> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgov.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Applications

> Application records assign ownership and accountability to a hostname — the foundation for expiry notifications, App Connectors, and certificate lifecycle tracking.

An **Application** record in CertForge represents a service or system that consumes certificates. It ties a hostname to an owner, an environment, and optionally a preferred Trust Profile — making cert ownership explicit and expiry notifications actionable.

***

## Why applications matter

Without an application record, CertForge can issue and track certificates, but there is no defined owner to notify when they approach expiry. Applications also serve as the parent record for [App Connectors](/guides/app-connector) — you cannot create an App Connector for a hostname without an Application record.

***

## What an Application record contains

| Field                       | Description                                                                        |
| --------------------------- | ---------------------------------------------------------------------------------- |
| **Name**                    | Human-readable service name (e.g., `nginx-prod`, `api-gateway`).                   |
| **Primary hostname**        | The main domain this application serves (e.g., `fun.example.com`).                 |
| **Additional hostnames**    | Other domains this application owns.                                               |
| **Environment**             | `production`, `staging`, `development`, or custom.                                 |
| **Owner emails**            | One or more people notified on expiry warnings, renewal failures, and cert events. |
| **Preferred Trust Profile** | Default DTP used when requesting certificates for this application.                |
| **GL code**                 | Optional cost attribution.                                                         |
| **Notes**                   | Free-form description.                                                             |

***

## Create an Application

### Via the UI

1. Navigate to **Applications** in the sidebar.
2. Click **New Application**.
3. Enter a **Name** and **Primary Hostname**.
4. Set the **Environment** (`production` for live systems).
5. Add at least one **Owner Email** — this person receives expiry notifications.
6. Optionally select a **Preferred Trust Profile** matching the hostname.
7. Save.

### Via MCP (AI agent)

```
"Create an application for fun.example.com, owner john@example.com, production"
```

The AI calls `create_application` in two steps — preview then confirm:

```
Step 1: Preview shown
Step 2: "Create it" → executes with dry_run=false, confirmed=true
```

Required parameters: `name`, `primary_hostname`, `owner_emails` (array)

***

## Notifications

Owners listed on an Application receive email alerts when:

* A certificate is within the **expiry warning window** (configurable in Settings → Notifications)
* A certificate renewal **fails**
* An App Connector reports an **installation error**
* An approval request is created for a cert on this application's hostname

See [Notifications](/guides/notifications) for alert configuration.

***

## App Connectors and Applications

An [App Connector](/guides/app-connector) must be linked to an Application. The connector uses the Application's Trust Profile preference to know which DTP to request certs under. When you create an App Connector via the MCP agent, it looks up or creates an Application record for the domain automatically.

***

## Querying applications

```
"List all production applications"
→ list_applications(environment="production")

"Who owns fun.example.com?"
→ get_application(name="nginx-prod")
  or
→ check_domain(domain="fun.example.com")  — includes application section
```