi inside the workflow builder [4]. You can also use built-in workflow nodes (AI Agent, Human in the Loop, Condition, Aggregate Results) in pair with Venafi modules to craft complex integration flows with branches, filtering, and conditional logic. There are absolutely no limits of what you can build.

References

List of sources used to gather information about the Venafi integration.

Venafi integration source code, module specs and credentials implementation.
Internal Venafi integration documentation, structured input and output parameters, scopes, and authentication methods.
Official Venafi vendor API documentation — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
WEXTL® Visual Workflow Builder, anonymized data from our technical support team.
WEXTL® Apps Library
WEXTL® Venafi App Documentation
WEXTL® Workflow Scheduler
WEXTL® HTTP node documentation

Venafi Integration

Supported triggers and actions for Venafi integration