openapi: 3.2.0
info:
  title: Fortanix Accounts API
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: '1.0'
  description: 'Operations tagged Accounts across 2 of this provider''s published API definitions: fortanix-ccm-openapi-original.json, fortanix-dsm-openapi-original.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://ccm.fortanix.com
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Accounts
paths:
  /v1/accounts:
    get:
      tags:
      - Accounts
      summary: Get all accounts.
      description: Get detailed information about all accounts that the current user has permission to see.
      operationId: getAccounts
      x-auth-resource: UserAuth,Reader,Writer,Manager
      parameters:
      - name: scope
        in: query
        description: 'Specify the scope from which to get the accounts. Possible options: USER, SYSTEM.'
        required: false
        schema:
          type: string
      - name: limit
        in: query
        description: Maximum numbers of accounts to return.
        required: false
        schema:
          type: integer
      - name: previous_id
        in: query
        description: Id of account from previous page of results.
        required: false
        schema:
          type: string
          format: uuid
      - name: sort_by
        in: query
        description: Sort fields. In the format of key1:ASC,key2:DESC,key3:DESC
        required: false
        schema:
          type: string
      responses:
        '200':
          description: All account details for the current user.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountListResponse'
      security:
      - bearerToken: []
    post:
      tags:
      - Accounts
      summary: Create a new account.
      description: Create a new account with the specified properties. Only an authenticated user can create an account.
      parameters:
      - $ref: '#/components/parameters/AccountRequest'
      operationId: createAccount
      x-auth-resource: UserAuth,Reader,Writer,Manager
      responses:
        '200':
          description: The details of the account created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account'
      security:
      - bearerToken: []
    servers:
    - url: https://ccm.fortanix.com
  /v1/accounts/{account-id}:
    get:
      tags:
      - Accounts
      summary: Get a specific account.
      description: Look up an account by account ID. Current user must belong to a particular account.
      parameters:
      - $ref: '#/components/parameters/AccountId'
      - $ref: '#/components/parameters/WithTotals'
      operationId: getAccount
      x-auth-resource: UserAuth,Reader,Writer,Manager
      responses:
        '200':
          description: Particular account details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account'
      security:
      - bearerToken: []
    delete:
      tags:
      - Accounts
      summary: Delete an account.
      description: Remove an account.
      parameters:
      - $ref: '#/components/parameters/AccountId'
      operationId: deleteAccount
      x-auth-resource: NoAuth
      responses:
        '204':
          description: Nothing is returned on success.
      security:
      - bearerToken: []
    patch:
      tags:
      - Accounts
      summary: Update an account.
      description: Update the properties of an account. Only certain properties may be changed with this API.
      parameters:
      - $ref: '#/components/parameters/AccountId'
      - $ref: '#/components/parameters/AccountUpdateRequest'
      operationId: updateAccount
      x-auth-resource: Manager, UserAuth
      responses:
        '200':
          description: Updated account.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account'
      security:
      - bearerToken: []
    servers:
    - url: https://ccm.fortanix.com
  /sys/v1/accounts/{acct_id}/usage:
    get:
      operationId: AccountUsage
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Get account usage information. See input and output of this API

        for info on what it can return.'
      description: 'Get account usage information. See input and output of this API

        for info on what it can return.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/CountParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUsageResponse'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts:
    post:
      operationId: CreateAccount
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Create a new account.
      description: Create a new account.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountRequest_2'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account_2'
    get:
      operationId: ListAccounts
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get info about all accounts.
      description: 'A user can have access to multiple accounts and this API gets

        all accounts the calling user has access to.'
      parameters:
      - $ref: '#/components/parameters/GetAccountParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Account_2'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts/{acct_id}/replication/credentials:
    post:
      operationId: CreateReplicationCredential
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Create an admin app credential that can be used to perform

        account replication.'
      description: 'Note that this does _not_ immediately create a usable credential;

        further processing is necessary before it can be actually used for

        account replication.


        Currently, a single replication account can store up to two

        replication credentials.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateReplicationCredentialRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReplicationCredential'
    get:
      operationId: ListReplicationCredentials
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Retrieve all stored replication credentials under the account.
      description: Retrieve all stored replication credentials under the account.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListReplicationCredentialsResponse'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts/{acct_id}:
    delete:
      operationId: DeleteAccount
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Delete an account.
      description: Delete an account.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    get:
      operationId: GetAccount
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get info for a specific account.
      description: 'A user can have access to multiple accounts and this API tries

        to look one up given by the input id.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/GetAccountParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account_2'
    patch:
      operationId: UpdateAccount
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Update account settings such as authentication, logging, etc.
      description: Update account settings such as authentication, logging, etc.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountRequest_2'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account_2'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}:
    delete:
      operationId: DeleteReplicationCredential
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Delete the specified replication credential.
      description: Delete the specified replication credential.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: credential_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    get:
      operationId: GetReplicationCredential
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Retrieve the specified replication credential.
      description: Retrieve the specified replication credential.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: credential_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReplicationCredential'
    patch:
      operationId: UpdateReplicationCredential
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Update the specified replication credential.
      description: 'This can be used to associate an app ID with the credential,

        and/or upload cert chains for the credential.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: credential_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateReplicationCredentialRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReplicationCredential'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts/{acct_id}/replication/recent_scan_summary:
    get:
      operationId: RecentReplicationScanSummary
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Fetch a summary of recent scans.
      description: Fetch a summary of recent scans.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecentScanSummary'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
  /sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}/self_sign:
    post:
      operationId: ReplicationCredentialSelfSignedCert
      tags:
      - Accounts
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Generate a self-signed cert for the specified credential.
      description: 'Note that this does _not_ immediately associate the certificate

        with the credential; the credential still needs to be updated

        afterwards.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: credential_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReplicationCredentialSelfSignedCertRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReplicationCredentialSelfSignedCertResponse'
    servers:
    - url: '{dsmEndpoint}'
      description: DSM Endpoint
      variables:
        dsmEndpoint:
          default: https://amer.smartkey.io
          description: Type your DSM server URL here (include https://)
components:
  schemas:
    CaConfig:
      type: object
      properties:
        ca_set:
          $ref: '#/components/schemas/CaSet'
        pinned:
          type: array
          items:
            type: string
            format: binary
    AccessRoles:
      type: string
      description: Roles of a user.
      enum:
      - READER
      - WRITER
      - MANAGER
    AuthConfigPassword:
      type: object
      description: Configuration for password-based authentication.
      required:
      - require_2fa
      - administrators_only
      properties:
        require_2fa:
          type: boolean
        administrators_only:
          type: boolean
    TlsConfigRequired:
      type: object
      required:
      - validate_hostname
      - ca
      properties:
        validate_hostname:
          type: boolean
        client_key:
          type: string
          format: binary
        client_cert:
          type: string
          format: binary
        ca:
          $ref: '#/components/schemas/CaConfig'
    AccountRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Name of the account. Accounts must be unique within a CCM instance.
        custom_logo:
          type: string
          format: binary
          description: Logo for an account. Max size 128Kb, .jpg, .png, .svg file formats only.
        auth_configs:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticationConfig'
        node_enrollment:
          $ref: '#/components/schemas/NodeEnrollment'
        component:
          $ref: '#/components/schemas/AccountComponent'
    AccountUpdateRequest:
      type: object
      properties:
        name:
          type: string
        custom_logo:
          type: string
          format: binary
        add_auth_configs:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticationConfig'
        mod_auth_configs:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AuthenticationConfig'
        del_auth_configs:
          type: array
          items:
            type: string
            format: uuid
        enabled:
          type: boolean
        default_group_id:
          type: string
          format: uuid
        marketplace_group_id:
          type: string
          format: uuid
        account_status:
          $ref: '#/components/schemas/AccountStatus'
        azure_cvm_pcr_priority:
          $ref: '#/components/schemas/AzureCvmPcrPriority'
    AzureCvmPcrPriority:
      type: array
      description: Ordered list of exactly the integer elements 0 through 22
      items:
        type: integer
    AuthConfigRef:
      type: object
      required:
      - target_id
      properties:
        target_id:
          type: string
    AuthConfigOauth:
      type: object
      required:
      - idp_name
      - idp_icon_url
      - idp_authorization_endpoint
      - idp_token_endpoint
      - idp_requires_basic_auth
      - tls
      - client_id
      - client_secret
      properties:
        idp_name:
          type: string
        idp_icon_url:
          type: string
        idp_authorization_endpoint:
          type: string
        idp_token_endpoint:
          type: string
        idp_requires_basic_auth:
          type: boolean
        idp_userinfo_endpoint:
          type: string
        tls:
          $ref: '#/components/schemas/TlsConfig'
        client_id:
          type: string
        client_secret:
          type: string
    AuthenticationConfig:
      type: object
      properties:
        password:
          $ref: '#/components/schemas/AuthConfigPassword'
        oauth:
          $ref: '#/components/schemas/AuthConfigOauth'
        cluster_auth_ref:
          $ref: '#/components/schemas/AuthConfigRef'
    CaSet:
      type: string
      enum:
      - GLOBAL_ROOTS
    NodeEnrollment:
      type: object
      required:
      - attestation_enforcement_disabled_insecure
      properties:
        attestation_enforcement_disabled_insecure:
          type: boolean
    Account:
      type: object
      required:
      - acct_id
      - node_enrollment
      - component
      properties:
        name:
          type: string
          description: Name of the account. Account names must be unique within a CCM instance.
        acct_id:
          type: string
          format: uuid
          description: Account ID uniquely identifying this account.
        created_at:
          type: integer
          format: int64
          description: When this account was created.
        roles:
          type: array
          description: Role of the current user in a particular account.
          items:
            $ref: '#/components/schemas/AccessRoles'
        custom_logo:
          type: string
          format: binary
          description: Logo of the particular account. Max size 128Kb, .jpg, .png, .svg file formats only.
        status:
          $ref: '#/components/schemas/UserAccountStatus'
        auth_configs:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AuthenticationConfig'
        node_enrollment:
          $ref: '#/components/schemas/NodeEnrollment'
        totals:
          $ref: '#/components/schemas/ObjectCounts'
        component:
          $ref: '#/components/schemas/AccountComponent'
        default_group_id:
          type: string
          format: uuid
          description: Default group_id in an account.
        marketplace_group_id:
          type: string
          format: uuid
          description: Marketplace group_id for the account
        account_status:
          $ref: '#/components/schemas/AccountStatus'
        azure_cvm_pcr_priority:
          $ref: '#/components/schemas/AzureCvmPcrPriority'
    UserAccountStatus:
      type: string
      description: Status of an Account for a user.
      enum:
      - ACTIVE
      - PENDING
      - DISABLED
    TlsConfig:
      type: object
      properties:
        disabled:
          type: object
        opportunistic:
          type: object
        required:
          $ref: '#/components/schemas/TlsConfigRequired'
    AccountListResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Account'
    ObjectCounts:
      type: object
      required:
      - datasets
      - final_workflows
      - nodes
      properties:
        datasets:
          type: integer
          minimum: 0
        final_workflows:
          type: integer
          minimum: 0
        nodes:
          type: integer
          minimum: 0
    AccountStatus:
      type: string
      enum:
      - Active
      - Deactivated
    AccountComponent:
      type: string
      description: Get the account type.
      enum:
      - DEFAULT
      - CONFIDENTIAL_AI
    ClientFileLogging:
      oneOf:
      - $ref: '#/components/schemas/ClientFileLoggingVariantEnabled'
      - $ref: '#/components/schemas/ClientFileLoggingVariantDisabled'
      discriminator:
        propertyName: mode
        mapping:
          enabled: ClientFileLoggingVariantEnabled
          disabled: ClientFileLoggingVariantDisabled
    SigningKeysVariantStored:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - stored
        required:
        - kind
      - $ref: '#/components/schemas/SigningKeysStored'
    FpeDate:
      description: 'A structure for specifying a token part representing a date that occurs after a specified date

        and/or occurs before a specified date. Depending on the subparts that make up the date, one of

        the three options is used.'
      oneOf:
      - title: FpeDateVariantDayMonthYear
        type: object
        properties:
          dmy_date:
            $ref: '#/components/schemas/FpeDateDayMonthYear'
        required:
        - dmy_date
      - title: FpeDateVariantMonthDay
        type: object
        properties:
          month_day_date:
            $ref: '#/components/schemas/FpeDateMonthDay'
        required:
        - month_day_date
      - title: FpeDateVariantMonthYear
        type: object
        properties:
          month_year_date:
            $ref: '#/components/schemas/FpeDateMonthYear'
        required:
        - month_year_date
    ApiPath:
      allOf:
      - type: object
        properties:
          api_path:
            type: string
          method:
            type: string
          context:
            $ref: '#/components/schemas/TepKeyContext'
          key_path:
            type: string
        required:
        - api_path
        - method
        - context
        - key_path
    FpeDataPart:
      description: Structure for specifying (part of) a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeEncryptedPart'
      - $ref: '#/components/schemas/FpeDataPartLiteral'
      - $ref: '#/components/schemas/FpeCompoundPart'
    AccountPurpose:
      description: Describes the purpose of the account.
      oneOf:
      - $ref: '#/components/schemas/AccountPurposeVariantStandard'
      - $ref: '#/components/schemas/AccountPurposeVariantAccountReplication'
      discriminator:
        propertyName: $type
        mapping:
          Standard: AccountPurposeVariantStandard
          AccountReplication: AccountPurposeVariantAccountReplication
    NotificationPref:
      description: Notification preferences.
      type: string
      enum:
      - None
      - Email
      - Phone
      - Both
    CipherMode:
      description: Cipher mode used for symmetric key algorithms.
      type: string
      enum:
      - ECB
      - CBC
      - CBCNOPAD
      - CFB
      - OFB
      - CTR
      - GCM
      - CCM
      - KW
      - KWP
      - FF1
    CountAccuracy:
      description: An indicator of how accurate a count of objects is.
      oneOf:
      - $ref: '#/components/schemas/CountAccuracyVariantExact'
      - $ref: '#/components/schemas/CountAccuracyVariantApproximate'
      discriminator:
        propertyName: $type
        mapping:
          Exact: CountAccuracyVariantExact
          Approximate: CountAccuracyVariantApproximate
    AccountPurposeTypeVariantAccountReplication:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - AccountReplication
        required:
        - $type
      - type: object
        properties: {}
    TlsConfigVariantOpportunistic:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - opportunistic
        required:
        - mode
      - type: object
        properties: {}
    AccountReplicationScanSettings:
      allOf:
      - type: object
        description: 'Settings for how DSM should go about replicating objects from the source account once a connection

          has been established.


          Today, account replication is performed using "basic" replication, which exports key material in

          the clear (over a TLS connection).'
        properties:
          auto_scan:
            $ref: '#/components/schemas/AutoScanSettings'
        required:
        - auto_scan
    FpeDayMonthDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day and a month, for use in an

          FpeDate structure.'
        properties:
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month

              and year. Here, February is treated as having 29 days.'
        required:
        - month
        - day
    FpeInputProcessing:
      description: Options to apply some pre- and post-processing to the input.
      oneOf:
      - title: FpeInputProcessingVariantStripUnknown
        type: string
        enum:
        - strip_unknown
      - title: FpeInputProcessingVariantPassthroughUnknown
        type: string
        enum:
        - passthrough_unknown
      - title: FpeInputProcessingVariantPassthroughSpecific
        type: object
        properties:
          passthrough_specific:
            $ref: '#/components/schemas/FpeInputProcessingPassthroughSpecific'
        required:
        - passthrough_specific
    CommonClientConfig:
      allOf:
      - type: object
        properties:
          retry_timeout_millis:
            type:
            - integer
            - 'null'
          cache_ttl:
            type:
            - integer
            - 'null'
          log:
            $ref: '#/components/schemas/ClientLogConfig'
          h2_num_connections:
            type:
            - integer
            - 'null'
          quorum_approval:
            $ref: '#/components/schemas/QuorumApprovalConfig'
    RemovableKmipClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/KmipClientConfig'
    SplunkLoggingConfigRequest:
      allOf:
      - type: object
        properties:
          enabled:
            type:
            - boolean
            - 'null'
          host:
            type:
            - string
            - 'null'
          port:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 65535
          index:
            type:
            - string
            - 'null'
            description: The Splunk index that will receive log items.
          token:
            type: string
            description: The Splunk authentication token.
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          use_fqdn_hostname:
            type:
            - boolean
            - 'null'
            description: Enable sending the cluster FQDN as the hostname in log entries.
    KeyExpiryAlertTrigger:
      oneOf:
      - $ref: '#/components/schemas/KeyExpiryAlertTriggerVariantDaysAhead'
      discriminator:
        propertyName: $type
        mapping:
          DaysAhead: KeyExpiryAlertTriggerVariantDaysAhead
    ReplicationCredentialVariantCertificate:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Certificate
        required:
        - $type
      - $ref: '#/components/schemas/CertificateReplicationCredential'
    SigningKeysStored:
      allOf:
      - type: object
        properties:
          keys:
            type: object
            additionalProperties:
              type: string
              format: byte
            description: Mapping key ids to DER-encoded public key.
        required:
        - keys
    CertificateOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    AccountPurposeVariantAccountReplication:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - AccountReplication
        required:
        - $type
      - $ref: '#/components/schemas/AccountReplicationConfiguration'
    Des3OptionsPolicy:
      allOf:
      - type: object
        description: 'Cryptographic policy for triple DES objects. Setting `key_sizes: [168]`

          forbids two-key triple DES.'
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          random_iv:
            type:
            - boolean
            - 'null'
    ApprovalRequestSettingsRequest:
      allOf:
      - type: object
        description: A request struct for modifying settings that apply to quorum approval requests.
        properties:
          approval_request_expiry:
            type:
            - integer
            - 'null'
            description: 'The number of seconds after which an approval request expires. Changing this

              setting will not change the expiry of existing approval requests, but it may

              still affect the "updated" expiry period assigned to existing requests upon

              their approval (see below for details).


              Upon creation, an approval request''s expiry date is (time of creation +

              expiry period). However, when the request is approved by all its approvers,

              its expiry date will be changed to (time of approval + expiry period).'
          retain_expired_requests:
            type:
            - boolean
            - 'null'
            description: 'Whether or not expired approval requests should be kept. (Obviously, any

              pending requests that have expired are no longer actionable!)


              This is only applicable for onprem clusters; the field is ignored in SaaS

              environments.'
          log_expired_pending_requests:
            type:
            - boolean
            - 'null'
            description: 'Whether or not expiry of pending approval requests should be audit logged.

              Changing this setting will not retroactively apply to existing expired

              approval requests.


              This is only applicable for onprem clusters; the field is ignored in SaaS

              environments.'
          check_access_for_sensitive_operation_results:
            type:
            - boolean
            - 'null'
            description: 'Whether or not the requester''s access should be checked again when they

              request to see the operation results for an approved quorum request with

              sensitive data in the output. Sensitive data includes secret values such

              as API keys, decrypted plaintext, exported key material etc. Note that

              if the result is not deemed sensitive this setting does not apply, e.g.

              approval request to sign a message (signatures are not deemed secret) or

              encrypt data (ciphertext is not deemed secret). Here is the list of all

              operations that are deemed sensitive (this list may be expanded in the

              future):


              - Get App Credential: `GET /sys/v1/apps/${app_id}/credential`

              - Decrypt:

              - Legacy version: `POST /crypto/v1/keys/${key_id}/decrypt`

              - New version: `POST /crypto/v1/decrypt`

              - Export Object Value:

              - Legacy version: `GET /crypto/v1/keys/${key_id}/export`

              - New version: `POST /crypto/v1/keys/export`

              - Batch: `POST /batch/v1` if any of the operations in the batch input is

              sensitive.


              This setting is introduced for backwards compatibility so that existing

              approval request workflows are not broken. For new use cases, it is

              recommended to leave this setting enabled.'
    FpeInputProcessingPassthroughSpecific:
      allOf:
      - type: object
        properties:
          passthrough:
            type: array
            uniqueItems: true
            items:
              type: string
              minLength: 1
              maxLength: 1
          other:
            $ref: '#/components/schemas/FpeInputDefaultProcessing'
        required:
        - passthrough
        - other
    UpdateReplicationCredentialRequestVariantCertificate:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Certificate
        required:
        - $type
      - $ref: '#/components/schemas/UpdateCertificateReplicationCredentialRequest'
    AccountPurposeTypeVariantStandard:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Standard
        required:
        - $type
      - type: object
        properties: {}
    AuthConfig:
      allOf:
      - type: object
        description: Account authentication settings for users.
        properties:
          password:
            $ref: '#/components/schemas/AuthConfigPassword_2'
          saml:
            type:
            - string
            - 'null'
            description: 'Settings for SAML authentication.


              Omitting this field, or setting it to null, will DISABLE

              SAML authentication for users.'
          oauth:
            $ref: '#/components/schemas/AuthConfigOauth_2'
          ldap:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/AuthConfigLdap'
            description: 'Settings for LDAP authentication. This field is only used

              in responses; in requests, please utilize the `add_ldap`,

              `mod_ldap`, and `del_ldap` fields in an `AccountRequest`.'
          signed_jwt:
            $ref: '#/components/schemas/AuthConfigSignedJwt'
          vcd:
            $ref: '#/components/schemas/AuthConfigVcd'
    ReplicationScan:
      allOf:
      - type: object
        description: Information about a scan performed under a replication account.
        properties:
          started_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: The time the scan began.
          finished_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: The time the scan finished.
          error_message:
            type:
            - string
            - 'null'
            description: 'Any error message returned by the scan. If this field is empty, the

              scan is either ongoing, or returned successfully.'
        required:
        - started_at
    CertificateReplicationCredential:
      allOf:
      - type: object
        description: Details about a certificate-based admin app credential used for account replication.
        properties:
          app_id:
            type:
            - string
            - 'null'
            format: uuid
            description: The ID of the source-side admin app that uses this credential.
          credential_id:
            $ref: '#/components/schemas/ReplicationCredentialId'
          certificate_chain:
            type:
            - array
            - 'null'
            items:
              type: string
              format: byte
            description: 'The certificate chain associated with the credential. This is a list of DER-encoded

              certificates, starting from the leaf certificate, and can consist of a single certificate if

              no intermediate certificates are necessary when authenticating with the source cluster.'
        required:
        - credential_id
    KeyExpiryAlertConfig:
      allOf:
      - type: object
        properties:
          triggers:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/KeyExpiryAlertTrigger'
          siem_tool_configs:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/KeyExpiryAlertSiemToolConfig'
        required:
        - triggers
        - siem_tool_configs
    AuthConfigLdap:
      allOf:
      - type: object
        description: LDAP authentication settings.
        properties:
          name:
            type: string
            description: A user-visible name to give this LDAP integration.
          icon_url:
            type: string
            description: 'The URL hosting an image to display for this LDAP integration.

              An empty string can also be specified (to indicate that no

              icon needs to be displayed).'
          ldap_url:
            type: string
            description: The URL of the LDAP server, e.g., "ldap://example.org".
          dn_resolution:
            $ref: '#/components/schemas/LdapDnResolution'
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          base_dn:
            type:
            - string
            - 'null'
            description: 'The subtree from which to perform LDAP searches; for example,

              "OU=users,DC=example,DC=org".'
          user_object_class:
            type:
            - string
            - 'null'
            description: 'The LDAP object class (e.g., "User") to use when looking up

              DSM users trying to authenticate. This field is required if

              the DN resolution method is search-by-mail or if authorization

              settings are enabled for this LDAP integraton.'
          service_account:
            $ref: '#/components/schemas/LdapServiceAccount'
          authorization:
            $ref: '#/components/schemas/LdapAuthorizationConfig'
        required:
        - name
        - icon_url
        - ldap_url
        - dn_resolution
        - tls
    ApprovalAuthConfig:
      allOf:
      - type: object
        description: Authentication requirements for approval request reviewers.
        properties:
          require_password:
            type:
            - boolean
            - 'null'
          require_2fa:
            type:
            - boolean
            - 'null'
    TepKeyMapList:
      allOf:
      - type: array
        items:
          $ref: '#/components/schemas/TepKeyMap'
    LmsOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    AutoScanSettings:
      allOf:
      - type: object
        description: Settings for automatic scanning in DSM-backed groups or replication accounts.
        properties:
          scan_interval_hours:
            type: integer
            minimum: 0
            maximum: 255
            description: The number of hours between successive automatic scans. Must be greater than 0.
        required:
        - scan_interval_hours
    LdapRoleConflictResolution:
      description: 'Controls how we resolve conflicting role assignments with LDAP authorization.


        When users are authorized through LDAP, their DSM group memberships are

        determined by their LDAP groups and the external role mappings created in

        DSM. For example, if the user belongs to 3 LDAP groups A, B and C, and these

        LDAP groups are mapped to DSM groups G1 and G2 in the following way:

        - A -> G1 as "group auditor"

        - B -> G1 as "group administrator"

        - C -> G2 as "group administrator"

        Then which role should be assigned to this user in G1?


        The answer to this question used to be simple before the introduction of

        custom user roles in DSM: we took the maximum of the roles. Note that the

        legacy roles (group admin/auditor) formed a strict "more powerful than"

        relation, i.e. group administrator is strictly more powerful than group

        auditor (and same is true for legacy account roles). However, custom user

        roles do not have that relationship anymore. Moreover, the legacy behavior

        is not quite square with the role exclusivity rules either since the legacy

        behavior can also be regarded as assigning multiple exclusive roles in the

        same group.


        After the introduction of custom user roles, we allow a user to have

        multiple roles in one group as long as none of the roles are marked as

        exclusive. That rule is easily enforceable in the user Invite API. With LDAP

        authorization, the group memberships are computed dynamically when the

        Select Account API is called and it is possible that we run into conflicting

        role assignments due to user''s LDAP group membership and current mappings

        between external roles (i.e. LDAP groups) and DSM groups.'
      type: string
      enum:
      - backcompat_legacy_roles_only
      - disregard_exclusive_roles
    FpeConstraints:
      allOf:
      - type: object
        description: Constraints on a portion of a complex tokenization data type.
        properties:
          luhn_check:
            type:
            - boolean
            - 'null'
            description: 'Whether the token part contains a checksum that satisfies the Luhn formula. It is an

              error to apply this constraint to non-numeric parts, or to have an encrypted part be

              under more than one Luhn check constraint. Also, if an encrypted part has a Luhn check

              constraint applied to it and may contain at least one digit that is not preserved, it

              must not specify any other constraints.'
          num_gt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be greater than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_lt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be smaller than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_ne:
            type:
            - array
            - 'null'
            items:
              type: integer
            description: 'Numbers that the token part should not be equal to. It is an error to apply this

              constraint to non-numeric parts.'
          date:
            $ref: '#/components/schemas/FpeDateConstraint'
          applies_to:
            $ref: '#/components/schemas/FpeConstraintsApplicability'
    WorkspaceCseIdentityProvider:
      allOf:
      - type: object
        description: An identity provider trusted to authenticate users for Workspace CSE APIs
        properties:
          name:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
            description: Identity provider's name
          signing_keys:
            $ref: '#/components/schemas/SigningKeys'
          valid_issuers:
            type: array
            uniqueItems: true
            items:
              type: string
            description: 'Acceptable values for the `iss` (issuer) field used in authentication

              tokens'
          valid_audiences:
            type: array
            uniqueItems: true
            items:
              type: string
            description: 'Acceptable values for the `aud` (audience) field used in authentication

              tokens'
        required:
        - name
        - signing_keys
        - valid_issuers
        - valid_audiences
    FpeCompoundPartOr:
      allOf:
      - type: object
        description: 'Represents an OR of multiple structures.


          Implementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing

          the input, the backend will simply choose the first subpart that matches the current

          portion of the input, and tokenize/detokenize accordingly. If that choice results in

          an invalid parse of the rest of the input, the backend ***will not backtrack*** and

          will simply return with an error.'
        properties:
          or:
            type: array
            items:
              $ref: '#/components/schemas/FpeDataPart'
            description: The actual subparts that make up this compound part.
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is

              set, any descendant subparts cannot contain any preserve-related fields set.'
          mask:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire OR should be masked when doing masked decryption. If this is set,

              any descendant subparts cannot contain any mask-related fields set.'
          min_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
        required:
        - or
    EcKcdsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    OnPremSubscriptionType:
      allOf:
      - type: object
        description: OnPrem subscription type
        properties:
          count_transient_ops:
            type:
            - boolean
            - 'null'
    SyslogFacility:
      type: string
      enum:
      - User
      - Local0
      - Local1
      - Local2
      - Local3
      - Local4
      - Local5
      - Local6
      - Local7
    GetAccountParams:
      allOf:
      - type: object
        properties:
          with_totals:
            type: boolean
          previous_id:
            type: string
            format: uuid
          limit:
            type: integer
      - $ref: '#/components/schemas/AccountSort'
    LdapUserSelfProvisioningConfig:
      allOf:
      - type: object
        description: 'LDAP user self-provisioning settings. Currently, the only

          setting available for configuration is the mapping from

          LDAP users to DSM account roles.'
        properties:
          role_assignment:
            $ref: '#/components/schemas/LdapUserSelfProvisioningRole'
        required:
        - role_assignment
    LegacyKeyPolicy:
      type: string
      enum:
      - allowed
      - prohibited
      - unprotect_only
    MetadataStringConstraintRequired:
      allOf:
      - type: object
        properties:
          non_empty_after_trim:
            type:
            - boolean
            - 'null'
            description: 'If set to `true`, the value must have a length > 0 after trimming

              leading and trailing whitespace characters.'
          allowed_values:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
            description: If not specified or empty, it will not impose any restrictions on the value.
    TepKeyMap:
      allOf:
      - type: object
        properties:
          path:
            $ref: '#/components/schemas/ApiPath'
          kid:
            type: string
            format: uuid
          mode:
            $ref: '#/components/schemas/CipherMode'
        required:
        - path
        - kid
        - mode
    FpeDayMonthYearDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day, month, and year, for use in

          an FpeDate structure.'
        properties:
          year:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The year, which should be an integer less than 100000. Zero is treated as a leap year.
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the

              month and year.'
        required:
        - year
        - month
        - day
    MlDsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    AccountSort:
      oneOf:
      - title: AccountSortVariantByAcctId
        type: object
        properties:
          sort_by:
            type: string
            pattern: ^acct_id:(?:asc|desc)$
            example: acct_id:asc
        required:
        - sort_by
    FpeOptions:
      description: 'FPE-specific options (for specifying the format of the

        data to be encrypted)'
      oneOf:
      - $ref: '#/components/schemas/FpeOptionsBasic'
      - $ref: '#/components/schemas/FpeOptionsAdvanced'
      - $ref: '#/components/schemas/FpeOptionsV2'
    LoggingConfig:
      oneOf:
      - title: LoggingConfigVariantSplunk
        type: object
        properties:
          splunk:
            $ref: '#/components/schemas/SplunkLoggingConfig'
        required:
        - splunk
      - title: LoggingConfigVariantStackdriver
        type: object
        properties:
          stackdriver:
            $ref: '#/components/schemas/StackdriverLoggingConfig'
        required:
        - stackdriver
      - title: LoggingConfigVariantSyslog
        type: object
        properties:
          syslog:
            $ref: '#/components/schemas/SyslogLoggingConfig'
        required:
        - syslog
      - title: LoggingConfigVariantAzureLogAnalytics
        type: object
        properties:
          azure_log_analytics:
            $ref: '#/components/schemas/AzureLogAnalyticsLoggingConfig'
        required:
        - azure_log_analytics
      - title: LoggingConfigVariantAzureLogIngestion
        type: object
        properties:
          azure_log_ingestion:
            $ref: '#/components/schemas/AzureLogIngestionLoggingConfig'
        required:
        - azure_log_ingestion
    CountParams:
      allOf:
      - type: object
        properties:
          range_from:
            type: integer
          range_to:
            type: integer
          detailed_usage:
            type: boolean
          saas_full_usage:
            type: boolean
    SubscriptionTypeTrial:
      allOf:
      - type: object
        description: A trial subscription on DSM SaaS.
        properties:
          expires_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: 'The time that this subscription expires. If not set, the

              subscription will expire 30 days after the account''s creation

              date.


              The account''s `trial_expires_at` field can be used to determine

              the effective expiry date of a trial account.'
    DsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    KeyHistoryPolicy:
      allOf:
      - type: object
        description: Configuration for a key history (aka key undo) policy.
        properties:
          undo_time_window:
            $ref: '#/components/schemas/Secs'
        required:
        - undo_time_window
    SyslogLoggingConfig:
      allOf:
      - type: object
        properties:
          enabled:
            type: boolean
          host:
            type: string
          port:
            type: integer
            minimum: 0
            maximum: 65535
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          facility:
            $ref: '#/components/schemas/SyslogFacility'
          use_fqdn_hostname:
            type:
            - boolean
            - 'null'
            description: 'Enable sending the cluster FQDN as the hostname in log entries.


              Defaults to `true` for newly created configs, but remains `false` when the

              field is omitted to preserve backward compatibility.'
        required:
        - enabled
        - host
        - port
        - tls
        - facility
    AzureLogIngestionLoggingConfigRequest:
      allOf:
      - type: object
        description: Azure Monitor Log Ingestion API configuration (DCR-based) request.
        properties:
          enabled:
            type:
            - boolean
            - 'null'
          logs_ingestion_endpoint_url:
            type:
            - string
            - 'null'
            format: url
          dcr_immutable_id:
            type:
            - string
            - 'null'
          stream_name:
            type:
            - string
            - 'null'
          credential_id:
            $ref: '#/components/schemas/CredentialId'
    LegacyUserAccountRole:
      description: Legacy user account role
      type: string
      enum:
      - ACCOUNTADMINISTRATOR
      - ACCOUNTMEMBER
      - ACCOUNTAUDITOR
    UserAccountFlag:
      description: User account flag
      type: string
      enum:
      - STATEENABLED
      - PENDINGINVITE
    LdapUserSelfProvisioningRole:
      description: 'A structure indicating how self-provisioned LDAP users will

        be assigned account roles.'
      oneOf:
      - $ref: '#/components/schemas/LdapUserSelfProvisioningRoleVariantFixed'
      discriminator:
        propertyName: $type
        mapping:
          Fixed: LdapUserSelfProvisioningRoleVariantFixed
    FpeSection:
      allOf:
      - type: object
        description: A concatenation of groups, optionally including a checksum.
        properties:
          groups:
            type: array
            items:
              $ref: '#/components/schemas/FpeGroup'
          checksum:
            $ref: '#/components/schemas/FpeChecksum'
        required:
        - groups
    CaConfig_2:
      description: CA settings.
      oneOf:
      - title: CaConfigVariantCaSet
        type: object
        properties:
          ca_set:
            $ref: '#/components/schemas/CaSet_2'
        required:
        - ca_set
      - title: CaConfigVariantPinned
        type: object
        properties:
          pinned:
            type: array
            items:
              type: string
              format: byte
        required:
        - pinned
    CryptographicPolicy:
      allOf:
      - type: object
        properties:
          aes:
            $ref: '#/components/schemas/AesOptionsPolicy'
          aria:
            $ref: '#/components/schemas/AriaOptionsPolicy'
          des3:
            $ref: '#/components/schemas/Des3OptionsPolicy'
          rsa:
            $ref: '#/components/schemas/RsaOptionsPolicy'
          hmac:
            $ref: '#/components/schemas/HmacOptionsPolicy'
          ec:
            $ref: '#/components/schemas/EcOptionsPolicy'
          legacy_policy:
            $ref: '#/components/schemas/LegacyKeyPolicy'
          key_ops:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyOperations'
          des:
            $ref: '#/components/schemas/DesOptionsPolicy'
          seed:
            $ref: '#/components/schemas/SeedOptionsPolicy'
          dsa:
            $ref: '#/components/schemas/DsaOptionsPolicy'
          kcdsa:
            $ref: '#/components/schemas/KcdsaOptionsPolicy'
          eckcdsa:
            $ref: '#/components/schemas/EcKcdsaOptionsPolicy'
          lms:
            $ref: '#/components/schemas/LmsOptionsPolicy'
          xmss:
            $ref: '#/components/schemas/XmssOptionsPolicy'
          mldsa:
            $ref: '#/components/schemas/MlDsaOptionsPolicy'
          mlkem:
            $ref: '#/components/schemas/MlKemOptionsPolicy'
          bip32:
            $ref: '#/components/schemas/Bip32OptionsPolicy'
          slip10:
            $ref: '#/components/schemas/Slip10OptionsPolicy'
          bls:
            $ref: '#/components/schemas/BlsOptionsPolicy'
          opaque:
            $ref: '#/components/schemas/OpaqueOptionsPolicy'
          secret:
            $ref: '#/components/schemas/SecretOptionsPolicy'
          certificate:
            $ref: '#/components/schemas/CertificateOptionsPolicy'
    FpeMonthYearDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a month and a year, for use in an

          FpeDate structure.'
        properties:
          year:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The year, which should be an integer less than 100000. Zero is treated as a leap year.
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
        required:
        - year
        - month
    ClientConfigurationsRequest:
      allOf:
      - type: object
        properties:
          common:
            $ref: '#/components/schemas/RemovableCommonClientConfig'
          pkcs11:
            $ref: '#/components/schemas/RemovablePkcs11ClientConfig'
          kmip:
            $ref: '#/components/schemas/RemovableKmipClientConfig'
          tep:
            $ref: '#/components/schemas/RemovableTepClientConfig'
    FpeVariant:
      allOf:
      - type: object
        description: A concatenation of sections.
        properties:
          sections:
            type: array
            items:
              $ref: '#/components/schemas/FpeSection'
        required:
        - sections
    AccountReplicationConfiguration:
      allOf:
      - type: object
        properties:
          connection_settings:
            $ref: '#/components/schemas/AccountReplicationConnection'
          scan_settings:
            $ref: '#/components/schemas/AccountReplicationScanSettings'
        required:
        - connection_settings
        - scan_settings
    Bip32OptionsPolicy:
      allOf:
      - type: object
        properties: {}
    FpeDateDayMonthYear:
      allOf:
      - type: object
        description: 'Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The

          Year part is allowed to be preserved, and the Day and Month parts are allowed to be

          preserved together. (The Day part cannot be preserved if the Month part is not, and vice

          versa.)'
        properties:
          before:
            $ref: '#/components/schemas/FpeDayMonthYearDate'
          after:
            $ref: '#/components/schemas/FpeDayMonthYearDate'
    AzureLogIngestionLoggingConfig:
      allOf:
      - type: object
        description: 'Azure Monitor Log Ingestion API logging configuration (DCR-based).

          Auth credentials are managed as an IntegrationCredential object via `CredentialId`.


          Note: This replaces the legacy `Azure Log Analytics` HTTP Data Collector API

          which Microsoft plans to deprecate on September 14th, 2026.'
        properties:
          enabled:
            type: boolean
          logs_ingestion_endpoint_url:
            type: string
            format: url
            description: 'The DCR logs ingestion endpoint URL (e.g. https://<dce>.ingest.monitor.azure.com).

              For public internet, this is the DCR''s built-in logs ingestion URL.

              For private link, this is the DCE URL.'
          dcr_immutable_id:
            type: string
            description: The immutable ID of the Data Collection Rule (DCR).
          stream_name:
            type: string
            description: The stream name defined in the DCR (e.g. "Custom-DSMAuditLog").
          credential_id:
            $ref: '#/components/schemas/CredentialId'
        required:
        - enabled
        - logs_ingestion_endpoint_url
        - dcr_immutable_id
        - stream_name
        - credential_id
    ReplicationCredential:
      description: Details about the admin app credential used to replicate objects from the source account.
      oneOf:
      - $ref: '#/components/schemas/ReplicationCredentialVariantCertificate'
      discriminator:
        propertyName: $type
        mapping:
          Certificate: ReplicationCredentialVariantCertificate
    SubscriptionType:
      description: Type of subscription.
      oneOf:
      - title: SubscriptionTypeVariantTrial
        type: object
        properties:
          trial:
            $ref: '#/components/schemas/SubscriptionTypeTrial'
        required:
        - trial
      - title: SubscriptionTypeVariantStandard
        type: object
        properties:
          standard:
            type: object
            properties: {}
        required:
        - standard
      - title: SubscriptionTypeVariantEnterprise
        type: object
        properties:
          enterprise:
            type: object
            properties: {}
        required:
        - enterprise
      - title: SubscriptionTypeVariantCustom
        type: object
        properties:
          custom:
            $ref: '#/components/schemas/CustomSubscriptionType'
        required:
        - custom
      - title: SubscriptionTypeVariantFreemium
        type: object
        properties:
          freemium:
            $ref: '#/components/schemas/FreemiumSubscriptionType'
        required:
        - freemium
      - title: SubscriptionTypeVariantOnPrem
        type: object
        properties:
          on_prem:
            $ref: '#/components/schemas/OnPremSubscriptionType'
        required:
        - on_prem
      - title: SubscriptionTypeVariantReseller
        type: object
        properties:
          reseller:
            $ref: '#/components/schemas/ResellerSubscriptionType'
        required:
        - reseller
    FpeCompoundPartMultiple:
      allOf:
      - type: object
        description: 'Indicates a part that is possibly repeated multiple times.


          Implementation note: the backend parser is locally "greedy" and will attempt to match

          as many repetitions as possible. If this later results in an invalid parse of the rest

          of the input, the backend ***will not backtrack*** and will simply return with an error.'
        properties:
          multiple:
            $ref: '#/components/schemas/FpeDataPart'
          min_repetitions:
            type:
            - integer
            - 'null'
            description: 'The minimum number of times the subpart may occur. (A value of 1 marks a single

              occurrence.)'
          max_repetitions:
            type:
            - integer
            - 'null'
            description: 'The maximum number of times the subpart may occur. (A value of 1 marks a single

              occurrence.)'
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this

              is set, the `multiple` subpart and its descendants cannot contain any preserve-related

              fields set.'
          mask:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire Multiple should be masked when doing masked decryption. If this is

              set, the `multiple` subpart and its descendants cannot contain any mask-related fields

              set.'
          min_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
        required:
        - multiple
    All:
      description: 'A helper enum with a single variant, All, which indicates that something should apply to an

        entire part. (This is here mainly to allow other untagged enums to work properly.)'
      type: string
      enum:
      - all
    HmacOptionsPolicy:
      allOf:
      - type: object
        properties:
          minimum_key_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
    WorkspaceCseAuthorizationProvider:
      allOf:
      - type: object
        description: 'These settings will allow the service to validate the Google-issued

          authorization tokens used in Workspace CSE APIs.


          For example, the specific settings for CSE Docs & Drive are:

          - JWKS URL: https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-drive@system.gserviceaccount.com

          - Issuer: gsuitecse-tokenissuer-drive@system.gserviceaccount.com

          - Audience: cse-authorization'
        properties:
          name:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
            description: Authorization provider's name
          jwks_url:
            type: string
            description: A URL pointing to the JWKS endpoint
          cache_duration:
            type: integer
            description: Number of seconds that the service is allowed to cache the fetched keys
          valid_issuers:
            type: array
            uniqueItems: true
            items:
              type: string
            description: 'Acceptable values for the `iss` (issuer) field used in Google''s

              authorization tokens'
          valid_audiences:
            type: array
            uniqueItems: true
            items:
              type: string
            description: 'Acceptable values for the `aud` (audience) field used in Google''s

              authorization tokens'
        required:
        - name
        - jwks_url
        - cache_duration
        - valid_issuers
        - valid_audiences
    RecentScanSummary:
      allOf:
      - type: object
        description: A summary of the latest scans for a replication account.
        properties:
          in_progress:
            $ref: '#/components/schemas/ReplicationScan'
          last_completed:
            $ref: '#/components/schemas/ReplicationScan'
          last_successful:
            $ref: '#/components/schemas/ReplicationScan'
    FpeWords:
      description: A set of fixed-length strings.
      oneOf:
      - title: FpeWordsVariantIntegerRanges
        type: object
        properties:
          integer_ranges:
            $ref: '#/components/schemas/FpeWordsIntegerRanges'
        required:
        - integer_ranges
      - title: FpeWordsVariantAlphabet
        type: object
        properties:
          alphabet:
            $ref: '#/components/schemas/FpeCharSet'
        required:
        - alphabet
      - title: FpeWordsVariantCustom
        type: object
        properties:
          custom:
            $ref: '#/components/schemas/FpeWordsCustom'
        required:
        - custom
    CountAccuracyVariantExact:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Exact
        required:
        - $type
      - type: object
        properties: {}
    TepSchemaVariantOpenAPI:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - OpenAPI
        required:
        - $type
      - type: object
        properties:
          openapi:
            type: string
    GetUsageResponse:
      allOf:
      - type: object
        description: The response from the account stats API (`/sys/v1/accounts/:acct_id/usage_report`).
        properties:
          num_operations:
            type: integer
            description: 'The count of all operations performed in the account. This value includes **both**

              key management (e.g., CRUD ops) and cryptographic operations (e.g., encrypt/decrypt).


              To illustrate, here are a few examples:

              - If you have a key which was copied to another group and then do a key rotation (with the key-links also being updated), the `num_operations` count will increase by two.

              - If you have a key and do an encrypt operation this will increase the `num_operations` and `encryption_operations` each by one.

              - If you delete a key, this will increase the only `num_operations` by one.'
          encryption_operations:
            type:
            - integer
            - 'null'
          decryption_operations:
            type:
            - integer
            - 'null'
          sign_operations:
            type:
            - integer
            - 'null'
          verify_operations:
            type:
            - integer
            - 'null'
          tokenization_operations:
            type:
            - integer
            - 'null'
          detokenization_operations:
            type:
            - integer
            - 'null'
          secrets_operations:
            type:
            - integer
            - 'null'
          plugin_invoke_operations:
            type:
            - integer
            - 'null'
          apps:
            $ref: '#/components/schemas/AppCreditsUsage'
          plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          sobjects:
            type:
            - integer
            - 'null'
            description: 'The total number of sobjects in the account, or

              an approximation thereof. This field is present if

              the `saas_full_usage` query parameter is specified

              when retrieving account usage statistics.


              Note that all sobjects in the account are counted,

              regardless of whether the user has access to them.'
          sobjects_accuracy:
            $ref: '#/components/schemas/CountAccuracy'
          hsm_gateway:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          operation_top_app:
            type:
            - object
            - 'null'
            additionalProperties:
              type: integer
          operation_top_sobject:
            type:
            - object
            - 'null'
            additionalProperties:
              type: integer
        required:
        - num_operations
    KeyOpsOverride:
      allOf:
      - type: object
        properties:
          add_key_ops:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyOperations'
            description: 'The operations to add to any key creation request (only supported in KMIP).


              The following operations can be specified:

              - `EXPORT`

              - `APPMANAGEABLE`

              - `HIGHVOLUME`


              The operations specified cannot conflict with what''s specified in the

              `key_ops` field of account and/or group policies (where applicable).


              **Note**: This is only enforced on (KMIP) creation requests since we assume

              updates removing key operations are intentional.'
    Secs:
      allOf:
      - type: integer
    MetadataDurationConstraint:
      oneOf:
      - title: MetadataDurationConstraintVariantForbidden
        type: object
        properties:
          forbidden:
            type: object
            properties: {}
        required:
        - forbidden
      - title: MetadataDurationConstraintVariantRequired
        type: object
        properties:
          required:
            $ref: '#/components/schemas/MetadataDurationConstraintRequired'
        required:
        - required
    RestrictedDuration:
      allOf:
      - type: object
        properties:
          min:
            $ref: '#/components/schemas/TimeSpan'
          max:
            $ref: '#/components/schemas/TimeSpan'
          default:
            $ref: '#/components/schemas/TimeSpan'
    SeedOptionsPolicy:
      allOf:
      - type: object
        properties:
          random_iv:
            type:
            - boolean
            - 'null'
    RsaEncryptionPaddingPolicy:
      description: RSA encryption padding policy.
      oneOf:
      - title: RsaEncryptionPaddingPolicyVariantOaep
        type: object
        properties:
          OAEP:
            $ref: '#/components/schemas/RsaEncryptionPaddingPolicyOaep'
        required:
        - OAEP
      - title: RsaEncryptionPaddingPolicyVariantPkcs1V15
        type: object
        properties:
          PKCS1_V15:
            type: object
            properties: {}
        required:
        - PKCS1_V15
      - title: RsaEncryptionPaddingPolicyVariantRawDecrypt
        type: object
        properties:
          RAW_DECRYPT:
            type: object
            properties: {}
        required:
        - RAW_DECRYPT
    LdapServiceAccount:
      allOf:
      - type: object
        description: Credentials used by the service to authenticate itself to an LDAP server.
        properties:
          dn:
            type: string
            description: Distinguished name of the service account.
          password:
            type: string
            description: The password for the service account.
        required:
        - dn
        - password
    MgfPolicy:
      description: MGF policy.
      oneOf:
      - title: MgfPolicyVariantMgf1
        type: object
        properties:
          mgf1:
            $ref: '#/components/schemas/MgfPolicyMgf1'
        required:
        - mgf1
    SigningKeys:
      description: 'Signing keys used to validate JSON Web Signature objects including signed

        JSON Web Tokens.'
      oneOf:
      - $ref: '#/components/schemas/SigningKeysVariantStored'
      - $ref: '#/components/schemas/SigningKeysVariantFetched'
      discriminator:
        propertyName: kind
        mapping:
          stored: SigningKeysVariantStored
          fetched: SigningKeysVariantFetched
    RsaSignaturePaddingPolicyPss:
      allOf:
      - type: object
        properties:
          mgf:
            $ref: '#/components/schemas/MgfPolicy'
    ReplicationCredentialSelfSignedCertRequest:
      allOf:
      - type: object
        description: 'A request to generate a new self-signed certificate for a

          replication credential.


          For now, the default attributes will include the following:

          - Version 3 certificate

          - Subject:

          - Common name is "<acct-id> replication credential <credential-id>",

          where <acct-id> and <credential-id> are replaced with the actual IDs

          - No other attributes in the subject

          - No expiry (represented by 99991231235959Z as per RFC 5280)

          - There will not be a basic constraints extension'
        properties: {}
    TepSchema:
      oneOf:
      - $ref: '#/components/schemas/TepSchemaVariantOpenAPI'
      discriminator:
        propertyName: $type
        mapping:
          OpenAPI: TepSchemaVariantOpenAPI
    FpePreserveMask:
      description: A structure indicating which indices in an encrypted part to mask or preserve.
      oneOf:
      - $ref: '#/components/schemas/All'
      - type: array
        items:
          type: integer
          format: int64
        description: 'Indicates that only certain characters are to be preserved or masked. Indices are

          Python-like; i.e., negative indices index from the end of the token portion, with

          index -1 denoting the last character. (Indicating that nothing should be preserved

          or masked can be done via an empty list, which is the default value for this enum.)'
    RsaEncryptionPaddingPolicyOaep:
      allOf:
      - type: object
        description: 'The Optional Asymmetric Encryption Padding scheme, as defined

          in RFC 8017 (PKCS #1 version 2.2)'
        properties:
          mgf:
            $ref: '#/components/schemas/MgfPolicy'
    RemovableWorkspaceCseConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/WorkspaceCseConfig'
    TepKeyContext:
      type: string
      enum:
      - request
      - response
    MlKemOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    AccountReplicationConnection:
      allOf:
      - type: object
        description: 'Settings for how a replication account should connect to a source cluster. This type does not

          handle configuration of a source-side admin app used in the replication process; such setup is

          handled by separate endpoints.'
        properties:
          url:
            type: string
            format: url
            description: The URL of the DSM cluster containing the account to back up. Only HTTPS is supported.
          active_replication_credential:
            $ref: '#/components/schemas/ReplicationCredentialId'
        required:
        - url
    OpaqueOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    ObjectTypeFilterSelection:
      allOf:
      - type: object
        properties:
          selection:
            type: array
            items:
              $ref: '#/components/schemas/ObjectType'
        required:
        - selection
    MgfPolicyMgf1:
      allOf:
      - type: object
        properties:
          hash:
            $ref: '#/components/schemas/DigestAlgorithm'
    LdapDnResolutionVariantUserPrincipalName:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - upn
        required:
        - method
      - type: object
        properties: {}
    CreateReplicationCredentialRequestVariantCertificate:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Certificate
        required:
        - $type
      - type: object
        properties: {}
    Account_2:
      allOf:
      - type: object
        properties:
          acct_id:
            type: string
            format: uuid
          approval_policy:
            $ref: '#/components/schemas/AccountApprovalPolicy'
          auth_config:
            $ref: '#/components/schemas/AuthConfig'
          client_configurations:
            $ref: '#/components/schemas/ClientConfigurations'
          country:
            type:
            - string
            - 'null'
          created_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
          cryptographic_policy:
            $ref: '#/components/schemas/CryptographicPolicy'
          custom_logo:
            type: string
            format: byte
          custom_metadata:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
          custom_metadata_attributes:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/CustomAttributeSearchMetadata'
          description:
            type:
            - string
            - 'null'
          disabled_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
          enabled:
            type: boolean
          initial_purchase_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
          key_expiry_alert_config:
            $ref: '#/components/schemas/KeyExpiryAlertConfig'
          key_history_policy:
            $ref: '#/components/schemas/KeyHistoryPolicy'
          key_metadata_policy:
            $ref: '#/components/schemas/KeyMetadataPolicy'
          log_bad_requests:
            type:
            - boolean
            - 'null'
          log_retention_days:
            type:
            - integer
            - 'null'
          logging_configs:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/LoggingConfig'
          mark_key_disable_when_deactivated:
            type: boolean
            description: Enable the user to opt out from the current behaviour of key being marked as disabled at time of deactivation.
          max_app:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_group:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_operation:
            type:
            - integer
            - 'null'
          max_plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_sobj:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_user:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          name:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
          notification_pref:
            $ref: '#/components/schemas/NotificationPref'
          organization:
            type:
            - string
            - 'null'
          original_purpose:
            $ref: '#/components/schemas/AccountPurposeType'
          parent_acct_id:
            type:
            - string
            - 'null'
            format: uuid
          pending_subscription_change_request:
            $ref: '#/components/schemas/SubscriptionChangeRequest'
          phone:
            type:
            - string
            - 'null'
          plugin_code_signing_policy:
            $ref: '#/components/schemas/PluginCodeSigningPolicy'
          plugin_enabled:
            type:
            - boolean
            - 'null'
          purpose:
            $ref: '#/components/schemas/AccountPurpose'
          subscription:
            $ref: '#/components/schemas/Subscription'
          totals:
            $ref: '#/components/schemas/ObjectCounts_2'
          trial_expires_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: 'The date when an account''s trial expires.


              It is recommended to rely on this field instead of looking at the account''s subscription to determine the expiry date, since not all trial subscriptions have the expiry date explicitly indicated.


              This field is read-only, and is not shown for non-trial accounts.'
          workspace_cse_config:
            $ref: '#/components/schemas/WorkspaceCseConfig'
        required:
        - acct_id
        - enabled
        - logging_configs
        - mark_key_disable_when_deactivated
        - name
        - original_purpose
        - purpose
        - subscription
      - $ref: '#/components/schemas/ApprovalRequestSettings'
    AuthConfigVcd:
      allOf:
      - type: object
        description: Vcd single sign-on authentication settings.
        properties:
          idp_name:
            type: string
          idp_authorization_endpoint:
            type: string
          org:
            type: string
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
        required:
        - idp_name
        - idp_authorization_endpoint
        - org
        - tls
    RemovablePkcs11ClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/Pkcs11ClientConfig'
    ObjectCounts_2:
      allOf:
      - type: object
        description: Counts of objects of various types in an account.
        properties:
          groups:
            type: integer
          apps:
            type: integer
          users:
            type: integer
          plugins:
            type: integer
          sobjects:
            type: integer
            description: 'The total number of sobjects in the account, or

              an approximation thereof.


              Note that all sobjects in the account are counted,

              regardless of whether the user has access to them.'
          sobjects_accuracy:
            $ref: '#/components/schemas/CountAccuracy'
          child_accounts:
            type: integer
        required:
        - groups
        - apps
        - users
        - plugins
        - sobjects
        - sobjects_accuracy
        - child_accounts
    MetadataPolicyItem:
      allOf:
      - type: object
        properties:
          custom_metadata:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/MetadataStringConstraint'
          description:
            $ref: '#/components/schemas/MetadataStringConstraint'
          deactivation_date:
            $ref: '#/components/schemas/MetadataDurationConstraint'
          activation_date:
            $ref: '#/components/schemas/MetadataDurationConstraint'
        required:
        - custom_metadata
    SyslogLoggingConfigRequest:
      allOf:
      - type: object
        properties:
          enabled:
            type:
            - boolean
            - 'null'
          host:
            type:
            - string
            - 'null'
          port:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 65535
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          facility:
            $ref: '#/components/schemas/SyslogFacility'
          use_fqdn_hostname:
            type:
            - boolean
            - 'null'
            description: Enable sending the cluster FQDN as the hostname in log entries.
    RemovableCommonClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/CommonClientConfig'
    AccountPurposeVariantStandard:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Standard
        required:
        - $type
      - type: object
        properties: {}
    FpeChecksum:
      type: string
      enum:
      - luhn
    FpeGroup:
      allOf:
      - type: object
        description: 'A concatenation of codes, that can be repeated an amount of times. An

          amount of leading and trailing characters can be preserved, this is,

          unmodified by tokenization.'
        properties:
          codes:
            type: array
            items:
              $ref: '#/components/schemas/FpeCode'
          min_repetitions:
            type:
            - integer
            - 'null'
            description: A group cannot be omitted, thus this field must be positive if present.
          max_repetitions:
            type:
            - integer
            - 'null'
          preserve:
            type:
            - array
            - 'null'
            items:
              type: integer
            minItems: 2
            maxItems: 2
            description: 'Amount of leading and trailing characters to preserve in this group.

              Preserved characters are the leading/trailing characters of the whole

              group, not individual repetitions.'
        required:
        - codes
    ClientLogConfig:
      allOf:
      - type: object
        properties:
          system:
            type:
            - boolean
            - 'null'
          file:
            $ref: '#/components/schemas/ClientFileLogging'
          level:
            type:
            - string
            - 'null'
    TepClientConfig:
      allOf:
      - type: object
        properties:
          schema:
            $ref: '#/components/schemas/TepSchema'
          key_map:
            $ref: '#/components/schemas/TepKeyMapList'
        required:
        - schema
        - key_map
    LdapAuthorizationConfig:
      allOf:
      - type: object
        description: LDAP authorization settings.
        properties:
          valid_for:
            type: integer
            description: Number of seconds after which the authorization should be checked again.
          require_role:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
            description: 'A map from account roles to distinguished names of LDAP groups.

              If a DN is specified for an account role, entities with that role

              must be a member of the specified LDAP group.'
          user_self_provisioning:
            $ref: '#/components/schemas/LdapUserSelfProvisioningConfig'
          role_conflict_resolution:
            $ref: '#/components/schemas/LdapRoleConflictResolution'
        required:
        - valid_for
    FpeCharSet:
      description: 'The alphabet to use for an encrypted portion of a complex tokenization data type.

        Characters should be specified as a list of pairs, where each pair [a, b] represents the

        range of Unicode code points from a to b, with both bounds being inclusive. A single

        code point can be specified as [c, c].


        Normally, each character is assigned a numeric value for FF1. The first character is

        assigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on,

        up to the size of the alphabet. Note that the order of the ranges matters; characters

        appearing in later ranges are assigned higher numerical values compared to earlier

        characters. For instance, in the FpeCharSet [[''a'', ''z''], [''0'', ''9'']], the digits ''0'' to

        ''9'' are assigned values from 26 to 35, since they are listed after the ''a'' to ''z'' range.


        In any case, ranges should not overlap with each other, and should not contain surrogate

        code points.'
      allOf:
      - type: array
        items:
          type: array
          minItems: 2
          maxItems: 2
          items:
            type: string
            minLength: 1
            maxLength: 1
    EllipticCurve:
      description: Identifies a standardized elliptic curve.
      type: string
      enum:
      - X25519
      - Ed25519
      - Ed448
      - X448
      - SecP192K1
      - SecP224K1
      - SecP256K1
      - NistP192
      - NistP224
      - NistP256
      - NistP384
      - NistP521
      - Gost256A
    SubscriptionChangeRequest:
      allOf:
      - type: object
        description: A request to update subscription type.
        properties:
          subscription:
            $ref: '#/components/schemas/Subscription'
          contact:
            type:
            - string
            - 'null'
          comment:
            type:
            - string
            - 'null'
        required:
        - subscription
    FpeFormatV2:
      allOf:
      - type: object
        description: The second generation of Fortanix Tokenization scheme.
        properties:
          variants:
            type: array
            items:
              $ref: '#/components/schemas/FpeVariant'
            description: 'A token is accepted if it is accepted by any of these variants. Note

              tokenization results depend on the order of this list.'
          mode:
            $ref: '#/components/schemas/FpeTokenizeMode'
          input_processing:
            $ref: '#/components/schemas/FpeInputProcessing'
        required:
        - variants
    OauthAuthenticationParameters:
      allOf:
      - type: object
        description: 'Parameters for the OpenID Connect Authentication Request

          https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest'
        properties:
          prompt:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/OauthAuthParamPrompt'
            description: Specifies whether the Authorization Server prompts the End-User for reauthentication and consent
          display:
            $ref: '#/components/schemas/OauthAuthParamDisplay'
          max_age:
            type:
            - integer
            - 'null'
            description: 'Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.

              If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User'
    CustomSubscriptionType:
      allOf:
      - type: object
        description: Custom subscription type
        properties:
          max_plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_app:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_hsmg:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_operation:
            type:
            - integer
            - 'null'
          max_tokenization_operation:
            type:
            - integer
            - 'null'
          count_transient_ops:
            type:
            - boolean
            - 'null'
          package_name:
            type:
            - string
            - 'null'
          features:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/SubscriptionFeatures'
          add_ons:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
          soft_ops_per_second_limit:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
    DesOptionsPolicy:
      allOf:
      - type: object
        properties:
          random_iv:
            type:
            - boolean
            - 'null'
    RemovableTepClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/TepClientConfig'
    ObjectTypeFilter:
      oneOf:
      - $ref: '#/components/schemas/ObjectTypeFilterVariantAll'
      - $ref: '#/components/schemas/ObjectTypeFilterVariantSelection'
      discriminator:
        propertyName: $type
        mapping:
          All: ObjectTypeFilterVariantAll
          Selection: ObjectTypeFilterVariantSelection
    KeyExpiryAlertTriggerVariantDaysAhead:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - DaysAhead
        required:
        - $type
      - $ref: '#/components/schemas/DaysAhead'
    AuthConfigPassword_2:
      allOf:
      - type: object
        description: Password authentication settings.
        properties:
          require_2fa:
            type: boolean
            description: Require two-factor authentication for password logins.
          administrators_only:
            type: boolean
            description: 'Limit password login to account administators only.


              Note: password login will be always allowed for all users

              if there are no alternative authentication methods for the

              account.'
        required:
        - require_2fa
        - administrators_only
    AccountRequest_2:
      allOf:
      - type: object
        properties:
          add_ldap:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/AuthConfigLdap'
            description: 'LDAP integrations to add when creating or updating an account.


              In order for this field to take effect during creation, it must be specified alongside the `auth_config` field.'
          add_logging_configs:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/LoggingConfigRequest'
          approval_policy:
            $ref: '#/components/schemas/AccountApprovalPolicy'
          auth_config:
            $ref: '#/components/schemas/AuthConfig'
          client_configurations:
            $ref: '#/components/schemas/ClientConfigurationsRequest'
          country:
            type:
            - string
            - 'null'
          cryptographic_policy:
            $ref: '#/components/schemas/RemovableCryptographicPolicy'
          custom_logo:
            type: string
            format: byte
          custom_metadata:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
          custom_metadata_attributes:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/CustomAttributeSearchMetadata'
          del_ldap:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
              format: uuid
            description: LDAP integrations to remove when updating an account. This field is a list of LDAP integration IDs. (DSM assigns each LDAP integration a UUID; refer to the `auth_config.ldap` field.)
          del_logging_configs:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
              format: uuid
          description:
            type:
            - string
            - 'null'
          enabled:
            type:
            - boolean
            - 'null'
          key_expiry_alert_config:
            $ref: '#/components/schemas/KeyExpiryAlertConfigRequest'
          key_history_policy:
            $ref: '#/components/schemas/RemovableKeyHistoryPolicy'
          key_metadata_policy:
            $ref: '#/components/schemas/RemovableKeyMetadataPolicy'
          log_bad_requests:
            type:
            - boolean
            - 'null'
          log_retention_days:
            type:
            - integer
            - 'null'
          mark_key_disable_when_deactivated:
            type:
            - boolean
            - 'null'
            description: Enable the user to opt out from the current behaviour of key being marked as disabled at time of deactivation.
          mod_ldap:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/AuthConfigLdap'
            description: LDAP integrations to modify when updating an account. This field is a object, where the keys are LDAP integration IDs, and the values are LDAP auth configs. (DSM assigns each LDAP integration a UUID; check the `auth_config.ldap` field to see them.)
          mod_logging_configs:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/LoggingConfigRequest'
          name:
            type:
            - string
            - 'null'
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
          notification_pref:
            $ref: '#/components/schemas/NotificationPref'
          organization:
            type:
            - string
            - 'null'
          parent_acct_id:
            type:
            - string
            - 'null'
            format: uuid
          pending_subscription_change_request:
            $ref: '#/components/schemas/SubscriptionChangeRequest'
          phone:
            type:
            - string
            - 'null'
          plugin_code_signing_policy:
            $ref: '#/components/schemas/RemovablePluginCodeSigningPolicy'
          plugin_enabled:
            type:
            - boolean
            - 'null'
          purpose:
            $ref: '#/components/schemas/AccountPurpose'
          subscription:
            $ref: '#/components/schemas/Subscription'
          workspace_cse_config:
            $ref: '#/components/schemas/RemovableWorkspaceCseConfig'
      - $ref: '#/components/schemas/ApprovalRequestSettingsRequest'
    TlsConfigRequired_2:
      allOf:
      - type: object
        properties:
          validate_hostname:
            type: boolean
          ca:
            $ref: '#/components/schemas/CaConfig_2'
          client_key:
            type: string
            format: byte
          client_cert:
            type: string
            format: byte
        required:
        - validate_hostname
        - ca
    FpeWordsIntegerRanges:
      allOf:
      - type: object
        description: 'A union of positive integer ranges.


          ```plain

          Examples: [[0, 400], [402, 1000]]

          = {0000, 0001, ..., 0400, 0402, ..., 1000}


          [[1,3], [49, 50]] with optional padding of length 8

          = {00000001, 00000002, 00000003, 00000049, 00000050}

          (accepts 1, 01, 00002, 49, 000050, etc)

          ```'
        properties:
          ranges:
            type: array
            items:
              type: array
              items:
                type: integer
              minItems: 2
              maxItems: 2
          padding_required:
            type: boolean
            description: 'If this field is true, this set accepts only numeric strings

              padded to the length given by the maximum integer in the range

              set.'
        required:
        - ranges
        - padding_required
    AzureLogAnalyticsLoggingConfigRequest:
      allOf:
      - type: object
        properties:
          enabled:
            type:
            - boolean
            - 'null'
          workspace_id:
            type:
            - string
            - 'null'
            format: uuid
          shared_key:
            type: string
            format: byte
    ClientFileLoggingVariantDisabled:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - disabled
        required:
        - mode
      - type: object
        properties: {}
    QuorumPolicy:
      allOf:
      - type: object
        description: Approval policy.
        properties:
          quorum:
            $ref: '#/components/schemas/Quorum'
          user:
            type:
            - string
            - 'null'
            format: uuid
          app:
            type:
            - string
            - 'null'
            format: uuid
    RsaSignaturePaddingPolicy:
      description: RSA signature padding policy.
      oneOf:
      - title: RsaSignaturePaddingPolicyVariantPss
        type: object
        properties:
          PSS:
            $ref: '#/components/schemas/RsaSignaturePaddingPolicyPss'
        required:
        - PSS
      - title: RsaSignaturePaddingPolicyVariantPkcs1V15
        type: object
        properties:
          PKCS1_V15:
            type: object
            properties: {}
        required:
        - PKCS1_V15
    LdapDnResolutionConstruct:
      allOf:
      - type: object
        description: Transform the user email through a pattern to derive the DN.
        properties:
          domain_format:
            type: object
            additionalProperties:
              type: string
            description: 'For example: "example.com" => "uid={},ou=users,dc=example,dc=com".'
        required:
        - domain_format
    FpeOptionsV2:
      allOf:
      - type: object
        properties:
          format_v2:
            $ref: '#/components/schemas/FpeFormatV2'
          description:
            type:
            - string
            - 'null'
        required:
        - format_v2
    ClientConfigurations:
      allOf:
      - type: object
        properties:
          common:
            $ref: '#/components/schemas/CommonClientConfig'
          pkcs11:
            $ref: '#/components/schemas/Pkcs11ClientConfig'
          kmip:
            $ref: '#/components/schemas/KmipClientConfig'
          tep:
            $ref: '#/components/schemas/TepClientConfig'
    FpeDatePart:
      description: 'Possible date-related constraint types that do not form a complete date (by themselves) for a

        complex tokenization data type.'
      type: string
      enum:
      - month
      - day
      - year
    CustomAttributeSearchMetadata:
      allOf:
      - type: object
        properties:
          suggest:
            type:
            - boolean
            - 'null'
    LdapDnResolutionVariantSearchByMail:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - search-by-mail
        required:
        - method
      - type: object
        properties: {}
    FpeCompoundPartConcat:
      allOf:
      - type: object
        description: Represents a concatenation of multiple structures (in a particular order).
        properties:
          concat:
            type: array
            items:
              $ref: '#/components/schemas/FpeDataPart'
            description: The actual subparts that make up this compound part, in order.
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire concat should be preserved as-is (i.e., not tokenized). If this is

              set, any descendant subparts cannot contain any preserve-related fields set.'
          mask:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire concat should be masked when doing masked decryption. If this is

              set, any descendant subparts cannot contain any mask-related fields set.'
          min_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
        required:
        - concat
    GoogleServiceAccountKey:
      allOf:
      - type: object
        description: A Google service account key object. See https://cloud.google.com/video-intelligence/docs/common/auth.
        properties:
          type:
            type: string
          project_id:
            type: string
          private_key_id:
            type: string
          private_key:
            type: string
          client_email:
            type: string
        required:
        - type
        - project_id
        - private_key_id
        - client_email
    FpeOptionsBasic:
      allOf:
      - type: object
        description: 'Basic FPE-specific options. This is suitable for simple datatypes

          that consist of ASCII digits, or ASCII digits and uppercase letters.'
        properties:
          radix:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: 'The FPE base for the input data (i.e., the size of the character

              set of the datatype). This must be an integer from 2 to 36.


              This also implicitly defines the alphabet of the datatype. A base

              from 2 to 10 implies ASCII digits (e.g., a radix of 3 can be used

              to represent a ternary string), and a base from 11 to 36 implies

              ASCII digits and uppercase letters (e.g., a radix of 16 can be'
          min_length:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for the input data.
          max_length:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for the input data.
          preserve:
            type: array
            items:
              type: integer
              format: int64
            description: 'The list of indices of characters to be preserved while performing encryption/decryption.

              Indices are Python-like; i.e., nonnegative indices index from the beginning of the input

              (where 0 is the first character), and negative indices index from the end of the input.

              (where -1 is the last character, -2 is second to last, and so on).


              Any preserved characters will be concatenated together and used as an FF1 tweak. For example,

              if the input data is "abcd", and the first and last characters are to be preserved, the FF1

              tweak will be the ASCII bytes of the string "ad".'
          mask:
            type:
            - array
            - 'null'
            items:
              type: integer
              format: int64
            description: 'The list of indices of characters to be masked while performing masked decryption.

              Indices are Python-like; i.e., nonnegative indices index from the beginning of the input

              (where 0 is the first character), and negative indices index from the end of the input.

              (where -1 is the last character, -2 is second to last, and so on).'
          luhn_check:
            type:
            - boolean
            - 'null'
            description: 'Whether the encrypted/decrypted data contains a checksum digit that satisfies the Luhn

              formula. (The output ciphertext/plaintext will also contain a Luhn checksum digit.)'
          name:
            type:
            - string
            - 'null'
            description: The user-provided name for the data type that represents the input data.
        required:
        - radix
        - min_length
        - max_length
        - preserve
    ResellerSubscriptionType:
      allOf:
      - type: object
        description: Reseller subscription type
        properties:
          max_plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_operation:
            type:
            - integer
            - 'null'
          max_tenant:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_tenant_plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_tenant_operation:
            type:
            - integer
            - 'null'
          package_name:
            type:
            - string
            - 'null'
          features:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/SubscriptionFeatures'
          add_ons:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
          tenant_features:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/SubscriptionFeatures'
    SubscriptionFeatures:
      description: "Features in subscription\n\n\n\n          TOKENIZATION:\n\n\n          HMG:\n\n\n          AWSBYOK:\n\n\n          AZUREBYOK:\n\n\n          GCPBYOK:\n\n\n          GCPEKMCONTROLPLANE:\n\n\n          OCIBYOK:\n\n"
      type: string
      enum:
      - TOKENIZATION
      - HMG
      - AWSBYOK
      - AZUREBYOK
      - GCPBYOK
      - GCPEKMCONTROLPLANE
      - OCIBYOK
    SigningKeysVariantFetched:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - fetched
        required:
        - kind
      - $ref: '#/components/schemas/SigningKeysFetched'
    KeyOperations:
      description: "Operations allowed to be performed on a given key.\n\n\n\n          SIGN:\n            If this is set, the key can be used to for signing.\n\n\n          VERIFY:\n            If this is set, the key can used for verifying a signature.\n\n\n          ENCRYPT:\n            If this is set, the key can be used for encryption.\n\n\n          DECRYPT:\n            If this is set, the key can be used for decryption.\n\n\n          WRAPKEY:\n            If this is set, the key can be used wrapping other keys.\n            The key being wrapped must have the EXPORT operation enabled.\n\n\n          UNWRAPKEY:\n            If this is set, the key can be used to unwrap a wrapped key.\n\n\n          DERIVEKEY:\n            If this is set, the key can be used to derive another key.\n\n\n          TRANSFORM:\n            If this is set, the key can be transformed.\n\n\n          MACGENERATE:\n            If this is set, the key can be used to compute a cryptographic\n            Message Authentication Code (MAC) on a message.\n\n\n          MACVERIFY:\n            If they is set, the key can be used to verify a MAC.\n\n\n          EXPORT:\n            If this is set, the value of the key can be retrieved\n            with an authenticated request. This shouldn't be set unless\n            required. It is more secure to keep the key's value inside DSM only.\n\n\n          APPMANAGEABLE:\n            Without this operation, management operations like delete, destroy,\n            rotate, activate, restore, revoke, revert, update, remove_private, etc.\n            cannot be performed by a crypto App.\n            A user with access or admin app can still perform these operations.\n            This option is only relevant for crypto apps.\n\n\n          HIGHVOLUME:\n            If this is set, audit logs will not be recorded for the key.\n            High volume here tries to signify a key that is being used a lot\n            and will produce lots of logs. Setting this operation disables\n            audit logs for the key.\n\n\n          AGREEKEY:\n            If this is set, the key can be used for key agreement.\n            Both the private and public key should have this option enabled\n            to perform an agree operation.\n\n\n          ENCAPSULATE:\n            If this is set, the key can be used for key encapsulation. The\n            result is a new symmetric key and a ciphertext.\n\n\n          DECAPSULATE:\n            If this is set, the key can be used for key decapsulation. If\n            decapsulation succeeds, the result is a new symmetric key.\n\n"
      type: string
      enum:
      - SIGN
      - VERIFY
      - ENCRYPT
      - DECRYPT
      - WRAPKEY
      - UNWRAPKEY
      - DERIVEKEY
      - TRANSFORM
      - MACGENERATE
      - MACVERIFY
      - EXPORT
      - APPMANAGEABLE
      - HIGHVOLUME
      - AGREEKEY
      - ENCAPSULATE
      - DECAPSULATE
    SecretOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    RemovablePluginCodeSigningPolicy:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/PluginCodeSigningPolicy'
    StackdriverLoggingConfigRequest:
      allOf:
      - type: object
        properties:
          enabled:
            type:
            - boolean
            - 'null'
          log_id:
            type:
            - string
            - 'null'
            description: The log ID that will receive the log items (see https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry).
          service_account_key:
            $ref: '#/components/schemas/GoogleServiceAccountKey'
    LdapDnResolution:
      description: 'Distinguished Name (DN) resolution method. Given a user''s email address, a DN resolution method

        is used to find the user''s DN in an LDAP directory.'
      oneOf:
      - $ref: '#/components/schemas/LdapDnResolutionVariantConstruct'
      - $ref: '#/components/schemas/LdapDnResolutionVariantSearchByMail'
      - $ref: '#/components/schemas/LdapDnResolutionVariantUserPrincipalName'
      discriminator:
        propertyName: method
        mapping:
          construct: LdapDnResolutionVariantConstruct
          search-by-mail: LdapDnResolutionVariantSearchByMail
          upn: LdapDnResolutionVariantUserPrincipalName
    AuthConfigOauth_2:
      allOf:
      - type: object
        description: OAuth single sign-on authentication settings.
        properties:
          idp_name:
            type: string
          idp_icon_url:
            type: string
          idp_authorization_endpoint:
            type: string
          idp_token_endpoint:
            type: string
          idp_userinfo_endpoint:
            type:
            - string
            - 'null'
          idp_requires_basic_auth:
            type: boolean
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          client_id:
            type: string
          client_secret:
            type: string
          auth_params:
            $ref: '#/components/schemas/OauthAuthenticationParameters'
        required:
        - idp_name
        - idp_icon_url
        - idp_authorization_endpoint
        - idp_token_endpoint
        - idp_requires_basic_auth
        - tls
        - client_id
        - client_secret
    SplunkLoggingConfig:
      allOf:
      - type: object
        description: Splunk logging configuration.
        properties:
          enabled:
            type: boolean
          host:
            type: string
          port:
            type: integer
            minimum: 0
            maximum: 65535
          index:
            type: string
          token:
            type: string
          tls:
            $ref: '#/components/schemas/TlsConfig_2'
          use_fqdn_hostname:
            type:
            - boolean
            - 'null'
            description: 'Enable sending the cluster FQDN as the hostname in log entries.


              Defaults to `true` for newly created configs, but remains `false` when the

              field is omitted to preserve backward compatibility.'
        required:
        - enabled
        - host
        - port
        - index
        - tls
    ApprovalRequestSettings:
      allOf:
      - type: object
        description: Settings that apply to quorum approval requests.
        properties:
          approval_request_expiry:
            type:
            - integer
            - 'null'
            description: 'The number of seconds after which an approval request expires. If not

              specified, the cluster-wide setting will be used (30 days by default).


              Upon creation, an approval request''s expiry date is (time of creation +

              expiry period). However, when the request is approved by all its approvers,

              its expiry date will be changed to (time of approval + expiry period).'
          retain_expired_requests:
            type:
            - boolean
            - 'null'
            description: 'Whether or not expired approval requests should be kept. (Obviously, any

              pending requests that have expired are no longer actionable!)


              This is only applicable for onprem clusters; the field is ignored in SaaS

              environments.'
          log_expired_pending_requests:
            type:
            - boolean
            - 'null'
            description: 'Whether or not expiry of pending approval requests should be audit logged.


              This is only applicable for onprem clusters; the field is ignored in SaaS

              environments.'
          check_access_for_sensitive_operation_results:
            type:
            - boolean
            - 'null'
            description: 'Whether or not the requester''s access should be checked again when they

              request to see the operation results for an approved quorum request with

              sensitive data in the output. Sensitive data includes secret values such

              as API keys, decrypted plaintext, exported key material etc. Note that

              if the result is not deemed sensitive this setting does not apply, e.g.

              approval request to sign a message (signatures are not deemed secret) or

              encrypt data (ciphertext is not deemed secret). Here is the list of all

              operations that are deemed sensitive (this list may be expanded in the

              future):


              - Get App Credential: `GET /sys/v1/apps/${app_id}/credential`

              - Decrypt:

              - Legacy version: `POST /crypto/v1/keys/${key_id}/decrypt`

              - New version: `POST /crypto/v1/decrypt`

              - Export Object Value:

              - Legacy version: `GET /crypto/v1/keys/${key_id}/export`

              - New version: `POST /crypto/v1/keys/export`

              - Batch: `POST /batch/v1` if any of the operations in the batch input is

              sensitive.


              This setting is introduced for backwards compatibility so that existing

              approval request workflows are not broken. For new use cases, it is

              recommended to leave this setting enabled.'
    KeyMetadataPolicy:
      allOf:
      - type: object
        properties:
          base:
            $ref: '#/components/schemas/MetadataPolicyItem'
          for_obj_type:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/MetadataPolicyItem'
            description: Each entry in this map fully overrides `base` for a particular object type.
          legacy_objects:
            $ref: '#/components/schemas/LegacyKeyPolicy'
        required:
        - base
        - for_obj_type
        - legacy_objects
    ReplicationCredentialSelfSignedCertResponse:
      allOf:
      - type: object
        description: Response from the endpoint to generate a new self-signed cert for a replication credential.
        properties:
          certificate:
            type: string
            format: byte
            description: The self-signed certificate generated by DSM.
        required:
        - certificate
    FpeCode:
      allOf:
      - type: object
        description: A set of words, repeated an amount of times.
        properties:
          words:
            $ref: '#/components/schemas/FpeWords'
          min_repetitions:
            type:
            - integer
            - 'null'
          max_repetitions:
            type:
            - integer
            - 'null'
        required:
        - words
    AccountApprovalPolicy:
      allOf:
      - type: object
        description: Account approval policy.
        properties:
          policy:
            $ref: '#/components/schemas/QuorumPolicy'
          manage_groups:
            type:
            - boolean
            - 'null'
          protect_authentication_methods:
            type:
            - boolean
            - 'null'
            description: When this is true, changes to the account authentication methods require approval.
          protect_cryptographic_policy:
            type:
            - boolean
            - 'null'
            description: When this is true, changes to the account cryptographic policy requires approval.
          protect_logging_config:
            type:
            - boolean
            - 'null'
            description: When this is true, changes to logging configuration require approval.
          protect_custom_role_updates:
            type:
            - boolean
            - 'null'
            description: When set to true, updating custom roles would require approval.
        required:
        - policy
    ApprovalWaitConfig:
      allOf:
      - type: object
        description: Configurations for waiting for quorum approval.
        properties:
          enabled:
            type: boolean
            description: Indicates whether waiting for quorum approval is activated or disabled
          poll_interval_secs:
            type:
            - integer
            - 'null'
            description: Time interval in seconds for client lib to check quorum status.
          max_wait_for_secs:
            type:
            - integer
            - 'null'
            description: Maximum time in seconds for client lib to wait for quorum reply.
        required:
        - enabled
    CaSet_2:
      description: Predefined CA sets.
      type: string
      enum:
      - global_roots
    KmipClientConfig:
      allOf:
      - type: object
        properties:
          ignore_unknown_key_ops_for_secrets:
            type:
            - boolean
            - 'null'
            description: Use `ignore_unknown_key_ops_for` with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``
          ignore_unknown_key_ops_for:
            $ref: '#/components/schemas/ObjectTypeFilter'
          key_ops_override:
            $ref: '#/components/schemas/KeyOpsOverride'
    ObjectTypeFilterVariantAll:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - All
        required:
        - $type
      - type: object
        properties: {}
    KeyExpiryAlertConfigRequest:
      allOf:
      - type: object
        properties:
          add_triggers:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyExpiryAlertTrigger'
          mod_triggers:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/KeyExpiryAlertTrigger'
          del_triggers:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
              format: uuid
          add_siem_tool_configs:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyExpiryAlertSiemToolConfig'
          mod_siem_tool_configs:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/KeyExpiryAlertSiemToolConfig'
          del_siem_tool_configs:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
              format: uuid
    ListReplicationCredentialsResponse:
      allOf:
      - type: object
        description: Response body for a GET call to retrieve all replication credentials.
        properties:
          items:
            type: array
            items:
              $ref: '#/components/schemas/ReplicationCredential'
            description: The list of replication credentials.
        required:
        - items
    LoggingConfigRequest:
      oneOf:
      - title: LoggingConfigRequestVariantSplunk
        type: object
        properties:
          splunk:
            $ref: '#/components/schemas/SplunkLoggingConfigRequest'
        required:
        - splunk
      - title: LoggingConfigRequestVariantStackdriver
        type: object
        properties:
          stackdriver:
            $ref: '#/components/schemas/StackdriverLoggingConfigRequest'
        required:
        - stackdriver
      - title: LoggingConfigRequestVariantSyslog
        type: object
        properties:
          syslog:
            $ref: '#/components/schemas/SyslogLoggingConfigRequest'
        required:
        - syslog
      - title: LoggingConfigRequestVariantAzureLogAnalytics
        type: object
        properties:
          azure_log_analytics:
            $ref: '#/components/schemas/AzureLogAnalyticsLoggingConfigRequest'
        required:
        - azure_log_analytics
      - title: LoggingConfigRequestVariantAzureLogIngestion
        type: object
        properties:
          azure_log_ingestion:
            $ref: '#/components/schemas/AzureLogIngestionLoggingConfigRequest'
        required:
        - azure_log_ingestion
    LdapUserSelfProvisioningRoleVariantFixed:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Fixed
        required:
        - $type
      - $ref: '#/components/schemas/LdapUserSelfProvisioningRoleFixed'
    FreemiumSubscriptionType:
      allOf:
      - type: object
        properties:
          max_app:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_hsmg:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
          max_operation:
            type:
            - integer
            - 'null'
          max_tokenization_operation:
            type:
            - integer
            - 'null'
          max_plugin:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
    WorkspaceCseAuthMethod:
      description: 'Authentication method for Google Workspace CSE, `User` (default choice) requires each CSE user

        to be registered as a DSM user, while `App` requires each CSE user to be represented by a DSM app.


        Note:

        For large organizations where lots of users use Google Workspace CSE but are not otherwise expected

        to be able to access DSM, App authentication method could be easier to implement.'
      type: string
      enum:
      - User
      - App
    TlsConfigVariantDisabled:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - disabled
        required:
        - mode
      - type: object
        properties: {}
    SigningKeysFetched:
      allOf:
      - type: object
        properties:
          url:
            type: string
          cache_duration:
            type: integer
            description: Number of seconds that the service is allowed to cache the fetched keys.
        required:
        - url
        - cache_duration
    FpeConstraintsApplicability:
      description: A structure indicating which subparts to which to apply a set of constraints.
      oneOf:
      - $ref: '#/components/schemas/All'
      - type: object
        additionalProperties:
          $ref: '#/components/schemas/FpeConstraintsApplicability'
        description: 'An object representing the individual subparts that the constraints should apply to. This

          is a BTreeMap where for each key-value pair, the key represents the "index" of the subpart

          (with the first subpart having index 0), and the value is an FpeConstraintsApplicability

          instance. Note that a Multiple part only allows for one possible key-value pair, since it

          only contains one subpart. For Concat parts, the key is the zero-based index of the subpart

          in the `concat` field, and for Multiple parts, this is always 0 (due to a Multiple having

          only one subpart).


          This cannot be used with OR parts; instead, specify constraints individually on each

          relevant subpart.'
    AuthConfigSignedJwt:
      allOf:
      - type: object
        description: Signed JWT authentication settings.
        properties:
          valid_issuers:
            type: array
            uniqueItems: true
            items:
              type: string
          signing_keys:
            $ref: '#/components/schemas/SigningKeys'
        required:
        - valid_issuers
        - signing_keys
    FpeEncryptedPart:
      allOf:
      - type: object
        description: 'Structure of a tokenized portion of a complex tokenization data type.


          Implementation note: the backend parser is locally "greedy" and will attempt to match

          as many characters as possible. If this later results in an invalid parse of the rest

          of the input, the backend ***will not backtrack*** and will simply return with an error.'
        properties:
          min_length:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
          char_set:
            $ref: '#/components/schemas/FpeCharSet'
          cipher_char_set:
            $ref: '#/components/schemas/FpeCharSet'
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            $ref: '#/components/schemas/FpePreserveMask'
          mask:
            $ref: '#/components/schemas/FpePreserveMask'
        required:
        - min_length
        - max_length
        - char_set
    ClientFileLoggingConfig:
      allOf:
      - type: object
        properties:
          path:
            type:
            - string
            - 'null'
          file_size_kb:
            type:
            - integer
            - 'null'
          max_files:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
    TimeSpan:
      oneOf:
      - title: TimeSpanVariantSeconds
        type: object
        properties:
          seconds:
            type: integer
            minimum: 0
            maximum: 4294967295
        required:
        - seconds
      - title: TimeSpanVariantMinutes
        type: object
        properties:
          minutes:
            type: integer
            minimum: 0
            maximum: 4294967295
        required:
        - minutes
      - title: TimeSpanVariantHours
        type: object
        properties:
          hours:
            type: integer
            minimum: 0
            maximum: 4294967295
        required:
        - hours
      - title: TimeSpanVariantDays
        type: object
        properties:
          days:
            type: integer
            minimum: 0
            maximum: 4294967295
        required:
        - days
    DaysAhead:
      allOf:
      - type: object
        properties:
          days:
            type: integer
            minimum: 0
            maximum: 65535
        required:
        - days
    StackdriverLoggingConfig:
      allOf:
      - type: object
        description: Stackdriver logging configuration.
        properties:
          enabled:
            type: boolean
          log_id:
            type: string
            description: The log ID that will receive the log items (see https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry).
          service_account_key:
            $ref: '#/components/schemas/GoogleServiceAccountKey'
        required:
        - enabled
        - log_id
        - service_account_key
    FpeDateConstraint:
      description: Possible date-related constraint types for a portion of a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeDate'
      - $ref: '#/components/schemas/FpeDatePart'
    ReplicationCredentialId:
      description: The ID of a replication credential.
      allOf:
      - type: string
    RemovableCryptographicPolicy:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/CryptographicPolicy'
    AriaOptionsPolicy:
      allOf:
      - type: object
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          random_iv:
            type:
            - boolean
            - 'null'
    FpeDataPartLiteral:
      allOf:
      - type: object
        description: 'A section of the data type that is not to be tokenized (e.g., a delimiter).


          Unlike preserved characters, literal characters are not used for FF1 tweaks.'
        properties:
          literal:
            type: array
            items:
              type: string
            description: 'The list of possible strings that make up this literal portion of the token.

              For example, if a delimiter can either be a space or a dash, the list would

              be `[" ", "-"]`.


              Implementation note: the backend will pick the first choice that matches when

              when parsing the input. If this results in an invalid parse of the rest of the

              input, the backend ***will not backtrack*** and will simply return with an error.'
        required:
        - literal
    Quorum:
      allOf:
      - type: object
        description: Quorum approval policy.
        properties:
          n:
            type: integer
          members:
            type: array
            items:
              $ref: '#/components/schemas/QuorumPolicy'
        required:
        - n
        - members
      - $ref: '#/components/schemas/ApprovalAuthConfig'
    PluginCodeSigningPolicy:
      allOf:
      - type: object
        description: 'Plugin code signing policy.


          When a code signing policy is set, all requests to create new plugins or

          update existing plugins (if updating the code) would need to provide a valid

          signature.'
        properties:
          signing_keys:
            $ref: '#/components/schemas/SigningKeys'
        required:
        - signing_keys
    UserAccountFlags:
      description: User's role(s) and state in an account.
      allOf:
      - type: array
        uniqueItems: true
        items:
          $ref: '#/components/schemas/UserAccountFlagOrRole'
    Subscription:
      allOf:
      - type: object
        properties:
          memo:
            type:
            - string
            - 'null'
          experimental_features:
            $ref: '#/components/schemas/SubscriptionExperimentalFeatures'
      - $ref: '#/components/schemas/SubscriptionType'
    SubscriptionExperimentalFeatures:
      allOf:
      - type: object
        properties: {}
    Pkcs11ClientConfig:
      allOf:
      - type: object
        properties:
          fake_rsa_x9_31_keygen_support:
            type:
            - boolean
            - 'null'
          signing_aes_key_as_hmac:
            type:
            - boolean
            - 'null'
          exact_key_ops:
            type:
            - boolean
            - 'null'
          prevent_duplicate_opaque_objects:
            type:
            - boolean
            - 'null'
          opaque_objects_are_not_certificates:
            type:
            - boolean
            - 'null'
          max_concurrent_requests_per_slot:
            type:
            - integer
            - 'null'
    QuorumApprovalConfig:
      allOf:
      - type: object
        description: Quorum Policy Configurations in clients
        properties:
          wait_for_quorum_approval:
            $ref: '#/components/schemas/ApprovalWaitConfig'
    UpdateCertificateReplicationCredentialRequest:
      allOf:
      - type: object
        description: A request to update a certificate-based replication credential.
        properties:
          app_id:
            type:
            - string
            - 'null'
            format: uuid
            description: 'The app ID to associate with the credential. This should be the ID of

              a source-side admin app.'
          certificate_chain:
            type:
            - array
            - 'null'
            items:
              type: string
              format: byte
            description: 'The certificate chain to associate with the credential. This is a

              list of DER-encoded certificates, starting from the leaf certificate,

              and may consist of a single certificate if no intermediate

              certificates are necessary when authenticating with the source

              cluster.'
    OauthAuthParamDisplay:
      description: 'Corresponds to the `display` parameter in

        https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest'
      type: string
      enum:
      - page
      - popup
      - touch
      - wap
    FpeDateMonthDay:
      allOf:
      - type: object
        description: 'Represents a date that consists of a Month subpart and a Day subpart. It is an error to

          preserve only the Month part or the Day part.'
        properties:
          before:
            $ref: '#/components/schemas/FpeDayMonthDate'
          after:
            $ref: '#/components/schemas/FpeDayMonthDate'
    FpeWordsCustom:
      allOf:
      - type: object
        properties:
          list:
            type: array
            items:
              type: string
            description: 'Examples: {"john", "jane"}, {".", "-", "_", "@", " "}'
        required:
        - list
    ClientFileLoggingVariantEnabled:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - enabled
        required:
        - mode
      - $ref: '#/components/schemas/ClientFileLoggingConfig'
    KcdsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    RsaEncryptionPolicy:
      allOf:
      - type: object
        description: Constraints on RSA encryption parameters. In general, if a constraint is not specified, anything is allowed.
        properties:
          padding:
            $ref: '#/components/schemas/RsaEncryptionPaddingPolicy'
    OauthAuthParamPrompt:
      description: 'Corresponds to the `prompt` parameter in

        https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest'
      type: string
      enum:
      - login
      - none
      - consent
      - select_account
    CreateReplicationCredentialRequest:
      description: 'A request to create a new admin app credential for account replication

        purposes. Note that the result is not immediately usable; further steps

        are needed in order to configure this and set it as the account''s active

        credential.'
      oneOf:
      - $ref: '#/components/schemas/CreateReplicationCredentialRequestVariantCertificate'
      discriminator:
        propertyName: $type
        mapping:
          Certificate: CreateReplicationCredentialRequestVariantCertificate
    CountAccuracyVariantApproximate:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Approximate
        required:
        - $type
      - type: object
        properties: {}
    FpeCompoundPart:
      description: 'Structure of a compound portion of a complex tokenization data type, itself composed of

        smaller parts.'
      oneOf:
      - $ref: '#/components/schemas/FpeCompoundPartOr'
      - $ref: '#/components/schemas/FpeCompoundPartConcat'
      - $ref: '#/components/schemas/FpeCompoundPartMultiple'
    BlsOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    AzureLogAnalyticsLoggingConfig:
      allOf:
      - type: object
        properties:
          enabled:
            type: boolean
          workspace_id:
            type: string
            format: uuid
          shared_key:
            type: string
            format: byte
        required:
        - enabled
        - workspace_id
    FpeDateMonthYear:
      allOf:
      - type: object
        description: 'Represents a date that consists of a Month subpart and a Year subpart. The Year part is

          allowed to be preserved; however, the Month part cannot be preserved by itself.'
        properties:
          before:
            $ref: '#/components/schemas/FpeMonthYearDate'
          after:
            $ref: '#/components/schemas/FpeMonthYearDate'
    FpeOptionsAdvanced:
      allOf:
      - type: object
        description: 'Advanced FPE options. It is recommended to use this for

          specifying any FPE options, as it is more expressive than

          FpeOptionsBasic.'
        properties:
          format:
            $ref: '#/components/schemas/FpeDataPart'
          description:
            type:
            - string
            - 'null'
            description: The user-provided name for the data type.
        required:
        - format
    UserAccountFlagOrRole:
      description: User account flag or legacy user account role name or custom role id
      oneOf:
      - $ref: '#/components/schemas/UserAccountFlag'
      - $ref: '#/components/schemas/LegacyUserAccountRole'
      - type: string
        format: uuid
    AppCreditsUsage:
      allOf:
      - type: object
        properties:
          generic:
            type: integer
            minimum: 0
            maximum: 4294967295
          tokenization:
            type: integer
            minimum: 0
            maximum: 4294967295
          tep:
            type: integer
            minimum: 0
            maximum: 4294967295
          accelerator:
            type: integer
            minimum: 0
            maximum: 4294967295
          secrets_management:
            type: integer
            minimum: 0
            maximum: 4294967295
          aws_cloud_accounts:
            type: integer
            minimum: 0
            maximum: 4294967295
          azure_cloud_accounts:
            type: integer
            minimum: 0
            maximum: 4294967295
          gcp_cloud_accounts:
            type: integer
            minimum: 0
            maximum: 4294967295
          google_ekm_projects:
            type: integer
            minimum: 0
            maximum: 4294967295
          aws_xks_instances:
            type: integer
            minimum: 0
            maximum: 4294967295
        required:
        - generic
        - tokenization
        - tep
        - accelerator
        - secrets_management
        - aws_cloud_accounts
        - azure_cloud_accounts
        - gcp_cloud_accounts
        - google_ekm_projects
        - aws_xks_instances
    RsaOptionsPolicy:
      allOf:
      - type: object
        properties:
          encryption_policy:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/RsaEncryptionPolicy'
          signature_policy:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/RsaSignaturePolicy'
            description: 'Signature policy for an RSA key. When doing a signature operation, the policies are

              evaluated against the specified parameters one by one. If one matches, the operation is

              allowed. If none match, including if the policy list is empty, the operation is disallowed.

              Missing optional parameters will have their defaults specified according to the matched

              policy. The default for new keys is `[{}]` (no constraints).

              If (part of) a constraint is not specified, anything is allowed for that constraint.'
          minimum_key_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: 'The minimum allowed key length. This is only relevant for group or account cryptographic

              policies (and hence has no effect in an RSA policy on a specific key).'
    CredentialId:
      description: 'A wrapper type to provide better clarity that the id

        referenced is an integration credential object.'
      allOf:
      - type: string
        format: uuid
    MetadataStringConstraint:
      oneOf:
      - title: MetadataStringConstraintVariantForbidden
        type: object
        properties:
          forbidden:
            type: object
            properties: {}
        required:
        - forbidden
      - title: MetadataStringConstraintVariantRequired
        type: object
        properties:
          required:
            $ref: '#/components/schemas/MetadataStringConstraintRequired'
        required:
        - required
    RsaSignaturePolicy:
      allOf:
      - type: object
        description: Constraints on RSA signature parameters. In general, if a constraint is not specified, anything is allowed.
        properties:
          padding:
            $ref: '#/components/schemas/RsaSignaturePaddingPolicy'
    TlsConfigVariantRequired:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - required
        required:
        - mode
      - $ref: '#/components/schemas/TlsConfigRequired_2'
    DigestAlgorithm:
      description: A hash algorithm.
      type: string
      enum:
      - BLAKE2B256
      - BLAKE2B384
      - BLAKE2B512
      - BLAKE2S256
      - RIPEMD160
      - SSL3
      - SHA1
      - SHA224
      - SHA256
      - SHA384
      - SHA512
      - STREEBOG256
      - STREEBOG512
      - SHA3_224
      - SHA3_256
      - SHA3_384
      - SHA3_512
    ObjectType:
      description: Type of security object.
      type: string
      enum:
      - AES
      - ARIA
      - DES
      - DES3
      - SEED
      - RSA
      - DSA
      - EC
      - KCDSA
      - ECKCDSA
      - BIP32
      - SLIP10
      - BLS
      - OPAQUE
      - HMAC
      - LEDABETA
      - ROUND5BETA
      - SECRET
      - LMS
      - XMSS
      - MLDSA
      - MLDSABETA
      - MLKEM
      - MLKEMBETA
      - CERTIFICATE
      - PBE
    UpdateReplicationCredentialRequest:
      description: 'A request to update a replication credential (e.g., associating it with

        an app ID).


        Note that changing the credential from one type to another is disallowed;

        users should create a new credential instead.'
      oneOf:
      - $ref: '#/components/schemas/UpdateReplicationCredentialRequestVariantCertificate'
      discriminator:
        propertyName: $type
        mapping:
          Certificate: UpdateReplicationCredentialRequestVariantCertificate
    ObjectTypeFilterVariantSelection:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Selection
        required:
        - $type
      - $ref: '#/components/schemas/ObjectTypeFilterSelection'
    EcOptionsPolicy:
      allOf:
      - type: object
        properties:
          elliptic_curves:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/EllipticCurve'
    FpeTokenizeMode:
      description: How to tokenize a given input. The most secure option is "PreserveFormat".
      type: string
      enum:
      - preserve_format
      - preserve_variant
      - preserve_length
    FpeInputDefaultProcessing:
      type: string
      enum:
      - strip
      - reject
    WorkspaceCseConfig:
      allOf:
      - type: object
        description: 'Workspace CSE API settings. Specifying these settings enables the CSE APIs

          for the account.'
        properties:
          identity_providers:
            type: array
            items:
              $ref: '#/components/schemas/WorkspaceCseIdentityProvider'
            description: 'One or more Identity Providers (IdP) trusted to authenticate users.

              Note that we don''t check if Single Sign-On (SSO) settings exist for

              each IdP listed here, but it is recommended to add these IdPs in SSO

              settings as well (usually as OAuth/OIDC providers).'
          authorization_providers:
            type: array
            items:
              $ref: '#/components/schemas/WorkspaceCseAuthorizationProvider'
            description: 'One or more authorization providers used to validate authorization

              tokens. Different Workspace applications might require different

              authorization settings.'
          auth_method:
            $ref: '#/components/schemas/WorkspaceCseAuthMethod'
        required:
        - identity_providers
        - authorization_providers
    LdapUserSelfProvisioningRoleFixed:
      allOf:
      - type: object
        description: 'Map all self-provisioned users to a single specified account role.

          (Note that this setting only determines the role that a self-

          provisioned user starts with; an account admin can change any user''s

          role at a later time.) A "state enabled" flag will be implicitly added,

          and any specified "pending invite" flag will be removed.'
        properties:
          role:
            $ref: '#/components/schemas/UserAccountFlags'
        required:
        - role
    TlsConfig_2:
      description: TLS client settings.
      oneOf:
      - $ref: '#/components/schemas/TlsConfigVariantDisabled'
      - $ref: '#/components/schemas/TlsConfigVariantOpportunistic'
      - $ref: '#/components/schemas/TlsConfigVariantRequired'
      discriminator:
        propertyName: mode
        mapping:
          disabled: TlsConfigVariantDisabled
          opportunistic: TlsConfigVariantOpportunistic
          required: TlsConfigVariantRequired
    RemovableKeyHistoryPolicy:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/KeyHistoryPolicy'
    AesOptionsPolicy:
      allOf:
      - type: object
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          random_iv:
            type:
            - boolean
            - 'null'
          fpe:
            $ref: '#/components/schemas/FpeOptions'
    MetadataDurationConstraintRequired:
      allOf:
      - type: object
        properties:
          allowed_values:
            $ref: '#/components/schemas/RestrictedDuration'
    Slip10OptionsPolicy:
      allOf:
      - type: object
        properties: {}
    XmssOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    KeyExpiryAlertSiemToolConfig:
      allOf:
      - type: object
        properties:
          max_key_info_per_alert:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 65535
          config:
            $ref: '#/components/schemas/LoggingConfig'
        required:
        - config
    RemovableKeyMetadataPolicy:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/KeyMetadataPolicy'
    LdapDnResolutionVariantConstruct:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - construct
        required:
        - method
      - $ref: '#/components/schemas/LdapDnResolutionConstruct'
    AccountPurposeType:
      description: The purpose of the account (minus any configuration-related details).
      oneOf:
      - $ref: '#/components/schemas/AccountPurposeTypeVariantStandard'
      - $ref: '#/components/schemas/AccountPurposeTypeVariantAccountReplication'
      discriminator:
        propertyName: $type
        mapping:
          Standard: AccountPurposeTypeVariantStandard
          AccountReplication: AccountPurposeTypeVariantAccountReplication
  parameters:
    AccountId:
      name: account-id
      in: path
      required: true
      description: UUID of an Account.
      schema:
        type: string
        format: uuid
    AccountUpdateRequest:
      name: body
      in: body
      required: true
      description: Request to update an account.
      schema:
        $ref: '#/components/schemas/AccountUpdateRequest'
    AccountRequest:
      name: body
      in: body
      required: true
      description: Request to create an account.
      schema:
        $ref: '#/components/schemas/AccountRequest'
    WithTotals:
      name: with_totals
      in: query
      required: false
      description: Whether to return the `totals` field in the response
      schema:
        type: boolean
        default: false
    GetAccountParams:
      in: query
      name: GetAccountParams
      schema:
        $ref: '#/components/schemas/GetAccountParams'
      explode: true
    CountParams:
      in: query
      name: CountParams
      schema:
        $ref: '#/components/schemas/CountParams'
      explode: true
  securitySchemes:
    bearerToken:
      type: apiKey
      in: header
      name: Authentication
      description: A JWT bearer token to be passed once authenticated.
    basicAuth:
      type: http
      scheme: basic
    apiKeyAuth:
      type: apiKey
      name: Authorization
      in: header
      description: Please enter your token prefixed with 'Basic ' (e.g., 'Basic your_token_here')
x-refined-from:
- fortanix-ccm-openapi-original.json
- fortanix-dsm-openapi-original.json