Initial scaffold: certificate control plane v0.1.0

internal/api/handler/agents.go

@@ -0,0 +1,233 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// AgentService defines the service interface for agent operations.
+type AgentService interface {
+	ListAgents(page, perPage int) ([]domain.Agent, int64, error)
+	GetAgent(id string) (*domain.Agent, error)
+	RegisterAgent(agent domain.Agent) (*domain.Agent, error)
+	Heartbeat(agentID string) error
+	CSRSubmit(agentID string, csrPEM string) (string, error)
+	CertificatePickup(agentID, certID string) (string, error)
+}
+
+// AgentHandler handles HTTP requests for agent operations.
+type AgentHandler struct {
+	svc AgentService
+}
+
+// NewAgentHandler creates a new AgentHandler with a service dependency.
+func NewAgentHandler(svc AgentService) AgentHandler {
+	return AgentHandler{svc: svc}
+}
+
+// ListAgents lists all registered agents.
+// GET /api/v1/agents?page=1&per_page=50
+func (h AgentHandler) ListAgents(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	agents, total, err := h.svc.ListAgents(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list agents", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    agents,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetAgent retrieves a single agent by ID.
+// GET /api/v1/agents/{id}
+func (h AgentHandler) GetAgent(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/agents/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Agent ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	agent, err := h.svc.GetAgent(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Agent not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, agent)
+}
+
+// RegisterAgent registers a new agent.
+// POST /api/v1/agents
+func (h AgentHandler) RegisterAgent(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var agent domain.Agent
+	if err := json.NewDecoder(r.Body).Decode(&agent); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.RegisterAgent(agent)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to register agent", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// Heartbeat records a heartbeat from an agent.
+// POST /api/v1/agents/{id}/heartbeat
+func (h AgentHandler) Heartbeat(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract agent ID from path /api/v1/agents/{id}/heartbeat
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/agents/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Agent ID is required", requestID)
+		return
+	}
+	agentID := parts[0]
+
+	if err := h.svc.Heartbeat(agentID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to record heartbeat", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "heartbeat_recorded",
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// AgentCSRSubmit receives a Certificate Signing Request from an agent.
+// POST /api/v1/agents/{id}/csr
+func (h AgentHandler) AgentCSRSubmit(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract agent ID from path /api/v1/agents/{id}/csr
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/agents/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Agent ID is required", requestID)
+		return
+	}
+	agentID := parts[0]
+
+	var req struct {
+		CSRPEM string `json:"csr_pem"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	if req.CSRPEM == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "CSR PEM is required", requestID)
+		return
+	}
+
+	jobID, err := h.svc.CSRSubmit(agentID, req.CSRPEM)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to submit CSR", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"job_id": jobID,
+		"status": "csr_received",
+	}
+
+	JSON(w, http.StatusAccepted, response)
+}
+
+// AgentCertificatePickup allows an agent to retrieve an issued certificate.
+// GET /api/v1/agents/{id}/certificates/{cert_id}
+func (h AgentHandler) AgentCertificatePickup(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract agent ID and certificate ID from path /api/v1/agents/{id}/certificates/{cert_id}
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/agents/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 4 || parts[0] == "" || parts[2] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Agent ID and Certificate ID are required", requestID)
+		return
+	}
+	agentID := parts[0]
+	certID := parts[2]
+
+	certPEM, err := h.svc.CertificatePickup(agentID, certID)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found or not ready", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"certificate_pem": certPEM,
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/audit.go

@@ -0,0 +1,93 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// AuditService defines the service interface for audit event operations.
+type AuditService interface {
+	ListAuditEvents(page, perPage int) ([]domain.AuditEvent, int64, error)
+	GetAuditEvent(id string) (*domain.AuditEvent, error)
+}
+
+// AuditHandler handles HTTP requests for audit event operations.
+type AuditHandler struct {
+	svc AuditService
+}
+
+// NewAuditHandler creates a new AuditHandler with a service dependency.
+func NewAuditHandler(svc AuditService) AuditHandler {
+	return AuditHandler{svc: svc}
+}
+
+// ListAuditEvents lists audit events.
+// GET /api/v1/audit?page=1&per_page=50
+func (h AuditHandler) ListAuditEvents(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	events, total, err := h.svc.ListAuditEvents(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list audit events", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    events,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetAuditEvent retrieves a single audit event by ID.
+// GET /api/v1/audit/{id}
+func (h AuditHandler) GetAuditEvent(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/audit/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Audit event ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	event, err := h.svc.GetAuditEvent(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Audit event not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, event)
+}

internal/api/handler/certificates.go

@@ -0,0 +1,306 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// CertificateService defines the service interface for certificate operations.
+type CertificateService interface {
+	ListCertificates(status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error)
+	GetCertificate(id string) (*domain.ManagedCertificate, error)
+	CreateCertificate(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	UpdateCertificate(id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	ArchiveCertificate(id string) error
+	GetCertificateVersions(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error)
+	TriggerRenewal(certID string) error
+	TriggerDeployment(certID string, targetID string) error
+}
+
+// CertificateHandler handles HTTP requests for certificate operations.
+type CertificateHandler struct {
+	svc CertificateService
+}
+
+// NewCertificateHandler creates a new CertificateHandler with a service dependency.
+func NewCertificateHandler(svc CertificateService) CertificateHandler {
+	return CertificateHandler{svc: svc}
+}
+
+// ListCertificates lists certificates with optional filtering.
+// GET /api/v1/certificates?status=Active&environment=prod&owner_id=...&team_id=...&issuer_id=...&page=1&per_page=50
+func (h CertificateHandler) ListCertificates(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Parse query parameters
+	query := r.URL.Query()
+	status := query.Get("status")
+	environment := query.Get("environment")
+	ownerID := query.Get("owner_id")
+	teamID := query.Get("team_id")
+	issuerID := query.Get("issuer_id")
+
+	page := 1
+	perPage := 50
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	certs, total, err := h.svc.ListCertificates(status, environment, ownerID, teamID, issuerID, page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list certificates", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    certs,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetCertificate retrieves a single certificate by ID.
+// GET /api/v1/certificates/{id}
+func (h CertificateHandler) GetCertificate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	if id == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+
+	cert, err := h.svc.GetCertificate(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, cert)
+}
+
+// CreateCertificate creates a new certificate.
+// POST /api/v1/certificates
+func (h CertificateHandler) CreateCertificate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var cert domain.ManagedCertificate
+	if err := json.NewDecoder(r.Body).Decode(&cert); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreateCertificate(cert)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create certificate", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdateCertificate updates an existing certificate.
+// PUT /api/v1/certificates/{id}
+func (h CertificateHandler) UpdateCertificate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var cert domain.ManagedCertificate
+	if err := json.NewDecoder(r.Body).Decode(&cert); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdateCertificate(id, cert)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update certificate", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// ArchiveCertificate archives a certificate (soft delete).
+// DELETE /api/v1/certificates/{id}
+func (h CertificateHandler) ArchiveCertificate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	if id == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+
+	if err := h.svc.ArchiveCertificate(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to archive certificate", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// GetCertificateVersions retrieves version history for a certificate.
+// GET /api/v1/certificates/{id}/versions
+func (h CertificateHandler) GetCertificateVersions(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract certificate ID from path /api/v1/certificates/{id}/versions
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+	certID := parts[0]
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	versions, total, err := h.svc.GetCertificateVersions(certID, page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    versions,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// TriggerRenewal triggers manual renewal for a certificate.
+// POST /api/v1/certificates/{id}/renew
+func (h CertificateHandler) TriggerRenewal(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract certificate ID from path /api/v1/certificates/{id}/renew
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+	certID := parts[0]
+
+	if err := h.svc.TriggerRenewal(certID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to trigger renewal", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "renewal_triggered",
+	}
+
+	JSON(w, http.StatusAccepted, response)
+}
+
+// TriggerDeployment triggers deployment of a certificate to targets.
+// POST /api/v1/certificates/{id}/deploy
+func (h CertificateHandler) TriggerDeployment(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract certificate ID from path /api/v1/certificates/{id}/deploy
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/certificates/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Certificate ID is required", requestID)
+		return
+	}
+	certID := parts[0]
+
+	// Optional: parse request body for specific target ID
+	var req struct {
+		TargetID string `json:"target_id,omitempty"`
+	}
+	if r.Header.Get("Content-Type") == "application/json" {
+		json.NewDecoder(r.Body).Decode(&req)
+	}
+
+	if err := h.svc.TriggerDeployment(certID, req.TargetID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to trigger deployment", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "deployment_triggered",
+	}
+
+	JSON(w, http.StatusAccepted, response)
+}

internal/api/handler/health.go

@@ -0,0 +1,43 @@
+package handler
+
+import (
+	"net/http"
+)
+
+// HealthHandler handles health and readiness check endpoints.
+type HealthHandler struct{}
+
+// NewHealthHandler creates a new HealthHandler.
+func NewHealthHandler() HealthHandler {
+	return HealthHandler{}
+}
+
+// Health responds with a simple health check indicating the service is alive.
+// GET /health
+func (h HealthHandler) Health(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	response := map[string]string{
+		"status": "healthy",
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// Ready responds with readiness status, indicating whether the service is ready to handle requests.
+// GET /ready
+func (h HealthHandler) Ready(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	response := map[string]string{
+		"status": "ready",
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/issuers.go

@@ -0,0 +1,209 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// IssuerService defines the service interface for issuer operations.
+type IssuerService interface {
+	ListIssuers(page, perPage int) ([]domain.Issuer, int64, error)
+	GetIssuer(id string) (*domain.Issuer, error)
+	CreateIssuer(issuer domain.Issuer) (*domain.Issuer, error)
+	UpdateIssuer(id string, issuer domain.Issuer) (*domain.Issuer, error)
+	DeleteIssuer(id string) error
+	TestConnection(id string) error
+}
+
+// IssuerHandler handles HTTP requests for issuer operations.
+type IssuerHandler struct {
+	svc IssuerService
+}
+
+// NewIssuerHandler creates a new IssuerHandler with a service dependency.
+func NewIssuerHandler(svc IssuerService) IssuerHandler {
+	return IssuerHandler{svc: svc}
+}
+
+// ListIssuers lists all configured issuers.
+// GET /api/v1/issuers?page=1&per_page=50
+func (h IssuerHandler) ListIssuers(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	issuers, total, err := h.svc.ListIssuers(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list issuers", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    issuers,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetIssuer retrieves a single issuer by ID.
+// GET /api/v1/issuers/{id}
+func (h IssuerHandler) GetIssuer(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/issuers/")
+	if id == "" || strings.Contains(id, "/") {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID is required", requestID)
+		return
+	}
+
+	issuer, err := h.svc.GetIssuer(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Issuer not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, issuer)
+}
+
+// CreateIssuer creates a new issuer configuration.
+// POST /api/v1/issuers
+func (h IssuerHandler) CreateIssuer(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var issuer domain.Issuer
+	if err := json.NewDecoder(r.Body).Decode(&issuer); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreateIssuer(issuer)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create issuer", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdateIssuer updates an existing issuer configuration.
+// PUT /api/v1/issuers/{id}
+func (h IssuerHandler) UpdateIssuer(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/issuers/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var issuer domain.Issuer
+	if err := json.NewDecoder(r.Body).Decode(&issuer); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdateIssuer(id, issuer)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update issuer", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// DeleteIssuer deletes an issuer configuration.
+// DELETE /api/v1/issuers/{id}
+func (h IssuerHandler) DeleteIssuer(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/issuers/")
+	if id == "" || strings.Contains(id, "/") {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID is required", requestID)
+		return
+	}
+
+	if err := h.svc.DeleteIssuer(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to delete issuer", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// TestConnection tests the connection to an issuer.
+// POST /api/v1/issuers/{id}/test
+func (h IssuerHandler) TestConnection(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract issuer ID from path /api/v1/issuers/{id}/test
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/issuers/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID is required", requestID)
+		return
+	}
+	issuerID := parts[0]
+
+	if err := h.svc.TestConnection(issuerID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Connection test failed", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "connection_successful",
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/jobs.go

@@ -0,0 +1,128 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// JobService defines the service interface for job operations.
+type JobService interface {
+	ListJobs(status, jobType string, page, perPage int) ([]domain.Job, int64, error)
+	GetJob(id string) (*domain.Job, error)
+	CancelJob(id string) error
+}
+
+// JobHandler handles HTTP requests for job operations.
+type JobHandler struct {
+	svc JobService
+}
+
+// NewJobHandler creates a new JobHandler with a service dependency.
+func NewJobHandler(svc JobService) JobHandler {
+	return JobHandler{svc: svc}
+}
+
+// ListJobs lists jobs with optional filtering by status and type.
+// GET /api/v1/jobs?status=Pending&type=Renewal&page=1&per_page=50
+func (h JobHandler) ListJobs(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	query := r.URL.Query()
+	status := query.Get("status")
+	jobType := query.Get("type")
+
+	page := 1
+	perPage := 50
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	jobs, total, err := h.svc.ListJobs(status, jobType, page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list jobs", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    jobs,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetJob retrieves a single job by ID.
+// GET /api/v1/jobs/{id}
+func (h JobHandler) GetJob(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/jobs/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Job ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	job, err := h.svc.GetJob(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Job not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, job)
+}
+
+// CancelJob cancels a job.
+// POST /api/v1/jobs/{id}/cancel
+func (h JobHandler) CancelJob(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract job ID from path /api/v1/jobs/{id}/cancel
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/jobs/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Job ID is required", requestID)
+		return
+	}
+	jobID := parts[0]
+
+	if err := h.svc.CancelJob(jobID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to cancel job", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "job_cancelled",
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/notifications.go

@@ -0,0 +1,125 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// NotificationService defines the service interface for notification operations.
+type NotificationService interface {
+	ListNotifications(page, perPage int) ([]domain.NotificationEvent, int64, error)
+	GetNotification(id string) (*domain.NotificationEvent, error)
+	MarkAsRead(id string) error
+}
+
+// NotificationHandler handles HTTP requests for notification operations.
+type NotificationHandler struct {
+	svc NotificationService
+}
+
+// NewNotificationHandler creates a new NotificationHandler with a service dependency.
+func NewNotificationHandler(svc NotificationService) NotificationHandler {
+	return NotificationHandler{svc: svc}
+}
+
+// ListNotifications lists notifications.
+// GET /api/v1/notifications?page=1&per_page=50
+func (h NotificationHandler) ListNotifications(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	notifications, total, err := h.svc.ListNotifications(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list notifications", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    notifications,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetNotification retrieves a single notification by ID.
+// GET /api/v1/notifications/{id}
+func (h NotificationHandler) GetNotification(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/notifications/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Notification ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	notification, err := h.svc.GetNotification(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Notification not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, notification)
+}
+
+// MarkAsRead marks a notification as read.
+// POST /api/v1/notifications/{id}/read
+func (h NotificationHandler) MarkAsRead(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract notification ID from path /api/v1/notifications/{id}/read
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/notifications/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Notification ID is required", requestID)
+		return
+	}
+	notificationID := parts[0]
+
+	if err := h.svc.MarkAsRead(notificationID); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to mark notification as read", requestID)
+		return
+	}
+
+	response := map[string]string{
+		"status": "marked_as_read",
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/owners.go

@@ -0,0 +1,181 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// OwnerService defines the service interface for owner operations.
+type OwnerService interface {
+	ListOwners(page, perPage int) ([]domain.Owner, int64, error)
+	GetOwner(id string) (*domain.Owner, error)
+	CreateOwner(owner domain.Owner) (*domain.Owner, error)
+	UpdateOwner(id string, owner domain.Owner) (*domain.Owner, error)
+	DeleteOwner(id string) error
+}
+
+// OwnerHandler handles HTTP requests for owner operations.
+type OwnerHandler struct {
+	svc OwnerService
+}
+
+// NewOwnerHandler creates a new OwnerHandler with a service dependency.
+func NewOwnerHandler(svc OwnerService) OwnerHandler {
+	return OwnerHandler{svc: svc}
+}
+
+// ListOwners lists all owners.
+// GET /api/v1/owners?page=1&per_page=50
+func (h OwnerHandler) ListOwners(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	owners, total, err := h.svc.ListOwners(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list owners", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    owners,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetOwner retrieves a single owner by ID.
+// GET /api/v1/owners/{id}
+func (h OwnerHandler) GetOwner(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/owners/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Owner ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	owner, err := h.svc.GetOwner(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Owner not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, owner)
+}
+
+// CreateOwner creates a new owner.
+// POST /api/v1/owners
+func (h OwnerHandler) CreateOwner(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var owner domain.Owner
+	if err := json.NewDecoder(r.Body).Decode(&owner); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreateOwner(owner)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create owner", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdateOwner updates an existing owner.
+// PUT /api/v1/owners/{id}
+func (h OwnerHandler) UpdateOwner(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/owners/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Owner ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var owner domain.Owner
+	if err := json.NewDecoder(r.Body).Decode(&owner); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdateOwner(id, owner)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update owner", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// DeleteOwner deletes an owner.
+// DELETE /api/v1/owners/{id}
+func (h OwnerHandler) DeleteOwner(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/owners/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Owner ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	if err := h.svc.DeleteOwner(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to delete owner", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}

internal/api/handler/policies.go

@@ -0,0 +1,231 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// PolicyService defines the service interface for policy rule operations.
+type PolicyService interface {
+	ListPolicies(page, perPage int) ([]domain.PolicyRule, int64, error)
+	GetPolicy(id string) (*domain.PolicyRule, error)
+	CreatePolicy(policy domain.PolicyRule) (*domain.PolicyRule, error)
+	UpdatePolicy(id string, policy domain.PolicyRule) (*domain.PolicyRule, error)
+	DeletePolicy(id string) error
+	ListViolations(policyID string, page, perPage int) ([]domain.PolicyViolation, int64, error)
+}
+
+// PolicyHandler handles HTTP requests for policy rule operations.
+type PolicyHandler struct {
+	svc PolicyService
+}
+
+// NewPolicyHandler creates a new PolicyHandler with a service dependency.
+func NewPolicyHandler(svc PolicyService) PolicyHandler {
+	return PolicyHandler{svc: svc}
+}
+
+// ListPolicies lists all policy rules.
+// GET /api/v1/policies?page=1&per_page=50
+func (h PolicyHandler) ListPolicies(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	policies, total, err := h.svc.ListPolicies(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list policies", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    policies,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetPolicy retrieves a single policy rule by ID.
+// GET /api/v1/policies/{id}
+func (h PolicyHandler) GetPolicy(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/policies/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Policy ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	policy, err := h.svc.GetPolicy(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Policy not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, policy)
+}
+
+// CreatePolicy creates a new policy rule.
+// POST /api/v1/policies
+func (h PolicyHandler) CreatePolicy(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var policy domain.PolicyRule
+	if err := json.NewDecoder(r.Body).Decode(&policy); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreatePolicy(policy)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create policy", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdatePolicy updates an existing policy rule.
+// PUT /api/v1/policies/{id}
+func (h PolicyHandler) UpdatePolicy(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/policies/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Policy ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var policy domain.PolicyRule
+	if err := json.NewDecoder(r.Body).Decode(&policy); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdatePolicy(id, policy)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update policy", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// DeletePolicy deletes a policy rule.
+// DELETE /api/v1/policies/{id}
+func (h PolicyHandler) DeletePolicy(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/policies/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Policy ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	if err := h.svc.DeletePolicy(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to delete policy", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// ListViolations lists policy violations for a specific policy rule.
+// GET /api/v1/policies/{id}/violations?page=1&per_page=50
+func (h PolicyHandler) ListViolations(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract policy ID from path /api/v1/policies/{id}/violations
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/policies/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Policy ID is required", requestID)
+		return
+	}
+	policyID := parts[0]
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	violations, total, err := h.svc.ListViolations(policyID, page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list violations", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    violations,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}

internal/api/handler/response.go

@@ -0,0 +1,51 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+// PagedResponse represents a paginated API response.
+type PagedResponse struct {
+	Data    interface{} `json:"data"`
+	Total   int64       `json:"total"`
+	Page    int         `json:"page"`
+	PerPage int         `json:"per_page"`
+}
+
+// ErrorResponse represents a standard error response.
+type ErrorResponse struct {
+	Error     string `json:"error"`
+	Message   string `json:"message"`
+	RequestID string `json:"request_id,omitempty"`
+}
+
+// JSON writes a JSON response with the given status code and data.
+func JSON(w http.ResponseWriter, status int, data interface{}) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	return json.NewEncoder(w).Encode(data)
+}
+
+// Error writes a JSON error response with the given status code and message.
+func Error(w http.ResponseWriter, status int, message string) error {
+	errResp := ErrorResponse{
+		Error:   http.StatusText(status),
+		Message: message,
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	return json.NewEncoder(w).Encode(errResp)
+}
+
+// ErrorWithRequestID writes a JSON error response including a request ID.
+func ErrorWithRequestID(w http.ResponseWriter, status int, message, requestID string) error {
+	errResp := ErrorResponse{
+		Error:     http.StatusText(status),
+		Message:   message,
+		RequestID: requestID,
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	return json.NewEncoder(w).Encode(errResp)
+}

internal/api/handler/targets.go

@@ -0,0 +1,177 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// TargetService defines the service interface for deployment target operations.
+type TargetService interface {
+	ListTargets(page, perPage int) ([]domain.DeploymentTarget, int64, error)
+	GetTarget(id string) (*domain.DeploymentTarget, error)
+	CreateTarget(target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
+	UpdateTarget(id string, target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
+	DeleteTarget(id string) error
+}
+
+// TargetHandler handles HTTP requests for deployment target operations.
+type TargetHandler struct {
+	svc TargetService
+}
+
+// NewTargetHandler creates a new TargetHandler with a service dependency.
+func NewTargetHandler(svc TargetService) TargetHandler {
+	return TargetHandler{svc: svc}
+}
+
+// ListTargets lists all deployment targets.
+// GET /api/v1/targets?page=1&per_page=50
+func (h TargetHandler) ListTargets(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	targets, total, err := h.svc.ListTargets(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list targets", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    targets,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetTarget retrieves a single deployment target by ID.
+// GET /api/v1/targets/{id}
+func (h TargetHandler) GetTarget(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/targets/")
+	if id == "" || strings.Contains(id, "/") {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Target ID is required", requestID)
+		return
+	}
+
+	target, err := h.svc.GetTarget(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Target not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, target)
+}
+
+// CreateTarget creates a new deployment target.
+// POST /api/v1/targets
+func (h TargetHandler) CreateTarget(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var target domain.DeploymentTarget
+	if err := json.NewDecoder(r.Body).Decode(&target); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreateTarget(target)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create target", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdateTarget updates an existing deployment target.
+// PUT /api/v1/targets/{id}
+func (h TargetHandler) UpdateTarget(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/targets/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Target ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var target domain.DeploymentTarget
+	if err := json.NewDecoder(r.Body).Decode(&target); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdateTarget(id, target)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update target", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// DeleteTarget deletes a deployment target.
+// DELETE /api/v1/targets/{id}
+func (h TargetHandler) DeleteTarget(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/targets/")
+	if id == "" || strings.Contains(id, "/") {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Target ID is required", requestID)
+		return
+	}
+
+	if err := h.svc.DeleteTarget(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to delete target", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}

internal/api/handler/teams.go

@@ -0,0 +1,181 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// TeamService defines the service interface for team operations.
+type TeamService interface {
+	ListTeams(page, perPage int) ([]domain.Team, int64, error)
+	GetTeam(id string) (*domain.Team, error)
+	CreateTeam(team domain.Team) (*domain.Team, error)
+	UpdateTeam(id string, team domain.Team) (*domain.Team, error)
+	DeleteTeam(id string) error
+}
+
+// TeamHandler handles HTTP requests for team operations.
+type TeamHandler struct {
+	svc TeamService
+}
+
+// NewTeamHandler creates a new TeamHandler with a service dependency.
+func NewTeamHandler(svc TeamService) TeamHandler {
+	return TeamHandler{svc: svc}
+}
+
+// ListTeams lists all teams.
+// GET /api/v1/teams?page=1&per_page=50
+func (h TeamHandler) ListTeams(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	page := 1
+	perPage := 50
+	query := r.URL.Query()
+	if p := query.Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+	if pp := query.Get("per_page"); pp != "" {
+		if parsed, err := strconv.Atoi(pp); err == nil && parsed > 0 && parsed <= 500 {
+			perPage = parsed
+		}
+	}
+
+	teams, total, err := h.svc.ListTeams(page, perPage)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list teams", requestID)
+		return
+	}
+
+	response := PagedResponse{
+		Data:    teams,
+		Total:   total,
+		Page:    page,
+		PerPage: perPage,
+	}
+
+	JSON(w, http.StatusOK, response)
+}
+
+// GetTeam retrieves a single team by ID.
+// GET /api/v1/teams/{id}
+func (h TeamHandler) GetTeam(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/teams/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Team ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	team, err := h.svc.GetTeam(id)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusNotFound, "Team not found", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, team)
+}
+
+// CreateTeam creates a new team.
+// POST /api/v1/teams
+func (h TeamHandler) CreateTeam(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	var team domain.Team
+	if err := json.NewDecoder(r.Body).Decode(&team); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	created, err := h.svc.CreateTeam(team)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create team", requestID)
+		return
+	}
+
+	JSON(w, http.StatusCreated, created)
+}
+
+// UpdateTeam updates an existing team.
+// PUT /api/v1/teams/{id}
+func (h TeamHandler) UpdateTeam(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/teams/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Team ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	var team domain.Team
+	if err := json.NewDecoder(r.Body).Decode(&team); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	updated, err := h.svc.UpdateTeam(id, team)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update team", requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, updated)
+}
+
+// DeleteTeam deletes a team.
+// DELETE /api/v1/teams/{id}
+func (h TeamHandler) DeleteTeam(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	id := strings.TrimPrefix(r.URL.Path, "/api/v1/teams/")
+	parts := strings.Split(id, "/")
+	if len(parts) == 0 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Team ID is required", requestID)
+		return
+	}
+	id = parts[0]
+
+	if err := h.svc.DeleteTeam(id); err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to delete team", requestID)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}