How do you pin a node during cert request

I would like to pin a node to an environment and role when requesting a cert. I know you can use external facts, but changing some files on a disk may be a potential security issue. I have heard of a way of using an api call during asking a cert request to do this.