Venafi TLS Protect Datacenter Trigger

Trigger workflows on Venafi TLS Protect Datacenter certificate events

Overview

The Venafi TLS Protect Datacenter Trigger node polls the Venafi Trust Protection Platform API at a configurable interval to detect certificate expiry events. On each poll it authenticates against the TPP instance, then queries the certificates endpoint with validity-window filters to find certificates whose expiration falls within the window since the last poll. The access token is cached and refreshed only when expired. On the very first poll the node establishes a baseline timestamp and returns no items, preventing a flood of historical certificate data. Returns full certificate objects including DN, name, GUID, validity dates, and metadata.

Category: Utility
Tool Name: venafi_datacenter_trigger
Version: 1

Appearance: Icon: lucide-ShieldCheck | Color: #00b050

Node Type

Trigger — polling (checks for new data on a schedule)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool requires Venafi TLS Protect Datacenter credentials. See the Credentials Guide for setup instructions.

Parameters

Parameter	Type	Required	Default	Description
Trigger On	options	Yes	certificateExpired	Which event to trigger on.
				Options: certificateExpired (Certificate Expired)
Poll Interval	number	No	5	How often to check for certificate events.
Poll Interval Unit	options	No	minutes	Unit for the poll interval.
				Options: seconds, minutes, hours

Output Data

Each certificate that expired inside the poll window becomes one output item. The certificate is emitted exactly as the Venafi API returns it, plus two trigger markers:

{
  "DN": "\\VED\\Policy\\Certificates\\example.com",
  "Name": "example.com",
  "Guid": "{00000000-0000-0000-0000-000000000000}",
  "SchemaClass": "X509 Server Certificate",
  "ParentDn": "\\VED\\Policy\\Certificates",
  "CreatedOn": "2025-08-15T09:00:00.0000000Z",
  "_trigger": "venafi_datacenter_polling",
  "_timestamp": "2026-08-15T09:00:00.000Z"
}

• DN — the certificate’s distinguished name in the policy tree.
• Guid — the certificate’s unique identifier, useful for follow-up API calls.
• _trigger — always venafi_datacenter_polling.
• _timestamp — when the poll that produced the item ran.

Reference certificate data downstream by expression, e.g. {{ $json.Name }}.

Usage Examples

• Start a workflow when a TLS certificate expires in Venafi TPP
• Monitor Venafi Datacenter for expiring certificates and send alerts
• Trigger renewal automation when certificates expire in TLS Protect
• Watch for certificate expiry events across the organization

Example Configuration

Check for newly expired certificates every five minutes:

{
  "type": "venafi_datacenter_trigger",
  "parameters": {
    "triggerOn": "certificateExpired",
    "pollInterval": 5,
    "pollIntervalUnit": "minutes"
  }
}

Check once an hour for a large certificate estate:

{
  "type": "venafi_datacenter_trigger",
  "parameters": {
    "triggerOn": "certificateExpired",
    "pollInterval": 1,
    "pollIntervalUnit": "hours"
  }
}

Trigger Behavior

• Activation: Polling starts when the workflow is activated. There is no poll at the moment of activation — the first check runs one full interval later.
• Schedule: The trigger polls for new data based on the configured polling interval.
• State: Maintains internal state (the timestamp of the last check, plus the cached access token) so each poll covers only the window since the previous one.
• First Run: The first poll records the current time and returns no items, so activating the workflow never replays certificates that expired earlier.
• Testing: Running the node from the editor emits a single sample certificate so you can build the rest of the workflow; real events arrive only while the workflow is activated.

Tips

Configure your Venafi TLS Protect Datacenter credentials (domain, client ID, username, password). Select the “Certificate Expired” trigger event. The trigger will poll the TPP API at the configured interval and return certificates whose expiry date falls within the time window since the last check. On first activation it establishes a baseline and will only trigger on newly expired certificates afterward.

Notes

• Each poll asks for certificates whose validity ends between the previous check and now, so a certificate is reported once, at the moment it lapses — not repeatedly while it remains expired.
• To act before expiry rather than after it, drive renewal from the returned certificate’s validity data in a downstream node.