> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate alerts by email

> Send certificate alert notifications by email.

An email channel on a certificate [alert](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) emails the recipients you choose whenever the alert fires. Email channels are available on every plan.

> [!NOTE]
>
> If you self-host Infisical, [configure an SMTP server](https://infisical.com/docs/self-hosting/configuration/envars.md#email-service) before you create an email alert. Without one, Infisical writes alert emails to its logs instead of sending them, so a **Send test** can look successful even though no email arrives.

## Prerequisites

* The Certificate Management **Admin** role to create an organization-wide alert, or the **Admin** [application role](https://infisical.com/docs/documentation/platform/pki/applications/overview.md#application-roles) to create an application alert
* Recipients who are organization members, or addresses on one of your organization's [verified email domains](https://infisical.com/docs/documentation/platform/email-domain.md)

## Create the alert

> [tab] Infisical UI
>
> **Step 1**
>
> Open the alert form:
>
> * For an organization-wide alert, go to **Certificate Manager** > **Settings**, select the **Alerts** tab, then select **Create Alert**
> * For an application alert, go to **Certificate Manager** > **Applications** and select your application, then select the **Settings** tab and select **Create Alert** in the **Alerts** section
>
> **Step 2**
>
> Select the **Alert Type**, then enter an **Alert Name** and an optional **Description**. An application can have one alert for each event, so to notify more places about the same event, add more channels to that alert.
>
> **Step 3**
>
> For an expiration alert, enter **Alert Before** as a number and a unit. For example: `30d` or `2w`, up to 365 days.
>
> > [!NOTE]
> >
> > To get a reminder every day, turn on **Repeat daily until expiry**. Otherwise, the alert repeats on a [schedule based on **Alert Before**](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#how-often-expiration-alerts-repeat).
>
> Select **Continue**.
>
> **Step 4**
>
> For an organization-wide alert, on the **Filters** step, optionally select **Add Filter** to [narrow the certificates the alert covers](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#filter-an-organization-wide-alert), then select **Continue**. Application alerts and signer certificate expiration alerts skip this step.
>
> > [!TIP]
> >
> > To add this channel to an existing alert instead, edit the alert and go to its **Channels** step.
>
> On the **Channels** step, add the email channel:
>
> **Step 1**
>
> Select **Add Channel** > **Email**.
>
> **Step 2**
>
> In **Recipients**, select organization members, or type an address on one of your organization's verified email domains and add it.
>
> **Step 3**
>
> Optionally, select **Send test** to send a test email to the recipients.
>
> **Step 4**
>
> Select **Continue**, check the **Review** step, and select **Create Alert**.

> [tab] API
>
> Send a request to the create alert endpoint with an [access token](https://infisical.com/docs/api-reference/overview/authentication.md) and an `email` channel.
>
> Set `resourceType` and `resourceId` to the certificates the alert covers:
>
> | Alert | `resourceType` | `resourceId` |
> | - | - | - |
> | Organization-wide | `cert-manager` | Leave out |
> | Application | `cert-manager.application` | The application's ID, from [the list applications endpoint](https://infisical.com/docs/api-reference/endpoints/pki/applications/configuration/list.md) |
> | Signer certificate expiration | `cert-manager.signer` | Leave out |
>
> Set `eventType` to the event the alert watches:
>
> | Event | Organization-wide alert | Application alert |
> | - | - | - |
> | Expiration | `cert-manager.certificate.expiry` | `cert-manager.application.certificate.expiry` |
> | Issuance | `cert-manager.certificate.issuance` | `cert-manager.application.certificate.issuance` |
> | Renewal | `cert-manager.certificate.renewal` | `cert-manager.application.certificate.renewal` |
> | Revocation | `cert-manager.certificate.revocation` | `cert-manager.application.certificate.revocation` |
> | Signer certificate expiration | `cert-manager.signer.certificate.expiry` | Not available |
>
> Set `condition` to the same settings as the **Alert Before** field, the **Repeat daily until expiry** toggle, and the **Filters** step in Infisical:
>
> | Field | Applies to | Value |
> | - | - | - |
> | `alertBefore` | Expiration alerts (required) | A number and a unit, such as `30d` or `2w`, up to 365 days |
> | `dailyReminder` | Expiration alerts | `true` to [repeat the alert every day](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#how-often-expiration-alerts-repeat) until the certificate expires |
> | `applicationIds` | Organization-wide alerts | Up to 100 application IDs |
> | `profileIds` | Organization-wide alerts | Up to 100 certificate profile IDs |
> | `sources` | Organization-wide alerts | Any of `issued` (**Managed** in Infisical), `imported`, and `discovered` |
> | `signerIds` | Signer certificate expiration alerts | Up to 100 signer IDs |
>
> For issuance, renewal, and revocation alerts on an application, leave out `condition`.
>
> Each entry in the channel's `recipients` array is one of these:
>
> * An organization member, with `principalType` set to `user` and `principalId` set to the member's `user.id` from [the get user memberships endpoint](https://infisical.com/docs/api-reference/endpoints/organizations/memberships.md)
> * An address on one of your organization's verified email domains, with `principalType` set to `email` and `principalId` set to the address
>
> ```bash Organization-wide theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/alerts \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "issued-certificates-expiring",
>     "resourceType": "cert-manager",
>     "eventType": "cert-manager.certificate.expiry",
>     "condition": { "alertBefore": "30d", "sources": ["issued"] },
>     "channels": [
>       {
>         "name": "platform-team",
>         "channelType": "email",
>         "recipients": [{ "principalType": "email", "principalId": "platform@example.com" }]
>       }
>     ]
>   }'
> ```
>
> ```bash Application theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/alerts \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "payments-api-expiring",
>     "resourceType": "cert-manager.application",
>     "resourceId": "<application-id>",
>     "eventType": "cert-manager.application.certificate.expiry",
>     "condition": { "alertBefore": "30d" },
>     "channels": [
>       {
>         "name": "payments-team",
>         "channelType": "email",
>         "recipients": [{ "principalType": "email", "principalId": "payments@example.com" }]
>       }
>     ]
>   }'
> ```

> [!TIP]
>
> Your alert is set up. Infisical emails the recipients whenever the alert fires.

If a recipient is an organization member, they stop receiving alerts when they leave the organization.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.