diff --git a/docs/api-reference/endpoints/certificates/bundle.mdx b/docs/api-reference/endpoints/certificates/bundle.mdx
new file mode 100644
index 000000000..78cf7e073
--- /dev/null
+++ b/docs/api-reference/endpoints/certificates/bundle.mdx
@@ -0,0 +1,8 @@
+---
+title: "List"
+openapi: "GET /api/v2/workspace/{slug}/bundle"
+---
+
+<Note>
+    You must have the certificate `read-private-key` permission in order to call this endpoint.
+</Note>
diff --git a/docs/api-reference/endpoints/certificates/private-key.mdx b/docs/api-reference/endpoints/certificates/private-key.mdx
new file mode 100644
index 000000000..15056fceb
--- /dev/null
+++ b/docs/api-reference/endpoints/certificates/private-key.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v2/workspace/{slug}/private-key"
+---
diff --git a/docs/internals/permissions/project-permissions.mdx b/docs/internals/permissions/project-permissions.mdx
index 4e0c592cb..acf95485b 100644
--- a/docs/internals/permissions/project-permissions.mdx
+++ b/docs/internals/permissions/project-permissions.mdx
@@ -252,11 +252,12 @@ Supports conditions and permission inversion
 
 #### Subject: `certificates`
 
-| Action   | Description                   |
-| -------- | ----------------------------- |
-| `read`   | View certificates             |
-| `create` | Issue new certificates        |
-| `delete` | Revoke or remove certificates |
+| Action               | Description                   |
+| -------------------- | ----------------------------- |
+| `read`               | View certificates             |
+| `read-private-key`   | Read certificate private key  |
+| `create`             | Issue new certificates        |
+| `delete`             | Revoke or remove certificates |
 
 #### Subject: `certificate-templates`