Keyfactor EJBCA Python API Docs | dltHub

EJBCA is a certificate authority and certificate management REST API used to enroll, manage, revoke, and query certificates and CA resources. The REST API base URL is https://<HOST>:<PORT>/ejbca/ejbca-rest-api/v1 and all requests require either client certificate mTLS or an OAuth Bearer token.

dlt is an open-source Python library that handles authentication, pagination, and schema evolution automatically. dlthub provides AI context files that enable code assistants to generate production-ready pipelines. Install with uv add "dlt[hub]" and start loading Keyfactor EJBCA data in under 10 minutes.

---

What data can I load from Keyfactor EJBCA?

Here are some of the endpoints you can load from Keyfactor EJBCA:

---

How do I authenticate with the Keyfactor EJBCA API?

The API supports mutual TLS (mTLS) with client certificates or OAuth 2.0. For OAuth, include an 'Authorization' header with the value 'Bearer {token}'.

1. Get your credentials

The EJBCA REST API does not use traditional API keys for authentication. Instead, it supports two primary methods: 1) Client Certificate Authentication (mTLS) or 2) OAuth 2.0 (Bearer token). To set up access: 1) Access the EJBCA CA UI as an administrator. 2) Navigate to System Configuration > Protocol Configuration. 3) Enable the REST interface for the desired protocol. 4) Ensure your client has a valid client certificate (for mTLS) or is configured to request a token from your identity provider (for OAuth). For mTLS, the client must present a certificate trusted by the EJBCA server.

2. Add them to .dlt/secrets.toml

Copy
[sources.keyfactor_ejbca_source]
# For mTLS (recommended)
cert_path = "/path/to/client.crt"
key_path = "/path/to/client.key"
ca_cert_path = "/path/to/ejbca_ca.crt" # For OAuth2 (alternative)
oauth_token_url = "https://identity-provider.com/token"
oauth_client_id = "your_client_id"
oauth_client_secret = "your_client_secret"

dlt reads this automatically at runtime — never hardcode tokens in your pipeline script. For production environments, see setting up credentials with dlt for environment variable and vault-based options.

---

How do I set up and run the pipeline?

Set up a virtual environment and install dlt:

Copy
uv init
uv add "dlt[hub]"

1. Install the dlt AI harness:

Copy
uv run dlthub ai init --agent <your-agent> # <agent>: claude | cursor | codex

This installs project rules, a secrets management skill, appropriate ignore files, and configures the dlt MCP server for your agent. Learn more →

2. Install the rest-api-pipeline toolkit:

Copy
uv run dlthub ai toolkit install rest-api-pipeline

This loads the skills and context about dlt the agent uses to build the pipeline iteratively, efficiently, and safely. The agent uses MCP tools to inspect credentials — it never needs to read your secrets.toml directly. Learn more →

3. Start LLM-assisted coding:

Use /find-source to load data from the Keyfactor EJBCA API into DuckDB.

The rest-api-pipeline toolkit takes over from here — it reads relevant API documentation, presents you with options for which endpoints to load, and follows a structured workflow to scaffold, debug, and validate the pipeline step by step.

4. Run the pipeline:

Copy
uv run python keyfactor_ejbca_pipeline.py

If everything is configured correctly, you'll see output like this:

Copy
Pipeline keyfactor_ejbca_pipeline load step completed in 0.26 seconds
1 load package(s) were loaded to destination duckdb and into dataset keyfactor_ejbca_data
The duckdb destination used duckdb:/keyfactor_ejbca.duckdb location to store data
Load package 1749667187.541553 is LOADED and contains no failed jobs

Inspect your pipeline and data:

Copy
uv run dlthub show

This opens the Pipeline Dashboard where you can verify pipeline state, load metrics, schema (tables, columns, types), and query the loaded data directly.

---

Python pipeline example

This example loads /v1/ca and /v1/certificate from the Keyfactor EJBCA API into DuckDB. It mirrors the endpoint and data selector configuration from the table above:

Copy
import dlt
from dlt.sources.rest_api import RESTAPIConfig, rest_api_resources

@dlt.source
def keyfactor_ejbca_source(token=dlt.secrets.value):
    config: RESTAPIConfig = {
        "client": {
            "base_url": "https://<HOST>:<PORT>/ejbca/ejbca-rest-api/v1",
            "auth": {"type": "bearer", "token": token},
        },
        "resources": [
            {"name": "certificate_search", "endpoint": {"path": "v2/certificate/search", "data_selector": "certificates"}},
            {"name": "list_cas", "endpoint": {"path": "v1/ca"}}
        ],
    }
    yield from rest_api_resources(config)


def get_data() -> None:
    pipeline = dlt.pipeline(
        pipeline_name="keyfactor_ejbca_pipeline",
        destination="duckdb",
        dataset_name="keyfactor_ejbca_data",
    )
    load_info = pipeline.run(keyfactor_ejbca_source())
    print(load_info)

To add more endpoints, append entries from the resource table to the "resources" list using the same name, path, and data_selector pattern.

---

How do I query the loaded data?

Once the pipeline runs, dlt creates one table per resource. You can query with Python or SQL.

Python (pandas DataFrame):

Copy
import dlt

data = dlt.pipeline("keyfactor_ejbca_pipeline").dataset()
sessions_df = data.certificate_search.df()
print(sessions_df.head())

SQL (DuckDB example):

Copy
SELECT * FROM keyfactor_ejbca_data.certificate_search LIMIT 10;

In a marimo or Jupyter notebook:

Copy
import dlt

data = dlt.pipeline("keyfactor_ejbca_pipeline").dataset()
data.certificate_search.df().head()

See how to explore your data in marimo Notebooks and how to query your data in Python with dataset.

---

What destinations can I load Keyfactor EJBCA data to?

dlt supports loading into any of these destinations — only the destination parameter changes:

Change the destination in dlt.pipeline(destination="snowflake") and add credentials in .dlt/secrets.toml. See the full destinations list.

---

Next steps

Continue your data engineering journey with the other toolkits of the dltHub AI harness:

• data-exploration — Build custom notebooks, charts, and dashboards for deeper analysis with marimo notebooks.
• dlthub-platform — Deploy, schedule, and monitor your pipeline in production.

Copy
uv run dlthub ai toolkit install data-exploration
uv run dlthub ai toolkit install dlthub-platform

• How to deploy a pipeline
• How to explore your data in marimo Notebooks
• How to query your data in Python with dataset
• Join the dlt community on Slack