API index

Every documented primitive, grouped by namespace page — 167 primitives. Generated from the same source comments that build the rest of this site.

Constants

Primitive	Since	Status
`C.TIME.days(n) -> milliseconds`	0.1.0	stable
`C.BYTES.mib(n) -> bytes`	0.1.0	stable

Errors

Primitive	Since	Status
`new PkiError(message, code)`	0.1.0	stable
`pki.errors.defineClass(name, opts?) -> constructor`	0.1.0	stable

ASN.1 / DER

Primitive	Since	Status
`pki.asn1.decode(bytes, opts?) -> node`	0.1.0	stable
`pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"`	0.1.15	stable
`pki.asn1.encode(classBits, constructed, tagNumber, content) -> Buffer`	0.1.0	stable
`pki.asn1.build.sequence([ ...tlvBuffers ]) -> Buffer`	0.1.0	stable

CBOR (deterministic)

Primitive	Since	Status
`pki.cbor.decode(bytes, opts?) -> node`	0.1.27	experimental
`pki.cbor.read.uint(node) -> 0n`	0.1.27	experimental
`pki.cbor.read.nint(node) -> -1n`	0.1.27	experimental
`pki.cbor.read.int(node) -> -1n`	0.1.27	experimental
`pki.cbor.read.byteString(node) -> Buffer`	0.1.27	experimental
`pki.cbor.read.textString(node) -> "text"`	0.1.27	experimental
`pki.cbor.read.array(node) -> [node, ...]`	0.1.27	experimental
`pki.cbor.read.map(node) -> [[keyNode, valueNode], ...]`	0.1.27	experimental
`pki.cbor.read.mapGet(node, key) -> valueNode \| null`	0.2.20	experimental
`pki.cbor.read.boolean(node) -> false`	0.1.27	experimental
`pki.cbor.read.nullValue(node) -> null`	0.1.27	experimental
`pki.cbor.read.undefinedValue(node) -> undefined`	0.1.27	experimental
`pki.cbor.read.float(node) -> 1.5`	0.1.27	experimental
`pki.cbor.read.biguint(node) -> 18446744073709551616n`	0.1.27	experimental
`pki.cbor.read.time(node) -> Date`	0.1.27	experimental
`pki.cbor.read.oid(node) -> "2.5.4.3"`	0.1.27	experimental

Object Identifiers

Primitive	Since	Status
`pki.oid.name(dotted) -> string \| undefined`	0.1.0	stable
`pki.oid.register(dotted, name) -> void`	0.1.0	stable
`pki.oid.registerFamily(base, members) -> void`	0.1.2	stable
`pki.oid.paramsMustBeAbsent(dotted) -> boolean`	0.1.21	stable

WebCrypto

Primitive	Since	Status
`new pki.webcrypto.CryptoKey(type, extractable, algorithm, usages, handle)`	0.1.0	stable
`await pki.webcrypto.subtle.exportKey(format, key)`	0.1.0	stable
`pki.webcrypto.getRandomValues(typedArray) / pki.webcrypto.subtle`	0.1.0	stable

Certification path validation (RFC 5280 6)

Primitive	Since	Status
`pki.path.validate(path, opts) -> Promise<result>`	0.1.16	experimental
`pki.path.crlChecker(crls) -> RevocationChecker`	0.1.16	experimental
`pki.path.ocspChecker(responses) -> RevocationChecker`	0.1.32	experimental
`pki.path.verifyOcspResponse(parsedResponse, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, reason }>`	0.2.22	experimental
`pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>`	0.3.7	experimental

Trust-store ingestion

Primitive	Since	Status
`pki.trust.parseCertdata(text) -> { anchors }`	0.2.0	experimental
`pki.trust.parseCcadbCsv(text) -> { anchors }`	0.2.0	experimental
`pki.trust.anchor(entry, opts?) -> trustAnchor`	0.2.0	experimental

JOSE (JWS / JWK)

Primitive	Since	Status
`pki.jose.base64url.encode(bytes) -> string`	0.1.25	stable
`pki.jose.base64url.decode(text) -> Buffer`	0.1.25	stable
`pki.jose.parseJson(input) -> value`	0.1.25	stable
`pki.jose.assertPublicJwk(jwk) -> jwk`	0.1.25	stable
`pki.jose.verify(jws, opts) -> Promise<{ header, payload }>`	0.1.25	stable
`pki.jose.sign(opts) -> Promise<{ protected, payload, signature }>`	0.1.25	stable
`pki.jose.thumbprint(jwk) -> Promise<string>`	0.1.25	stable

ACME

Primitive	Since	Status
`pki.acme.assertTransition(kind, from, to) -> void`	0.1.25	experimental
`pki.acme.validateProblem(obj) -> obj`	0.1.25	experimental
`pki.acme.validate(kind, obj) -> obj`	0.1.25	experimental
`pki.acme.identify(obj) -> string`	0.1.25	experimental
`pki.acme.keyAuthorization(token, accountJwk) -> Promise<string>`	0.1.25	experimental
`pki.acme.http01(token, accountJwk) -> Promise<{ path, body }>`	0.1.25	experimental
`pki.acme.dns01(token, accountJwk, domain) -> Promise<{ name, value }>`	0.1.25	experimental
`pki.acme.tlsAlpn01Extension(token, accountJwk) -> Promise<Buffer>`	0.1.25	experimental
`pki.acme.verifyTlsAlpn01(certDer, token, accountJwk, identifier) -> Promise<void>`	0.1.25	experimental
`pki.acme.postAsGet(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.newAccount(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.externalAccountBinding(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.newOrder(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.finalize(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.challengeResponse(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.deactivate(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.revokeCert(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.keyChange(opts) -> Promise<object>`	0.1.25	experimental
`pki.acme.ariCertId(certDer) -> string`	0.1.25	experimental
`pki.acme.parseAriCertId(certId) -> { keyIdentifier, serial }`	0.1.25	experimental
`pki.acme.validateRenewalInfo(obj) -> obj`	0.1.25	experimental
`pki.acme.client(directoryUrl, opts) -> client`	0.3.18	experimental

HPKE

Primitive	Since	Status
`pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context }`	0.2.2	experimental
`pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context`	0.2.2	experimental
`pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }`	0.2.2	experimental
`pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt`	0.2.2	experimental

Transport

Primitive	Since	Status
`pki.transport.https(defaults?) -> transport`	0.3.16	experimental

OCSP

Primitive	Since	Status
`pki.ocsp.buildRequest(query, opts?) -> Buffer \| string`	0.2.22	experimental
`pki.ocsp.sign(responseData, responder, opts?) -> Promise<Buffer \| string>`	0.2.22	experimental
`pki.ocsp.buildErrorResponse(status) -> Buffer \| string`	0.2.22	experimental
`pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, thisUpdate, nextUpdate, revocationReason?, nonceMatched?, reason }>`	0.2.22	experimental

Schema

Primitive	Since	Status
`pki.schema.all() -> string[]`	0.1.7	stable
`pki.schema.parse(input) -> parsed`	0.1.7	stable
`pki.schema.detectFormat(input) -> string \| null`	0.3.8	experimental

Schema engine

Primitive	Since	Status
`pki.schema.engine.walk(schema, node, ctx) -> value`	0.1.7	stable
`pki.schema.engine.encode(schema, value, ctx) -> Buffer`	0.1.17	experimental
`pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value`	0.1.18	experimental

C509

Primitive	Since	Status
`pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }`	0.2.30	experimental
`pki.schema.c509.encode(input[, opts]) -> Buffer`	0.3.4	experimental

X.509

Primitive	Since	Status
`pki.schema.x509.pemDecode(text, label?) -> Buffer`	0.1.7	stable
`pki.schema.x509.pemEncode(der, label) -> string`	0.1.7	stable
`pki.schema.x509.parse(input) -> certificate`	0.1.7	stable

PKCS#8

Primitive	Since	Status
`pki.schema.pkcs8.parse(input) -> privateKey`	0.1.9	stable
`pki.schema.pkcs8.parseEncrypted(input) -> encrypted`	0.1.9	stable
`pki.schema.pkcs8.pemDecode(text, label?) -> Buffer`	0.1.9	stable
`pki.schema.pkcs8.pemEncode(der, label?) -> string`	0.1.9	stable

TSP

Primitive	Since	Status
`pki.schema.tsp.parseRequest(input) -> timeStampReq`	0.2.19	experimental
`pki.schema.tsp.parseTstInfo(input) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.parse(input) -> timeStampResp`	0.1.13	stable
`pki.schema.tsp.parseToken(input) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.pemDecode(text, label?) -> Buffer`	0.1.13	stable
`pki.schema.tsp.pemEncode(der, label) -> string`	0.1.23	stable

S/MIME (ESS)

Primitive	Since	Status
`pki.schema.smime.parseSigningCertificate(der) -> { certs, policies }`	0.1.22	experimental
`pki.schema.smime.parseSigningCertificateV2(der) -> { certs, policies }`	0.1.22	experimental
`pki.schema.smime.parseSmimeCapabilities(der) -> { capabilities }`	0.1.22	experimental
`pki.schema.smime.decodeAttribute(attr) -> { kind, ... }`	0.1.22	experimental

CSR Attributes

Primitive	Since	Status
`pki.schema.csrattrs.parse(der) -> { items }`	0.1.24	stable

EST

Primitive	Since	Status
`pki.est.transferDecode(body) -> Buffer`	0.1.24	experimental
`pki.est.transferEncode(der) -> string`	0.1.24	experimental
`pki.est.parseCertsOnly(der) -> { certificates, crls }`	0.1.24	experimental
`pki.est.classifyResponse(status, headers, body, opts?) -> verdict`	0.1.24	experimental
`pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }`	0.1.24	experimental
`pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } \| { retry, retryAfterSeconds }>`	0.3.16	experimental
`pki.est.simpleenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	experimental
`pki.est.simplereenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	experimental

Stateful hash-based

Primitive	Since	Status
`pki.shbs.verify(publicKey, message, signature) -> boolean`	0.2.1	experimental
`pki.shbs.verifyLms(publicKey, message, signature) -> boolean`	0.2.1	experimental

Attribute certificates

Primitive	Since	Status
`pki.attrcert.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.2	experimental

Certificate management protocol messages

Primitive	Since	Status
`pki.cmp.build(message, opts?) -> Promise<Buffer\|string>`	0.3.5	experimental
`pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>`	0.3.19	experimental
`pki.cmp.wellKnownUrl(base, opts?) -> string`	0.3.19	experimental

CRLs

Primitive	Since	Status
`pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.9	experimental
`pki.crl.verify(crl, issuer) -> Promise<boolean>`	0.3.9	experimental
`pki.crl.isRevoked(crl, serialNumber) -> entry \| null`	0.3.9	experimental

Certificate request messages

Primitive	Since	Status
`pki.crmf.build(spec, key?, opts?) -> Promise<Buffer\|string>`	0.3.3	experimental
`pki.crmf.buildCertTemplate(template) -> Buffer`	0.3.5	experimental

Certification requests

Primitive	Since	Status
`pki.csr.sign(spec, key, opts?) -> Promise<Buffer\|string>`	0.3.1	stable

Keys

Primitive	Since	Status
`pki.key.encrypt(privateKey, password, opts?) -> Promise<Buffer\|string>`	0.3.10	experimental
`pki.key.decrypt(encrypted, password, opts?) -> Promise<Buffer\|string>`	0.3.10	experimental
`pki.key.export(key, opts?) -> Promise<Buffer\|string>`	0.3.10	experimental
`pki.key.import(input, opts?) -> Promise<CryptoKey>`	0.3.10	experimental
`pki.key.generate(algorithm, opts?) -> Promise<{ privateKey, publicKey }>`	0.3.10	experimental
`pki.key.publicFromPrivate(privateKey, opts?) -> Promise<Buffer\|string>`	0.3.10	experimental

PKCS#12

Primitive	Since	Status
`pki.pkcs12.build(spec, opts?) -> Promise<Buffer\|string>`	0.3.11	experimental
`pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<boolean>`	0.3.11	experimental
`pki.pkcs12.open(pfx, password, opts?) -> Promise<OpenResult>`	0.3.12	experimental

Sigstore

Primitive	Since	Status
`pki.sigstore.pae(payloadType, payloadBytes) -> Buffer`	0.2.3	experimental
`pki.sigstore.parseBundle(input) -> bundle`	0.2.3	experimental
`pki.sigstore.verifyBundle(bundle, opts) -> Promise<result>`	0.2.3	experimental

Inspect

Primitive	Since	Status
`pki.inspect.certificate(input) -> string`	0.2.4	experimental
`pki.inspect.crl(input) -> string`	0.3.8	experimental
`pki.inspect.csr(input) -> string`	0.3.8	experimental
`pki.inspect.cms(input) -> string`	0.3.8	experimental
`pki.inspect.any(input) -> string`	0.3.8	experimental

Lint

Primitive	Since	Status
`pki.lint.certificate(input, opts?) -> LintReport`	0.2.10	experimental
`pki.lint.rules(profile?) -> [{id, severity, source, citation}]`	0.2.10	experimental
`pki.lint.profiles() -> [string]`	0.2.10	experimental

CT

Primitive	Since	Status
`pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }`	0.1.20	experimental
`pki.ct.reconstructSignedData(entry, sct) -> Buffer`	0.1.20	experimental
`pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>`	0.2.12	experimental
`pki.ct.encodeSctList(scts) -> Buffer`	0.2.24	experimental
`pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>`	0.2.24	experimental
`pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }`	0.2.28	experimental
`pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>`	0.2.28	experimental
`pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>`	0.2.29	experimental
`pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>`	0.3.21	experimental

Merkle

Primitive	Since	Status
`pki.merkle.leafHash(entry) -> Buffer`	0.1.28	experimental
`pki.merkle.nodeHash(left, right) -> Buffer`	0.1.28	experimental
`pki.merkle.emptyRootHash() -> Buffer`	0.1.28	experimental
`pki.merkle.verifyInclusion(opts) -> boolean`	0.1.28	experimental
`pki.merkle.verifyConsistency(opts) -> boolean`	0.1.28	experimental

WebAuthn

Primitive	Since	Status
`pki.webauthn.parseAttestationObject(bytes) -> { fmt, attStmt, authData, authDataBytes }`	0.2.5	experimental
`pki.webauthn.verify(attestationObject, clientDataHash, opts) -> Promise<{ verified, fmt, attestationType, trustPath, aaguid, credentialPublicKey }>`	0.2.5	experimental

CMS

Primitive	Since	Status
`pki.cms.verify(input, opts?) -> Promise<{ valid, signers }>`	0.2.14	experimental
`pki.cms.sign(content, signers, opts?) -> Promise<Buffer\|string>`	0.2.15	experimental
`pki.cms.countersign(cms, signers, opts?) -> Promise<Buffer\|string>`	0.3.13	experimental
`pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer \| string>`	0.2.23	experimental
`pki.cms.authenticate(content, recipients, opts?) -> Promise<Buffer \| string>`	0.3.14	experimental
`pki.cms.decrypt(input, keyMaterial, opts?) -> Promise<{ content, contentType, contentTypeName, recipientType, recipientIndex, contentEncryptionAlgorithm, authenticated }>`	0.2.23	experimental
`pki.cms.compress(content, opts?) -> Promise<Buffer \| string>`	0.2.27	experimental
`pki.cms.decompress(input, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>`	0.2.27	experimental

pkijs.com — source-driven documentation, generated from the toolkit's own @primitive comment blocks. Zero runtime dependencies.