Sooner or later every CA gets scripted against — and that's where you learn whether the API was the product or an afterthought. goca's rule is strict API-first parity: everything the console does is a public REST call — no exceptions. The console is just another client. If you watched it do something, you can script that something.
For enrollment, the API is POST /v1/requests against a RestEndpoint: the request carries the PKCS#10 CSR, the endpoint/template choice, an idempotency key, and optional RA-supplied attributes outside the CSR — the trusted-attribute channel the template's ra source reads (frame 38). Registered RA identities may submit RA-attested requests where policy grants it. Use it for CLM integrations, bulk and async issuance, and workflows that need rich metadata.
Two labels to keep straight: this is goca's own API — its envelope, field names and error codes — distinct from the designed API-emulation head that would speak a foreign CA's dialect. And the rest head listed in chapter 2 is the same API behind a DMZ front door, not a second API — it is designed, not built; today the issuance plane (api-cert) serves it.
Now I can automate anything the console can do — through the same API it uses.