API index

Every documented primitive, grouped by namespace page — 210 primitives. Generated from the same source comments that build the rest of this site.

Constants

Primitive	Since	Status
`C.TIME.days(n) -> milliseconds`	0.1.0	stable
`C.BYTES.mib(n) -> bytes`	0.1.0	stable

Errors

Primitive	Since	Status
`new PkiError(message, code)`	0.1.0	stable
`pki.errors.defineClass(name, opts?) -> constructor`	0.1.0	stable

ASN.1 / DER

Primitive	Since	Status
`pki.asn1.decode(bytes, opts?) -> node`	0.1.0	stable
`pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"`	0.1.15	stable
`pki.asn1.encode(classBits, constructed, tagNumber, content) -> Buffer`	0.1.0	stable
`pki.asn1.build.sequence([ ...tlvBuffers ]) -> Buffer`	0.1.0	stable

CBOR (deterministic)

Primitive	Since	Status
`pki.cbor.decode(bytes, opts?) -> node`	0.1.27	stable
`pki.cbor.read.uint(node) -> 0n`	0.1.27	stable
`pki.cbor.read.nint(node) -> -1n`	0.1.27	stable
`pki.cbor.read.int(node) -> -1n`	0.1.27	stable
`pki.cbor.read.byteString(node) -> Buffer`	0.1.27	stable
`pki.cbor.read.textString(node) -> "text"`	0.1.27	stable
`pki.cbor.read.array(node) -> [node, ...]`	0.1.27	stable
`pki.cbor.read.map(node) -> [[keyNode, valueNode], ...]`	0.1.27	stable
`pki.cbor.read.mapGet(node, key) -> valueNode \| null`	0.2.20	stable
`pki.cbor.read.boolean(node) -> false`	0.1.27	stable
`pki.cbor.read.nullValue(node) -> null`	0.1.27	stable
`pki.cbor.read.undefinedValue(node) -> undefined`	0.1.27	stable
`pki.cbor.read.float(node) -> 1.5`	0.1.27	stable
`pki.cbor.read.biguint(node) -> 18446744073709551616n`	0.1.27	stable
`pki.cbor.read.time(node) -> Date`	0.1.27	stable
`pki.cbor.read.oid(node) -> "2.5.4.3"`	0.1.27	stable

Object Identifiers

Primitive	Since	Status
`pki.oid.name(dotted) -> string \| undefined`	0.1.0	stable
`pki.oid.register(dotted, name) -> void`	0.1.0	stable
`pki.oid.registerFamily(base, members) -> void`	0.1.2	stable
`pki.oid.paramsMustBeAbsent(dotted) -> boolean`	0.1.21	stable

WebCrypto

Primitive	Since	Status
`new pki.webcrypto.CryptoKey(type, extractable, algorithm, usages, handle)`	0.1.0	stable
`await pki.webcrypto.subtle.exportKey(format, key)`	0.1.0	stable
`pki.webcrypto.getRandomValues(typedArray) / pki.webcrypto.subtle`	0.1.0	stable

CMC

Primitive	Since	Status
`pki.cmc.verify(response, sent?) -> Promise<verdict>`	0.4.16	stable
`pki.cmc.build(spec, signer, opts?) -> Promise<Buffer\|string>`	0.4.16	stable

Certification path validation (RFC 5280 6)

Primitive	Since	Status
`pki.path.validate(path, opts) -> Promise<result>`	0.1.16	stable
`pki.path.crlChecker(crls, opts?) -> RevocationChecker`	0.1.16	stable
`pki.path.ocspChecker(responses) -> RevocationChecker`	0.1.32	stable
`pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>`	0.2.22	stable
`pki.path.anchorFromCert(cert) -> { name, publicKey, algorithm, parameters, subjectDer }`		stable
`pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>`	0.3.7	stable

Trust-store ingestion

Primitive	Since	Status
`pki.trust.parseCertdata(text) -> { anchors }`	0.2.0	stable
`pki.trust.parseCcadbCsv(text) -> { anchors }`	0.2.0	stable
`pki.trust.anchor(entry, opts?) -> trustAnchor`	0.2.0	stable

JOSE (JWS / JWK)

Primitive	Since	Status
`pki.jose.base64url.encode(bytes) -> string`	0.1.25	stable
`pki.jose.base64url.decode(text) -> Buffer`	0.1.25	stable
`pki.jose.parseJson(input) -> value`	0.1.25	stable
`pki.jose.assertPublicJwk(jwk) -> jwk`	0.1.25	stable
`pki.jose.verify(jws, opts) -> Promise<{ header, payload, keySource }>`	0.1.25	stable
`pki.jose.sign(opts) -> Promise<{ protected, payload, signature }>`	0.1.25	stable
`pki.jose.thumbprint(jwk) -> Promise<string>`	0.1.25	stable
`pki.jose.sigAlgs() -> Array<{alg,kty,crv,hash,saltLength}>`	0.5.3	stable

ACME

Primitive	Since	Status
`pki.acme.assertTransition(kind, from, to) -> void`	0.1.25	stable
`pki.acme.validateProblem(obj) -> obj`	0.1.25	stable
`pki.acme.validate(kind, obj) -> obj`	0.1.25	stable
`pki.acme.identify(obj) -> string`	0.1.25	stable
`pki.acme.keyAuthorization(token, accountJwk) -> Promise<string>`	0.1.25	stable
`pki.acme.http01(token, accountJwk) -> Promise<{ path, body }>`	0.1.25	stable
`pki.acme.dns01(token, accountJwk, domain) -> Promise<{ name, value }>`	0.1.25	stable
`pki.acme.tlsAlpn01Extension(token, accountJwk) -> Promise<Buffer>`	0.1.25	stable
`pki.acme.verifyTlsAlpn01(certDer, token, accountJwk, identifier) -> Promise<void>`	0.1.25	stable
`pki.acme.postAsGet(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newAccount(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.externalAccountBinding(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newOrder(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newAuthz(opts) -> flattened JWS`	0.3.29	stable
`pki.acme.finalize(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.challengeResponse(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.deactivate(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.updateAccount(opts) -> Promise<object>`	0.6.4	stable
`pki.acme.revokeCert(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.keyChange(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.ariCertId(certDer) -> string`	0.1.25	stable
`pki.acme.parseAriCertId(certId) -> { keyIdentifier, serial }`	0.1.25	stable
`pki.acme.validateRenewalInfo(obj) -> obj`	0.1.25	stable
`pki.acme.client(directoryUrl, opts) -> client`	0.3.18	stable

HPKE

Primitive	Since	Status
`pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context, sharedSecret }`	0.2.2	stable
`pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context`	0.2.2	stable
`pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }`	0.2.2	stable
`pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt`	0.2.2	stable

Composite ML-KEM

Primitive	Since	Status
`pki.kem.decapsulate(privateKey, ciphertext) -> Promise<Buffer>`	0.6.6	stable
`pki.kem.encapsulate(publicKey) -> Promise<{ sharedSecret: Buffer, ciphertext: Buffer }>`	0.6.6	stable

Transport

Primitive	Since	Status
`pki.transport.https(defaults?) -> transport`	0.3.16	stable

OCSP

Primitive	Since	Status
`pki.ocsp.buildRequest(query, opts?) -> Buffer \| string`	0.2.22	stable
`pki.ocsp.sign(responseData, responder, opts?) -> Promise<Buffer \| string>`	0.2.22	stable
`pki.ocsp.buildErrorResponse(status) -> Buffer`	0.2.22	stable
`pki.ocsp.verify(response, opts) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>`	0.2.22	stable
`pki.ocsp.verifyRequest(request, opts?) -> Promise<{ valid, signed, signatureValid, requestorNamed, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>`	0.6.0	stable

Schema

Primitive	Since	Status
`pki.schema.all() -> string[]`	0.1.7	stable
`pki.schema.parse(input) -> parsed`	0.1.7	stable
`pki.schema.detectFormat(input) -> string \| null`	0.3.8	stable

Schema engine

Primitive	Since	Status
`pki.schema.engine.walk(schema, node, ctx) -> value`	0.1.7	stable
`pki.schema.engine.encode(schema, value, ctx) -> Buffer`	0.1.17	stable
`pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value`	0.1.18	stable

C509

Primitive	Since	Status
`pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }`	0.2.30	stable
`pki.schema.c509.encode(input[, opts]) -> Buffer`	0.3.4	stable

X.509

Primitive	Since	Status
`pki.schema.x509.pemDecode(text, label?) -> Buffer`	0.1.7	stable
`pki.schema.x509.pemEncode(der, label) -> string`	0.1.7	stable
`pki.schema.x509.parse(input) -> certificate`	0.1.7	stable

PKCS#8

Primitive	Since	Status
`pki.schema.pkcs8.parse(input) -> privateKey`	0.1.9	stable
`pki.schema.pkcs8.parseEncrypted(input) -> encrypted`	0.1.9	stable
`pki.schema.pkcs8.pemDecode(text, label?) -> Buffer`	0.1.9	stable
`pki.schema.pkcs8.pemEncode(der, label?) -> string`	0.1.9	stable

TSP

Primitive	Since	Status
`pki.schema.tsp.parseRequest(input) -> timeStampReq`	0.2.19	stable
`pki.schema.tsp.parseTstInfo(input) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.parse(input) -> timeStampResp`	0.1.13	stable
`pki.schema.tsp.parseToken(input) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.pemDecode(text, label?) -> Buffer`	0.1.13	stable
`pki.schema.tsp.pemEncode(der, label) -> string`	0.1.23	stable

S/MIME (ESS)

Primitive	Since	Status
`pki.schema.smime.parseSigningCertificate(der) -> { certs, policies }`	0.1.22	stable
`pki.schema.smime.parseSigningCertificateV2(der) -> { certs, policies }`	0.1.22	stable
`pki.schema.smime.parseSmimeCapabilities(der) -> { capabilities }`	0.1.22	stable
`pki.schema.smime.decodeAttribute(attr) -> { kind, ... }`	0.1.22	stable

CSR Attributes

Primitive	Since	Status
`pki.schema.csrattrs.parse(der) -> { items }`	0.1.24	stable

EST

Primitive	Since	Status
`pki.est.transferDecode(body) -> Buffer`	0.1.24	stable
`pki.est.transferEncode(der) -> string`	0.1.24	stable
`pki.est.parseCertsOnly(der) -> { certificates, crls }`	0.1.24	stable
`pki.est.classifyResponse(status, headers, body, opts?) -> verdict`	0.1.24	stable
`pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }`	0.1.24	stable
`pki.est.challengePasswordFromTlsUnique(channelBinding) -> Buffer`	0.6.31	stable
`pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict \| { retry, retryAfterSeconds }>`	0.4.16	stable
`pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.simpleenroll(baseUrl, csr \| builder, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.simplereenroll(baseUrl, csr \| builder, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.serverkeygen(baseUrl, csr, opts?) -> Promise<{ certificates, privateKey } \| { certificates, encryptedKey } \| { retry, retryAfterSeconds, retryAfterDate }>`	0.3.28	stable
`pki.est.csrattrs(baseUrl, opts?) -> Promise<{ available: true, attrs, plan } \| { available: false, attrs: null }>`	0.3.28	stable

SCEP

Primitive	Since	Status
`pki.scep.build(spec) -> Promise<Buffer>`	0.6.2	stable
`pki.scep.parse(bytes, opts?) -> Promise<verdict>`	0.6.2	stable
`pki.scep.parseCapabilities(text) -> { AES?, "SHA-256"?, POSTPKIOperation?, ... }`	0.6.7	stable
`pki.scep.getCACaps(baseUrl, opts?) -> Promise<capabilities>`	0.6.7	stable
`pki.scep.getCACert(baseUrl, opts?) -> Promise<{ caCertificate, certificates }>`	0.6.7	stable
`pki.scep.getNextCACert(baseUrl, opts) -> Promise<{ certificates }>`	0.6.14	stable
`pki.scep.enroll(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>`	0.6.7	stable
`pki.scep.renew(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>`	0.6.7	stable
`pki.scep.getCert(baseUrl, opts) -> Promise<{ certificate, certificates, transactionId }>`	0.6.17	stable
`pki.scep.getCrl(baseUrl, opts) -> Promise<{ crl, crls, transactionId }>`	0.6.17	stable

Stateful hash-based

Primitive	Since	Status
`pki.shbs.verify(publicKey, message, signature) -> boolean`	0.2.1	stable
`pki.shbs.verifyLms(publicKey, message, signature) -> boolean`	0.2.1	stable

Attribute certificates

Primitive	Since	Status
`pki.attrcert.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.2	stable
`pki.attrcert.verify(ac, issuer, opts) -> Promise<{ valid, verified, signatureValid, validityChecked, targetingChecked, revocationChecked, noRevAvail, holderBindingChecked, issuerPathChecked, holder, issuer, attributes, extensions, notBefore, notAfter, serialNumberHex, reason }>`	0.5.15	stable

Certificate management protocol messages

Primitive	Since	Status
`pki.cmp.build(message, opts?) -> Promise<Buffer\|string>`	0.3.5	stable
`pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>`	0.3.19	stable
`pki.cmp.wellKnownUrl(base, opts?) -> string`	0.3.19	stable

CRLs

Primitive	Since	Status
`pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.9	stable
`pki.crl.verify(crl, issuer) -> Promise<{ valid, issuerMaySign, signatureValid, issuer, code?, reason? }>`	0.3.9	stable
`pki.crl.isRevoked(crl, serialNumber, opts?) -> entry \| null`	0.3.9	stable

Certificate request messages

Primitive	Since	Status
`pki.crmf.build(spec, key?, opts?) -> Promise<Buffer\|string>`	0.3.3	stable
`pki.crmf.buildCertTemplate(template) -> Buffer`	0.3.5	stable
`pki.crmf.verifyPop(messages) -> Promise<{ valid, verified, messages: [{ valid, verified, method, cryptographicallyVerified, certReqId, subject, subjectBound, publicKey, reason }] }>`	0.5.14	stable

Certification requests

Primitive	Since	Status
`pki.csr.sign(spec, key, opts?) -> Promise<Buffer\|string>`	0.3.1	stable
`pki.csr.verify(request) -> Promise<{ valid, verified, subject, subjectPublicKeyInfo, attributes, certificationRequestInfoBytes }>`	0.5.13	stable

Keys

Primitive	Since	Status
`pki.key.encrypt(privateKey, password, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.decrypt(encrypted, password, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.export(key, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.import(input, opts?) -> Promise<CryptoKey>`	0.3.10	stable
`pki.key.generate(algorithm, opts?) -> Promise<{ privateKey, publicKey }>`	0.3.10	stable
`pki.key.publicFromPrivate(privateKey, opts?) -> Promise<Buffer\|string>`	0.3.10	stable

PKCS#12

Primitive	Since	Status
`pki.pkcs12.build(spec, opts?) -> Promise<Buffer\|string>`	0.3.11	stable
`pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<{ valid, macAlgorithm, macAlgorithmName, iterationCount }>`	0.3.11	stable
`pki.pkcs12.open(pfx, password, opts?) -> Promise<OpenResult>`	0.3.12	stable

Sigstore

Primitive	Since	Status
`pki.sigstore.pae(payloadType, payloadBytes) -> Buffer`	0.2.3	stable
`pki.sigstore.parseBundle(input) -> bundle`	0.2.3	stable
`pki.sigstore.verifyBundle(bundle, opts) -> Promise<result>`	0.2.3	stable

Inspect

Primitive	Since	Status
`pki.inspect.certificate(input) -> string`	0.2.4	stable
`pki.inspect.crl(input) -> string`	0.3.8	stable
`pki.inspect.csr(input) -> string`	0.3.8	stable
`pki.inspect.cms(input) -> string`	0.3.8	stable
`pki.inspect.any(input) -> string`	0.3.8	stable

Lint

Primitive	Since	Status
`pki.lint.certificate(input, opts?) -> LintReport`	0.2.10	stable
`pki.lint.crl(pem \| der \| parsed, opts?) -> LintReport`	0.7.9	stable
`pki.lint.ocsp(pem \| der \| parsed, opts?) -> LintReport`	0.7.26	stable
`pki.lint.rules(profile?) -> [{id, severity, source, citation}]`	0.2.10	stable
`pki.lint.profiles() -> [string]`	0.2.10	stable

CT

Primitive	Since	Status
`pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }`	0.1.20	stable
`pki.ct.reconstructSignedData(entry, sct) -> Buffer`	0.1.20	stable
`pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>`	0.2.12	stable
`pki.ct.encodeSctList(scts) -> Buffer`	0.2.24	stable
`pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>`	0.2.24	stable
`pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }`	0.2.28	stable
`pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<{ valid, logId, logIdHex, operator, logState, timestamp }>`	0.2.28	stable
`pki.ct.verifySctList(entry, list, logList, opts?) -> Promise<verdict>`	0.6.1	stable
`pki.ct.x509CertEntry(cert, issuer) -> { entryType, tbsCertificate, issuerKeyHash }`	0.6.1	stable
`pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>`	0.2.29	stable
`pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>`	0.3.21	stable

TLS

Primitive	Since	Status
`pki.tls.decompressCertificate(bytes, opts?) -> { algorithm, algorithmName, uncompressedLength, certificateMessage, certificate }`	0.4.3	stable
`pki.tls.parseCertificateMessage(bytes, opts?) -> { certificateRequestContext, entries }`	0.4.3	stable
`pki.tls.compressCertificate(certificateMessage, opts?) -> Buffer`	0.4.3	stable

Merkle

Primitive	Since	Status
`pki.merkle.leafHash(entry) -> Buffer`	0.1.28	stable
`pki.merkle.nodeHash(left, right) -> Buffer`	0.1.28	stable
`pki.merkle.emptyRootHash() -> Buffer`	0.1.28	stable
`pki.merkle.verifyInclusion(opts) -> boolean`	0.1.28	stable
`pki.merkle.verifyConsistency(opts) -> boolean`	0.1.28	stable

WebAuthn

Primitive	Since	Status
`pki.webauthn.parseCoseKey(bytes) -> object`	0.5.2	stable
`pki.webauthn.parseAttestationObject(bytes) -> { fmt, attStmt, authData, authDataBytes }`	0.2.5	stable
`pki.webauthn.verify(attestationObject, clientDataHash?, opts?) -> Promise<{ valid, attestationVerified, fmt, attestationType, trustPath, anchoredTo, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, signCount, flags, rpIdHash, extensions, bindingChecked, clientData }>`	0.2.5	stable
`pki.webauthn.verifyMetadataBlob(blob, opts) -> Promise<{ no, legalHeader, nextUpdate, stale, allowStale, rollbackChecked, previousNo, entries, byAaguid, byKeyIdentifier, statusPolicy, rejectUnknownStatus }>`	0.4.11	stable
`pki.webauthn.metadataFor(metadata, identifier) -> entry \| null`	0.4.11	stable
`pki.webauthn.metadataAnchors(entry, opts?) -> [certificate]`	0.4.11	stable
`pki.webauthn.parseClientData(bytes, opts?) -> { type, challenge, origin, crossOrigin, topOrigin, checked }`	0.5.0	stable
`pki.webauthn.parseAuthenticatorData(bytes) -> { rpIdHash, flags, signCount, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, extensions }`	0.5.0	stable
`pki.webauthn.verifyAssertion(input) -> Promise<{ valid, signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>`	0.5.0	stable

CMS

Primitive	Since	Status
`pki.cms.verify(input, opts?) -> Promise<{ valid, trusted, eContentType, eContent, signers }>`	0.2.14	stable
`pki.cms.sign(content, signers, opts?) -> Promise<Buffer\|string>`	0.2.15	stable
`pki.cms.countersign(cms, signers, opts?) -> Promise<Buffer\|string>`	0.3.13	stable
`pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer \| string>`	0.2.23	stable
`pki.cms.authenticate(content, recipients, opts?) -> Promise<Buffer \| string>`	0.3.14	stable
`pki.cms.decrypt(input, keyMaterial, opts?) -> Promise<{ content, contentType, contentTypeName, recipientType, recipientIndex, contentEncryptionAlgorithm, authenticated, authenticatedBy, originAuthenticated, originatorInfo }>`	0.2.23	stable
`pki.cms.compress(content, opts?) -> Promise<Buffer \| string>`	0.2.27	stable
`pki.cms.decompress(input, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>`	0.2.27	stable
`pki.cms.certsOnly(certs, opts?) -> Buffer \| string`	0.6.3	stable
`pki.cms.parseCertsOnly(input, opts?) -> { certificates, crls }`	0.6.3	stable
`pki.cms.isCertsOnly(input) -> boolean`	0.6.3	stable

pkijs.com — source-driven documentation, generated from the toolkit's own @primitive comment blocks. Zero runtime dependencies.