{ "openapi": "3.0.0", "info": { "title": "Fortanix DSM REST API", "description": "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update.", "termsOfService": "https://fortanix.com/legal/agreements-and-standard-terms", "contact": { "name": "Fortanix Support", "url": "https://support.fortanix.com/", "email": "support@fortanix.com" }, "license": { "name": "Apache 2.0", "url": "http://www.apache.org/licenses/LICENSE-2.0.html" }, "version": "0.1.0-20260710" }, "servers": [ { "url": "{dsmEndpoint}", "description": "DSM Endpoint", "variables": { "dsmEndpoint": { "default": "https://amer.smartkey.io", "description": "Type your DSM server URL here (include https://)" } } } ], "components": { "securitySchemes": { "basicAuth": { "type": "http", "scheme": "basic" }, "apiKeyAuth": { "type": "apiKey", "name": "Authorization", "in": "header", "description": "Please enter your token prefixed with 'Basic ' (e.g., 'Basic your_token_here')" }, "bearerToken": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } }, "schemas": { "Account": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "approval_policy": { "$ref": "#/components/schemas/AccountApprovalPolicy" }, "auth_config": { "$ref": "#/components/schemas/AuthConfig" }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurations" }, "country": { "type": "string", "nullable": true }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "cryptographic_policy": { "$ref": "#/components/schemas/CryptographicPolicy" }, "custom_logo": { "type": "string", "format": "byte" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "disabled_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "enabled": { "type": "boolean" }, "initial_purchase_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "key_expiry_alert_config": { "$ref": "#/components/schemas/KeyExpiryAlertConfig" }, "key_history_policy": { "$ref": "#/components/schemas/KeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/KeyMetadataPolicy" }, "log_bad_requests": { "type": "boolean", "nullable": true }, "log_retention_days": { "type": "integer", "nullable": true }, "logging_configs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/LoggingConfig" } }, "mark_key_disable_when_deactivated": { "type": "boolean", "description": "Enable the user to opt out from the current behaviour of key being marked as disabled at time of deactivation." }, "max_app": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_group": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_operation": { "type": "integer", "nullable": true }, "max_plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_sobj": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_user": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "notification_pref": { "$ref": "#/components/schemas/NotificationPref" }, "organization": { "type": "string", "nullable": true }, "original_purpose": { "$ref": "#/components/schemas/AccountPurposeType" }, "parent_acct_id": { "type": "string", "format": "uuid", "nullable": true }, "pending_subscription_change_request": { "$ref": "#/components/schemas/SubscriptionChangeRequest" }, "phone": { "type": "string", "nullable": true }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/PluginCodeSigningPolicy" }, "plugin_enabled": { "type": "boolean", "nullable": true }, "purpose": { "$ref": "#/components/schemas/AccountPurpose" }, "subscription": { "$ref": "#/components/schemas/Subscription" }, "totals": { "$ref": "#/components/schemas/ObjectCounts" }, "trial_expires_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The date when an account's trial expires.\n\nIt is recommended to rely on this field instead of looking at the account's subscription to determine the expiry date, since not all trial subscriptions have the expiry date explicitly indicated.\n\nThis field is read-only, and is not shown for non-trial accounts." }, "workspace_cse_config": { "$ref": "#/components/schemas/WorkspaceCseConfig" } }, "required": [ "acct_id", "enabled", "logging_configs", "mark_key_disable_when_deactivated", "name", "original_purpose", "purpose", "subscription" ] }, { "$ref": "#/components/schemas/ApprovalRequestSettings" } ] }, "AccountApprovalPolicy": { "allOf": [ { "type": "object", "description": "Account approval policy.", "properties": { "policy": { "$ref": "#/components/schemas/QuorumPolicy" }, "manage_groups": { "type": "boolean", "nullable": true }, "protect_authentication_methods": { "type": "boolean", "nullable": true, "description": "When this is true, changes to the account authentication methods require approval." }, "protect_cryptographic_policy": { "type": "boolean", "nullable": true, "description": "When this is true, changes to the account cryptographic policy requires approval." }, "protect_logging_config": { "type": "boolean", "nullable": true, "description": "When this is true, changes to logging configuration require approval." }, "protect_custom_role_updates": { "type": "boolean", "nullable": true, "description": "When set to true, updating custom roles would require approval." } }, "required": [ "policy" ] } ] }, "AccountExtension": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "cryptographic_policy": { "$ref": "#/components/schemas/CryptographicPolicy" }, "key_history_policy": { "$ref": "#/components/schemas/KeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/KeyMetadataPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" } }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" } }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/PluginCodeSigningPolicy" }, "mark_key_disabled_when_deactivated": { "type": "boolean" } }, "required": [ "acct_id", "custom_metadata", "custom_metadata_attributes", "mark_key_disabled_when_deactivated" ] } ] }, "AccountExtensionCreateRequest": { "allOf": [ { "type": "object", "description": "The model used to create a new account extension.", "properties": { "cryptographic_policy": { "$ref": "#/components/schemas/CryptographicPolicy" }, "key_history_policy": { "$ref": "#/components/schemas/KeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/KeyMetadataPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" } }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" } }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/PluginCodeSigningPolicy" }, "mark_key_disabled_when_deactivated": { "type": "boolean" } }, "required": [ "custom_metadata", "custom_metadata_attributes", "mark_key_disabled_when_deactivated" ] } ] }, "AccountExtensionRequest": { "allOf": [ { "type": "object", "properties": { "cryptographic_policy": { "$ref": "#/components/schemas/RemovableCryptographicPolicy" }, "key_history_policy": { "$ref": "#/components/schemas/RemovableKeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/RemovableKeyMetadataPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" }, "nullable": true }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/RemovablePluginCodeSigningPolicy" }, "mark_key_disabled_when_deactivated": { "type": "boolean", "nullable": true } } } ] }, "AccountPermissions": { "description": "\n\n\n MANAGE_LOGGING:\n Permission to manage logging integrations, and enable/disable error\n logging.\n\n\n MANAGE_AUTH:\n Permission to manage SSO and password policy.\n\n\n MANAGE_WORKSPACE_CSE:\n Permission to manage Workspace CSE configuration.\n\n\n UNWRAP_WORKSPACE_CSE_PRIVILEGED:\n Permission required for Workspace CSE PrivilegedUnwrap API. Note\n that `UNWRAP_WORKSPACE_CSE` permission in the group where the key is\n stored is also required.\n\n\n MANAGE_ACCOUNT_CLIENT_CONFIGS:\n Permission to manage account level client configurations.\n\n\n MANAGE_PLUGIN_CODE_SIGNING_POLICY:\n Permission to manage plugin code signing policy.\n\n\n CREATE_ACCOUNT_APPROVAL_POLICY:\n Permission to create account-level approval policy. Note that\n updating/deleting the approval policy is protected by the approval\n policy itself.\n\n\n SET_APPROVAL_REQUEST_EXPIRY:\n Permission to set approval request expiry for all approval requests\n created in the account.\n\n\n MANAGE_APPROVAL_REQUEST_SETTINGS:\n Permission to manage all approval request settings including\n approval request expiry. Implies `SET_APPROVAL_REQUEST_EXPIRY`.\n\n\n UPDATE_ACCOUNT_CUSTOM_METADATA_ATTRIBUTES:\n Permission to update account's custom metadata attributes.\n\n\n MANAGE_ACCOUNT_SUBSCRIPTION:\n Permission to manage account subscription (only relevant for SaaS\n accounts).\n\n\n MANAGE_ACCOUNT_PROFILE:\n Permission to update account name, custom logo, and other profile\n information.\n\n\n DELETE_ACCOUNT:\n Permission to delete the account.\n\n\n CREATE_ADMIN_APPS:\n Permission to create administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n UPDATE_ADMIN_APPS:\n Permission to update administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n DELETE_ADMIN_APPS:\n Permission to delete administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n RETRIEVE_ADMIN_APP_SECRETS:\n Permission to retrieve administrative apps' secrets. Note that not\n all admin app credentials contain secrets. If an admin app's\n credential does not contain any secrets, `GET_ADMIN_APPS` permission\n is sufficient to call the `GetAppCredential` API. Implies\n `GET_ADMIN_APPS`.\n\n\n MANAGE_ADMIN_APPS:\n Currently implies `CREATE_ADMIN_APPS`, `UPDATE_ADMIN_APPS`,\n `DELETE_ADMIN_APPS`, `RETRIEVE_ADMIN_APP_SECRETS` and\n `GET_ADMIN_APPS` permissions.\n\n\n CREATE_CUSTOM_ROLES:\n Permission to create custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n UPDATE_CUSTOM_ROLES:\n Permission to update custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n DELETE_CUSTOM_ROLES:\n Permission to delete custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n MANAGE_CUSTOM_ROLES:\n Currently implies `CREATE_CUSTOM_ROLES`, `UPDATE_CUSTOM_ROLES`,\n `DELETE_CUSTOM_ROLES` and `GET_CUSTOM_ROLES` permissions.\n\n\n INVITE_USERS_TO_ACCOUNT:\n Permission to invite users to the account. Implies `GET_ALL_USERS`.\n\n\n DELETE_USERS_FROM_ACCOUNT:\n Permission to remove users from the account. Implies\n `GET_ALL_USERS`.\n\n\n UPDATE_USERS_ACCOUNT_ROLE:\n Permission to change users' role in the account. Implies\n `GET_ALL_USERS`.\n\n\n UPDATE_USERS_ACCOUNT_ENABLED_STATE:\n Permission to enable/disable users in the account. Implies\n `GET_ALL_USERS`.\n\n\n MANAGE_ACCOUNT_USERS:\n Currently implies `INVITE_USERS_TO_ACCOUNT`,\n `DELETE_USERS_FROM_ACCOUNT`, `UPDATE_USERS_ACCOUNT_ROLE`,\n `UPDATE_USERS_ACCOUNT_ENABLED_STATE` and `GET_ALL_USERS`\n permissions.\n\n\n CREATE_EXTERNAL_ROLES:\n Permission to create external roles. Implies `GET_EXTERNAL_ROLES`.\n\n\n SYNC_EXTERNAL_ROLES:\n Permission to synchronize external roles. Implies\n `GET_EXTERNAL_ROLES`.\n\n\n DELETE_EXTERNAL_ROLES:\n Permission to delete external roles. Implies `GET_EXTERNAL_ROLES`.\n\n\n MANAGE_EXTERNAL_ROLES:\n Currently implies `CREATE_EXTERNAL_ROLES`, `SYNC_EXTERNAL_ROLES`,\n `DELETE_EXTERNAL_ROLES` and `GET_EXTERNAL_ROLES` permissions.\n\n\n CREATE_ACCOUNT_SOBJECT_POLICIES:\n Permission to create various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n UPDATE_ACCOUNT_SOBJECT_POLICIES:\n Permission to update various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n DELETE_ACCOUNT_SOBJECT_POLICIES:\n Permission to delete various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n MANAGE_ACCOUNT_SOBJECT_POLICIES:\n Currently implies `CREATE_ACCOUNT_SOBJECT_POLICIES`,\n `UPDATE_ACCOUNT_SOBJECT_POLICIES`, and\n `DELETE_ACCOUNT_SOBJECT_POLICIES` permissions.\n\n\n CREATE_CHILD_ACCOUNTS:\n Permission to create child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n UPDATE_CHILD_ACCOUNTS:\n Permission to update child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n DELETE_CHILD_ACCOUNTS:\n Permission to delete child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n CREATE_CHILD_ACCOUNT_USERS:\n Permission to create users in child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS` and `GET_CHILD_ACCOUNT_USERS`.\n\n\n GET_CHILD_ACCOUNTS:\n Permission to get child accounts. Note that this is only applicable\n to SaaS accounts with reseller subscription.\n\n\n GET_CHILD_ACCOUNT_USERS:\n Permission to get child account users. Note that this is only\n applicable to SaaS accounts with reseller subscription.\n\n\n MANAGE_CHILD_ACCOUNTS:\n Currently implies `CREATE_CHILD_ACCOUNTS`, `UPDATE_CHILD_ACCOUNTS`,\n `DELETE_CHILD_ACCOUNTS`, `CREATE_CHILD_ACCOUNT_USERS`,\n `GET_CHILD_ACCOUNTS`, and `GET_CHILD_ACCOUNT_USERS` permissions.\n\n\n CREATE_LOCAL_GROUPS:\n Permission to create new local groups.\n\n\n CREATE_EXTERNAL_GROUPS:\n Permission to create new group backed by external HSM/KMS.\n\n\n ALLOW_QUORUM_REVIEWER:\n Controls if the user can act as an approval policy reviewer.\n\n\n ALLOW_KEY_CUSTODIAN:\n Controls if the user can act as a key custodian.\n\n\n GET_ALL_APPROVAL_REQUESTS:\n Grants read access to **all** approval requests in the account. Note\n that there is a related group-level permission that is restricted to\n approval requests related to one group.\n\n\n GET_ADMIN_APPS:\n Permission to get administrative apps.\n\n\n GET_CUSTOM_ROLES:\n Permission to get custom user roles.\n\n\n GET_EXTERNAL_ROLES:\n Permission to get external roles.\n\n\n GET_ALL_USERS:\n Permission to get all users. Note that users can always get\n themselves.\n\n\n GET_ACCOUNT_USAGE:\n Grants access to accounts::GetAccountUsage API.\n\n\n MANAGE_KEY_EXPIRY_ALERTS:\n Permission to manage key expiry alert configurations.\n\n\n MANAGE_REPLICATION:\n Permission to modify an account's `purpose` field (e.g., changing a\n replication account's settings), or to call any APIs involving\n replication credentials. If the account is not a replication account,\n this permission has no effect.\n\n", "type": "string", "enum": [ "MANAGE_LOGGING", "MANAGE_AUTH", "MANAGE_WORKSPACE_CSE", "UNWRAP_WORKSPACE_CSE_PRIVILEGED", "MANAGE_ACCOUNT_CLIENT_CONFIGS", "MANAGE_PLUGIN_CODE_SIGNING_POLICY", "CREATE_ACCOUNT_APPROVAL_POLICY", "SET_APPROVAL_REQUEST_EXPIRY", "MANAGE_APPROVAL_REQUEST_SETTINGS", "UPDATE_ACCOUNT_CUSTOM_METADATA_ATTRIBUTES", "MANAGE_ACCOUNT_SUBSCRIPTION", "MANAGE_ACCOUNT_PROFILE", "DELETE_ACCOUNT", "CREATE_ADMIN_APPS", "UPDATE_ADMIN_APPS", "DELETE_ADMIN_APPS", "RETRIEVE_ADMIN_APP_SECRETS", "MANAGE_ADMIN_APPS", "CREATE_CUSTOM_ROLES", "UPDATE_CUSTOM_ROLES", "DELETE_CUSTOM_ROLES", "MANAGE_CUSTOM_ROLES", "INVITE_USERS_TO_ACCOUNT", "DELETE_USERS_FROM_ACCOUNT", "UPDATE_USERS_ACCOUNT_ROLE", "UPDATE_USERS_ACCOUNT_ENABLED_STATE", "MANAGE_ACCOUNT_USERS", "CREATE_EXTERNAL_ROLES", "SYNC_EXTERNAL_ROLES", "DELETE_EXTERNAL_ROLES", "MANAGE_EXTERNAL_ROLES", "CREATE_ACCOUNT_SOBJECT_POLICIES", "UPDATE_ACCOUNT_SOBJECT_POLICIES", "DELETE_ACCOUNT_SOBJECT_POLICIES", "MANAGE_ACCOUNT_SOBJECT_POLICIES", "CREATE_CHILD_ACCOUNTS", "UPDATE_CHILD_ACCOUNTS", "DELETE_CHILD_ACCOUNTS", "CREATE_CHILD_ACCOUNT_USERS", "GET_CHILD_ACCOUNTS", "GET_CHILD_ACCOUNT_USERS", "MANAGE_CHILD_ACCOUNTS", "CREATE_LOCAL_GROUPS", "CREATE_EXTERNAL_GROUPS", "ALLOW_QUORUM_REVIEWER", "ALLOW_KEY_CUSTODIAN", "GET_ALL_APPROVAL_REQUESTS", "GET_ADMIN_APPS", "GET_CUSTOM_ROLES", "GET_EXTERNAL_ROLES", "GET_ALL_USERS", "GET_ACCOUNT_USAGE", "MANAGE_KEY_EXPIRY_ALERTS", "MANAGE_REPLICATION" ] }, "AccountPurpose": { "description": "Describes the purpose of the account.", "oneOf": [ { "$ref": "#/components/schemas/AccountPurposeVariantStandard" }, { "$ref": "#/components/schemas/AccountPurposeVariantAccountReplication" } ], "discriminator": { "propertyName": "$type", "mapping": { "Standard": "AccountPurposeVariantStandard", "AccountReplication": "AccountPurposeVariantAccountReplication" } } }, "AccountPurposeVariantStandard": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Standard" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "AccountPurposeVariantAccountReplication": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "AccountReplication" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/AccountReplicationConfiguration" } ] }, "AccountPurposeType": { "description": "The purpose of the account (minus any configuration-related details).", "oneOf": [ { "$ref": "#/components/schemas/AccountPurposeTypeVariantStandard" }, { "$ref": "#/components/schemas/AccountPurposeTypeVariantAccountReplication" } ], "discriminator": { "propertyName": "$type", "mapping": { "Standard": "AccountPurposeTypeVariantStandard", "AccountReplication": "AccountPurposeTypeVariantAccountReplication" } } }, "AccountPurposeTypeVariantStandard": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Standard" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "AccountPurposeTypeVariantAccountReplication": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "AccountReplication" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "AccountReplicationConfiguration": { "allOf": [ { "type": "object", "properties": { "connection_settings": { "$ref": "#/components/schemas/AccountReplicationConnection" }, "scan_settings": { "$ref": "#/components/schemas/AccountReplicationScanSettings" } }, "required": [ "connection_settings", "scan_settings" ] } ] }, "AccountReplicationConnection": { "allOf": [ { "type": "object", "description": "Settings for how a replication account should connect to a source cluster. This type does not\nhandle configuration of a source-side admin app used in the replication process; such setup is\nhandled by separate endpoints.", "properties": { "url": { "type": "string", "format": "url", "description": "The URL of the DSM cluster containing the account to back up. Only HTTPS is supported." }, "active_replication_credential": { "$ref": "#/components/schemas/ReplicationCredentialId" } }, "required": [ "url" ] } ] }, "AccountReplicationScanSettings": { "allOf": [ { "type": "object", "description": "Settings for how DSM should go about replicating objects from the source account once a connection\nhas been established.\n\nToday, account replication is performed using \"basic\" replication, which exports key material in\nthe clear (over a TLS connection).", "properties": { "auto_scan": { "$ref": "#/components/schemas/AutoScanSettings" } }, "required": [ "auto_scan" ] } ] }, "AccountRequest": { "allOf": [ { "type": "object", "properties": { "add_ldap": { "type": "array", "items": { "$ref": "#/components/schemas/AuthConfigLdap" }, "nullable": true, "description": "LDAP integrations to add when creating or updating an account.\n\nIn order for this field to take effect during creation, it must be specified alongside the `auth_config` field." }, "add_logging_configs": { "type": "array", "items": { "$ref": "#/components/schemas/LoggingConfigRequest" }, "nullable": true }, "approval_policy": { "$ref": "#/components/schemas/AccountApprovalPolicy" }, "auth_config": { "$ref": "#/components/schemas/AuthConfig" }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurationsRequest" }, "country": { "type": "string", "nullable": true }, "cryptographic_policy": { "$ref": "#/components/schemas/RemovableCryptographicPolicy" }, "custom_logo": { "type": "string", "format": "byte" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" }, "nullable": true }, "del_ldap": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "LDAP integrations to remove when updating an account. This field is a list of LDAP integration IDs. (DSM assigns each LDAP integration a UUID; refer to the `auth_config.ldap` field.)" }, "del_logging_configs": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "enabled": { "type": "boolean", "nullable": true }, "key_expiry_alert_config": { "$ref": "#/components/schemas/KeyExpiryAlertConfigRequest" }, "key_history_policy": { "$ref": "#/components/schemas/RemovableKeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/RemovableKeyMetadataPolicy" }, "log_bad_requests": { "type": "boolean", "nullable": true }, "log_retention_days": { "type": "integer", "nullable": true }, "mark_key_disable_when_deactivated": { "type": "boolean", "nullable": true, "description": "Enable the user to opt out from the current behaviour of key being marked as disabled at time of deactivation." }, "mod_ldap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AuthConfigLdap" }, "nullable": true, "description": "LDAP integrations to modify when updating an account. This field is a object, where the keys are LDAP integration IDs, and the values are LDAP auth configs. (DSM assigns each LDAP integration a UUID; check the `auth_config.ldap` field to see them.)" }, "mod_logging_configs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/LoggingConfigRequest" }, "nullable": true }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "notification_pref": { "$ref": "#/components/schemas/NotificationPref" }, "organization": { "type": "string", "nullable": true }, "parent_acct_id": { "type": "string", "format": "uuid", "nullable": true }, "pending_subscription_change_request": { "$ref": "#/components/schemas/SubscriptionChangeRequest" }, "phone": { "type": "string", "nullable": true }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/RemovablePluginCodeSigningPolicy" }, "plugin_enabled": { "type": "boolean", "nullable": true }, "purpose": { "$ref": "#/components/schemas/AccountPurpose" }, "subscription": { "$ref": "#/components/schemas/Subscription" }, "workspace_cse_config": { "$ref": "#/components/schemas/RemovableWorkspaceCseConfig" } } }, { "$ref": "#/components/schemas/ApprovalRequestSettingsRequest" } ] }, "AccountRole": { "allOf": [ { "type": "object", "properties": { "permissions": { "type": "array", "items": { "$ref": "#/components/schemas/AccountPermissions" } }, "exclusive": { "type": "boolean", "nullable": true }, "all_groups_role": { "type": "string", "format": "uuid", "nullable": true, "description": "If specified, users with this account role will have the specified role\nin all groups. The uuid should refer to an existing `Role` of kind\n`RoleKind::Group`." } }, "required": [ "permissions" ] } ] }, "AccountSort": { "oneOf": [ { "title": "AccountSortVariantByAcctId", "type": "object", "properties": { "sort_by": { "type": "string", "pattern": "^acct_id:(?:asc|desc)$", "example": "acct_id:asc" } }, "required": [ "sort_by" ] } ] }, "ActionType": { "type": "string", "enum": [ "ADMINISTRATIVE", "AUTH", "CRYPTOOPERATION", "RUNPLUGIN", "CUSTOM", "OTHER" ] }, "AesOptions": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "fpe": { "$ref": "#/components/schemas/FpeOptions" }, "tag_length": { "type": "integer", "format": "int32", "nullable": true }, "cipher_mode": { "$ref": "#/components/schemas/CipherMode" }, "random_iv": { "type": "boolean", "nullable": true }, "iv_length": { "type": "integer", "format": "int32", "nullable": true } } } ] }, "AesOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true }, "fpe": { "$ref": "#/components/schemas/FpeOptions" } } } ] }, "AgreeKeyMechanism": { "description": "Options to use for key agreement mechanism.", "type": "string", "enum": [ "diffie_hellman" ] }, "AgreeKeyRequest": { "allOf": [ { "type": "object", "description": "Request body to perform key agreement.", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Activation date of the agreed key" }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deactivation date of the agreed key" }, "private_key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "public_key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "mechanism": { "$ref": "#/components/schemas/AgreeKeyMechanism" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the agreed-upon key. Key names must be unique within an account.\nThe name is ignored for transient keys." }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the security group that this security object should belong to. The user or\napplication creating this security object must be a member of this group. If no group is\nspecified, the default group for the requesting application will be used." }, "key_type": { "$ref": "#/components/schemas/ObjectType" }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "Key size in bits. If less than the output size of the algorithm, the secret's most-significant bits will be truncated." }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether the agreed key should have cryptographic operations enabled" }, "description": { "type": "string", "nullable": true, "description": "Description of the agreed key" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User-defined metadata for this key stored as key-value pairs." }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Optional array of key operations to be enabled for this security object. If not\nprovided the service will provide a default set of key operations. Note that if you\nprovide an empty array, all key operations will be disabled." }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the resulting key will be transient." }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" } }, "required": [ "private_key", "public_key", "mechanism", "key_type", "key_size" ] } ] }, "Algorithm": { "description": "A cryptographic algorithm.", "type": "string", "enum": [ "AES", "ARIA", "DES", "DES3", "SEED", "RSA", "DSA", "KCDSA", "EC", "ECKCDSA", "BIP32", "SLIP10", "BLS", "LMS", "XMSS", "MLDSA", "MLDSABETA", "MLKEM", "MLKEMBETA", "HMAC", "LEDABETA", "ROUND5BETA", "PBE" ] }, "All": { "description": "A helper enum with a single variant, All, which indicates that something should apply to an\nentire part. (This is here mainly to allow other untagged enums to work properly.)", "type": "string", "enum": [ "all" ] }, "ApiPath": { "allOf": [ { "type": "object", "properties": { "api_path": { "type": "string" }, "method": { "type": "string" }, "context": { "$ref": "#/components/schemas/TepKeyContext" }, "key_path": { "type": "string" } }, "required": [ "api_path", "method", "context", "key_path" ] } ] }, "App": { "allOf": [ { "type": "object", "properties": { "account_membership": { "$ref": "#/components/schemas/AppAccountMembership" }, "acct_id": { "type": "string", "format": "uuid", "description": "The id of the Account that this application belongs to." }, "app_id": { "type": "string", "format": "uuid", "description": "Unique id to identify the application." }, "app_type": { "type": "string", "description": "The user-defined type of this application." }, "cert_not_after": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Certificate expiration date for apps that use client certificate or trusted CA auth.\n\nFor a client certificate app, this field is the expiry date of the client certifiate. For a trusted CA app, this field is the maximum expiry date among all configured root CA certs in the app's config.\n\nFor all other apps, this field is omitted." }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurations" }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp when the application was created." }, "creator": { "$ref": "#/components/schemas/Principal" }, "default_group": { "type": "string", "format": "uuid", "nullable": true, "description": "The default group an application belongs to." }, "description": { "type": "string", "nullable": true, "description": "Description of this application." }, "enabled": { "type": "boolean", "description": "Whether this application is enabled." }, "groups": { "$ref": "#/components/schemas/AppGroups" }, "interface": { "type": "string", "nullable": true, "description": "Interface used with this application (PKCS11, CNG, JCE, KMIP, etc)." }, "ip_address_policy": { "$ref": "#/components/schemas/IpAddressPolicy" }, "last_operations": { "$ref": "#/components/schemas/LastAppOperationTimestamp" }, "lastused_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp when the application was most recently used." }, "legacy_access": { "type": "boolean", "description": "If a requester is updating an App or retrieving its credentials,\nthey must have the relevant permissions in all Groups that App has access to.\nBut for legacy Apps, requester is required to have relevant permissions\nin any of the groups that App has access to." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Name of this application, which must be unique within an account." }, "oauth_config": { "$ref": "#/components/schemas/AppOauthConfig" }, "role": { "$ref": "#/components/schemas/AppRole" } }, "required": [ "acct_id", "app_id", "app_type", "client_configurations", "created_at", "creator", "enabled", "groups", "ip_address_policy", "last_operations", "legacy_access", "name", "role" ] }, { "$ref": "#/components/schemas/AppAuthType" } ] }, "AppAccountMembership": { "allOf": [ { "type": "object", "properties": { "roles": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/AppAccountRoleDescriptor" } } }, "required": [ "roles" ] } ] }, "AppAccountRole": { "type": "string", "enum": [ "AccountAdministrator", "AccountMember", "AccountAuditor" ] }, "AppAccountRoleDescriptor": { "oneOf": [ { "$ref": "#/components/schemas/AppAccountRoleDescriptorVariantSystemDefined" }, { "$ref": "#/components/schemas/AppAccountRoleDescriptorVariantCustom" } ], "discriminator": { "propertyName": "$type", "mapping": { "SystemDefined": "AppAccountRoleDescriptorVariantSystemDefined", "Custom": "AppAccountRoleDescriptorVariantCustom" } } }, "AppAccountRoleDescriptorVariantSystemDefined": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "SystemDefined" ] }, "value": { "$ref": "#/components/schemas/AppAccountRole" } }, "required": [ "$type", "value" ] } ] }, "AppAccountRoleDescriptorVariantCustom": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Custom" ] }, "value": { "type": "string", "format": "uuid" } }, "required": [ "$type", "value" ] } ] }, "AppAuthType": { "allOf": [ { "type": "object", "properties": { "auth_type": { "$ref": "#/components/schemas/AppAuthTypeVariants" }, "auth_type_all": { "type": "array", "items": { "$ref": "#/components/schemas/OneAppAuthType" }, "nullable": true, "description": "If `auth_type` is `all`, this field will include the list of individual auth\ntypes for the app" } }, "required": [ "auth_type" ] } ] }, "AppAuthTypeVariants": { "oneOf": [ { "title": "AppAuthTypeVariantsVariantAll", "type": "string", "enum": [ "All" ] }, { "$ref": "#/components/schemas/OneAppAuthType" } ] }, "AppCredential": { "oneOf": [ { "title": "AppCredentialVariantAll", "type": "object", "properties": { "all": { "type": "array", "items": { "$ref": "#/components/schemas/OneAppCredential" } } }, "required": [ "all" ] }, { "$ref": "#/components/schemas/OneAppCredential" } ] }, "AppCredentialRequest": { "oneOf": [ { "title": "AppCredentialRequestVariantAll", "type": "object", "properties": { "all": { "type": "array", "items": { "$ref": "#/components/schemas/OneAppCredentialRequest" }, "description": "Using `all`, clients can specify a combination of two credentials:\n- one must be a mutual TLS credential (either `certificate` or `trustedca`),\n- the other must be a general app credential (one of `secret`, `awsiam`, `signedjwt`, or `ldap`)\n\nApps authenticating with this variant must present both forms of credentials,\ni.e., they must present a client certificate during TLS handshake, and also\npresent the other form of credential in the HTTP request." } }, "required": [ "all" ] }, { "$ref": "#/components/schemas/OneAppCredentialRequest" } ] }, "AppCredentialResponse": { "allOf": [ { "type": "object", "description": "App credential response.", "properties": { "app_id": { "type": "string", "format": "uuid", "description": "Unique identifier of the App." }, "credential": { "$ref": "#/components/schemas/AppCredential" }, "previous_credential": { "$ref": "#/components/schemas/PreviousCredential" } }, "required": [ "app_id", "credential" ] } ] }, "AppCreditsUsage": { "allOf": [ { "type": "object", "properties": { "generic": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "tokenization": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "tep": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "accelerator": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "secrets_management": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "aws_cloud_accounts": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "azure_cloud_accounts": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "gcp_cloud_accounts": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "google_ekm_projects": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "aws_xks_instances": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "generic", "tokenization", "tep", "accelerator", "secrets_management", "aws_cloud_accounts", "azure_cloud_accounts", "gcp_cloud_accounts", "google_ekm_projects", "aws_xks_instances" ] } ] }, "AppGroupMembership": { "allOf": [ { "type": "object", "properties": { "group_id": { "type": "string", "format": "uuid" }, "roles": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/AppGroupRoleDescriptor" } } }, "required": [ "group_id", "roles" ] } ] }, "AppGroupRole": { "type": "string", "enum": [ "GroupAuditor", "GroupAdministrator" ] }, "AppGroupRoleDescriptor": { "oneOf": [ { "$ref": "#/components/schemas/AppGroupRoleDescriptorVariantSystemDefined" }, { "$ref": "#/components/schemas/AppGroupRoleDescriptorVariantCustom" } ], "discriminator": { "propertyName": "$type", "mapping": { "SystemDefined": "AppGroupRoleDescriptorVariantSystemDefined", "Custom": "AppGroupRoleDescriptorVariantCustom" } } }, "AppGroupRoleDescriptorVariantSystemDefined": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "SystemDefined" ] }, "value": { "$ref": "#/components/schemas/AppGroupRole" } }, "required": [ "$type", "value" ] } ] }, "AppGroupRoleDescriptorVariantCustom": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Custom" ] }, "value": { "type": "string", "format": "uuid" } }, "required": [ "$type", "value" ] } ] }, "AppOauthConfigEnabled": { "allOf": [ { "type": "object", "properties": { "redirect_uris": { "type": "array", "items": { "type": "string" } } }, "required": [ "redirect_uris" ] } ] }, "AppOauthConfig": { "description": "OAuth settings for an app. If enabled, an app can request to act on behalf of a user.", "oneOf": [ { "$ref": "#/components/schemas/AppOauthConfigVariantEnabled" }, { "$ref": "#/components/schemas/AppOauthConfigVariantDisabled" } ], "discriminator": { "propertyName": "state", "mapping": { "enabled": "AppOauthConfigVariantEnabled", "disabled": "AppOauthConfigVariantDisabled" } } }, "AppOauthConfigVariantEnabled": { "allOf": [ { "type": "object", "properties": { "state": { "type": "string", "enum": [ "enabled" ] } }, "required": [ "state" ] }, { "$ref": "#/components/schemas/AppOauthConfigEnabled" } ] }, "AppOauthConfigVariantDisabled": { "allOf": [ { "type": "object", "properties": { "state": { "type": "string", "enum": [ "disabled" ] } }, "required": [ "state" ] }, { "type": "object", "properties": {} } ] }, "AppPermissions": { "description": "Operations allowed to be performed by an app.\n\n\n\n SIGN:\n\n\n VERIFY:\n\n\n ENCRYPT:\n\n\n DECRYPT:\n\n\n WRAPKEY:\n\n\n UNWRAPKEY:\n\n\n DERIVEKEY:\n\n\n MACGENERATE:\n\n\n MACVERIFY:\n\n\n EXPORT:\n\n\n MANAGE:\n\n\n AGREEKEY:\n\n\n MASKDECRYPT:\n\n\n AUDIT:\n\n\n TRANSFORM:\n\n\n CREATE_SOBJECTS:\n\n\n COPY_SOBJECTS:\n\n\n ROTATE_SOBJECTS:\n\n\n ACTIVATE_SOBJECTS:\n\n\n REVOKE_SOBJECTS:\n\n\n REVERT_SOBJECTS:\n\n\n MOVE_SOBJECTS:\n\n\n UPDATE_SOBJECTS_PROFILE:\n\n\n UPDATE_SOBJECTS_ENABLED_STATE:\n\n\n UPDATE_SOBJECT_POLICIES:\n\n\n UPDATE_KEY_OPS:\n\n\n DELETE_KEY_MATERIAL:\n\n\n DELETE_SOBJECTS:\n\n\n DESTROY_SOBJECTS:\n\n\n RESTORE_EXTERNAL_SOBJECTS:\n\n\n CALCULATE_DIGEST:\n\n\n ENCAPSULATE:\n\n\n DECAPSULATE:\n\n", "type": "string", "enum": [ "SIGN", "VERIFY", "ENCRYPT", "DECRYPT", "WRAPKEY", "UNWRAPKEY", "DERIVEKEY", "MACGENERATE", "MACVERIFY", "EXPORT", "MANAGE", "AGREEKEY", "MASKDECRYPT", "AUDIT", "TRANSFORM", "CREATE_SOBJECTS", "COPY_SOBJECTS", "ROTATE_SOBJECTS", "ACTIVATE_SOBJECTS", "REVOKE_SOBJECTS", "REVERT_SOBJECTS", "MOVE_SOBJECTS", "UPDATE_SOBJECTS_PROFILE", "UPDATE_SOBJECTS_ENABLED_STATE", "UPDATE_SOBJECT_POLICIES", "UPDATE_KEY_OPS", "DELETE_KEY_MATERIAL", "DELETE_SOBJECTS", "DESTROY_SOBJECTS", "RESTORE_EXTERNAL_SOBJECTS", "CALCULATE_DIGEST", "ENCAPSULATE", "DECAPSULATE" ] }, "AppRequest": { "allOf": [ { "type": "object", "properties": { "account_membership": { "$ref": "#/components/schemas/AppAccountMembership" }, "add_groups": { "$ref": "#/components/schemas/AppGroups" }, "app_type": { "type": "string", "nullable": true, "description": "The user-defined type of this application." }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurationsRequest" }, "credential": { "$ref": "#/components/schemas/AppCredentialRequest" }, "credential_migration_period": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Migration period for which credentials(and its sessions) remain valid during api key regeneration." }, "default_group": { "type": "string", "format": "uuid", "nullable": true, "description": "The default group an application belongs to." }, "del_groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Groups an application no longer needs to be a part of. Array of UUID of groups." }, "description": { "type": "string", "nullable": true, "description": "Description of this application." }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether this application is enabled." }, "interface": { "type": "string", "nullable": true, "description": "Interface used with this application (PKCS11, CNG, JCE, KMIP, etc)." }, "ip_address_policy": { "$ref": "#/components/schemas/IpAddressPolicy" }, "mod_groups": { "$ref": "#/components/schemas/AppGroups" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of this application, which must be unique within an account." }, "oauth_config": { "$ref": "#/components/schemas/AppOauthConfig" }, "role": { "$ref": "#/components/schemas/AppRole" }, "secret_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Size in bytes of app's secret." } } } ] }, "AppResetSecretRequest": { "allOf": [ { "type": "object", "description": "Request for resetting the app secret.", "properties": { "secret_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Size of app's secret in bytes." }, "credential_migration_period": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Time until which previous credentials(or its sessions)\nwill not be invalidated as the API key gets regenerated." } } } ] }, "AppRole": { "description": "App's role.", "type": "string", "enum": [ "admin", "crypto" ] }, "AppSort": { "oneOf": [ { "title": "AppSortVariantByAppId", "type": "object", "description": "Sort apps on the basis of their app_id.", "properties": { "sort": { "type": "string", "pattern": "^app_id:(?:asc|desc)$", "example": "app_id:asc" }, "start": { "type": "string", "format": "uuid", "description": "Starting from a particular app_id." } }, "required": [ "sort" ] }, { "title": "AppSortVariantByAppName", "type": "object", "description": "Sort apps on the basis of their app_name.", "properties": { "sort": { "type": "string", "pattern": "^app_name:(?:asc|desc)$", "example": "app_name:asc" }, "start": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Starting from a particular app_name." } }, "required": [ "sort" ] } ] }, "ApprovalAuthConfig": { "allOf": [ { "type": "object", "description": "Authentication requirements for approval request reviewers.", "properties": { "require_password": { "type": "boolean", "nullable": true }, "require_2fa": { "type": "boolean", "nullable": true } } } ] }, "ApprovalRequest": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "approvers": { "type": "array", "items": { "$ref": "#/components/schemas/ReviewerPrincipal" } }, "body": { "nullable": true }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "denial_reason": { "type": "string", "nullable": true }, "denier": { "$ref": "#/components/schemas/ReviewerPrincipal" }, "description": { "type": "string", "nullable": true }, "expiry": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "method": { "type": "string" }, "operation": { "type": "string" }, "request_id": { "type": "string", "format": "uuid" }, "requester": { "$ref": "#/components/schemas/Principal" }, "result_viewed": { "type": "boolean" }, "reviewers": { "type": "array", "items": { "$ref": "#/components/schemas/Reviewer" }, "nullable": true }, "status": { "$ref": "#/components/schemas/ApprovalStatus" }, "subjects": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/ApprovalSubject" }, "nullable": true } }, "required": [ "acct_id", "approvers", "created_at", "expiry", "method", "operation", "request_id", "requester", "result_viewed", "status" ] } ] }, "ApprovalRequestRequest": { "allOf": [ { "type": "object", "properties": { "body": { "nullable": true }, "description": { "type": "string", "nullable": true }, "method": { "type": "string", "nullable": true }, "operation": { "type": "string", "nullable": true } } } ] }, "ApprovalRequestSettings": { "allOf": [ { "type": "object", "description": "Settings that apply to quorum approval requests.", "properties": { "approval_request_expiry": { "type": "integer", "nullable": true, "description": "The number of seconds after which an approval request expires. If not\nspecified, the cluster-wide setting will be used (30 days by default).\n\nUpon creation, an approval request's expiry date is (time of creation +\nexpiry period). However, when the request is approved by all its approvers,\nits expiry date will be changed to (time of approval + expiry period)." }, "retain_expired_requests": { "type": "boolean", "nullable": true, "description": "Whether or not expired approval requests should be kept. (Obviously, any\npending requests that have expired are no longer actionable!)\n\nThis is only applicable for onprem clusters; the field is ignored in SaaS\nenvironments." }, "log_expired_pending_requests": { "type": "boolean", "nullable": true, "description": "Whether or not expiry of pending approval requests should be audit logged.\n\nThis is only applicable for onprem clusters; the field is ignored in SaaS\nenvironments." }, "check_access_for_sensitive_operation_results": { "type": "boolean", "nullable": true, "description": "Whether or not the requester's access should be checked again when they\nrequest to see the operation results for an approved quorum request with\nsensitive data in the output. Sensitive data includes secret values such\nas API keys, decrypted plaintext, exported key material etc. Note that\nif the result is not deemed sensitive this setting does not apply, e.g.\napproval request to sign a message (signatures are not deemed secret) or\nencrypt data (ciphertext is not deemed secret). Here is the list of all\noperations that are deemed sensitive (this list may be expanded in the\nfuture):\n\n- Get App Credential: `GET /sys/v1/apps/${app_id}/credential`\n- Decrypt:\n- Legacy version: `POST /crypto/v1/keys/${key_id}/decrypt`\n- New version: `POST /crypto/v1/decrypt`\n- Export Object Value:\n- Legacy version: `GET /crypto/v1/keys/${key_id}/export`\n- New version: `POST /crypto/v1/keys/export`\n- Batch: `POST /batch/v1` if any of the operations in the batch input is\nsensitive.\n\nThis setting is introduced for backwards compatibility so that existing\napproval request workflows are not broken. For new use cases, it is\nrecommended to leave this setting enabled." } } } ] }, "ApprovalRequestSettingsRequest": { "allOf": [ { "type": "object", "description": "A request struct for modifying settings that apply to quorum approval requests.", "properties": { "approval_request_expiry": { "type": "integer", "nullable": true, "description": "The number of seconds after which an approval request expires. Changing this\nsetting will not change the expiry of existing approval requests, but it may\nstill affect the \"updated\" expiry period assigned to existing requests upon\ntheir approval (see below for details).\n\nUpon creation, an approval request's expiry date is (time of creation +\nexpiry period). However, when the request is approved by all its approvers,\nits expiry date will be changed to (time of approval + expiry period)." }, "retain_expired_requests": { "type": "boolean", "nullable": true, "description": "Whether or not expired approval requests should be kept. (Obviously, any\npending requests that have expired are no longer actionable!)\n\nThis is only applicable for onprem clusters; the field is ignored in SaaS\nenvironments." }, "log_expired_pending_requests": { "type": "boolean", "nullable": true, "description": "Whether or not expiry of pending approval requests should be audit logged.\nChanging this setting will not retroactively apply to existing expired\napproval requests.\n\nThis is only applicable for onprem clusters; the field is ignored in SaaS\nenvironments." }, "check_access_for_sensitive_operation_results": { "type": "boolean", "nullable": true, "description": "Whether or not the requester's access should be checked again when they\nrequest to see the operation results for an approved quorum request with\nsensitive data in the output. Sensitive data includes secret values such\nas API keys, decrypted plaintext, exported key material etc. Note that\nif the result is not deemed sensitive this setting does not apply, e.g.\napproval request to sign a message (signatures are not deemed secret) or\nencrypt data (ciphertext is not deemed secret). Here is the list of all\noperations that are deemed sensitive (this list may be expanded in the\nfuture):\n\n- Get App Credential: `GET /sys/v1/apps/${app_id}/credential`\n- Decrypt:\n- Legacy version: `POST /crypto/v1/keys/${key_id}/decrypt`\n- New version: `POST /crypto/v1/decrypt`\n- Export Object Value:\n- Legacy version: `GET /crypto/v1/keys/${key_id}/export`\n- New version: `POST /crypto/v1/keys/export`\n- Batch: `POST /batch/v1` if any of the operations in the batch input is\nsensitive.\n\nThis setting is introduced for backwards compatibility so that existing\napproval request workflows are not broken. For new use cases, it is\nrecommended to leave this setting enabled." } } } ] }, "ApprovalStatus": { "description": "Approval request status.", "type": "string", "enum": [ "PENDING", "APPROVED", "DENIED", "FAILED" ] }, "ApprovalSubject": { "description": "Identifies an object acted upon by an approval request.", "oneOf": [ { "title": "ApprovalSubjectVariantGroup", "type": "object", "properties": { "group": { "type": "string", "format": "uuid" } }, "required": [ "group" ] }, { "title": "ApprovalSubjectVariantSobject", "type": "object", "properties": { "sobject": { "type": "string", "format": "uuid" } }, "required": [ "sobject" ] }, { "title": "ApprovalSubjectVariantApp", "type": "object", "properties": { "app": { "type": "string", "format": "uuid" } }, "required": [ "app" ] }, { "title": "ApprovalSubjectVariantPlugin", "type": "object", "properties": { "plugin": { "type": "string", "format": "uuid" } }, "required": [ "plugin" ] }, { "title": "ApprovalSubjectVariantAccount", "type": "object", "properties": { "account": { "type": "string", "format": "uuid" } }, "required": [ "account" ] }, { "title": "ApprovalSubjectVariantNewAccount", "type": "string", "enum": [ "newaccount" ] }, { "title": "ApprovalSubjectVariantRole", "type": "object", "properties": { "role": { "type": "string", "format": "uuid" } }, "required": [ "role" ] }, { "title": "ApprovalSubjectVariantClusterConfig", "type": "string", "enum": [ "clusterconfig" ] } ] }, "ApprovalWaitConfig": { "allOf": [ { "type": "object", "description": "Configurations for waiting for quorum approval.", "properties": { "enabled": { "type": "boolean", "description": "Indicates whether waiting for quorum approval is activated or disabled" }, "poll_interval_secs": { "type": "integer", "nullable": true, "description": "Time interval in seconds for client lib to check quorum status." }, "max_wait_for_secs": { "type": "integer", "nullable": true, "description": "Maximum time in seconds for client lib to wait for quorum reply." } }, "required": [ "enabled" ] } ] }, "ApproveRequest": { "allOf": [ { "type": "object", "properties": { "password": { "type": "string", "description": "Password is required if the approval policy requires password authentication." }, "u2f": { "$ref": "#/components/schemas/U2fAuthRequest" }, "fido2_auth_request": { "$ref": "#/components/schemas/PublicKeyCredentialAuthenticatorAssertionResponse" }, "body": { "nullable": true, "description": "Data associated with the approval" } } } ] }, "AriaOptions": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "tag_length": { "type": "integer", "minimum": 0, "maximum": 255, "nullable": true }, "cipher_mode": { "$ref": "#/components/schemas/CipherMode" }, "random_iv": { "type": "boolean", "nullable": true }, "iv_length": { "type": "integer", "minimum": 0, "maximum": 255, "nullable": true } } } ] }, "AriaOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "AttestationConveyancePreference": { "description": "\n\n\nIf you really want to understand attestation, read the following:\n\n\n\nThis enum just specified how the attestation should be conveyed\nto the RP. You can see doc of the individual variants to understand\nvarious ways.", "type": "string", "enum": [ "none", "indirect", "direct", "enterprise" ] }, "AuthConfig": { "allOf": [ { "type": "object", "description": "Account authentication settings for users.", "properties": { "password": { "$ref": "#/components/schemas/AuthConfigPassword" }, "saml": { "type": "string", "nullable": true, "description": "Settings for SAML authentication.\n\nOmitting this field, or setting it to null, will DISABLE\nSAML authentication for users." }, "oauth": { "$ref": "#/components/schemas/AuthConfigOauth" }, "ldap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AuthConfigLdap" }, "nullable": true, "description": "Settings for LDAP authentication. This field is only used\nin responses; in requests, please utilize the `add_ldap`,\n`mod_ldap`, and `del_ldap` fields in an `AccountRequest`." }, "signed_jwt": { "$ref": "#/components/schemas/AuthConfigSignedJwt" }, "vcd": { "$ref": "#/components/schemas/AuthConfigVcd" } } } ] }, "AuthConfigLdap": { "allOf": [ { "type": "object", "description": "LDAP authentication settings.", "properties": { "name": { "type": "string", "description": "A user-visible name to give this LDAP integration." }, "icon_url": { "type": "string", "description": "The URL hosting an image to display for this LDAP integration.\nAn empty string can also be specified (to indicate that no\nicon needs to be displayed)." }, "ldap_url": { "type": "string", "description": "The URL of the LDAP server, e.g., \"ldap://example.org\"." }, "dn_resolution": { "$ref": "#/components/schemas/LdapDnResolution" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "base_dn": { "type": "string", "nullable": true, "description": "The subtree from which to perform LDAP searches; for example,\n\"OU=users,DC=example,DC=org\"." }, "user_object_class": { "type": "string", "nullable": true, "description": "The LDAP object class (e.g., \"User\") to use when looking up\nDSM users trying to authenticate. This field is required if\nthe DN resolution method is search-by-mail or if authorization\nsettings are enabled for this LDAP integraton." }, "service_account": { "$ref": "#/components/schemas/LdapServiceAccount" }, "authorization": { "$ref": "#/components/schemas/LdapAuthorizationConfig" } }, "required": [ "name", "icon_url", "ldap_url", "dn_resolution", "tls" ] } ] }, "AuthConfigOauth": { "allOf": [ { "type": "object", "description": "OAuth single sign-on authentication settings.", "properties": { "idp_name": { "type": "string" }, "idp_icon_url": { "type": "string" }, "idp_authorization_endpoint": { "type": "string" }, "idp_token_endpoint": { "type": "string" }, "idp_userinfo_endpoint": { "type": "string", "nullable": true }, "idp_requires_basic_auth": { "type": "boolean" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "client_id": { "type": "string" }, "client_secret": { "type": "string" }, "auth_params": { "$ref": "#/components/schemas/OauthAuthenticationParameters" } }, "required": [ "idp_name", "idp_icon_url", "idp_authorization_endpoint", "idp_token_endpoint", "idp_requires_basic_auth", "tls", "client_id", "client_secret" ] } ] }, "AuthConfigPassword": { "allOf": [ { "type": "object", "description": "Password authentication settings.", "properties": { "require_2fa": { "type": "boolean", "description": "Require two-factor authentication for password logins." }, "administrators_only": { "type": "boolean", "description": "Limit password login to account administators only.\n\nNote: password login will be always allowed for all users\nif there are no alternative authentication methods for the\naccount." } }, "required": [ "require_2fa", "administrators_only" ] } ] }, "AuthConfigSignedJwt": { "allOf": [ { "type": "object", "description": "Signed JWT authentication settings.", "properties": { "valid_issuers": { "type": "array", "uniqueItems": true, "items": { "type": "string" } }, "signing_keys": { "$ref": "#/components/schemas/SigningKeys" } }, "required": [ "valid_issuers", "signing_keys" ] } ] }, "AuthConfigVcd": { "allOf": [ { "type": "object", "description": "Vcd single sign-on authentication settings.", "properties": { "idp_name": { "type": "string" }, "idp_authorization_endpoint": { "type": "string" }, "org": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" } }, "required": [ "idp_name", "idp_authorization_endpoint", "org", "tls" ] } ] }, "AuthDiscoverParams": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid", "description": "The account for which the user wishes to discover authentication mechanisms.\nNote that if specified, the user_email field in an AuthDiscoverRequest will\nbe ignored." } } } ] }, "AuthDiscoverRequest": { "allOf": [ { "type": "object", "properties": { "user_email": { "type": "string", "format": "email", "description": "The email of the user wishing to log in. If the auth discovery\nrequest also includes an acct_id query parameter, this field\nwill be effectively ignored." } } } ] }, "AuthMethodSamlPost": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "icon_url": { "type": "string" }, "id": { "type": "string" }, "binding_url": { "type": "string" }, "authn_request": { "type": "string" }, "idp_id": { "type": "string", "format": "byte" } }, "required": [ "name", "icon_url", "id", "binding_url", "authn_request", "idp_id" ] } ] }, "AuthMethodOauthAuthCodeGrant": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "icon_url": { "type": "string" }, "authorization_url": { "type": "string" }, "client_id": { "type": "string" }, "redirect_uri": { "type": "string" }, "state": { "type": "string" }, "idp_id": { "type": "string", "format": "byte" }, "auth_params": { "$ref": "#/components/schemas/OauthAuthenticationParameters" } }, "required": [ "name", "icon_url", "authorization_url", "client_id", "redirect_uri", "state", "idp_id", "auth_params" ] } ] }, "AuthMethodLdapPassword": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "icon_url": { "type": "string" }, "idp_id": { "type": "string", "format": "byte" } }, "required": [ "name", "icon_url", "idp_id" ] } ] }, "AuthMethodVcd": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "authorization_url": { "type": "string" }, "idp_id": { "type": "string", "format": "byte" } }, "required": [ "name", "authorization_url", "idp_id" ] } ] }, "AuthMethod": { "oneOf": [ { "$ref": "#/components/schemas/AuthMethodVariantPassword" }, { "$ref": "#/components/schemas/AuthMethodVariantSamlPost" }, { "$ref": "#/components/schemas/AuthMethodVariantOauthAuthCodeGrant" }, { "$ref": "#/components/schemas/AuthMethodVariantLdapPassword" }, { "$ref": "#/components/schemas/AuthMethodVariantVcd" } ], "discriminator": { "propertyName": "method", "mapping": { "password": "AuthMethodVariantPassword", "saml-post": "AuthMethodVariantSamlPost", "oauth-auth-code-grant": "AuthMethodVariantOauthAuthCodeGrant", "ldap-password": "AuthMethodVariantLdapPassword", "vcd": "AuthMethodVariantVcd" } } }, "AuthMethodVariantPassword": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "password" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "AuthMethodVariantSamlPost": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "saml-post" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthMethodSamlPost" } ] }, "AuthMethodVariantOauthAuthCodeGrant": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "oauth-auth-code-grant" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthMethodOauthAuthCodeGrant" } ] }, "AuthMethodVariantLdapPassword": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "ldap-password" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthMethodLdapPassword" } ] }, "AuthMethodVariantVcd": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "vcd" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthMethodVcd" } ] }, "AuthRequest": { "allOf": [ { "type": "object", "properties": { "token_type": { "$ref": "#/components/schemas/TokenType" }, "bind_to": { "$ref": "#/components/schemas/BindToPrincipal" } } }, { "$ref": "#/components/schemas/AuthRequestMethod" } ] }, "AuthRequestMethodSamlResponse": { "allOf": [ { "type": "object", "properties": { "id": { "type": "string", "nullable": true }, "response": { "type": "string" } }, "required": [ "response" ] } ] }, "AuthRequestMethodLdapBasicAuth": { "allOf": [ { "type": "object", "properties": { "idp_id": { "type": "string", "format": "byte" }, "email": { "type": "string" }, "password": { "type": "string" }, "acct_id": { "type": "string", "format": "uuid", "nullable": true, "description": "The account where the IdP is configured. This should\nonly be used if attempting to self-provision into the\naccount. (Self-provisioning may not be possible for\nexisting users; they may need to be manually invited\ninto the account.)" } }, "required": [ "idp_id", "email", "password" ] } ] }, "AuthRequestMethodAuthByAppName": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "password": { "type": "string" } }, "required": [ "acct_id", "name", "password" ] } ] }, "AuthRequestMethodAwsIam": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "region": { "type": "string" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } } }, "required": [ "acct_id", "region", "headers" ] } ] }, "AuthRequestMethodPassword": { "allOf": [ { "type": "object", "description": "Login using a DSM user password and, optionally, a captcha. This is useful\nfor situations where a user is locked out of their DSM account, and wants to\nbecome unlocked.", "properties": { "email": { "type": "string", "format": "email", "description": "The user's email." }, "password": { "type": "string", "description": "The user's password." }, "recaptcha_response": { "type": "string", "nullable": true, "description": "The response token after solving a reCAPTCHA successfully." } }, "required": [ "email", "password" ] } ] }, "AuthRequestMethod": { "oneOf": [ { "$ref": "#/components/schemas/AuthRequestMethodVariantSamlResponse" }, { "$ref": "#/components/schemas/AuthRequestMethodVariantOauthAuthCode" }, { "$ref": "#/components/schemas/AuthRequestMethodVariantLdapBasicAuth" }, { "$ref": "#/components/schemas/AuthRequestMethodVariantAuthByAppName" }, { "$ref": "#/components/schemas/AuthRequestMethodVariantAwsIam" }, { "$ref": "#/components/schemas/AuthRequestMethodVariantPassword" } ], "discriminator": { "propertyName": "method", "mapping": { "saml-response": "AuthRequestMethodVariantSamlResponse", "oauth-auth-code": "AuthRequestMethodVariantOauthAuthCode", "ldap-basic-auth": "AuthRequestMethodVariantLdapBasicAuth", "auth-by-app-name": "AuthRequestMethodVariantAuthByAppName", "aws-iam": "AuthRequestMethodVariantAwsIam", "password": "AuthRequestMethodVariantPassword" } } }, "AuthRequestMethodVariantSamlResponse": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "saml-response" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthRequestMethodSamlResponse" } ] }, "AuthRequestMethodVariantOauthAuthCode": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "oauth-auth-code" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/OauthCodeData" } ] }, "AuthRequestMethodVariantLdapBasicAuth": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "ldap-basic-auth" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthRequestMethodLdapBasicAuth" } ] }, "AuthRequestMethodVariantAuthByAppName": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "auth-by-app-name" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthRequestMethodAuthByAppName" } ] }, "AuthRequestMethodVariantAwsIam": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "aws-iam" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthRequestMethodAwsIam" } ] }, "AuthRequestMethodVariantPassword": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "password" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/AuthRequestMethodPassword" } ] }, "AuthResponse": { "allOf": [ { "type": "object", "properties": { "token_type": { "$ref": "#/components/schemas/TokenType" }, "expires_in": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "access_token": { "type": "string", "description": "Token value that the client should subsequently pass in Authorization header." }, "entity_id": { "type": "string", "format": "uuid" }, "challenge": { "$ref": "#/components/schemas/U2fMfaChallengeResponse" }, "fido2_assertion_options": { "$ref": "#/components/schemas/PublicKeyCredentialRequestOptions" }, "allowed_mfa_methods": { "type": "array", "items": { "$ref": "#/components/schemas/MfaAuthMethod" }, "nullable": true } }, "required": [ "token_type", "expires_in", "entity_id" ] } ] }, "AuthenticationExtensionsClientInputs": { "allOf": [ { "type": "object", "description": "Extensions for webauthn. For every extension input, an\noutput must be returned if the input was considered.\n\nhttps://www.w3.org/TR/webauthn-2/#dictdef-authenticationextensionsclientinputs", "properties": { "appidExclude": { "type": "string", "nullable": true, "description": "This extension excludes authenticators during registration\nbased on legacy u2f key handles specified in \"excludeCredentials\".\nIf that key handle was created with that device, it is excluded.\n\nhttps://www.w3.org/TR/webauthn-2/#sctn-appid-exclude-extension" }, "appid": { "type": "string", "nullable": true, "description": "This extension allows RPs that have previously registered a cred\nusing legacy U2F APIs to request an assertion.\n\nhttps://www.w3.org/TR/webauthn-2/#sctn-appid-extension" }, "example.extension.bool": { "type": "boolean", "nullable": true, "description": "Dummy extension used by conformance tests" } } } ] }, "AuthenticationExtensionsClientOutputs": { "allOf": [ { "type": "object", "description": "This is the response of extension inputs. For every input,\nan output must be returned if the input was considered.\n\n", "properties": { "appidExclude": { "type": "boolean", "nullable": true, "description": "Response of `appidExclude` extension.\nSee [AuthenticationExtensionsClientInputs::appid_exclude]." }, "appid": { "type": "boolean", "nullable": true, "description": "Response of `appid` extension.\nSee [AuthenticationExtensionsClientInputs::appid]." } } } ] }, "AuthenticatorAssertionResponse": { "allOf": [ { "type": "object", "description": "", "properties": { "clientDataJSON": { "$ref": "#/components/schemas/Base64UrlSafe" }, "authenticatorData": { "$ref": "#/components/schemas/Base64UrlSafe" }, "signature": { "$ref": "#/components/schemas/Base64UrlSafe" }, "userHandle": { "$ref": "#/components/schemas/Base64UrlSafe" } }, "required": [ "clientDataJSON", "authenticatorData", "signature" ] } ] }, "AuthenticatorAttachment": { "description": "", "type": "string", "enum": [ "platform", "cross-platform" ] }, "AuthenticatorAttestationResponse": { "allOf": [ { "type": "object", "description": "This represents the authenticator's response to a client’s request\nfor the creation of a new public key credential.\n\nIt contains\ninformation about the new credential that can be used to identify\nit for later use, and metadata that can be used by the WebAuthn\nRelying Party to assess the characteristics of the credential during\nregistration.\n\n", "properties": { "clientDataJSON": { "$ref": "#/components/schemas/Base64UrlSafe" }, "getTransports": { "type": "array", "items": { "$ref": "#/components/schemas/AuthenticatorTransport" }, "nullable": true, "description": "Values obtained from `AuthenticatorAttestationResponse.getTransports()`.\nWebauthn spec recommends RP to store it and user them along with\n`allowCredentials` while authentication ceremony." }, "attestationObject": { "$ref": "#/components/schemas/Base64UrlSafe" } }, "required": [ "clientDataJSON", "attestationObject" ] } ] }, "AuthenticatorSelectionCriteria": { "allOf": [ { "type": "object", "description": "Parameters for deciding which authenticators should be selected.\n\n", "properties": { "authenticatorAttachment": { "$ref": "#/components/schemas/AuthenticatorAttachment" }, "residentKey": { "$ref": "#/components/schemas/ResidentKeyRequirement" }, "requireResidentKey": { "type": "boolean", "nullable": true, "description": "Exists for backcompat with webauthn level 1.\nBy default it is false and should be set to true\nif `residentKey` is set to `required`." }, "userVerification": { "$ref": "#/components/schemas/UserVerificationRequirement" } } } ] }, "AuthenticatorTransport": { "description": "Hints by relying party on how client should communicate\nwith the authenticator.\n\nhttps://www.w3.org/TR/webauthn-2/#enum-transport", "oneOf": [ { "$ref": "#/components/schemas/AuthenticatorTransportInner" }, { "type": "string", "description": "Unknown values are stored as spec asks to do so.\nAs per the spec level 3 (which is draft):\n\"The values SHOULD be members of AuthenticatorTransport\nbut Relying Parties SHOULD accept and store unknown values.\"\nSee `[[transports]]` in https://w3c.github.io/webauthn/#iface-authenticatorattestationresponse\n\nLevel 2 also says that but comparitively unclear.\n\"The values SHOULD be members of AuthenticatorTransport but\nRelying Parties MUST ignore unknown values.\"\nSee `[[transports]]` in https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse" } ] }, "AuthenticatorTransportInner": { "description": "See [AuthenticatorTransport] type.", "type": "string", "enum": [ "usb", "nfc", "ble", "internal" ] }, "AutoScanSettings": { "allOf": [ { "type": "object", "description": "Settings for automatic scanning in DSM-backed groups or replication accounts.", "properties": { "scan_interval_hours": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The number of hours between successive automatic scans. Must be greater than 0." } }, "required": [ "scan_interval_hours" ] } ] }, "AwsKeyMaterialId": { "allOf": [ { "type": "object", "properties": { "key_material_id": { "type": "string", "description": "key material ID reported by AWS KMS" }, "key_material_index": { "type": "integer", "description": "The index of the key material in the AWS ListKeyRotations response" } }, "required": [ "key_material_id", "key_material_index" ] } ] }, "AwsKeyOrigin": { "description": "Origin of the AWS KMS key.\n\nSee the [AWS documentation](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyMetadata.html#KMS-Type-KeyMetadata-Origin)\nfor more information.", "type": "string", "enum": [ "AwsKms", "External", "AwsCloudHsm", "ExternalKeyStore" ] }, "AwsKeyRotationStatusKeyRotationEnabled": { "allOf": [ { "type": "object", "properties": { "rotation_period_in_days": { "type": "integer", "minimum": 0, "maximum": 65535, "nullable": true } } } ] }, "AwsKeyRotationStatus": { "oneOf": [ { "$ref": "#/components/schemas/AwsKeyRotationStatusVariantKeyRotationDisabled" }, { "$ref": "#/components/schemas/AwsKeyRotationStatusVariantKeyRotationEnabled" } ], "discriminator": { "propertyName": "type", "mapping": { "KeyRotationDisabled": "AwsKeyRotationStatusVariantKeyRotationDisabled", "KeyRotationEnabled": "AwsKeyRotationStatusVariantKeyRotationEnabled" } } }, "AwsKeyRotationStatusVariantKeyRotationDisabled": { "allOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "KeyRotationDisabled" ] } }, "required": [ "type" ] }, { "type": "object", "properties": {} } ] }, "AwsKeyRotationStatusVariantKeyRotationEnabled": { "allOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "KeyRotationEnabled" ] } }, "required": [ "type" ] }, { "$ref": "#/components/schemas/AwsKeyRotationStatusKeyRotationEnabled" } ] }, "AwsKmsInfo": { "allOf": [ { "type": "object", "description": "Information and properties of an AWS KMS key.", "properties": { "multi_region": { "$ref": "#/components/schemas/AwsMultiRegionInfo" }, "aws_key_rotation_status": { "$ref": "#/components/schemas/AwsKeyRotationStatus" }, "origin": { "$ref": "#/components/schemas/AwsKeyOrigin" } } } ] }, "AwsKmsKeyMaterialMapping": { "type": "string", "enum": [ "aws_key_container_maps_to_sobject", "aws_key_material_maps_to_sobject" ] }, "AwsMultiRegionInfo": { "allOf": [ { "type": "object", "description": "This structure mentions various properties\nof AWS multi region keys.\nhttps://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html", "properties": { "multi_region_key_type": { "$ref": "#/components/schemas/AwsMultiRegionKeyType" }, "primary_key_arn": { "type": "string", "nullable": true, "description": "Specifies a replica key's primary key ARN." }, "replica_key_arns": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Specifies ARNs of a primary key's replicas." } }, "required": [ "multi_region_key_type" ] } ] }, "AwsMultiRegionKeyType": { "description": "Specifies the type of multi-Region keys.\nhttps://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#multi-region-concepts", "type": "string", "enum": [ "PRIMARY", "REPLICA" ] }, "AwsTemporaryCredentials": { "allOf": [ { "type": "object", "description": "Temporary credentials to be used for AWS KMS.", "properties": { "access_key": { "type": "string" }, "secret_key": { "type": "string" }, "session_token": { "type": "string" } }, "required": [ "access_key", "secret_key", "session_token" ] } ] }, "AwsXksCredential": { "allOf": [ { "type": "object", "properties": { "access_key_id": { "type": "string" }, "secret_key": { "type": "string" } }, "required": [ "access_key_id", "secret_key" ] } ] }, "AwsXksCredentialRequest": { "allOf": [ { "type": "object", "properties": { "access_key_id": { "type": "string", "nullable": true }, "secret_key": { "type": "string" } } } ] }, "AwskmsService": { "description": "Specifies the AWS service. Only `kms` is supported for now.", "type": "string", "enum": [ "kms", "kms-fips" ] }, "AzureAuthConfigClientSecret": { "allOf": [ { "type": "object", "properties": { "client_secret": { "type": "string" } }, "required": [ "client_secret" ] } ] }, "AzureAuthConfigTokenAuthConfig": { "allOf": [ { "type": "object", "properties": { "client_cert": { "type": "string", "format": "byte" }, "client_key": { "type": "string", "format": "byte" } }, "required": [ "client_cert", "client_key" ] } ] }, "AzureAuthConfig": { "oneOf": [ { "$ref": "#/components/schemas/AzureAuthConfigVariantClientSecret" }, { "$ref": "#/components/schemas/AzureAuthConfigVariantTokenAuthConfig" } ], "discriminator": { "propertyName": "mode", "mapping": { "client_secret": "AzureAuthConfigVariantClientSecret", "token_auth_config": "AzureAuthConfigVariantTokenAuthConfig" } } }, "AzureAuthConfigVariantClientSecret": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "client_secret" ] } }, "required": [ "mode" ] }, { "$ref": "#/components/schemas/AzureAuthConfigClientSecret" } ] }, "AzureAuthConfigVariantTokenAuthConfig": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "token_auth_config" ] } }, "required": [ "mode" ] }, { "$ref": "#/components/schemas/AzureAuthConfigTokenAuthConfig" } ] }, "AzureCredentialAuthClientSecret": { "allOf": [ { "type": "object", "description": "OAuth2 client credentials with a client secret value.\nThe `tenant_id` and `client_id` is here as well as we\nneed these to get a token from the client credentials flow.", "properties": { "tenant_id": { "type": "string", "description": "Directory (tenant) ID of the Azure application" }, "client_id": { "type": "string", "description": "Application (client) ID of the Azure application" }, "client_secret": { "$ref": "#/components/schemas/SobjectId" } }, "required": [ "tenant_id", "client_id", "client_secret" ] } ] }, "AzureCredentialAuthCertificate": { "allOf": [ { "type": "object", "description": "OAuth2 client credentials with a certificate.\nAzure AD verifies the JWT using the uploaded certificate's public key", "properties": { "tenant_id": { "type": "string", "description": "Directory (tenant) ID of the Azure application" }, "client_id": { "type": "string", "description": "Application (client) ID of the Azure application" }, "client_cert": { "$ref": "#/components/schemas/SobjectId" }, "client_key": { "$ref": "#/components/schemas/SobjectId" } }, "required": [ "tenant_id", "client_id", "client_cert", "client_key" ] } ] }, "AzureCredentialAuth": { "description": "Authentication configuration for Azure integrations that use Credential Objects.", "oneOf": [ { "$ref": "#/components/schemas/AzureCredentialAuthVariantClientSecret" }, { "$ref": "#/components/schemas/AzureCredentialAuthVariantCertificate" } ], "discriminator": { "propertyName": "$type", "mapping": { "ClientSecret": "AzureCredentialAuthVariantClientSecret", "Certificate": "AzureCredentialAuthVariantCertificate" } } }, "AzureCredentialAuthVariantClientSecret": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "ClientSecret" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/AzureCredentialAuthClientSecret" } ] }, "AzureCredentialAuthVariantCertificate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Certificate" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/AzureCredentialAuthCertificate" } ] }, "AzureKeyVaultType": { "description": "Types of Azure Key Vault based on the protection level.", "type": "string", "enum": [ "STANDARD", "PREMIUM", "MANAGED" ] }, "AzureLogAnalyticsLoggingConfig": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean" }, "workspace_id": { "type": "string", "format": "uuid" }, "shared_key": { "type": "string", "format": "byte" } }, "required": [ "enabled", "workspace_id" ] } ] }, "AzureLogAnalyticsLoggingConfigRequest": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean", "nullable": true }, "workspace_id": { "type": "string", "format": "uuid", "nullable": true }, "shared_key": { "type": "string", "format": "byte" } } } ] }, "AzureLogIngestionLoggingConfig": { "allOf": [ { "type": "object", "description": "Azure Monitor Log Ingestion API logging configuration (DCR-based).\nAuth credentials are managed as an IntegrationCredential object via `CredentialId`.\n\nNote: This replaces the legacy `Azure Log Analytics` HTTP Data Collector API\nwhich Microsoft plans to deprecate on September 14th, 2026.", "properties": { "enabled": { "type": "boolean" }, "logs_ingestion_endpoint_url": { "type": "string", "format": "url", "description": "The DCR logs ingestion endpoint URL (e.g. https://.ingest.monitor.azure.com).\nFor public internet, this is the DCR's built-in logs ingestion URL.\nFor private link, this is the DCE URL." }, "dcr_immutable_id": { "type": "string", "description": "The immutable ID of the Data Collection Rule (DCR)." }, "stream_name": { "type": "string", "description": "The stream name defined in the DCR (e.g. \"Custom-DSMAuditLog\")." }, "credential_id": { "$ref": "#/components/schemas/CredentialId" } }, "required": [ "enabled", "logs_ingestion_endpoint_url", "dcr_immutable_id", "stream_name", "credential_id" ] } ] }, "AzureLogIngestionLoggingConfigRequest": { "allOf": [ { "type": "object", "description": "Azure Monitor Log Ingestion API configuration (DCR-based) request.", "properties": { "enabled": { "type": "boolean", "nullable": true }, "logs_ingestion_endpoint_url": { "type": "string", "format": "url", "nullable": true }, "dcr_immutable_id": { "type": "string", "nullable": true }, "stream_name": { "type": "string", "nullable": true }, "credential_id": { "$ref": "#/components/schemas/CredentialId" } } } ] }, "AzureServiceEndpoints": { "allOf": [ { "type": "object", "description": "The set of endpoints to use when connecting with Azure cloud.\n\nToday, only Azure global and Azure Government cloud endpoints are supported,\nand they cannot be mixed together. The Azure global endpoints are\n- `management`: management.azure.com\n- `key_vault`: vault.azure.net\n- `key_vault_managed_hsm`: managedhsm.azure.net\n- `iam`: login.microsoftonline.com\n\nand the Azure Government endpoints are\n- `management`: management.usgovcloudapi.net\n- `key_vault`: vault.usgovcloudapi.net\n- `key_vault_managed_hsm`: managedhsm.usgovcloudapi.net\n- `iam`: login.microsoftonline.us\n\n(In the future, this restriction may be relaxed to support custom clouds.)", "properties": { "management": { "type": "string", "description": "The API endpoint for managing Azure APIs and resources." }, "key_vault": { "type": "string", "description": "The API endpoint for Azure Key Vault (for Standard and Premium SKUs)." }, "key_vault_managed_hsm": { "type": "string", "description": "The API endpoint for Azure Key Vault Managed HSM." }, "iam": { "type": "string", "description": "The API endpoint for Azure AD (and authentication)." } }, "required": [ "management", "key_vault", "key_vault_managed_hsm", "iam" ] } ] }, "BatchDecryptRequestItem": { "allOf": [ { "type": "object", "description": "Request body of each item in batch decryption\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.", "properties": { "kid": { "type": "string", "format": "uuid", "description": "UUID of the sobject" }, "request": { "$ref": "#/components/schemas/DecryptRequest" } }, "required": [ "kid", "request" ] } ] }, "BatchEncryptRequestItem": { "allOf": [ { "type": "object", "description": "Request body of each item in batch encryption\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.", "properties": { "kid": { "type": "string", "format": "uuid", "description": "UUID of the sobject" }, "request": { "$ref": "#/components/schemas/EncryptRequest" } }, "required": [ "kid", "request" ] } ] }, "BatchExecutionType": { "type": "string", "enum": [ "Serial", "Unordered" ] }, "BatchRequest": { "oneOf": [ { "title": "BatchRequestVariantBatch", "type": "object", "properties": { "Batch": { "$ref": "#/components/schemas/BatchRequestList" } }, "required": [ "Batch" ] }, { "title": "BatchRequestVariantSingleItem", "type": "object", "properties": { "SingleItem": { "$ref": "#/components/schemas/BatchRequestItem" } }, "required": [ "SingleItem" ] } ] }, "BatchRequestItem": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string" }, "operation": { "type": "string" }, "body": { "nullable": true } }, "required": [ "method", "operation" ] } ] }, "BatchRequestList": { "allOf": [ { "type": "object", "properties": { "batch_execution_type": { "$ref": "#/components/schemas/BatchExecutionType" }, "items": { "type": "array", "items": { "$ref": "#/components/schemas/BatchRequest" } } }, "required": [ "batch_execution_type", "items" ] } ] }, "BatchResponse": { "oneOf": [ { "title": "BatchResponseVariantBatch", "type": "object", "properties": { "Batch": { "$ref": "#/components/schemas/BatchResponseList" } }, "required": [ "Batch" ] }, { "title": "BatchResponseVariantSingleItem", "type": "object", "properties": { "SingleItem": { "$ref": "#/components/schemas/BatchResponseObject" } }, "required": [ "SingleItem" ] } ] }, "BatchResponseList": { "allOf": [ { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/BatchResponse" } } }, "required": [ "items" ] } ] }, "BatchResponseObjectResult": { "allOf": [ { "type": "object", "properties": { "status": { "type": "integer", "minimum": 0, "maximum": 65535 }, "body": { "nullable": true } }, "required": [ "status" ] } ] }, "BatchResponseObjectSkipped": { "allOf": [ { "type": "object", "properties": { "reason": { "type": "string" } }, "required": [ "reason" ] } ] }, "BatchResponseObject": { "oneOf": [ { "title": "BatchResponseObjectVariantResult", "type": "object", "properties": { "Result": { "$ref": "#/components/schemas/BatchResponseObjectResult" } }, "required": [ "Result" ] }, { "title": "BatchResponseObjectVariantSkipped", "type": "object", "properties": { "Skipped": { "$ref": "#/components/schemas/BatchResponseObjectSkipped" } }, "required": [ "Skipped" ] } ] }, "BindToPrincipal": { "description": "A security principal that a session can be bound to.\n\nEg: When app-1 creates a session that can be validated against app-2's credentials,\napp-1 specifies app-2's ID in an Auth request body like below:\n\n```json\n{\n\"token_type\":\"Bearer\",\n\"bind_to\" : {\n\"app\":\"\"\n}\n}\n```\n\nThis is particularly useful when the session token generated using certificate auth of\none app needs to be used by another app.", "oneOf": [ { "title": "BindToPrincipalVariantApp", "type": "object", "properties": { "app": { "type": "string", "format": "uuid" } }, "required": [ "app" ] } ] }, "Bip32Network": { "description": "The BIP32 network\nThe Testnet network is usually an actual network with nodes and miners, and\nfree cryptocurrency. This provides a testing environment for developers.", "type": "string", "enum": [ "mainnet", "testnet" ] }, "Bip32Options": { "allOf": [ { "type": "object", "properties": { "derivation_path": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true, "description": "The BIP32 path, starting from master. Master key is Some([]).\nEx: m/42/42'/0 -> Some([42, 2**31 + 42, 0])" }, "network": { "$ref": "#/components/schemas/Bip32Network" } } } ] }, "Bip32OptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "BlsOptions": { "allOf": [ { "type": "object", "properties": { "variant": { "$ref": "#/components/schemas/BlsVariant" } }, "required": [ "variant" ] } ] }, "BlsOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "BlsVariant": { "description": "Signature/public-key size trade-off for BLS.", "type": "string", "enum": [ "small_signatures", "small_public_keys" ] }, "CaConfig": { "description": "CA settings.", "oneOf": [ { "title": "CaConfigVariantCaSet", "type": "object", "properties": { "ca_set": { "$ref": "#/components/schemas/CaSet" } }, "required": [ "ca_set" ] }, { "title": "CaConfigVariantPinned", "type": "object", "properties": { "pinned": { "type": "array", "items": { "type": "string", "format": "byte" } } }, "required": [ "pinned" ] } ] }, "CaSet": { "description": "Predefined CA sets.", "type": "string", "enum": [ "global_roots" ] }, "CertificateOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "CertificateReplicationCredential": { "allOf": [ { "type": "object", "description": "Details about a certificate-based admin app credential used for account replication.", "properties": { "app_id": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the source-side admin app that uses this credential." }, "credential_id": { "$ref": "#/components/schemas/ReplicationCredentialId" }, "certificate_chain": { "type": "array", "items": { "type": "string", "format": "byte" }, "nullable": true, "description": "The certificate chain associated with the credential. This is a list of DER-encoded\ncertificates, starting from the leaf certificate, and can consist of a single certificate if\nno intermediate certificates are necessary when authenticating with the source cluster." } }, "required": [ "credential_id" ] } ] }, "CheckHmgRequest": { "allOf": [ { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the hmg configuration in the group." }, "config": { "$ref": "#/components/schemas/HmgConfig" } } } ] }, "CipherMode": { "description": "Cipher mode used for symmetric key algorithms.", "type": "string", "enum": [ "ECB", "CBC", "CBCNOPAD", "CFB", "OFB", "CTR", "GCM", "CCM", "KW", "KWP", "FF1" ] }, "ClientConfigurations": { "allOf": [ { "type": "object", "properties": { "common": { "$ref": "#/components/schemas/CommonClientConfig" }, "pkcs11": { "$ref": "#/components/schemas/Pkcs11ClientConfig" }, "kmip": { "$ref": "#/components/schemas/KmipClientConfig" }, "tep": { "$ref": "#/components/schemas/TepClientConfig" } } } ] }, "ClientConfigurationsRequest": { "allOf": [ { "type": "object", "properties": { "common": { "$ref": "#/components/schemas/RemovableCommonClientConfig" }, "pkcs11": { "$ref": "#/components/schemas/RemovablePkcs11ClientConfig" }, "kmip": { "$ref": "#/components/schemas/RemovableKmipClientConfig" }, "tep": { "$ref": "#/components/schemas/RemovableTepClientConfig" } } } ] }, "ClientFileLogging": { "oneOf": [ { "$ref": "#/components/schemas/ClientFileLoggingVariantEnabled" }, { "$ref": "#/components/schemas/ClientFileLoggingVariantDisabled" } ], "discriminator": { "propertyName": "mode", "mapping": { "enabled": "ClientFileLoggingVariantEnabled", "disabled": "ClientFileLoggingVariantDisabled" } } }, "ClientFileLoggingVariantEnabled": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "enabled" ] } }, "required": [ "mode" ] }, { "$ref": "#/components/schemas/ClientFileLoggingConfig" } ] }, "ClientFileLoggingVariantDisabled": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "disabled" ] } }, "required": [ "mode" ] }, { "type": "object", "properties": {} } ] }, "ClientFileLoggingConfig": { "allOf": [ { "type": "object", "properties": { "path": { "type": "string", "nullable": true }, "file_size_kb": { "type": "integer", "nullable": true }, "max_files": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "ClientLogConfig": { "allOf": [ { "type": "object", "properties": { "system": { "type": "boolean", "nullable": true }, "file": { "$ref": "#/components/schemas/ClientFileLogging" }, "level": { "type": "string", "nullable": true } } } ] }, "CollectionMetadata": { "allOf": [ { "type": "object", "properties": { "continuation_token": { "type": "string", "nullable": true, "description": "Continuation token to continue getting results. If the response contains a continuation_token,\nthe results returned are partial. In that case, the client can make the same request with this\ncontinuation token to continue getting results." } } }, { "$ref": "#/components/schemas/ObjectCount" } ] }, "CommonClientConfig": { "allOf": [ { "type": "object", "properties": { "retry_timeout_millis": { "type": "integer", "nullable": true }, "cache_ttl": { "type": "integer", "nullable": true }, "log": { "$ref": "#/components/schemas/ClientLogConfig" }, "h2_num_connections": { "type": "integer", "nullable": true }, "quorum_approval": { "$ref": "#/components/schemas/QuorumApprovalConfig" } } } ] }, "Config2faAuthRequest": { "allOf": [ { "type": "object", "description": "Request to start configuring U2F.", "properties": { "password": { "type": "string" } }, "required": [ "password" ] } ] }, "Config2faAuthResponse": { "allOf": [ { "type": "object", "properties": {} } ] }, "ConfirmEmailRequest": { "allOf": [ { "type": "object", "properties": { "confirm_token": { "type": "string" } }, "required": [ "confirm_token" ] } ] }, "ConfirmEmailResponse": { "allOf": [ { "type": "object", "properties": { "user_email": { "type": "string", "format": "email" } }, "required": [ "user_email" ] } ] }, "CopySobjectRequest": { "allOf": [ { "type": "object", "description": "Request to copy a security object.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptorPersisted" } }, "required": [ "key" ] }, { "$ref": "#/components/schemas/SobjectRequest" } ] }, "CountAccuracy": { "description": "An indicator of how accurate a count of objects is.", "oneOf": [ { "$ref": "#/components/schemas/CountAccuracyVariantExact" }, { "$ref": "#/components/schemas/CountAccuracyVariantApproximate" } ], "discriminator": { "propertyName": "$type", "mapping": { "Exact": "CountAccuracyVariantExact", "Approximate": "CountAccuracyVariantApproximate" } } }, "CountAccuracyVariantExact": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Exact" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "CountAccuracyVariantApproximate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Approximate" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "CountParams": { "allOf": [ { "type": "object", "properties": { "range_from": { "type": "integer" }, "range_to": { "type": "integer" }, "detailed_usage": { "type": "boolean" }, "saas_full_usage": { "type": "boolean" } } } ] }, "CreateGroupMembership": { "allOf": [ { "type": "object", "description": "Request for assigning a group membership to an (AppRole::Admin) app.", "properties": { "group_id": { "type": "string", "format": "uuid", "description": "The id of the target group" }, "membership": { "$ref": "#/components/schemas/AppGroupMembership" } }, "required": [ "group_id", "membership" ] } ] }, "CreateReplicationCredentialRequest": { "description": "A request to create a new admin app credential for account replication\npurposes. Note that the result is not immediately usable; further steps\nare needed in order to configure this and set it as the account's active\ncredential.", "oneOf": [ { "$ref": "#/components/schemas/CreateReplicationCredentialRequestVariantCertificate" } ], "discriminator": { "propertyName": "$type", "mapping": { "Certificate": "CreateReplicationCredentialRequestVariantCertificate" } } }, "CreateReplicationCredentialRequestVariantCertificate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Certificate" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "CredentialDetails": { "description": "Describes the authentication type for a given integration.\n\nThis type is the \"backbone\" to the credential objects in DSM as it's what\ncontains the relevant information and references to the sobject(s) needed to authenticate\nto external systems/services.", "oneOf": [ { "$ref": "#/components/schemas/CredentialDetailsVariantOci" }, { "$ref": "#/components/schemas/CredentialDetailsVariantAzure" } ], "discriminator": { "propertyName": "$type", "mapping": { "Oci": "CredentialDetailsVariantOci", "Azure": "CredentialDetailsVariantAzure" } } }, "CredentialDetailsVariantOci": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Oci" ] }, "body": { "$ref": "#/components/schemas/OciCredentialAuth" } }, "required": [ "$type", "body" ] } ] }, "CredentialDetailsVariantAzure": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Azure" ] }, "body": { "$ref": "#/components/schemas/AzureCredentialAuth" } }, "required": [ "$type", "body" ] } ] }, "CredentialId": { "description": "A wrapper type to provide better clarity that the id\nreferenced is an integration credential object.", "allOf": [ { "type": "string", "format": "uuid" } ] }, "CredentialSort": { "oneOf": [ { "title": "CredentialSortVariantByCredentialId", "type": "object", "description": "Sort the credentials on the basis of the credential_id", "properties": { "sort_by": { "type": "string", "pattern": "^credential_id:(?:asc|desc)$", "example": "credential_id:asc" } }, "required": [ "sort_by" ] }, { "title": "CredentialSortVariantByCredentialName", "type": "object", "description": "Sort credentials on the basis of the credential name", "properties": { "sort_by": { "type": "string", "pattern": "^credential_name:(?:asc|desc)$", "example": "credential_name:asc" } }, "required": [ "sort_by" ] } ] }, "CryptMode": { "description": "`CipherMode` or `RsaEncryptionPadding`, depending on the encryption algorithm.", "oneOf": [ { "$ref": "#/components/schemas/CipherMode" }, { "$ref": "#/components/schemas/RsaEncryptionPadding" } ] }, "CryptographicPolicy": { "allOf": [ { "type": "object", "properties": { "aes": { "$ref": "#/components/schemas/AesOptionsPolicy" }, "aria": { "$ref": "#/components/schemas/AriaOptionsPolicy" }, "des3": { "$ref": "#/components/schemas/Des3OptionsPolicy" }, "rsa": { "$ref": "#/components/schemas/RsaOptionsPolicy" }, "hmac": { "$ref": "#/components/schemas/HmacOptionsPolicy" }, "ec": { "$ref": "#/components/schemas/EcOptionsPolicy" }, "legacy_policy": { "$ref": "#/components/schemas/LegacyKeyPolicy" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true }, "des": { "$ref": "#/components/schemas/DesOptionsPolicy" }, "seed": { "$ref": "#/components/schemas/SeedOptionsPolicy" }, "dsa": { "$ref": "#/components/schemas/DsaOptionsPolicy" }, "kcdsa": { "$ref": "#/components/schemas/KcdsaOptionsPolicy" }, "eckcdsa": { "$ref": "#/components/schemas/EcKcdsaOptionsPolicy" }, "lms": { "$ref": "#/components/schemas/LmsOptionsPolicy" }, "xmss": { "$ref": "#/components/schemas/XmssOptionsPolicy" }, "mldsa": { "$ref": "#/components/schemas/MlDsaOptionsPolicy" }, "mlkem": { "$ref": "#/components/schemas/MlKemOptionsPolicy" }, "bip32": { "$ref": "#/components/schemas/Bip32OptionsPolicy" }, "slip10": { "$ref": "#/components/schemas/Slip10OptionsPolicy" }, "bls": { "$ref": "#/components/schemas/BlsOptionsPolicy" }, "opaque": { "$ref": "#/components/schemas/OpaqueOptionsPolicy" }, "secret": { "$ref": "#/components/schemas/SecretOptionsPolicy" }, "certificate": { "$ref": "#/components/schemas/CertificateOptionsPolicy" } } } ] }, "CustomAttributeSearchMetadata": { "allOf": [ { "type": "object", "properties": { "suggest": { "type": "boolean", "nullable": true } } } ] }, "CustomSubscriptionType": { "allOf": [ { "type": "object", "description": "Custom subscription type", "properties": { "max_plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_app": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_hsmg": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_operation": { "type": "integer", "nullable": true }, "max_tokenization_operation": { "type": "integer", "nullable": true }, "count_transient_ops": { "type": "boolean", "nullable": true }, "package_name": { "type": "string", "nullable": true }, "features": { "type": "array", "items": { "$ref": "#/components/schemas/SubscriptionFeatures" }, "nullable": true }, "add_ons": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "soft_ops_per_second_limit": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "DaysAhead": { "allOf": [ { "type": "object", "properties": { "days": { "type": "integer", "minimum": 0, "maximum": 65535 } }, "required": [ "days" ] } ] }, "DecapsulateKeyRequest": { "allOf": [ { "type": "object", "description": "Request body to perform key decapsulation.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "ciphertext": { "type": "string", "format": "byte", "description": "The encapsulated key" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the resulting symmetric key" }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the security group that the resulting Sobject should belong\nto. The application creating the Sobject must be a member of\nthis group. If no group is specified, the default group for the\nrequesting application will be used" }, "key_type": { "$ref": "#/components/schemas/ObjectType" }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Key size in bits of the resulting symmetric key" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Key operations of the decapsulated key" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the decapsulated key will be transient." } }, "required": [ "key", "ciphertext", "key_type" ] } ] }, "DecryptFinalRequest": { "allOf": [ { "type": "object", "description": "Request body to finalize a multi-part decryption.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "state": { "type": "string", "format": "byte", "description": "Current state of the encrypted cipher" }, "tag": { "type": "string", "format": "byte", "description": "Tag value of the encrypted cipher. Only applicable when using GCM mode." } }, "required": [ "state" ] } ] }, "DecryptFinalResponse": { "allOf": [ { "type": "object", "description": "Final response body of a multi-part decryption.", "properties": { "plain": { "type": "string", "format": "byte", "description": "Decrypted bytes" } }, "required": [ "plain" ] } ] }, "DecryptInitRequest": { "allOf": [ { "type": "object", "description": "Request body to initialize multi-part decryption.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "mode": { "$ref": "#/components/schemas/CipherMode" }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector. Required for symmetric algorithms." }, "ad": { "type": "string", "format": "byte", "description": "Authenticated data. Only applicable when using GCM mode." } } } ] }, "DecryptInitResponse": { "allOf": [ { "type": "object", "description": "Response body for initializing multi-part decryption.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The key id is returned for non-transient keys." }, "state": { "type": "string", "format": "byte", "description": "Opaque data, not to be interpreted or modified by the client and must be provided with next request." } }, "required": [ "state" ] } ] }, "DecryptRequest": { "allOf": [ { "type": "object", "description": "Request to decrypt data.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "cipher": { "type": "string", "format": "byte", "description": "Ciphertext bytes to be decrypted.\n\nNote that when performing format-preserving decryption (i.e.,\ndetokenization), the ciphertext should be encoded as UTF-8 bytes." }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector to use, required for modes that take IVs\n(and irrelevant otherwise)." }, "ad": { "type": "string", "format": "byte", "description": "The authenticated data to use. This is only applicable when using\nauthenticated decryption modes (like GCM or CCM)." }, "tag": { "type": "string", "format": "byte", "description": "The authentication tag, relevant for authenticated encryption modes\n(i.e., GCM or CCM), and otherwise irrelevant." }, "masked": { "type": "boolean", "nullable": true, "description": "Whether to returned a masked result when detokenizing (i.e., when\ndecrypting using the FF1/FPE mode). Defaults to false.\n\nThis field is only useful if the app has the `DECRYPT` permission.\nIn such situations, when this field is `true`, decryption returns\nmasked output. However, with the `MASKDECRYPT` permission, this field\nis ignored and detokenization will always return the masked output." }, "label": { "type": "string", "format": "byte", "description": "The optional label to use. Currently this field only serves as the\nrsa_oaep_label when the decryption algorithm is RSA and the mode is\nOaep. For other modes, providing this field causes a bad request error." } }, "required": [ "cipher" ] } ] }, "DecryptResponse": { "allOf": [ { "type": "object", "description": "Response of a decryption request.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the key used for decryption. Returned for non-transient keys." }, "plain": { "type": "string", "format": "byte", "description": "Decrypted plaintext bytes.\n\nNote that when performing format-preserving decryption (i.e.,\ndetokenization), the plaintext is encoded as UTF-8 bytes." } }, "required": [ "plain" ] } ] }, "DecryptUpdateRequest": { "allOf": [ { "type": "object", "description": "Request body for multi-part decryption.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "cipher": { "type": "string", "format": "byte", "description": "Encrypted bytes" }, "state": { "type": "string", "format": "byte", "description": "Current state of the encrypted cipher" } }, "required": [ "cipher", "state" ] } ] }, "DecryptUpdateResponse": { "allOf": [ { "type": "object", "description": "Response body of multi-part decryption.", "properties": { "plain": { "type": "string", "format": "byte", "description": "Decrypted bytes" }, "state": { "type": "string", "format": "byte", "description": "Current state of the multi part decrypted object.\nOpaque data, not to be interpreted or modified by the client and must be provided with next request." } }, "required": [ "plain", "state" ] } ] }, "DenyRequest": { "allOf": [ { "type": "object", "properties": { "reason": { "type": "string", "nullable": true } } } ] }, "DeriveKeyMechanismBip32MasterKey": { "allOf": [ { "type": "object", "properties": { "network": { "$ref": "#/components/schemas/Bip32Network" } }, "required": [ "network" ] } ] }, "DeriveKeyMechanismBip32HardenedChild": { "allOf": [ { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "index" ] } ] }, "DeriveKeyMechanismSlip10HardenedChild": { "allOf": [ { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "index" ] } ] }, "DeriveKeyMechanismHkdf": { "allOf": [ { "type": "object", "properties": { "hash_alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "info": { "type": "string", "format": "byte" }, "salt": { "type": "string", "format": "byte" } }, "required": [ "hash_alg" ] } ] }, "DeriveKeyMechanism": { "description": "Mechanism to be used when deriving a new key from an existing key.", "oneOf": [ { "title": "DeriveKeyMechanismVariantEncryptData", "type": "object", "properties": { "encrypt_data": { "$ref": "#/components/schemas/EncryptRequest" } }, "required": [ "encrypt_data" ] }, { "title": "DeriveKeyMechanismVariantBip32MasterKey", "type": "object", "properties": { "bip32_master_key": { "$ref": "#/components/schemas/DeriveKeyMechanismBip32MasterKey" } }, "required": [ "bip32_master_key" ] }, { "title": "DeriveKeyMechanismVariantBip32HardenedChild", "type": "object", "properties": { "bip32_hardened_child": { "$ref": "#/components/schemas/DeriveKeyMechanismBip32HardenedChild" } }, "required": [ "bip32_hardened_child" ] }, { "title": "DeriveKeyMechanismVariantSlip10MasterKey", "type": "object", "properties": { "slip10_master_key": { "type": "object", "properties": {} } }, "required": [ "slip10_master_key" ] }, { "title": "DeriveKeyMechanismVariantSlip10HardenedChild", "type": "object", "properties": { "slip10_hardened_child": { "$ref": "#/components/schemas/DeriveKeyMechanismSlip10HardenedChild" } }, "required": [ "slip10_hardened_child" ] }, { "title": "DeriveKeyMechanismVariantHkdf", "type": "object", "properties": { "hkdf": { "$ref": "#/components/schemas/DeriveKeyMechanismHkdf" } }, "required": [ "hkdf" ] } ] }, "DeriveKeyRequest": { "allOf": [ { "type": "object", "description": "Request body to derive a key.", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Activation date of the derived key" }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deactivation date of the derived key" }, "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the derived key. Key names must be unique within an account." }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the security group that this security object should belong to. The user or\napplication creating this security object must be a member of this group. If no group is\nspecified, the default group for the requesting application will be used." }, "key_type": { "$ref": "#/components/schemas/ObjectType" }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Key size of the derived key in bits." }, "mechanism": { "$ref": "#/components/schemas/DeriveKeyMechanism" }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether the derived key should have cryptographic operations enabled." }, "description": { "type": "string", "nullable": true, "description": "Description for derived key" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User-defined metadata for this key stored as key-value pairs." }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Optional array of key operations to be enabled for this security object. If not\nprovided the service will provide a default set of key operations. Note that if you\nprovide an empty array, all key operations will be disabled." }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the derived key will be transient." }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" }, "elliptic_curve": { "$ref": "#/components/schemas/EllipticCurve" } }, "required": [ "key_type", "mechanism" ] } ] }, "Des3Options": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "cipher_mode": { "$ref": "#/components/schemas/CipherMode" }, "random_iv": { "type": "boolean", "nullable": true }, "iv_length": { "type": "integer", "format": "int32", "nullable": true } } } ] }, "Des3OptionsPolicy": { "allOf": [ { "type": "object", "description": "Cryptographic policy for triple DES objects. Setting `key_sizes: [168]`\nforbids two-key triple DES.", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "DesOptions": { "allOf": [ { "type": "object", "properties": { "cipher_mode": { "$ref": "#/components/schemas/CipherMode" }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "DesOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "random_iv": { "type": "boolean", "nullable": true } } } ] }, "DigestAlgorithm": { "description": "A hash algorithm.", "type": "string", "enum": [ "BLAKE2B256", "BLAKE2B384", "BLAKE2B512", "BLAKE2S256", "RIPEMD160", "SSL3", "SHA1", "SHA224", "SHA256", "SHA384", "SHA512", "STREEBOG256", "STREEBOG512", "SHA3_224", "SHA3_256", "SHA3_384", "SHA3_512" ] }, "DigestRequest": { "allOf": [ { "type": "object", "description": "Request to compute the hash of arbitrary data.", "properties": { "alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "data": { "type": "string", "format": "byte", "description": "Raw binary data" } }, "required": [ "alg", "data" ] } ] }, "DigestResponse": { "allOf": [ { "type": "object", "description": "Response body of a hash operation.", "properties": { "digest": { "type": "string", "format": "byte", "description": "Hashed binary output" } }, "required": [ "digest" ] } ] }, "DsaOptions": { "allOf": [ { "type": "object", "properties": { "subgroup_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "DsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "EcKcdsaOptions": { "allOf": [ { "type": "object", "properties": { "hash_alg": { "$ref": "#/components/schemas/DigestAlgorithm" } } } ] }, "EcKcdsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "EcOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "elliptic_curves": { "type": "array", "items": { "$ref": "#/components/schemas/EllipticCurve" }, "nullable": true } } } ] }, "EffectiveKeyOperations": { "description": "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n SIGN:\n If this is set, the key can be used for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n\n MASKDECRYPT:\n If this is set, the key can be used for masked decryption only.\n\n", "type": "string", "enum": [ "SIGN", "VERIFY", "ENCRYPT", "DECRYPT", "WRAPKEY", "UNWRAPKEY", "DERIVEKEY", "TRANSFORM", "MACGENERATE", "MACVERIFY", "EXPORT", "APPMANAGEABLE", "HIGHVOLUME", "AGREEKEY", "ENCAPSULATE", "DECAPSULATE", "MASKDECRYPT" ] }, "EffectiveKeyPolicy": { "allOf": [ { "type": "object", "description": "An aggregation of policies and permissions of the session creator for\na security object.", "properties": { "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/EffectiveKeyOperations" }, "description": "Indicates allowed key operations for the security key." }, "export_policy": { "$ref": "#/components/schemas/ExportPolicy" } }, "required": [ "key_ops" ] } ] }, "EllipticCurve": { "description": "Identifies a standardized elliptic curve.", "type": "string", "enum": [ "X25519", "Ed25519", "Ed448", "X448", "SecP192K1", "SecP224K1", "SecP256K1", "NistP192", "NistP224", "NistP256", "NistP384", "NistP521", "Gost256A" ] }, "EncapsulateKeyRequest": { "allOf": [ { "type": "object", "description": "Request body to perform key encapsulation.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the resulting symmetric key" }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the security group that the resulting Sobject should belong\nto. The application creating this Sobject must be a member of\nthis group. If no group is specified, the default group for the\nrequesting application will be used." }, "key_type": { "$ref": "#/components/schemas/ObjectType" }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Key size in bits of the resulting key" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Key operations of the resulting key" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the resulting key will be transient." } }, "required": [ "key", "key_type" ] } ] }, "EncapsulateKeyResponse": { "allOf": [ { "type": "object", "description": "Result of an encapsulation request.", "properties": { "key": { "$ref": "#/components/schemas/Sobject" }, "ciphertext": { "type": "string", "format": "byte", "description": "The encapsulated key" } }, "required": [ "key", "ciphertext" ] } ] }, "EncryptFinalRequest": { "allOf": [ { "type": "object", "description": "Request body to finalize a multi-part encryption.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "state": { "type": "string", "format": "byte", "description": "Last state of the encrypted cipher" }, "tag_len": { "type": "integer", "nullable": true, "description": "Size of authentication tag.\nTag length is only applicable when using GCM mode." } }, "required": [ "state" ] } ] }, "EncryptFinalResponse": { "allOf": [ { "type": "object", "description": "Final response body of a multi-part encryption.", "properties": { "cipher": { "type": "string", "format": "byte", "description": "Final encrypted bytes" }, "tag": { "type": "string", "format": "byte", "description": "Tag is only returned for symmetric encryption with GCM mode." } }, "required": [ "cipher" ] } ] }, "EncryptInitRequest": { "allOf": [ { "type": "object", "description": "Request body to initialize multi-part encryption.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "mode": { "$ref": "#/components/schemas/CipherMode" }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector" }, "ad": { "type": "string", "format": "byte", "description": "Authenticated data, required for AEAD algorithms" } }, "required": [ "alg" ] } ] }, "EncryptInitResponse": { "allOf": [ { "type": "object", "description": "Response body of initializing multi-part encryption.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "Key id is returned for non-transient keys." }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector. Only returned for symmetric encryption." }, "state": { "type": "string", "format": "byte", "description": "Current state of the encrypted cipher.\nOpaque data, not to be interpreted or modified by the client and must be provided with next request." } }, "required": [ "state" ] } ] }, "EncryptRequest": { "allOf": [ { "type": "object", "description": "Request to encrypt data.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "plain": { "type": "string", "format": "byte", "description": "Plaintext bytes to be encrypted.\n\nNote that when performing format-preserving encryption (i.e.,\ntokenization), the plaintext should be encoded as UTF-8 bytes." }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector to use. This is only applicable to modes\nthat take IVs, and will be randomly generated if not specified." }, "ad": { "type": "string", "format": "byte", "description": "The authenticated data to use. This is only applicable when using\nauthenticated encryption modes (like GCM or CCM)." }, "tag_len": { "type": "integer", "nullable": true, "description": "The length of the authentication tag, in bits, for authenticated\nencryption modes (i.e., GCM or CCM). For other modes, this field\nis irrelevant." }, "label": { "type": "string", "format": "byte", "description": "The optional label to use. Currently this field only serves as the\nrsa_oaep_label when the encryption algorithm is RSA and the mode is\nOaep. For other modes, providing this field causes a bad request error." } }, "required": [ "alg", "plain" ] } ] }, "EncryptResponse": { "allOf": [ { "type": "object", "description": "Response of an encryption request.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the key used for encryption. Returned for non-transient keys." }, "cipher": { "type": "string", "format": "byte", "description": "Encrypted ciphertext bytes.\n\nNote that when performing format-preserving encryption (i.e.,\ntokenization), the ciphertext is encoded as UTF-8 bytes." }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector used during encryption. This is only\napplicable for certain symmetric encryption modes." }, "tag": { "type": "string", "format": "byte", "description": "When using the GCM or CCM modes, the tag is returned from\nauthenticated encryption." } }, "required": [ "cipher" ] } ] }, "EncryptUpdateRequest": { "allOf": [ { "type": "object", "description": "Request body for continuing multi part encryption", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "plain": { "type": "string", "format": "byte", "description": "Data bytes to be encrypted" }, "state": { "type": "string", "format": "byte", "description": "Last state of the encrypted cipher" } }, "required": [ "plain", "state" ] } ] }, "EncryptUpdateResponse": { "allOf": [ { "type": "object", "description": "Response body of multi-part encryption.", "properties": { "cipher": { "type": "string", "format": "byte", "description": "Encrypted bytes object from multi-part flow" }, "state": { "type": "string", "format": "byte", "description": "Current state of the encrypted cipher\nOpaque data, not to be interpreted or modified by the client and must be provided with next request." } }, "required": [ "cipher", "state" ] } ] }, "EsAuditLog": { "allOf": [ { "type": "object", "description": "Response parameters to show Audit log details.", "properties": { "action_type": { "$ref": "#/components/schemas/ActionType" }, "actor_type": { "type": "string", "description": "Actor Type\nAvailable values are: User, App & Plugin." }, "message": { "type": "string", "description": "Audit log message" }, "client_provided_context": { "type": "string", "nullable": true, "description": "Additional information not already captured by\n`message`. In some cases, the format might\nbe customized by the client." }, "severity": { "$ref": "#/components/schemas/SeverityLevel" }, "time": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$", "example": "2017-05-09T07:09:12Z", "description": "Time of Event" }, "acct_id": { "type": "string", "format": "uuid", "description": "UUID of account" }, "actor_id": { "type": "string", "format": "uuid", "description": "UUID of Actor (User, App or Plugin)" }, "group_ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "UUIDs of groups involved/used in event" }, "object_id": { "type": "string", "format": "uuid", "description": "UUID of entity affected by event. For instance, if a group is created object_id will be UUID of group." }, "client_ip": { "oneOf": [ { "type": "string", "format": "ipv4", "nullable": true }, { "type": "string", "format": "ipv6", "nullable": true } ], "description": "IP Address of client" }, "response_time": { "type": "object", "properties": { "secs": { "type": "integer" }, "nanos": { "type": "integer", "minimum": 0, "maximum": 999999999 } }, "required": [ "secs", "nanos" ], "nullable": true, "description": "Time taken for event/operation completion" } }, "required": [ "action_type", "actor_type", "message", "severity", "time", "acct_id", "actor_id", "group_ids", "object_id" ] } ] }, "EsAuditLogOuter": { "allOf": [ { "type": "object", "description": "Response structure of a single log.", "properties": { "_id": { "type": "string", "description": "UUID of audit log" }, "_source": { "$ref": "#/components/schemas/EsAuditLog" } }, "required": [ "_id", "_source" ] } ] }, "EsAuditQueryResponse": { "allOf": [ { "type": "object", "description": "Response for Audit log Query.", "properties": { "hits": { "type": "array", "items": { "$ref": "#/components/schemas/EsAuditLogOuter" }, "description": "List of audit logs." } }, "required": [ "hits" ] } ] }, "EsCountStatsLog": { "allOf": [ { "type": "object", "properties": { "buckets": { "type": "array", "items": { "$ref": "#/components/schemas/OuterEsBucket" } } }, "required": [ "buckets" ] } ] }, "EsStatsCountQueryResponse": { "allOf": [ { "type": "object", "properties": { "time": { "$ref": "#/components/schemas/EsCountStatsLog" } }, "required": [ "time" ] } ] }, "EsTotalTxn": { "allOf": [ { "type": "object", "properties": { "buckets": { "type": "array", "items": { "$ref": "#/components/schemas/InnerEsBucket" } } }, "required": [ "buckets" ] } ] }, "ExportComponentsResponse": { "allOf": [ { "type": "object", "description": "Export security object by components response.", "properties": { "components": { "type": "array", "items": { "$ref": "#/components/schemas/SobjectComponent" }, "description": "Key components" }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector" }, "tag": { "type": "string", "format": "byte", "description": "Tag, if required by the encryption mode." }, "key_kcv": { "type": "string", "description": "KCV for the exported key calculated by encryption" }, "key_kcv_cmac": { "type": "string", "description": "KCV for the exported key calculated by CMAC" }, "description": { "type": "string", "nullable": true, "description": "Description of the exported key" } }, "required": [ "components" ] } ] }, "ExportPolicyWrapped": { "allOf": [ { "type": "object", "description": "The sobject can only be exported wrapped by a key as specified\nby the `WrappingKeys`.", "properties": { "by": { "$ref": "#/components/schemas/WrappingKeys" } }, "required": [ "by" ] } ] }, "ExportPolicy": { "oneOf": [ { "$ref": "#/components/schemas/ExportPolicyVariantWrapped" }, { "$ref": "#/components/schemas/ExportPolicyVariantUnrestricted" } ], "discriminator": { "propertyName": "$type", "mapping": { "Wrapped": "ExportPolicyVariantWrapped", "Unrestricted": "ExportPolicyVariantUnrestricted" } } }, "ExportPolicyVariantWrapped": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Wrapped" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/ExportPolicyWrapped" } ] }, "ExportPolicyVariantUnrestricted": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Unrestricted" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "ExportSobjectComponentsRequest": { "allOf": [ { "type": "object", "description": "Request to Export a security object by components", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "wrap_key_params": { "$ref": "#/components/schemas/WrapKeyParams" }, "custodians": { "type": "array", "items": { "$ref": "#/components/schemas/Principal" }, "description": "Key holder identifier" }, "method": { "$ref": "#/components/schemas/SplittingMethod" }, "description": { "type": "string", "nullable": true, "description": "Description of the exported security object" } }, "required": [ "key", "custodians" ] } ] }, "ExternalEntropyInfo": { "allOf": [ { "type": "object", "description": "Information about the service version.", "properties": { "external_entropy_sources": { "type": "array", "items": { "$ref": "#/components/schemas/ExternalEntropySourceInfo" } } }, "required": [ "external_entropy_sources" ] } ] }, "ExternalEntropySourceInfo": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string", "nullable": true } }, "required": [ "name" ] } ] }, "ExternalKeyIdPkcs11": { "allOf": [ { "type": "object", "description": "A key in a legacy HSM. (DSM uses HSM Gateway to interact with\nsuch legacy HSMs using PKCS #11.)", "properties": { "id": { "type": "string", "format": "byte", "description": "The PKCS #11 ID of the key." }, "label": { "type": "string", "format": "byte", "description": "The PKCS #11 label of the key." } }, "required": [ "id", "label" ] } ] }, "ExternalKeyIdFortanix": { "allOf": [ { "type": "object", "description": "An sobject in DSM.", "properties": { "id": { "type": "string", "format": "uuid", "description": "The UUID assigned to the sobject." } }, "required": [ "id" ] } ] }, "ExternalKeyIdAzureKeyVault": { "allOf": [ { "type": "object", "description": "A key in Azure Key Vault.", "properties": { "version": { "type": "string", "format": "uuid", "description": "The version of the key." }, "label": { "type": "string", "description": "The name of the key." } }, "required": [ "version", "label" ] } ] }, "ExternalKeyIdGcpKeyRing": { "allOf": [ { "type": "object", "description": "A key in a GCP key ring.", "properties": { "version": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The version of the key." }, "label": { "type": "string", "description": "The label for the key." } }, "required": [ "version", "label" ] } ] }, "ExternalKeyIdOciVault": { "allOf": [ { "type": "object", "description": "A key in an OCI key vault.", "properties": { "oci_key_id": { "type": "string", "description": "The OCID of the OciKey" }, "oci_key_version": { "type": "string", "description": "The OCID of the OciKeyVersion" } }, "required": [ "oci_key_id", "oci_key_version" ] } ] }, "ExternalKeyId": { "description": "Identification information for an external key. There are multiple\nvariants of this type to represent the different kinds of keys DSM\nsupports (e.g., AWS, Azure, etc.).\n\nThis is not to be confused with the UUID assigned to a virtual key\nin DSM, which is most likely different from the ID that the source\nkey (outside of DSM) has.", "oneOf": [ { "$ref": "#/components/schemas/ExternalKeyIdPkcs11" }, { "$ref": "#/components/schemas/ExternalKeyIdFortanix" }, { "$ref": "#/components/schemas/ExternalKeyIdAwsKms" }, { "$ref": "#/components/schemas/ExternalKeyIdAzureKeyVault" }, { "$ref": "#/components/schemas/ExternalKeyIdGcpKeyRing" }, { "$ref": "#/components/schemas/ExternalKeyIdOciVault" }, { "type": "object", "properties": {} } ] }, "ExternalKeyIdAwsKms": { "allOf": [ { "type": "object", "properties": { "key_arn": { "type": "string", "description": "The Amazon Resource Name of the key." }, "key_id": { "type": "string", "description": "The key ID assigned to the key." } }, "required": [ "key_arn", "key_id" ] }, { "$ref": "#/components/schemas/AwsKeyMaterialId" } ] }, "ExternalKmsInfo": { "description": "Information about a specific external KMS key object.", "oneOf": [ { "$ref": "#/components/schemas/ExternalKmsInfoVariantAWS" }, { "$ref": "#/components/schemas/ExternalKmsInfoVariantOci" } ], "discriminator": { "propertyName": "type", "mapping": { "AWS": "ExternalKmsInfoVariantAWS", "Oci": "ExternalKmsInfoVariantOci" } } }, "ExternalKmsInfoVariantAWS": { "allOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "AWS" ] } }, "required": [ "type" ] }, { "$ref": "#/components/schemas/AwsKmsInfo" } ] }, "ExternalKmsInfoVariantOci": { "allOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Oci" ] } }, "required": [ "type" ] }, { "$ref": "#/components/schemas/OciVaultInfo" } ] }, "ExternalRole": { "allOf": [ { "type": "object", "properties": { "external_role_id": { "type": "string", "format": "uuid" }, "groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/ExternalRoleMapping" } }, "kind": { "$ref": "#/components/schemas/ExternalRoleKind" }, "last_synced": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "name": { "type": "string" }, "source_id": { "type": "string", "format": "uuid" }, "acct_id": { "type": "string", "format": "uuid" } }, "required": [ "external_role_id", "groups", "kind", "last_synced", "name", "source_id", "acct_id" ] } ] }, "ExternalRoleKind": { "description": "Type of an external role.", "type": "string", "enum": [ "ldap-group" ] }, "ExternalRoleMapping": { "allOf": [ { "type": "object", "properties": { "users": { "$ref": "#/components/schemas/UserGroupRole" }, "apps": { "type": "array", "items": { "$ref": "#/components/schemas/AppPermissions" }, "nullable": true } } } ] }, "ExternalRoleRequest": { "allOf": [ { "type": "object", "properties": { "add_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/ExternalRoleMapping" }, "nullable": true }, "del_groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true }, "kind": { "$ref": "#/components/schemas/ExternalRoleKind" }, "mod_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/ExternalRoleMapping" }, "nullable": true }, "name": { "type": "string", "nullable": true }, "source_id": { "type": "string", "format": "uuid", "nullable": true } } } ] }, "ExternalSobjectInfo": { "allOf": [ { "type": "object", "description": "This describes an external object -- specifically, information about its\nsource object.", "properties": { "id": { "$ref": "#/components/schemas/ExternalKeyId" }, "hsm_group_id": { "type": "string", "format": "uuid", "description": "The group which corresponds to the external HSM." }, "external_kms_info": { "$ref": "#/components/schemas/ExternalKmsInfo" } }, "required": [ "id", "hsm_group_id" ] } ] }, "Fido2MfaChallengeResponse": { "description": "Fido2 options when requesting assertion or attestation to a device", "oneOf": [ { "$ref": "#/components/schemas/PublicKeyCredentialCreationOptions" }, { "$ref": "#/components/schemas/PublicKeyCredentialRequestOptions" } ] }, "FidoAddDeviceRequest": { "allOf": [ { "type": "object", "description": "This contains the request for adding a FIDO device\nto user's data.\nInitially, `POST /sys/v1/session/config_2fa/new_challenge` needs\nto be called with protocol set to `fido2` and using that data,\n`navigator.credentials.create()` is called in the frontend.\nThe data returned by `create` is sent in this request. The data\nsent back here creates a new FIDO2 device for the user after\nthe payload is verified as per the rules stated in webauthn doc.", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "A user friendly name for the device." }, "attestationResult": { "$ref": "#/components/schemas/PublicKeyCredentialAuthenticatorAttestationResponse" } }, "required": [ "name", "attestationResult" ] } ] }, "ForgotPasswordRequest": { "allOf": [ { "type": "object", "description": "Initiate password reset sequence.", "properties": { "user_email": { "type": "string", "format": "email" }, "recaptcha_response": { "type": "string", "nullable": true } }, "required": [ "user_email" ] } ] }, "FpeCharSet": { "description": "The alphabet to use for an encrypted portion of a complex tokenization data type.\nCharacters should be specified as a list of pairs, where each pair [a, b] represents the\nrange of Unicode code points from a to b, with both bounds being inclusive. A single\ncode point can be specified as [c, c].\n\nNormally, each character is assigned a numeric value for FF1. The first character is\nassigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on,\nup to the size of the alphabet. Note that the order of the ranges matters; characters\nappearing in later ranges are assigned higher numerical values compared to earlier\ncharacters. For instance, in the FpeCharSet [['a', 'z'], ['0', '9']], the digits '0' to\n'9' are assigned values from 26 to 35, since they are listed after the 'a' to 'z' range.\n\nIn any case, ranges should not overlap with each other, and should not contain surrogate\ncode points.", "allOf": [ { "type": "array", "items": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "type": "string", "minLength": 1, "maxLength": 1 } } } ] }, "FpeChecksum": { "type": "string", "enum": [ "luhn" ] }, "FpeCode": { "allOf": [ { "type": "object", "description": "A set of words, repeated an amount of times.", "properties": { "words": { "$ref": "#/components/schemas/FpeWords" }, "min_repetitions": { "type": "integer", "nullable": true }, "max_repetitions": { "type": "integer", "nullable": true } }, "required": [ "words" ] } ] }, "FpeCompoundPartOr": { "allOf": [ { "type": "object", "description": "Represents an OR of multiple structures.\n\nImplementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing\nthe input, the backend will simply choose the first subpart that matches the current\nportion of the input, and tokenize/detokenize accordingly. If that choice results in\nan invalid parse of the rest of the input, the backend ***will not backtrack*** and\nwill simply return with an error.", "properties": { "or": { "type": "array", "items": { "$ref": "#/components/schemas/FpeDataPart" }, "description": "The actual subparts that make up this compound part." }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is\nset, any descendant subparts cannot contain any preserve-related fields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire OR should be masked when doing masked decryption. If this is set,\nany descendant subparts cannot contain any mask-related fields set." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "or" ] } ] }, "FpeCompoundPartConcat": { "allOf": [ { "type": "object", "description": "Represents a concatenation of multiple structures (in a particular order).", "properties": { "concat": { "type": "array", "items": { "$ref": "#/components/schemas/FpeDataPart" }, "description": "The actual subparts that make up this compound part, in order." }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire concat should be preserved as-is (i.e., not tokenized). If this is\nset, any descendant subparts cannot contain any preserve-related fields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire concat should be masked when doing masked decryption. If this is\nset, any descendant subparts cannot contain any mask-related fields set." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "concat" ] } ] }, "FpeCompoundPartMultiple": { "allOf": [ { "type": "object", "description": "Indicates a part that is possibly repeated multiple times.\n\nImplementation note: the backend parser is locally \"greedy\" and will attempt to match\nas many repetitions as possible. If this later results in an invalid parse of the rest\nof the input, the backend ***will not backtrack*** and will simply return with an error.", "properties": { "multiple": { "$ref": "#/components/schemas/FpeDataPart" }, "min_repetitions": { "type": "integer", "nullable": true, "description": "The minimum number of times the subpart may occur. (A value of 1 marks a single\noccurrence.)" }, "max_repetitions": { "type": "integer", "nullable": true, "description": "The maximum number of times the subpart may occur. (A value of 1 marks a single\noccurrence.)" }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this\nis set, the `multiple` subpart and its descendants cannot contain any preserve-related\nfields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire Multiple should be masked when doing masked decryption. If this is\nset, the `multiple` subpart and its descendants cannot contain any mask-related fields\nset." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "multiple" ] } ] }, "FpeCompoundPart": { "description": "Structure of a compound portion of a complex tokenization data type, itself composed of\nsmaller parts.", "oneOf": [ { "$ref": "#/components/schemas/FpeCompoundPartOr" }, { "$ref": "#/components/schemas/FpeCompoundPartConcat" }, { "$ref": "#/components/schemas/FpeCompoundPartMultiple" } ] }, "FpeConstraints": { "allOf": [ { "type": "object", "description": "Constraints on a portion of a complex tokenization data type.", "properties": { "luhn_check": { "type": "boolean", "nullable": true, "description": "Whether the token part contains a checksum that satisfies the Luhn formula. It is an\nerror to apply this constraint to non-numeric parts, or to have an encrypted part be\nunder more than one Luhn check constraint. Also, if an encrypted part has a Luhn check\nconstraint applied to it and may contain at least one digit that is not preserved, it\nmust not specify any other constraints." }, "num_gt": { "type": "integer", "nullable": true, "description": "Number that the token part should be greater than.\n\nThis constraint can only be specified on (non-compound) numeric encrypted parts\nguaranteed to preserve either everything or nothing at all. (For example, if an\nencrypted part consists of 5 to 10 digits, a `preserve` list that covers only the\nfirst five digits is not guaranteed to preserve everything, because if the input\nhappens to be six or more digits long, there will be at least one digit that\nremains unpreserved.)" }, "num_lt": { "type": "integer", "nullable": true, "description": "Number that the token part should be smaller than.\n\nThis constraint can only be specified on (non-compound) numeric encrypted parts\nguaranteed to preserve either everything or nothing at all. (For example, if an\nencrypted part consists of 5 to 10 digits, a `preserve` list that covers only the\nfirst five digits is not guaranteed to preserve everything, because if the input\nhappens to be six or more digits long, there will be at least one digit that\nremains unpreserved.)" }, "num_ne": { "type": "array", "items": { "type": "integer" }, "nullable": true, "description": "Numbers that the token part should not be equal to. It is an error to apply this\nconstraint to non-numeric parts." }, "date": { "$ref": "#/components/schemas/FpeDateConstraint" }, "applies_to": { "$ref": "#/components/schemas/FpeConstraintsApplicability" } } } ] }, "FpeConstraintsApplicability": { "description": "A structure indicating which subparts to which to apply a set of constraints.", "oneOf": [ { "$ref": "#/components/schemas/All" }, { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/FpeConstraintsApplicability" }, "description": "An object representing the individual subparts that the constraints should apply to. This\nis a BTreeMap where for each key-value pair, the key represents the \"index\" of the subpart\n(with the first subpart having index 0), and the value is an FpeConstraintsApplicability\ninstance. Note that a Multiple part only allows for one possible key-value pair, since it\nonly contains one subpart. For Concat parts, the key is the zero-based index of the subpart\nin the `concat` field, and for Multiple parts, this is always 0 (due to a Multiple having\nonly one subpart).\n\nThis cannot be used with OR parts; instead, specify constraints individually on each\nrelevant subpart." } ] }, "FpeDataPartLiteral": { "allOf": [ { "type": "object", "description": "A section of the data type that is not to be tokenized (e.g., a delimiter).\n\nUnlike preserved characters, literal characters are not used for FF1 tweaks.", "properties": { "literal": { "type": "array", "items": { "type": "string" }, "description": "The list of possible strings that make up this literal portion of the token.\nFor example, if a delimiter can either be a space or a dash, the list would\nbe `[\" \", \"-\"]`.\n\nImplementation note: the backend will pick the first choice that matches when\nwhen parsing the input. If this results in an invalid parse of the rest of the\ninput, the backend ***will not backtrack*** and will simply return with an error." } }, "required": [ "literal" ] } ] }, "FpeDataPart": { "description": "Structure for specifying (part of) a complex tokenization data type.", "oneOf": [ { "$ref": "#/components/schemas/FpeEncryptedPart" }, { "$ref": "#/components/schemas/FpeDataPartLiteral" }, { "$ref": "#/components/schemas/FpeCompoundPart" } ] }, "FpeDateDayMonthYear": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The\nYear part is allowed to be preserved, and the Day and Month parts are allowed to be\npreserved together. (The Day part cannot be preserved if the Month part is not, and vice\nversa.)", "properties": { "before": { "$ref": "#/components/schemas/FpeDayMonthYearDate" }, "after": { "$ref": "#/components/schemas/FpeDayMonthYearDate" } } } ] }, "FpeDateMonthDay": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart and a Day subpart. It is an error to\npreserve only the Month part or the Day part.", "properties": { "before": { "$ref": "#/components/schemas/FpeDayMonthDate" }, "after": { "$ref": "#/components/schemas/FpeDayMonthDate" } } } ] }, "FpeDateMonthYear": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart and a Year subpart. The Year part is\nallowed to be preserved; however, the Month part cannot be preserved by itself.", "properties": { "before": { "$ref": "#/components/schemas/FpeMonthYearDate" }, "after": { "$ref": "#/components/schemas/FpeMonthYearDate" } } } ] }, "FpeDate": { "description": "A structure for specifying a token part representing a date that occurs after a specified date\nand/or occurs before a specified date. Depending on the subparts that make up the date, one of\nthe three options is used.", "oneOf": [ { "title": "FpeDateVariantDayMonthYear", "type": "object", "properties": { "dmy_date": { "$ref": "#/components/schemas/FpeDateDayMonthYear" } }, "required": [ "dmy_date" ] }, { "title": "FpeDateVariantMonthDay", "type": "object", "properties": { "month_day_date": { "$ref": "#/components/schemas/FpeDateMonthDay" } }, "required": [ "month_day_date" ] }, { "title": "FpeDateVariantMonthYear", "type": "object", "properties": { "month_year_date": { "$ref": "#/components/schemas/FpeDateMonthYear" } }, "required": [ "month_year_date" ] } ] }, "FpeDateConstraint": { "description": "Possible date-related constraint types for a portion of a complex tokenization data type.", "oneOf": [ { "$ref": "#/components/schemas/FpeDate" }, { "$ref": "#/components/schemas/FpeDatePart" } ] }, "FpeDatePart": { "description": "Possible date-related constraint types that do not form a complete date (by themselves) for a\ncomplex tokenization data type.", "type": "string", "enum": [ "month", "day", "year" ] }, "FpeDayMonthDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a day and a month, for use in an\nFpeDate structure.", "properties": { "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." }, "day": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month\nand year. Here, February is treated as having 29 days." } }, "required": [ "month", "day" ] } ] }, "FpeDayMonthYearDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a day, month, and year, for use in\nan FpeDate structure.", "properties": { "year": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The year, which should be an integer less than 100000. Zero is treated as a leap year." }, "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." }, "day": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the\nmonth and year." } }, "required": [ "year", "month", "day" ] } ] }, "FpeEncryptedPart": { "allOf": [ { "type": "object", "description": "Structure of a tokenized portion of a complex tokenization data type.\n\nImplementation note: the backend parser is locally \"greedy\" and will attempt to match\nas many characters as possible. If this later results in an invalid parse of the rest\nof the input, the backend ***will not backtrack*** and will simply return with an error.", "properties": { "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The maximum allowed length for this part (in chars)." }, "char_set": { "$ref": "#/components/schemas/FpeCharSet" }, "cipher_char_set": { "$ref": "#/components/schemas/FpeCharSet" }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "$ref": "#/components/schemas/FpePreserveMask" }, "mask": { "$ref": "#/components/schemas/FpePreserveMask" } }, "required": [ "min_length", "max_length", "char_set" ] } ] }, "FpeFormatV2": { "allOf": [ { "type": "object", "description": "The second generation of Fortanix Tokenization scheme.", "properties": { "variants": { "type": "array", "items": { "$ref": "#/components/schemas/FpeVariant" }, "description": "A token is accepted if it is accepted by any of these variants. Note\ntokenization results depend on the order of this list." }, "mode": { "$ref": "#/components/schemas/FpeTokenizeMode" }, "input_processing": { "$ref": "#/components/schemas/FpeInputProcessing" } }, "required": [ "variants" ] } ] }, "FpeGroup": { "allOf": [ { "type": "object", "description": "A concatenation of codes, that can be repeated an amount of times. An\namount of leading and trailing characters can be preserved, this is,\nunmodified by tokenization.", "properties": { "codes": { "type": "array", "items": { "$ref": "#/components/schemas/FpeCode" } }, "min_repetitions": { "type": "integer", "nullable": true, "description": "A group cannot be omitted, thus this field must be positive if present." }, "max_repetitions": { "type": "integer", "nullable": true }, "preserve": { "type": "array", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "nullable": true, "description": "Amount of leading and trailing characters to preserve in this group.\nPreserved characters are the leading/trailing characters of the whole\ngroup, not individual repetitions." } }, "required": [ "codes" ] } ] }, "FpeInputDefaultProcessing": { "type": "string", "enum": [ "strip", "reject" ] }, "FpeInputProcessingPassthroughSpecific": { "allOf": [ { "type": "object", "properties": { "passthrough": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 1 } }, "other": { "$ref": "#/components/schemas/FpeInputDefaultProcessing" } }, "required": [ "passthrough", "other" ] } ] }, "FpeInputProcessing": { "description": "Options to apply some pre- and post-processing to the input.", "oneOf": [ { "title": "FpeInputProcessingVariantStripUnknown", "type": "string", "enum": [ "strip_unknown" ] }, { "title": "FpeInputProcessingVariantPassthroughUnknown", "type": "string", "enum": [ "passthrough_unknown" ] }, { "title": "FpeInputProcessingVariantPassthroughSpecific", "type": "object", "properties": { "passthrough_specific": { "$ref": "#/components/schemas/FpeInputProcessingPassthroughSpecific" } }, "required": [ "passthrough_specific" ] } ] }, "FpeMonthYearDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a month and a year, for use in an\nFpeDate structure.", "properties": { "year": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The year, which should be an integer less than 100000. Zero is treated as a leap year." }, "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." } }, "required": [ "year", "month" ] } ] }, "FpeOptionsAdvanced": { "allOf": [ { "type": "object", "description": "Advanced FPE options. It is recommended to use this for\nspecifying any FPE options, as it is more expressive than\nFpeOptionsBasic.", "properties": { "format": { "$ref": "#/components/schemas/FpeDataPart" }, "description": { "type": "string", "nullable": true, "description": "The user-provided name for the data type." } }, "required": [ "format" ] } ] }, "FpeOptionsV2": { "allOf": [ { "type": "object", "properties": { "format_v2": { "$ref": "#/components/schemas/FpeFormatV2" }, "description": { "type": "string", "nullable": true } }, "required": [ "format_v2" ] } ] }, "FpeOptions": { "description": "FPE-specific options (for specifying the format of the\ndata to be encrypted)", "oneOf": [ { "$ref": "#/components/schemas/FpeOptionsBasic" }, { "$ref": "#/components/schemas/FpeOptionsAdvanced" }, { "$ref": "#/components/schemas/FpeOptionsV2" } ] }, "FpeOptionsBasic": { "allOf": [ { "type": "object", "description": "Basic FPE-specific options. This is suitable for simple datatypes\nthat consist of ASCII digits, or ASCII digits and uppercase letters.", "properties": { "radix": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The FPE base for the input data (i.e., the size of the character\nset of the datatype). This must be an integer from 2 to 36.\n\nThis also implicitly defines the alphabet of the datatype. A base\nfrom 2 to 10 implies ASCII digits (e.g., a radix of 3 can be used\nto represent a ternary string), and a base from 11 to 36 implies\nASCII digits and uppercase letters (e.g., a radix of 16 can be" }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The minimum allowed length for the input data." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The maximum allowed length for the input data." }, "preserve": { "type": "array", "items": { "type": "integer", "format": "int64" }, "description": "The list of indices of characters to be preserved while performing encryption/decryption.\nIndices are Python-like; i.e., nonnegative indices index from the beginning of the input\n(where 0 is the first character), and negative indices index from the end of the input.\n(where -1 is the last character, -2 is second to last, and so on).\n\nAny preserved characters will be concatenated together and used as an FF1 tweak. For example,\nif the input data is \"abcd\", and the first and last characters are to be preserved, the FF1\ntweak will be the ASCII bytes of the string \"ad\"." }, "mask": { "type": "array", "items": { "type": "integer", "format": "int64" }, "nullable": true, "description": "The list of indices of characters to be masked while performing masked decryption.\nIndices are Python-like; i.e., nonnegative indices index from the beginning of the input\n(where 0 is the first character), and negative indices index from the end of the input.\n(where -1 is the last character, -2 is second to last, and so on)." }, "luhn_check": { "type": "boolean", "nullable": true, "description": "Whether the encrypted/decrypted data contains a checksum digit that satisfies the Luhn\nformula. (The output ciphertext/plaintext will also contain a Luhn checksum digit.)" }, "name": { "type": "string", "nullable": true, "description": "The user-provided name for the data type that represents the input data." } }, "required": [ "radix", "min_length", "max_length", "preserve" ] } ] }, "FpePreserveMask": { "description": "A structure indicating which indices in an encrypted part to mask or preserve.", "oneOf": [ { "$ref": "#/components/schemas/All" }, { "type": "array", "items": { "type": "integer", "format": "int64" }, "description": "Indicates that only certain characters are to be preserved or masked. Indices are\nPython-like; i.e., negative indices index from the end of the token portion, with\nindex -1 denoting the last character. (Indicating that nothing should be preserved\nor masked can be done via an empty list, which is the default value for this enum.)" } ] }, "FpeSection": { "allOf": [ { "type": "object", "description": "A concatenation of groups, optionally including a checksum.", "properties": { "groups": { "type": "array", "items": { "$ref": "#/components/schemas/FpeGroup" } }, "checksum": { "$ref": "#/components/schemas/FpeChecksum" } }, "required": [ "groups" ] } ] }, "FpeTokenizeMode": { "description": "How to tokenize a given input. The most secure option is \"PreserveFormat\".", "type": "string", "enum": [ "preserve_format", "preserve_variant", "preserve_length" ] }, "FpeVariant": { "allOf": [ { "type": "object", "description": "A concatenation of sections.", "properties": { "sections": { "type": "array", "items": { "$ref": "#/components/schemas/FpeSection" } } }, "required": [ "sections" ] } ] }, "FpeWordsIntegerRanges": { "allOf": [ { "type": "object", "description": "A union of positive integer ranges.\n\n```plain\nExamples: [[0, 400], [402, 1000]]\n= {0000, 0001, ..., 0400, 0402, ..., 1000}\n\n[[1,3], [49, 50]] with optional padding of length 8\n= {00000001, 00000002, 00000003, 00000049, 00000050}\n(accepts 1, 01, 00002, 49, 000050, etc)\n```", "properties": { "ranges": { "type": "array", "items": { "type": "array", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2 } }, "padding_required": { "type": "boolean", "description": "If this field is true, this set accepts only numeric strings\npadded to the length given by the maximum integer in the range\nset." } }, "required": [ "ranges", "padding_required" ] } ] }, "FpeWordsCustom": { "allOf": [ { "type": "object", "properties": { "list": { "type": "array", "items": { "type": "string" }, "description": "Examples: {\"john\", \"jane\"}, {\".\", \"-\", \"_\", \"@\", \" \"}" } }, "required": [ "list" ] } ] }, "FpeWords": { "description": "A set of fixed-length strings.", "oneOf": [ { "title": "FpeWordsVariantIntegerRanges", "type": "object", "properties": { "integer_ranges": { "$ref": "#/components/schemas/FpeWordsIntegerRanges" } }, "required": [ "integer_ranges" ] }, { "title": "FpeWordsVariantAlphabet", "type": "object", "properties": { "alphabet": { "$ref": "#/components/schemas/FpeCharSet" } }, "required": [ "alphabet" ] }, { "title": "FpeWordsVariantCustom", "type": "object", "properties": { "custom": { "$ref": "#/components/schemas/FpeWordsCustom" } }, "required": [ "custom" ] } ] }, "FreemiumSubscriptionType": { "allOf": [ { "type": "object", "properties": { "max_app": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_hsmg": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_operation": { "type": "integer", "nullable": true }, "max_tokenization_operation": { "type": "integer", "nullable": true }, "max_plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "GcpAppPermissions": { "description": "\n\n\n CRYPTO_SPACE_GET_INFO:\n\n\n CRYPTO_SPACE_GET_PUBLIC_KEY:\n\n", "type": "string", "enum": [ "CRYPTO_SPACE_GET_INFO", "CRYPTO_SPACE_GET_PUBLIC_KEY" ] }, "GcpKeyRingConfig": { "allOf": [ { "type": "object", "properties": { "service_account_email": { "type": "string", "description": "Email for the service account to be used." }, "project_id": { "type": "string", "description": "The project ID is a unique identifier for a project" }, "location": { "type": "string", "description": "For a given project in GCP KMS, resources can be created in one of many locations.\nThese represent the geographical regions where a resource is stored and can be accessed.\nA key's location impacts the performance of applications using the key.\nhttps://cloud.google.com/kms/docs/locations" }, "key_ring": { "type": "string", "nullable": true, "description": "A key ring organizes keys in a specific GCP location and allows you to manage\naccess control on groups of keys.\nhttps://cloud.google.com/kms/docs/resource-hierarchy#key_rings" }, "private_key": { "type": "string", "format": "byte", "description": "Private component of the service account key pair that can be\nobtained from the GCP cloud console. It is used to authenticate\nthe requests made by DSM to the GCP cloud." } }, "required": [ "service_account_email", "project_id", "location" ] } ] }, "GetAccountParams": { "allOf": [ { "type": "object", "properties": { "with_totals": { "type": "boolean" }, "previous_id": { "type": "string", "format": "uuid" }, "limit": { "type": "integer" } } }, { "$ref": "#/components/schemas/AccountSort" } ] }, "GetAllHmgScansResponse": { "allOf": [ { "type": "object", "description": "Information about a group's recent scans.", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Scan" }, "description": "List of all tracked scans, from newest to oldest." } }, "required": [ "items" ] } ] }, "GetAllServicesResponse": { "allOf": [ { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Service" } } }, "required": [ "items" ] } ] }, "GetAppGroupMemberships": { "allOf": [ { "type": "object", "description": "The response for the GetAllGroupMembership endpoint", "properties": { "metadata": { "$ref": "#/components/schemas/GroupMetaData" }, "items": { "type": "array", "items": { "$ref": "#/components/schemas/AppGroupMembership" }, "description": "The collection of group memberships the entity is a member in" } }, "required": [ "metadata", "items" ] } ] }, "GetAppParams": { "allOf": [ { "type": "object", "description": "Query params for individual App APIs", "properties": { "group_permissions": { "type": "boolean", "description": "Flag specifying if group permissions should be returned with the app group." }, "role": { "type": "string", "description": "The App's role." } } } ] }, "GetGroupsParams": { "allOf": [ { "type": "object", "properties": { "limit": { "type": "integer" }, "filter": { "type": "string", "description": "If specified, only groups matching this `filter` are returned.\n\nThe following fields can be referenced in the filter:\n- `name`\n- `created_at`\n- `description`\n- `wrapping_key_name`" }, "offset": { "type": "integer", "description": "Number of groups to skip" }, "continuation_token": { "type": "string", "description": "Continuation token to continue getting results. It must be the same\ntoken returned from the backend from a previous call, or empty.\n\nExistence of this query parameter controls the response (and the backend behavior):\n- If specified (including an empty value), the backend returns metadata alongside\nthe collection of groups. The metadata will potentially contain a fresh `continuation_token`.\n\nNote: If there is a `limit` specified in the request and DSM returns `limit`-many items in the\nresponse, it will still include a fresh continuation token if there are more items in the collection.\nAdditionally, unlike other query parameters, `limit` is not required to remain unchanged in a chain of\nrequests with `continuation_token`s.\n- If omitted, the backend returns just a collection of groups with no metadata." } } }, { "$ref": "#/components/schemas/GroupSort" } ] }, "GetMarketplaceParams": { "allOf": [ { "type": "object", "properties": { "repo_url": { "type": "string" } }, "required": [ "repo_url" ] } ] }, "GetSobjectParams": { "allOf": [ { "type": "object", "description": "Parameters to show sobject details.", "properties": { "view": { "$ref": "#/components/schemas/SobjectEncoding" }, "show_destroyed": { "type": "boolean", "description": "Show destroyed security object(s)." }, "show_deleted": { "type": "boolean", "description": "Show deleted security object(s)." }, "show_value": { "type": "boolean", "description": "Show value of security object(s)." }, "show_pub_key": { "type": "boolean", "description": "Show public key of security objects(s) if present." }, "show_effective_export_policy": { "type": "boolean", "description": "Whether to include the effective export policy in the response." } } } ] }, "GetUsageResponse": { "allOf": [ { "type": "object", "description": "The response from the account stats API (`/sys/v1/accounts/:acct_id/usage_report`).", "properties": { "num_operations": { "type": "integer", "description": "The count of all operations performed in the account. This value includes **both**\nkey management (e.g., CRUD ops) and cryptographic operations (e.g., encrypt/decrypt).\n\nTo illustrate, here are a few examples:\n- If you have a key which was copied to another group and then do a key rotation (with the key-links also being updated), the `num_operations` count will increase by two.\n- If you have a key and do an encrypt operation this will increase the `num_operations` and `encryption_operations` each by one.\n- If you delete a key, this will increase the only `num_operations` by one." }, "encryption_operations": { "type": "integer", "nullable": true }, "decryption_operations": { "type": "integer", "nullable": true }, "sign_operations": { "type": "integer", "nullable": true }, "verify_operations": { "type": "integer", "nullable": true }, "tokenization_operations": { "type": "integer", "nullable": true }, "detokenization_operations": { "type": "integer", "nullable": true }, "secrets_operations": { "type": "integer", "nullable": true }, "plugin_invoke_operations": { "type": "integer", "nullable": true }, "apps": { "$ref": "#/components/schemas/AppCreditsUsage" }, "plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "sobjects": { "type": "integer", "nullable": true, "description": "The total number of sobjects in the account, or\nan approximation thereof. This field is present if\nthe `saas_full_usage` query parameter is specified\nwhen retrieving account usage statistics.\n\nNote that all sobjects in the account are counted,\nregardless of whether the user has access to them." }, "sobjects_accuracy": { "$ref": "#/components/schemas/CountAccuracy" }, "hsm_gateway": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "operation_top_app": { "type": "object", "additionalProperties": { "type": "integer" }, "nullable": true }, "operation_top_sobject": { "type": "object", "additionalProperties": { "type": "integer" }, "nullable": true } }, "required": [ "num_operations" ] } ] }, "GetUserParams": { "allOf": [ { "type": "object", "properties": { "with_groups": { "$ref": "#/components/schemas/WithGroups" } } } ] }, "GetUserPermissionsParams": { "allOf": [ { "type": "object", "properties": { "with_implied": { "type": "boolean", "description": "If `true`, implied permissions are added in the output. For example, if\npermission A implies permission B, and the user has permission A, the\noutput will include both A and B if this is set to `true`. If this is\nset to `false`, B will only be returned if it was assigned to the user\ndirectly." } } } ] }, "GetUserPermissionsResponse": { "allOf": [ { "type": "object", "properties": { "account": { "type": "array", "items": { "$ref": "#/components/schemas/AccountPermissions" }, "description": "User's permissions in the account." }, "all_groups": { "type": "array", "items": { "$ref": "#/components/schemas/GroupPermissions" }, "nullable": true, "description": "User's permissions in all groups. Note that this will only be returned\nif the user has one or more all-groups roles." }, "groups": { "type": "object", "additionalProperties": { "type": "array", "items": { "$ref": "#/components/schemas/GroupPermissions" } }, "description": "User's permissions in groups." } }, "required": [ "account", "groups" ] } ] }, "GoogleAccessReason": { "description": "An access reason provided by Google when making EKMS API calls.", "type": "string", "enum": [ "REASON_UNSPECIFIED", "CUSTOMER_INITIATED_SUPPORT", "GOOGLE_INITIATED_SERVICE", "THIRD_PARTY_DATA_REQUEST", "GOOGLE_INITIATED_REVIEW", "CUSTOMER_INITIATED_ACCESS", "GOOGLE_INITIATED_SYSTEM_OPERATION", "REASON_NOT_EXPECTED", "MODIFIED_CUSTOMER_INITIATED_ACCESS", "MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION", "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT", "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING" ] }, "GoogleAccessReasonPolicy": { "allOf": [ { "type": "object", "description": "Policy specifying acceptable access reasons\nby Google Service Account at App or Sobject level.", "properties": { "allow": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/GoogleAccessReason" }, "description": "Set of allowed Google Access reasons." }, "allow_missing_reason": { "type": "boolean", "description": "Accept incoming requests which do not specify any access reasons." } }, "required": [ "allow", "allow_missing_reason" ] } ] }, "GoogleServiceAccountCredential": { "allOf": [ { "type": "object", "properties": { "access_reason_policy": { "$ref": "#/components/schemas/GoogleAccessReasonPolicy" }, "groups": { "type": "object", "additionalProperties": { "type": "array", "items": { "$ref": "#/components/schemas/GcpAppPermissions" } }, "nullable": true, "description": "Mapping for all groups an application is part of and the Gcp specific permissions it has within each of those groups." } } } ] }, "GoogleServiceAccountKey": { "allOf": [ { "type": "object", "description": "A Google service account key object. See https://cloud.google.com/video-intelligence/docs/common/auth.", "properties": { "type": { "type": "string" }, "project_id": { "type": "string" }, "private_key_id": { "type": "string" }, "private_key": { "type": "string" }, "client_email": { "type": "string" } }, "required": [ "type", "project_id", "private_key_id", "client_email" ] } ] }, "Group": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "approval_policy": { "$ref": "#/components/schemas/GroupApprovalPolicy" }, "auto_scan": { "$ref": "#/components/schemas/AutoScanSettings" }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurations" }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "creator": { "$ref": "#/components/schemas/Principal" }, "cryptographic_policy": { "$ref": "#/components/schemas/CryptographicPolicy" }, "custodian_policy": { "$ref": "#/components/schemas/QuorumPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "export_policy": { "$ref": "#/components/schemas/ExportPolicy" }, "google_access_reason_policy": { "$ref": "#/components/schemas/GoogleAccessReasonPolicy" }, "group_id": { "type": "string", "format": "uuid" }, "hmg": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/HmgConfig" }, "nullable": true }, "hmg_redundancy": { "$ref": "#/components/schemas/HmgRedundancyScheme" }, "hmg_segregation": { "type": "boolean", "nullable": true }, "hmg_sync": { "type": "boolean", "nullable": true }, "key_history_policy": { "$ref": "#/components/schemas/KeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/KeyMetadataPolicy" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "wrapping_key_name": { "$ref": "#/components/schemas/WrappingKeyName" } }, "required": [ "acct_id", "client_configurations", "created_at", "creator", "group_id", "name" ] } ] }, "GroupApprovalPolicy": { "allOf": [ { "type": "object", "description": "Group approval policy.", "properties": { "protect_manage_operations": { "type": "boolean", "nullable": true, "description": "Deprecated, left this for backward compatibility.\nWhen this is true, manage operations on security objects require approval." }, "protect_permissions": { "type": "array", "items": { "$ref": "#/components/schemas/QuorumGroupPermissions" }, "nullable": true, "description": "Use QuorumGroupPermissions to represent operations that require approval." }, "protect_crypto_operations": { "type": "boolean", "nullable": true, "description": "When this is true, cryptographic operations on security objects require approval." } } }, { "$ref": "#/components/schemas/QuorumPolicy" } ] }, "GroupMembershipRequest": { "allOf": [ { "type": "object", "description": "Type for updating a group membership", "properties": { "add_group_roles": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/AppGroupRoleDescriptor" }, "nullable": true, "description": "The set of roles to add" }, "del_group_roles": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/AppGroupRoleDescriptor" }, "nullable": true, "description": "The set of roles to remove" } } } ] }, "GroupMetaData": { "allOf": [ { "type": "object", "description": "Additional information or context regarding the groups the entity\nholds membership in", "properties": { "all_groups": { "type": "boolean", "description": "Whether the entity has been assigned an exclusive \"all groups role\"" } }, "required": [ "all_groups" ] } ] }, "GroupPermissions": { "description": "\n\n\n CREATE_GROUP_APPROVAL_POLICY:\n Permission to create group-level approval policy. Note that\n updating/deleting the approval policy is protected by the approval\n policy itself. Implies `GET_GROUP`.\n\n\n UPDATE_GROUP_EXTERNAL_LINKS:\n Permission to update external HSM/KMS configurations. Note that this\n is only useful for groups backed by external HSM/KMS. Implies\n `GET_GROUP`.\n\n\n MANAGE_GROUP_CLIENT_CONFIGS:\n Permission to manage group-level client configurations. Implies\n `GET_GROUP`.\n\n\n UPDATE_GROUP_PROFILE:\n Permission to update name, description and custom metadata of the\n group. Implies `GET_GROUP`.\n\n\n DELETE_GROUP:\n Permission to delete the group. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES_FOR_APPS:\n Permission to map external roles to DSM groups for apps authorized\n through LDAP. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES_FOR_USERS:\n Permission to map external roles to DSM groups for users authorized\n through LDAP. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES:\n Currently implies `MAP_EXTERNAL_ROLES_FOR_APPS`,\n `MAP_EXTERNAL_ROLES_FOR_USERS`, and `GET_GROUP` permissions.\n\n\n ADD_USERS_TO_GROUP:\n Permission to add users to the group.\n\n\n DELETE_USERS_FROM_GROUP:\n Permission to remove users from the group.\n\n\n UPDATE_USERS_GROUP_ROLE:\n Permission to change users' role in the group.\n\n\n MANAGE_GROUP_USERS:\n Currently implies `ADD_USERS_TO_GROUP`, `DELETE_USERS_FROM_GROUP`,\n and `UPDATE_USERS_GROUP_ROLE` permissions.\n\n\n CREATE_GROUP_SOBJECT_POLICIES:\n Permission to create various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n UPDATE_GROUP_SOBJECT_POLICIES:\n Permission to update various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n DELETE_GROUP_SOBJECT_POLICIES:\n Permission to delete various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n MANAGE_GROUP_SOBJECT_POLICIES:\n Currently implies `CREATE_GROUP_SOBJECT_POLICIES`,\n `UPDATE_GROUP_SOBJECT_POLICIES`, `DELETE_GROUP_SOBJECT_POLICIES`,\n and `GET_GROUP` permissions.\n\n\n CREATE_GROUP_CUSTODIAN_POLICY:\n Permission to create key custodian policy for the group. Implies\n `GET_GROUP`.\n\n\n UPDATE_GROUP_CUSTODIAN_POLICY:\n Permission to update group's key custodian policy. Implies\n `GET_GROUP`.\n\n\n DELETE_GROUP_CUSTODIAN_POLICY:\n Permission to delete group's key custodian policy. Implies\n `GET_GROUP`.\n\n\n MANAGE_GROUP_CUSTODIAN_POLICY:\n Currently implies `CREATE_GROUP_CUSTODIAN_POLICY`,\n `UPDATE_GROUP_CUSTODIAN_POLICY`, `DELETE_GROUP_CUSTODIAN_POLICY`,\n and `GET_GROUP` permissions.\n\n\n CREATE_APPS:\n Permission to create cryptographic apps. Implies `GET_APPS`.\n\n\n UPDATE_APPS:\n Permission to update cryptographic apps. Implies `GET_APPS`.\n\n\n RETRIEVE_APP_SECRETS:\n Permission to retrieve cryptographic apps' secrets. Note that not\n all cryptographic app credentials contain secrets. If a\n cryptographic app's credential does not contain any secrets,\n `GET_APPS` permission is sufficient to call the `GetAppCredential`\n API. Implies `GET_APPS`.\n\n\n DELETE_APPS:\n Permission to delete cryptographic apps. Implies `GET_APPS`.\n\n\n MANAGE_APPS:\n Currently implies `CREATE_APPS`, `UPDATE_APPS`,\n `RETRIEVE_APP_SECRETS`, `DELETE_APPS`, and `GET_APPS` permissions.\n\n\n CREATE_PLUGINS:\n Permission to create plugins. Implies `GET_PLUGINS`.\n For creating a plugin, following group permissions are also required\n in each group plugin is being added, to prevent privilege escalation:\n `CREATE_SOBJECTS`, `EXPORT_SOBJECTS`, `COPY_SOBJECTS`,\n `WRAP_SOBJECTS`, `UNWRAP_SOBJECTS`, `ENCAPSULATE_SOBJECTS`, `DECAPSULATE_SOBJECTS`,\n `DERIVE_SOBJECTS`, `TRANSFORM_SOBJECTS`, `UPDATE_SOBJECTS_ENABLED_STATE`,\n `ROTATE_SOBJECTS`, `DELETE_SOBJECTS`, `REVOKE_SOBJECTS`, `ACTIVATE_SOBJECTS`,\n `MOVE_SOBJECTS`, `UPDATE_KEY_OPS`, `UPDATE_SOBJECT_POLICIES`, `UPDATE_SOBJECTS_PROFILE`,\n `GET_GROUP`, `GET_SOBJECTS`, `GET_APPS`, `GET_PLUGINS`, `GET_AUDIT_LOGS`\n Following account permissions are required as well:\n `GET_ALL_USERS`\n\n\n UPDATE_PLUGINS:\n Permission to update plugins. Implies `GET_PLUGINS`.\n For updating a plugin, following group permissions are also required\n in each group plugin is being added, to prevent privilege escalation:\n `CREATE_SOBJECTS`, `EXPORT_SOBJECTS`, `COPY_SOBJECTS`, `WRAP_SOBJECTS`, `UNWRAP_SOBJECTS`,\n `ENCAPSULATE_SOBJECTS`, `DECAPSULATE_SOBJECTS`, `UPDATE_SOBJECTS_ENABLED_STATE`,\n `ROTATE_SOBJECTS`, `DELETE_SOBJECTS`, `REVOKE_SOBJECTS`, `ACTIVATE_SOBJECTS`,\n `MOVE_SOBJECTS`, `UPDATE_KEY_OPS`, `UPDATE_SOBJECT_POLICIES`, `UPDATE_SOBJECTS_PROFILE`,\n `GET_GROUP`, `GET_SOBJECTS`, `GET_APPS`, `GET_PLUGINS`, `GET_AUDIT_LOGS`\n Following account permissions are required as well while adding\n new groups:\n `GET_ALL_USERS`\n\n\n INVOKE_PLUGINS:\n Permission to invoke plugins. Implies `GET_PLUGINS`.\n\n\n DELETE_PLUGINS:\n Permission to delete plugins. Implies `GET_PLUGINS`.\n\n\n MANAGE_PLUGINS:\n Currently implies `CREATE_PLUGINS`, `UPDATE_PLUGINS`,\n `INVOKE_PLUGINS`, `DELETE_PLUGINS`, and `GET_PLUGINS` permissions.\n\n\n CREATE_SOBJECTS:\n Permission to create security objects. This permission is required\n for APIs that result in creation of a new security object including:\n Generate, Import, Unwrap. Also required in destination group when\n moving a key to a different group or when copying a key. Implies\n `GET_SOBJECTS`.\n\n\n EXPORT_SOBJECTS:\n Permission to export security objects. This permission is required\n for Export, ExportByComponents, Copy (depending on destination\n group), Restore, and Wrap (for wrapped security object) APIs.\n Implies `GET_SOBJECTS`.\n\n\n COPY_SOBJECTS:\n Permission to copy security objects. This permission is required in\n the source group when calling the Copy API. Implies `GET_SOBJECTS`.\n\n\n WRAP_SOBJECTS:\n Permission to wrap security objects. This permission is required in\n the wrapping security object's group. Implies `GET_SOBJECTS`.\n\n\n UNWRAP_SOBJECTS:\n Permission to unwrap security objects. This permission is required\n in the unwrapping security object's group. Implies `GET_SOBJECTS`.\n\n\n DERIVE_SOBJECTS:\n Permission to derive other security objects. Implies `GET_SOBJECTS`.\n\n\n TRANSFORM_SOBJECTS:\n Permission to transform security objects. Implies `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECTS_ENABLED_STATE:\n Permission to enable/disable security objects. Implies\n `GET_SOBJECTS`.\n\n\n ROTATE_SOBJECTS:\n Permission to rotate (a.k.a. \"rekey\") security objects. Implies\n `GET_SOBJECTS`.\n\n\n DELETE_SOBJECTS:\n Permission to delete security objects. Implies `GET_SOBJECTS`.\n\n\n DESTROY_SOBJECTS:\n Permission to destroy security objects. Implies `GET_SOBJECTS`.\n\n\n REVOKE_SOBJECTS:\n Permission to revoke security objects, i.e. mark security objects as\n deactivated or compromised. Implies `GET_SOBJECTS`.\n\n\n ACTIVATE_SOBJECTS:\n Permission to activate security objects. Implies `GET_SOBJECTS`.\n\n\n REVERT_SOBJECTS:\n Permission to revert changes to security objects. Implies\n `GET_SOBJECTS`.\n\n\n DELETE_KEY_MATERIAL:\n Permission to delete key material including removing the private key\n part of an asymmetric key pair and removing key material of security\n objects backed by external HSM/KMS. Implies `GET_SOBJECTS`.\n\n\n MOVE_SOBJECTS:\n Permission to move security objects. This permission is required for\n changing the group of a security object in the source group. Note\n that changing the group of a security object also requires\n `CREATE_SOBJECTS` permission in the destination group. Implies\n `GET_SOBJECTS`.\n\n\n UPDATE_KEY_OPS:\n Permission to update key operations of security objects. Implies\n `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECT_POLICIES:\n Permission to update individual security objects' policies. This\n permission allows updating RSA options, as well as Google access\n reason policy (for use with Google EKM APIs) defined on the security\n object itself. Implies `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECTS_PROFILE:\n Permission to update name, description, custom metadata, key links\n (currently only create parent link), and publish public key settings\n of security objects. Implies `GET_SOBJECTS`.\n\n\n SCAN_EXTERNAL_SOBJECTS:\n Permission to scan for security objects in external HSM/KMS. Implies\n `GET_SOBJECTS`.\n\n\n RESTORE_EXTERNAL_SOBJECTS:\n Permission to restore key material of security objects backed by\n external HSM/KMS. Note that calling the Restore API needs this\n permission in the destination group as well as `EXPORT_SOBJECTS`\n permission in the source group (where the object was copied from\n originally). Implies `GET_SOBJECTS`.\n\n\n WRAP_WORKSPACE_CSE:\n Permission to call Workspace CSE Wrap API.\n\n\n UNWRAP_WORKSPACE_CSE:\n Permission to call Workspace CSE Unwrap API.\n\n\n WORKSPACE_CSE:\n\n\n GET_GROUP:\n Permission to get information about the group.\n\n\n GET_SOBJECTS:\n Permission to get security objects stored in the group.\n\n\n GET_APPS:\n Permission to get cryptographic apps in the group.\n\n\n GET_PLUGINS:\n Permission to get plugin in the group.\n\n\n GET_GROUP_APPROVAL_REQUESTS:\n Permission to get approval requests related to the group.\n\n\n GET_AUDIT_LOGS:\n Permission to get audit logs related to the group.\n\n\n MANAGE_GROUP_WRAPPING_KEY:\n Permission to update or remove wrapping key of the group\n\n\n ENCAPSULATE_SOBJECTS:\n Permission to encapsulate security objects. Implies `CREATE_SOBJECTS`.\n\n\n DECAPSULATE_SOBJECTS:\n Permission to decapsulate security objects. Implies `CREATE_SOBJECTS`.\n\n\n GET_CREDENTIALS:\n Permission to lookup a credential object\n\n\n CREATE_CREDENTIALS:\n Permission to create a credential object (Implies GET_CREDENTIALS)\n\n\n UPDATE_CREDENTIALS:\n Permission to update a credential object (Implies GET_CREDENTIALS)\n\n\n DELETE_CREDENTIALS:\n Permission to delete a credential object (Implies GET_CREDENTIALS)\n\n\n ASSIGN_CREDENTIALS:\n Permission to assign credential objects to integration points (Implies GET_CREDENTIALS)\n\n\n MANAGE_CREDENTIALS:\n Permission to manage credential objects (Currently implies `GET_CREDENTIALS`,\n `CREATE_CREDENTIALS`, `UPDATE_CREDENTIALS`, `DELETE_CREDENTIALS`, and\n `ASSIGN_CREDENTIALS`).\n\n", "type": "string", "enum": [ "CREATE_GROUP_APPROVAL_POLICY", "UPDATE_GROUP_EXTERNAL_LINKS", "MANAGE_GROUP_CLIENT_CONFIGS", "UPDATE_GROUP_PROFILE", "DELETE_GROUP", "MAP_EXTERNAL_ROLES_FOR_APPS", "MAP_EXTERNAL_ROLES_FOR_USERS", "MAP_EXTERNAL_ROLES", "ADD_USERS_TO_GROUP", "DELETE_USERS_FROM_GROUP", "UPDATE_USERS_GROUP_ROLE", "MANAGE_GROUP_USERS", "CREATE_GROUP_SOBJECT_POLICIES", "UPDATE_GROUP_SOBJECT_POLICIES", "DELETE_GROUP_SOBJECT_POLICIES", "MANAGE_GROUP_SOBJECT_POLICIES", "CREATE_GROUP_CUSTODIAN_POLICY", "UPDATE_GROUP_CUSTODIAN_POLICY", "DELETE_GROUP_CUSTODIAN_POLICY", "MANAGE_GROUP_CUSTODIAN_POLICY", "CREATE_APPS", "UPDATE_APPS", "RETRIEVE_APP_SECRETS", "DELETE_APPS", "MANAGE_APPS", "CREATE_PLUGINS", "UPDATE_PLUGINS", "INVOKE_PLUGINS", "DELETE_PLUGINS", "MANAGE_PLUGINS", "CREATE_SOBJECTS", "EXPORT_SOBJECTS", "COPY_SOBJECTS", "WRAP_SOBJECTS", "UNWRAP_SOBJECTS", "DERIVE_SOBJECTS", "TRANSFORM_SOBJECTS", "UPDATE_SOBJECTS_ENABLED_STATE", "ROTATE_SOBJECTS", "DELETE_SOBJECTS", "DESTROY_SOBJECTS", "REVOKE_SOBJECTS", "ACTIVATE_SOBJECTS", "REVERT_SOBJECTS", "DELETE_KEY_MATERIAL", "MOVE_SOBJECTS", "UPDATE_KEY_OPS", "UPDATE_SOBJECT_POLICIES", "UPDATE_SOBJECTS_PROFILE", "SCAN_EXTERNAL_SOBJECTS", "RESTORE_EXTERNAL_SOBJECTS", "WRAP_WORKSPACE_CSE", "UNWRAP_WORKSPACE_CSE", "WORKSPACE_CSE", "GET_GROUP", "GET_SOBJECTS", "GET_APPS", "GET_PLUGINS", "GET_GROUP_APPROVAL_REQUESTS", "GET_AUDIT_LOGS", "MANAGE_GROUP_WRAPPING_KEY", "ENCAPSULATE_SOBJECTS", "DECAPSULATE_SOBJECTS", "GET_CREDENTIALS", "CREATE_CREDENTIALS", "UPDATE_CREDENTIALS", "DELETE_CREDENTIALS", "ASSIGN_CREDENTIALS", "MANAGE_CREDENTIALS" ] }, "GroupRequest": { "allOf": [ { "type": "object", "properties": { "add_hmg": { "type": "array", "items": { "$ref": "#/components/schemas/HmgConfig" }, "nullable": true }, "approval_policy": { "$ref": "#/components/schemas/GroupApprovalPolicy" }, "auto_scan": { "$ref": "#/components/schemas/RemovableAutoScanSettings" }, "client_configurations": { "$ref": "#/components/schemas/ClientConfigurationsRequest" }, "cryptographic_policy": { "$ref": "#/components/schemas/RemovableCryptographicPolicy" }, "custodian_policy": { "$ref": "#/components/schemas/QuorumPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "del_hmg": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "export_policy": { "$ref": "#/components/schemas/ExportPolicy" }, "google_access_reason_policy": { "$ref": "#/components/schemas/RemovableGoogleAccessReasonPolicy" }, "hmg_redundancy": { "$ref": "#/components/schemas/RemovableHmgRedundancyScheme" }, "hmg_segregation": { "type": "boolean", "nullable": true }, "hmg_sync": { "type": "boolean", "nullable": true }, "key_history_policy": { "$ref": "#/components/schemas/RemovableKeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/RemovableKeyMetadataPolicy" }, "mod_hmg": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/HmgConfig" }, "nullable": true }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "wrapping_key_name": { "$ref": "#/components/schemas/WrappingKeyName" } } } ] }, "GroupRole": { "allOf": [ { "type": "object", "properties": { "permissions": { "type": "array", "items": { "$ref": "#/components/schemas/GroupPermissions" } }, "exclusive": { "type": "boolean", "nullable": true } }, "required": [ "permissions" ] } ] }, "GroupSort": { "oneOf": [ { "title": "GroupSortVariantByGroupId", "type": "object", "properties": { "sort_by": { "type": "string", "pattern": "^group_id:(?:asc|desc)$", "example": "group_id:asc" }, "previous_id": { "type": "string", "format": "uuid" } }, "required": [ "previous_id" ] }, { "title": "GroupSortVariantByGroupName", "type": "object", "properties": { "sort_by": { "type": "string", "pattern": "^group_name:(?:asc|desc)$", "example": "group_name:asc" }, "previous_sort_value": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" } }, "required": [ "previous_sort_value" ] } ] }, "HealthCheckInfo": { "allOf": [ { "type": "object", "properties": { "initiated_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the health check was initiated." }, "finished_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the health check finished (regardless of its outcome)." }, "result": { "type": "string", "description": "The result of the health check." } }, "required": [ "initiated_at", "finished_at", "result" ] } ] }, "HealthParams": { "allOf": [ { "type": "object", "properties": { "consistency": { "type": "string" }, "check_queues": { "type": "boolean" } } } ] }, "HealthStatus": { "type": "string", "enum": [ "Healthy", "Unhealthy" ] }, "HistoryItem": { "allOf": [ { "type": "object", "description": "A particular entry in a security object's history.\nThese entries are maintained as part of the key history\n(aka key undo) policy feature, which allows otherwise-\nirreversible operations on security objects to be reversible.\n\nEach entry represents a particular \"snapshot in time\" to which\na security object can be reverted. Such entries are only\nrecorded when key history is disabled.", "properties": { "id": { "type": "string", "format": "uuid", "description": "The ID identifying this particular entry." }, "state": { "$ref": "#/components/schemas/HistoryItemState" }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time when this history entry was created." }, "expiry": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time when this entry is no longer available for\nundo purposes." } }, "required": [ "id", "state", "created_at", "expiry" ] } ] }, "HistoryItemState": { "allOf": [ { "type": "object", "description": "The key metadata of the security object for a\ngiven `HistoryItem`. This keeps track of properties\nsuch as allowed key operations, key state, and so on.", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "activation_undo_window": { "$ref": "#/components/schemas/Secs" }, "revocation_reason": { "$ref": "#/components/schemas/RevocationReason" }, "compromise_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "deactivation_undo_window": { "$ref": "#/components/schemas/Secs" }, "destruction_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "deletion_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "state": { "$ref": "#/components/schemas/SobjectState" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" } }, "public_only": { "type": "boolean" }, "has_key": { "type": "boolean" }, "rotation_policy": { "$ref": "#/components/schemas/RotationPolicy" }, "group_id": { "type": "string", "format": "uuid", "nullable": true } }, "required": [ "state", "key_ops", "public_only", "has_key" ] } ] }, "HmacOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "minimum_key_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "HmgConfigNcipher": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "slot": { "type": "integer" }, "pin": { "type": "string" }, "hsm_order": { "type": "integer", "format": "int32", "nullable": true, "description": "The priority of this `HmgConfig`. This is used when a group is\nconfigured with an `HmgRedundancyScheme`, and is otherwise\nunused. (See the docs for `HmgRedundancyScheme` for more\ninformation about the interpretation of this field.)" } }, "required": [ "url", "tls", "slot" ] } ] }, "HmgConfigSafenet": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "slot": { "type": "integer" }, "pin": { "type": "string" }, "hsm_order": { "type": "integer", "format": "int32", "nullable": true, "description": "The priority of this `HmgConfig`. This is used when a group is\nconfigured with an `HmgRedundancyScheme`, and is otherwise\nunused. (See the docs for `HmgRedundancyScheme` for more\ninformation about the interpretation of this field.)" } }, "required": [ "url", "tls", "slot" ] } ] }, "HmgConfigAwsCloudHsm": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "slot": { "type": "integer" }, "pin": { "type": "string" }, "hsm_order": { "type": "integer", "format": "int32", "nullable": true, "description": "The priority of this `HmgConfig`. This is used when a group is\nconfigured with an `HmgRedundancyScheme`, and is otherwise\nunused. (See the docs for `HmgRedundancyScheme` for more\ninformation about the interpretation of this field.)" } }, "required": [ "url", "tls", "slot" ] } ] }, "HmgConfigAwsKms": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "access_key": { "type": "string", "nullable": true }, "secret_key": { "type": "string" }, "region": { "type": "string", "nullable": true }, "service": { "$ref": "#/components/schemas/AwskmsService" }, "account_id": { "type": "string", "nullable": true }, "key_material_mapping": { "$ref": "#/components/schemas/AwsKmsKeyMaterialMapping" } }, "required": [ "url", "tls" ] } ] }, "HmgConfigFortanix": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "pin": { "type": "string" } }, "required": [ "url", "tls" ] } ] }, "HmgConfigFortanixFipsCluster": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "pin": { "type": "string" }, "credentials": { "type": "array", "items": { "type": "string" }, "nullable": true }, "hsm_order": { "type": "integer", "format": "int32", "nullable": true, "description": "The priority of this `HmgConfig`. This is used when a group is\nconfigured with an `HmgRedundancyScheme`, and is otherwise\nunused. (See the docs for `HmgRedundancyScheme` for more\ninformation about the interpretation of this field.)" } }, "required": [ "url", "tls" ] } ] }, "HmgConfigAzureKeyVault": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "auth_config": { "$ref": "#/components/schemas/AzureAuthConfig" }, "secret_key": { "type": "string", "description": "Deprecated, left this for backward compatibility. Should use auth_config." }, "tenant_id": { "type": "string", "format": "uuid", "description": "A tenant ID is a unique way to identify an Azure AD instance\nwithin an Azure subscription." }, "client_id": { "type": "string", "format": "uuid", "description": "The client ID is the unique Application ID assigned\nto your app by Azure AD when the app was registered." }, "subscription_id": { "type": "string", "format": "uuid", "description": "A subscription ID is a unique alphanumeric string\nthat identifies your Azure subscription." }, "key_vault_type": { "$ref": "#/components/schemas/AzureKeyVaultType" }, "endpoints": { "$ref": "#/components/schemas/AzureServiceEndpoints" } }, "required": [ "url", "tls", "auth_config", "tenant_id", "client_id", "subscription_id" ] } ] }, "HmgConfigOciVault": { "allOf": [ { "type": "object", "properties": { "region": { "type": "string" }, "compartment_ocid": { "type": "string" }, "credential_id": { "$ref": "#/components/schemas/CredentialId" }, "vault_id": { "type": "string", "nullable": true } }, "required": [ "region", "compartment_ocid", "credential_id" ] } ] }, "HmgConfig": { "oneOf": [ { "$ref": "#/components/schemas/HmgConfigVariantNcipher" }, { "$ref": "#/components/schemas/HmgConfigVariantSafenet" }, { "$ref": "#/components/schemas/HmgConfigVariantAwsCloudHsm" }, { "$ref": "#/components/schemas/HmgConfigVariantAwsKms" }, { "$ref": "#/components/schemas/HmgConfigVariantFortanix" }, { "$ref": "#/components/schemas/HmgConfigVariantFortanixFipsCluster" }, { "$ref": "#/components/schemas/HmgConfigVariantAzureKeyVault" }, { "$ref": "#/components/schemas/HmgConfigVariantOciVault" }, { "$ref": "#/components/schemas/HmgConfigVariantGcpKeyRing" } ], "discriminator": { "propertyName": "kind", "mapping": { "Ncipher": "HmgConfigVariantNcipher", "Safenet": "HmgConfigVariantSafenet", "AwsCloudHsm": "HmgConfigVariantAwsCloudHsm", "AwsKms": "HmgConfigVariantAwsKms", "Fortanix": "HmgConfigVariantFortanix", "FortanixFipsCluster": "HmgConfigVariantFortanixFipsCluster", "AzureKeyVault": "HmgConfigVariantAzureKeyVault", "OciVault": "HmgConfigVariantOciVault", "GcpKeyRing": "HmgConfigVariantGcpKeyRing" } } }, "HmgConfigVariantNcipher": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "Ncipher" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigNcipher" } ] }, "HmgConfigVariantSafenet": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "Safenet" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigSafenet" } ] }, "HmgConfigVariantAwsCloudHsm": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "AwsCloudHsm" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigAwsCloudHsm" } ] }, "HmgConfigVariantAwsKms": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "AwsKms" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigAwsKms" } ] }, "HmgConfigVariantFortanix": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "Fortanix" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigFortanix" } ] }, "HmgConfigVariantFortanixFipsCluster": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "FortanixFipsCluster" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigFortanixFipsCluster" } ] }, "HmgConfigVariantAzureKeyVault": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "AzureKeyVault" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigAzureKeyVault" } ] }, "HmgConfigVariantOciVault": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "OciVault" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/HmgConfigOciVault" } ] }, "HmgConfigVariantGcpKeyRing": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "GcpKeyRing" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/GcpKeyRingConfig" } ] }, "HmgListKeyCollectionsRequest": { "oneOf": [ { "$ref": "#/components/schemas/HmgListKeyCollectionsRequestVariantOciVault" } ], "discriminator": { "propertyName": "$type", "mapping": { "OciVault": "HmgListKeyCollectionsRequestVariantOciVault" } } }, "HmgListKeyCollectionsRequestVariantOciVault": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "OciVault" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/ListOciVaultsRequest" } ] }, "HmgListKeyCollectionsResponseOciKeyVault": { "allOf": [ { "type": "object", "description": "A list of all the vaults accessible to the user configured", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/OciKeyVault" } } }, "required": [ "items" ] } ] }, "HmgListKeyCollectionsResponse": { "oneOf": [ { "$ref": "#/components/schemas/HmgListKeyCollectionsResponseVariantOciKeyVault" } ], "discriminator": { "propertyName": "$type", "mapping": { "OciKeyVault": "HmgListKeyCollectionsResponseVariantOciKeyVault" } } }, "HmgListKeyCollectionsResponseVariantOciKeyVault": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "OciKeyVault" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/HmgListKeyCollectionsResponseOciKeyVault" } ] }, "HmgRedundancyScheme": { "description": "The scheme for determining how multiple `HmgConfig`s on a group\nshould behave. If not specified, the backend will go through\nthe list in random order, and use the first `HmgConfig` that works.", "type": "string", "enum": [ "PriorityFailover" ] }, "HostnameInfo": { "allOf": [ { "type": "object", "properties": { "health_status": { "$ref": "#/components/schemas/HealthStatus" }, "last_health_check": { "$ref": "#/components/schemas/HealthCheckInfo" } }, "required": [ "health_status" ] } ] }, "ImportSobjectComponentsRequest": { "allOf": [ { "type": "object", "description": "Request to import a security object by components.", "properties": { "key": { "$ref": "#/components/schemas/SobjectRequest" }, "unwrap_key_params": { "$ref": "#/components/schemas/UnwrapKeyParams" }, "custodians": { "type": "array", "items": { "$ref": "#/components/schemas/Principal" }, "description": "Key holder identifier" }, "components": { "type": "array", "items": { "$ref": "#/components/schemas/SobjectComponent" }, "nullable": true, "description": "Key material by parts" }, "description": { "type": "string", "nullable": true, "description": "Description of the imported security object" }, "method": { "$ref": "#/components/schemas/SplittingMethod" }, "auth_config": { "$ref": "#/components/schemas/ApprovalAuthConfig" }, "kcv_method": { "$ref": "#/components/schemas/KcvMethod" } }, "required": [ "key", "custodians" ] } ] }, "InnerEsBucket": { "allOf": [ { "type": "object", "properties": { "doc_count": { "type": "integer" }, "key": { "type": "string", "format": "uuid" }, "unique_operations_count": { "$ref": "#/components/schemas/UniqueOperationsCount" }, "unique_active_sobj_count": { "$ref": "#/components/schemas/UniqueOperationsCount" }, "unique_active_app_count": { "$ref": "#/components/schemas/UniqueOperationsCount" } }, "required": [ "doc_count", "key" ] } ] }, "IntegrationCredential": { "allOf": [ { "type": "object", "properties": { "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the credential was created" }, "creator": { "$ref": "#/components/schemas/Principal" }, "credential_details": { "$ref": "#/components/schemas/CredentialDetails" }, "credential_id": { "type": "string", "format": "uuid" }, "description": { "type": "string", "nullable": true }, "group_id": { "type": "string", "format": "uuid", "description": "The ID of the group that this credential is associated with" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "The human readable name of the credential" } }, "required": [ "created_at", "creator", "credential_details", "credential_id", "group_id", "name" ] } ] }, "IntegrationCredentialCreateRequest": { "allOf": [ { "type": "object", "properties": { "credential_details": { "$ref": "#/components/schemas/CredentialDetails" }, "description": { "type": "string", "nullable": true }, "group_id": { "type": "string", "format": "uuid", "description": "The ID of the group that this credential is associated with" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "The human readable name of the credential" } }, "required": [ "credential_details", "group_id", "name" ] } ] }, "IntegrationCredentialRotationRequest": { "allOf": [ { "type": "object", "properties": { "method": { "$ref": "#/components/schemas/RotationMethod" } }, "required": [ "method" ] } ] }, "IntegrationCredentialUpdateRequest": { "allOf": [ { "type": "object", "properties": { "credential_details": { "$ref": "#/components/schemas/CredentialDetails" }, "description": { "type": "string", "nullable": true }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "The human readable name of the credential" } } } ] }, "IpAddressPolicy": { "description": "The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.", "oneOf": [ { "title": "IpAddressPolicyVariantAllowAll", "type": "string", "enum": [ "allow_all" ] }, { "title": "IpAddressPolicyVariantWhitelist", "type": "object", "properties": { "whitelist": { "type": "array", "uniqueItems": true, "items": { "type": "string" } } }, "required": [ "whitelist" ] } ] }, "KcdsaOptions": { "allOf": [ { "type": "object", "properties": { "subgroup_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "hash_alg": { "$ref": "#/components/schemas/DigestAlgorithm" } } } ] }, "KcdsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "KcvMethod": { "description": "Methods for calculating a Key Checksum Value.", "type": "string", "enum": [ "Encrypt", "Cmac" ] }, "KeyAttestationRequest": { "allOf": [ { "type": "object", "description": "Request to retrieve a key attestation certificate for a security object.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptorPersisted" } }, "required": [ "key" ] } ] }, "KeyAttestationResponse": { "allOf": [ { "type": "object", "description": "Key attestation response.", "properties": { "authority_chain": { "type": "array", "items": { "type": "string", "format": "byte" }, "description": "The DER-encoded certificate chain for the authority issuing the key\nattestation statement." }, "attestation_statement": { "$ref": "#/components/schemas/KeyAttestationStatement" } }, "required": [ "authority_chain", "attestation_statement" ] } ] }, "KeyAttestationStatement": { "allOf": [ { "type": "object", "description": "A key attestation statement", "properties": { "format": { "$ref": "#/components/schemas/KeyAttestationStatementFormat" }, "statement": { "type": "string", "format": "byte", "description": "The key attestation statement formatted according to `format`" } }, "required": [ "format", "statement" ] } ] }, "KeyAttestationStatementFormat": { "type": "string", "enum": [ "x509_certificate" ] }, "KeyCheckValueRequest": { "allOf": [ { "type": "object", "description": "Request for getting the KCV of a security object", "properties": { "kcv_method": { "$ref": "#/components/schemas/KcvMethod" } } }, { "$ref": "#/components/schemas/SobjectDescriptor" } ] }, "KeyCheckValueResponse": { "allOf": [ { "type": "object", "description": "KCV of a key", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "UUID, only for persistent keys" }, "kcv": { "type": "string", "description": "Key Checksum Value. Could be one of following two variants:\n- Encrypt KCV: 24-bit checksum as a 6-character case-insensitive hex string (Default)\n- Cmac KCV: 40-bit checksum as a 10-character case-insensitive hex string" } }, "required": [ "kcv" ] } ] }, "KeyCreationMethod": { "description": "Information about the method by which a key was created", "oneOf": [ { "$ref": "#/components/schemas/KeyCreationMethodVariantGenerate" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantAgree" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantTransform" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantDerive" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantUnwrap" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantImport" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantEncapsulate" }, { "$ref": "#/components/schemas/KeyCreationMethodVariantDecapsulate" } ], "discriminator": { "propertyName": "method", "mapping": { "Generate": "KeyCreationMethodVariantGenerate", "Agree": "KeyCreationMethodVariantAgree", "Transform": "KeyCreationMethodVariantTransform", "Derive": "KeyCreationMethodVariantDerive", "Unwrap": "KeyCreationMethodVariantUnwrap", "Import": "KeyCreationMethodVariantImport", "Encapsulate": "KeyCreationMethodVariantEncapsulate", "Decapsulate": "KeyCreationMethodVariantDecapsulate" } } }, "KeyCreationMethodVariantGenerate": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Generate" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantAgree": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Agree" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantTransform": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Transform" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantDerive": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Derive" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantUnwrap": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Unwrap" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantImport": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Import" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantEncapsulate": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Encapsulate" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyCreationMethodVariantDecapsulate": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "Decapsulate" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "KeyExpiryAlertConfig": { "allOf": [ { "type": "object", "properties": { "triggers": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/KeyExpiryAlertTrigger" } }, "siem_tool_configs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/KeyExpiryAlertSiemToolConfig" } } }, "required": [ "triggers", "siem_tool_configs" ] } ] }, "KeyExpiryAlertConfigRequest": { "allOf": [ { "type": "object", "properties": { "add_triggers": { "type": "array", "items": { "$ref": "#/components/schemas/KeyExpiryAlertTrigger" }, "nullable": true }, "mod_triggers": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/KeyExpiryAlertTrigger" }, "nullable": true }, "del_triggers": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true }, "add_siem_tool_configs": { "type": "array", "items": { "$ref": "#/components/schemas/KeyExpiryAlertSiemToolConfig" }, "nullable": true }, "mod_siem_tool_configs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/KeyExpiryAlertSiemToolConfig" }, "nullable": true }, "del_siem_tool_configs": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true } } } ] }, "KeyExpiryAlertSiemToolConfig": { "allOf": [ { "type": "object", "properties": { "max_key_info_per_alert": { "type": "integer", "minimum": 0, "maximum": 65535, "nullable": true }, "config": { "$ref": "#/components/schemas/LoggingConfig" } }, "required": [ "config" ] } ] }, "KeyExpiryAlertTrigger": { "oneOf": [ { "$ref": "#/components/schemas/KeyExpiryAlertTriggerVariantDaysAhead" } ], "discriminator": { "propertyName": "$type", "mapping": { "DaysAhead": "KeyExpiryAlertTriggerVariantDaysAhead" } } }, "KeyExpiryAlertTriggerVariantDaysAhead": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "DaysAhead" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/DaysAhead" } ] }, "KeyFormat": { "description": "Key Format", "type": "string", "enum": [ "Default", "Pkcs8" ] }, "KeyHistoryPolicy": { "allOf": [ { "type": "object", "description": "Configuration for a key history (aka key undo) policy.", "properties": { "undo_time_window": { "$ref": "#/components/schemas/Secs" } }, "required": [ "undo_time_window" ] } ] }, "KeyLinks": { "allOf": [ { "type": "object", "description": "Linked security objects.", "properties": { "replacement": { "type": "string", "format": "uuid", "nullable": true, "description": "key id of the key that replaced this key (i.e., this key was rotated to the `replacement` key)" }, "replaced": { "type": "string", "format": "uuid", "nullable": true, "description": "key id of the key that was replaced by this key (i.e., the `replaced` key was rotated to this key)" }, "copiedFrom": { "type": "string", "format": "uuid", "nullable": true }, "copiedTo": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "subkeys": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "parent": { "type": "string", "format": "uuid", "nullable": true }, "wrappingKey": { "type": "string", "format": "uuid", "nullable": true, "description": "Wrapping key used to wrap this security object" } } } ] }, "KeyMetadataPolicy": { "allOf": [ { "type": "object", "properties": { "base": { "$ref": "#/components/schemas/MetadataPolicyItem" }, "for_obj_type": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/MetadataPolicyItem" }, "description": "Each entry in this map fully overrides `base` for a particular object type." }, "legacy_objects": { "$ref": "#/components/schemas/LegacyKeyPolicy" } }, "required": [ "base", "for_obj_type", "legacy_objects" ] } ] }, "KeyOperations": { "description": "Operations allowed to be performed on a given key.\n\n\n\n SIGN:\n If this is set, the key can be used to for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n", "type": "string", "enum": [ "SIGN", "VERIFY", "ENCRYPT", "DECRYPT", "WRAPKEY", "UNWRAPKEY", "DERIVEKEY", "TRANSFORM", "MACGENERATE", "MACVERIFY", "EXPORT", "APPMANAGEABLE", "HIGHVOLUME", "AGREEKEY", "ENCAPSULATE", "DECAPSULATE" ] }, "KeyOpsOverride": { "allOf": [ { "type": "object", "properties": { "add_key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "The operations to add to any key creation request (only supported in KMIP).\n\nThe following operations can be specified:\n- `EXPORT`\n- `APPMANAGEABLE`\n- `HIGHVOLUME`\n\nThe operations specified cannot conflict with what's specified in the\n`key_ops` field of account and/or group policies (where applicable).\n\n**Note**: This is only enforced on (KMIP) creation requests since we assume\nupdates removing key operations are intentional." } } } ] }, "KeyVault": { "allOf": [ { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "vault_type": { "$ref": "#/components/schemas/AzureKeyVaultType" }, "location": { "type": "string" }, "tags": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "retention": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "uri": { "type": "string" } }, "required": [ "id", "name", "vault_type", "location", "uri" ] } ] }, "KmipClientConfig": { "allOf": [ { "type": "object", "properties": { "ignore_unknown_key_ops_for_secrets": { "type": "boolean", "nullable": true, "description": "Use `ignore_unknown_key_ops_for` with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``" }, "ignore_unknown_key_ops_for": { "$ref": "#/components/schemas/ObjectTypeFilter" }, "key_ops_override": { "$ref": "#/components/schemas/KeyOpsOverride" } } } ] }, "Language": { "description": "Language of plugin code.", "type": "string", "enum": [ "LUA" ] }, "LastAppOperationTimestamp": { "allOf": [ { "type": "object", "properties": { "generic": { "type": "integer", "nullable": true }, "tokenization": { "type": "integer", "nullable": true }, "tep": { "type": "integer", "nullable": true }, "accelerator": { "type": "integer", "nullable": true }, "secrets_management": { "type": "integer", "nullable": true } } } ] }, "LdapAccountRole": { "description": "Role of a user or app in an account for the purpose of LDAP configurations.", "oneOf": [ { "$ref": "#/components/schemas/LegacyLdapAccountRole" }, { "type": "string", "format": "uuid" } ] }, "LdapAuthorizationConfig": { "allOf": [ { "type": "object", "description": "LDAP authorization settings.", "properties": { "valid_for": { "type": "integer", "description": "Number of seconds after which the authorization should be checked again." }, "require_role": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "A map from account roles to distinguished names of LDAP groups.\nIf a DN is specified for an account role, entities with that role\nmust be a member of the specified LDAP group." }, "user_self_provisioning": { "$ref": "#/components/schemas/LdapUserSelfProvisioningConfig" }, "role_conflict_resolution": { "$ref": "#/components/schemas/LdapRoleConflictResolution" } }, "required": [ "valid_for" ] } ] }, "LdapDnResolutionConstruct": { "allOf": [ { "type": "object", "description": "Transform the user email through a pattern to derive the DN.", "properties": { "domain_format": { "type": "object", "additionalProperties": { "type": "string" }, "description": "For example: \"example.com\" => \"uid={},ou=users,dc=example,dc=com\"." } }, "required": [ "domain_format" ] } ] }, "LdapDnResolution": { "description": "Distinguished Name (DN) resolution method. Given a user's email address, a DN resolution method\nis used to find the user's DN in an LDAP directory.", "oneOf": [ { "$ref": "#/components/schemas/LdapDnResolutionVariantConstruct" }, { "$ref": "#/components/schemas/LdapDnResolutionVariantSearchByMail" }, { "$ref": "#/components/schemas/LdapDnResolutionVariantUserPrincipalName" } ], "discriminator": { "propertyName": "method", "mapping": { "construct": "LdapDnResolutionVariantConstruct", "search-by-mail": "LdapDnResolutionVariantSearchByMail", "upn": "LdapDnResolutionVariantUserPrincipalName" } } }, "LdapDnResolutionVariantConstruct": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "construct" ] } }, "required": [ "method" ] }, { "$ref": "#/components/schemas/LdapDnResolutionConstruct" } ] }, "LdapDnResolutionVariantSearchByMail": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "search-by-mail" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "LdapDnResolutionVariantUserPrincipalName": { "allOf": [ { "type": "object", "properties": { "method": { "type": "string", "enum": [ "upn" ] } }, "required": [ "method" ] }, { "type": "object", "properties": {} } ] }, "LdapPrincipalUnresolved": { "allOf": [ { "type": "object", "properties": { "email": { "type": "string", "format": "email" } }, "required": [ "email" ] } ] }, "LdapPrincipalResolved": { "allOf": [ { "type": "object", "properties": { "dn": { "type": "string" } }, "required": [ "dn" ] } ] }, "LdapPrincipal": { "oneOf": [ { "$ref": "#/components/schemas/LdapPrincipalUnresolved" }, { "$ref": "#/components/schemas/LdapPrincipalResolved" } ] }, "LdapRoleConflictResolution": { "description": "Controls how we resolve conflicting role assignments with LDAP authorization.\n\nWhen users are authorized through LDAP, their DSM group memberships are\ndetermined by their LDAP groups and the external role mappings created in\nDSM. For example, if the user belongs to 3 LDAP groups A, B and C, and these\nLDAP groups are mapped to DSM groups G1 and G2 in the following way:\n- A -> G1 as \"group auditor\"\n- B -> G1 as \"group administrator\"\n- C -> G2 as \"group administrator\"\nThen which role should be assigned to this user in G1?\n\nThe answer to this question used to be simple before the introduction of\ncustom user roles in DSM: we took the maximum of the roles. Note that the\nlegacy roles (group admin/auditor) formed a strict \"more powerful than\"\nrelation, i.e. group administrator is strictly more powerful than group\nauditor (and same is true for legacy account roles). However, custom user\nroles do not have that relationship anymore. Moreover, the legacy behavior\nis not quite square with the role exclusivity rules either since the legacy\nbehavior can also be regarded as assigning multiple exclusive roles in the\nsame group.\n\nAfter the introduction of custom user roles, we allow a user to have\nmultiple roles in one group as long as none of the roles are marked as\nexclusive. That rule is easily enforceable in the user Invite API. With LDAP\nauthorization, the group memberships are computed dynamically when the\nSelect Account API is called and it is possible that we run into conflicting\nrole assignments due to user's LDAP group membership and current mappings\nbetween external roles (i.e. LDAP groups) and DSM groups.", "type": "string", "enum": [ "backcompat_legacy_roles_only", "disregard_exclusive_roles" ] }, "LdapSearchFilter": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" } }, "required": [ "name", "value" ] } ] }, "LdapSearchRequest": { "allOf": [ { "type": "object", "properties": { "base_dn": { "type": "string", "nullable": true }, "filters": { "type": "array", "items": { "$ref": "#/components/schemas/LdapSearchFilter" } }, "object_class": { "type": "string", "nullable": true }, "scope": { "$ref": "#/components/schemas/LdapSearchScope" } }, "required": [ "filters", "scope" ] } ] }, "LdapSearchResultEntry": { "allOf": [ { "type": "object", "properties": { "distinguished_name": { "type": "string" }, "ldap_object_id": { "type": "string", "format": "uuid" }, "common_name": { "type": "array", "items": { "type": "string" } }, "description": { "type": "array", "items": { "type": "string" } }, "object_class": { "type": "array", "items": { "type": "string" } }, "mail": { "type": "string", "nullable": true }, "user_principal_name": { "type": "string", "nullable": true } }, "required": [ "distinguished_name", "ldap_object_id", "common_name", "description", "object_class" ] } ] }, "LdapSearchScope": { "type": "string", "enum": [ "single-level", "whole-subtree" ] }, "LdapServiceAccount": { "allOf": [ { "type": "object", "description": "Credentials used by the service to authenticate itself to an LDAP server.", "properties": { "dn": { "type": "string", "description": "Distinguished name of the service account." }, "password": { "type": "string", "description": "The password for the service account." } }, "required": [ "dn", "password" ] } ] }, "LdapTestCredentials": { "allOf": [ { "type": "object", "properties": { "password": { "type": "string" }, "account_role": { "$ref": "#/components/schemas/LdapAccountRole" } }, "required": [ "password" ] }, { "$ref": "#/components/schemas/LdapPrincipal" } ] }, "LdapTestRequest": { "allOf": [ { "type": "object", "properties": { "ldap": { "$ref": "#/components/schemas/AuthConfigLdap" }, "test_credentials": { "$ref": "#/components/schemas/LdapTestCredentials" } }, "required": [ "ldap" ] } ] }, "LdapUserSelfProvisioningConfig": { "allOf": [ { "type": "object", "description": "LDAP user self-provisioning settings. Currently, the only\nsetting available for configuration is the mapping from\nLDAP users to DSM account roles.", "properties": { "role_assignment": { "$ref": "#/components/schemas/LdapUserSelfProvisioningRole" } }, "required": [ "role_assignment" ] } ] }, "LdapUserSelfProvisioningRoleFixed": { "allOf": [ { "type": "object", "description": "Map all self-provisioned users to a single specified account role.\n(Note that this setting only determines the role that a self-\nprovisioned user starts with; an account admin can change any user's\nrole at a later time.) A \"state enabled\" flag will be implicitly added,\nand any specified \"pending invite\" flag will be removed.", "properties": { "role": { "$ref": "#/components/schemas/UserAccountFlags" } }, "required": [ "role" ] } ] }, "LdapUserSelfProvisioningRole": { "description": "A structure indicating how self-provisioned LDAP users will\nbe assigned account roles.", "oneOf": [ { "$ref": "#/components/schemas/LdapUserSelfProvisioningRoleVariantFixed" } ], "discriminator": { "propertyName": "$type", "mapping": { "Fixed": "LdapUserSelfProvisioningRoleVariantFixed" } } }, "LdapUserSelfProvisioningRoleVariantFixed": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Fixed" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/LdapUserSelfProvisioningRoleFixed" } ] }, "LegacyKeyPolicy": { "type": "string", "enum": [ "allowed", "prohibited", "unprotect_only" ] }, "LegacyLdapAccountRole": { "description": "Role of a user or app in an account for the purpose of LDAP configurations.", "type": "string", "enum": [ "ADMIN_USER", "MEMBER_USER", "AUDITOR_USER", "ADMIN_APP", "CRYPTO_APP" ] }, "LegacyUserAccountRole": { "description": "Legacy user account role", "type": "string", "enum": [ "ACCOUNTADMINISTRATOR", "ACCOUNTMEMBER", "ACCOUNTAUDITOR" ] }, "LegacyUserGroupRole": { "description": "Legacy user group role", "type": "string", "enum": [ "GROUPAUDITOR", "GROUPADMINISTRATOR" ] }, "LegacyUserGroupRoleOrRoleId": { "description": "Legacy user group role name or custom role id", "oneOf": [ { "$ref": "#/components/schemas/LegacyUserGroupRole" }, { "type": "string", "format": "uuid" } ] }, "ListApprovalRequestsParams": { "allOf": [ { "type": "object", "properties": { "requester": { "type": "string", "format": "uuid" }, "reviewer": { "type": "string", "format": "uuid" }, "subject": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/ApprovalStatus" } } } ] }, "ListAppsParams": { "allOf": [ { "type": "object", "description": "Query params for Get all apps API", "properties": { "group_id": { "type": "string", "format": "uuid", "description": "Group for which the associated apps should be retrieved." }, "limit": { "type": "integer", "description": "Maximum number of apps to return. Default limit is 1001." }, "offset": { "type": "integer", "description": "Number of apps to skip from the beginning/start." }, "group_permissions": { "type": "boolean", "description": "Flag specifying if group permissions should be returned with the apps." }, "role": { "$ref": "#/components/schemas/AppRole" }, "filter": { "type": "string", "description": "User specified filter.\n\nThe following fields can be referenced in the filter:\n- `name`\n- `app_type`\n- `created_at`\n- `auth_type`\n- `description`\n- `enabled`\n- `interface`" }, "continuation_token": { "type": "string", "description": "Continuation token to continue getting results. It must be the same\ntoken returned from the backend from a previous call, or empty.\n\nExistence of this query parameter controls the response\n(and the backend behavior):\n- If specified (including an empty value), the backend returns metadata alongside\nthe collection of apps. The metadata will potentially contain a fresh `continuation_token`.\n\nNote: If there is a `limit` specified in the request and DSM returns `limit`-many items in the\nresponse, it will still include a fresh continuation token if there are more items in the collection.\nAdditionally, unlike other query parameters, `limit` is not required to remain unchanged in a chain of\nrequests with `continuation_token`s.\n- If omitted, the backend returns just a collection of apps with no metadata." } } }, { "$ref": "#/components/schemas/AppSort" } ] }, "ListAppsResponseWithMetadata": { "allOf": [ { "type": "object", "description": "A response that includes metadata", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/App" }, "description": "The list of apps satisfying the request" }, "metadata": { "$ref": "#/components/schemas/CollectionMetadata" } }, "required": [ "items", "metadata" ] } ] }, "ListAppsResponse": { "description": "The response of the get all apps API", "oneOf": [ { "$ref": "#/components/schemas/ListAppsResponseWithMetadata" }, { "type": "array", "items": { "$ref": "#/components/schemas/App" }, "description": "A response that omits metadata" } ] }, "ListCredentialsMetadata": { "allOf": [ { "type": "object", "properties": { "total_count": { "type": "integer" }, "filtered_count": { "type": "integer" } }, "required": [ "total_count", "filtered_count" ] } ] }, "ListCredentialsParams": { "allOf": [ { "type": "object", "properties": { "limit": { "type": "integer", "description": "Set the max number of credentials to be returned in the response (default: 1000)." }, "offset": { "type": "integer", "description": "Skip first n (offset) matches" }, "filter": { "type": "string", "description": "Allows for more specific filters on the credential." } } }, { "$ref": "#/components/schemas/CredentialSort" } ] }, "ListCredentialsResponse": { "allOf": [ { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/IntegrationCredential" } }, "metadata": { "$ref": "#/components/schemas/ListCredentialsMetadata" } }, "required": [ "items", "metadata" ] } ] }, "ListExternalRolesParams": { "allOf": [ { "type": "object", "properties": { "group_id": { "type": "string", "format": "uuid" } } } ] }, "ListGroupsResponseWithMetadata": { "allOf": [ { "type": "object", "description": "A response that includes metadata", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Group" }, "description": "The list of groups satisfying the request" }, "metadata": { "$ref": "#/components/schemas/CollectionMetadata" } }, "required": [ "items", "metadata" ] } ] }, "ListGroupsResponse": { "description": "The response of the get all groups API", "oneOf": [ { "$ref": "#/components/schemas/ListGroupsResponseWithMetadata" }, { "type": "array", "items": { "$ref": "#/components/schemas/Group" }, "description": "A response that omits metadata" } ] }, "ListOciVaultsRequest": { "allOf": [ { "type": "object", "properties": { "region": { "type": "string" }, "compartment_ocid": { "type": "string" }, "credential_id": { "$ref": "#/components/schemas/CredentialId" } }, "required": [ "region", "compartment_ocid", "credential_id" ] } ] }, "ListPluginsParams": { "allOf": [ { "type": "object", "description": "Query parameters to get Plugins.", "properties": { "group_id": { "type": "string", "format": "uuid", "description": "Group for which the associated plugins should be retrieved." }, "limit": { "type": "integer", "description": "Maximum number of entries to return." }, "offset": { "type": "integer", "description": "Starting offset." } } }, { "$ref": "#/components/schemas/PluginSort" } ] }, "ListReplicationCredentialsResponse": { "allOf": [ { "type": "object", "description": "Response body for a GET call to retrieve all replication credentials.", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/ReplicationCredential" }, "description": "The list of replication credentials." } }, "required": [ "items" ] } ] }, "ListRolesParams": { "allOf": [ { "type": "object", "properties": { "filter": { "type": "string" }, "limit": { "type": "integer" } } }, { "$ref": "#/components/schemas/RoleSort" } ] }, "ListRolesResponse": { "allOf": [ { "type": "object", "properties": { "metadata": { "$ref": "#/components/schemas/Metadata" }, "items": { "type": "array", "items": { "$ref": "#/components/schemas/Role" } } }, "required": [ "metadata", "items" ] } ] }, "ListSobjectsParams": { "allOf": [ { "type": "object", "description": "Request parameters for filtering and listing security objects.", "properties": { "group_id": { "type": "string", "format": "uuid", "description": "Filter security object(s) by group ID." }, "creator": { "type": "string", "format": "uuid", "description": "Filter security object(s) by a particular creator." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Filter security object(s) by name." }, "pkcs11_label": { "type": "string", "description": "Filter security object(s) by PKCS11 label." }, "pkcs11_id": { "type": "string", "format": "byte", "description": "Filter security object(s) by PKCS11 unique identifier." }, "obj_type": { "$ref": "#/components/schemas/ObjectType" }, "limit": { "type": "integer", "description": "Set max security objects in returned in response (default: 1000)." }, "offset": { "type": "integer", "description": "Skip first n (offset) matches." }, "compliant_with_policies": { "type": "boolean", "description": "Only show security objects complying with group and account policies." }, "with_metadata": { "type": "boolean", "description": "Display query metadata in response, containing information on total objects\nand number of objects skipped." }, "show_destroyed": { "type": "boolean", "description": "Show destroyed security object(s)." }, "show_deleted": { "type": "boolean", "description": "Show deleted security object(s)." }, "show_value": { "type": "boolean", "description": "Show non-sensitive key material of security object(s)." }, "show_pub_key": { "type": "boolean", "description": "Show public key of security objects(s) if present." }, "show_kcv": { "type": "boolean", "description": "Show key check value for security object(s)." }, "filter": { "type": "string", "description": "Allows filtering Sobjects based on various attributes, including kid, key_size, and more.\nThe support portal section [2.8.1 Filtering Security Objects Using DSM REST API](https://support.fortanix.com/docs/users-guide-fortanix-data-security-manager-key-lifecycle-management#281-filtering-security-objects-using-dsm-rest-api) explains how to\ncompose various queries using the supported filter operations.\n\nThe following examples illustrate how to apply these filters when listing security objects:\n- `filter: {\"kid\":{\"$text\":{\"$search\":\"1e70c17a-78c3-4fd9-83f5-dbea8641147a\"}}}`\n- `filter: {\"name\":{\"$text\":{\"$search\":\"13F977EE2B857998\"}}}`\n- `filter: {\"state\":{\"$eq\":\"Deactivated\"}}`\n- `filter: {\"key_ops\":{\"$any\":{\"$or\":[{\"$eq\":\"ENCRYPT\"},{\"$eq\":\"DECRYPT\"},{\"$eq\":\"WRAPKEY\"},{\"$eq\":\"UNWRAPKEY\"}]}}}`\n- `filter: {\"group_name\":{\"$text\":{\"$search\":\"Test_Group\"}}}`\n- `filter: {\"creator_name\":{\"$text\":{\"$search\":\"key creator\"}}}`\n- `filter: {\"$and\":[{\"creator_type\":{\"$in\":[\"App\",\"User\",\"Plugin\"]}},{\"obj_type\":{\"$eq\":\"RSA\"}}, {\"enabled\":{\"$eq\":\"false\"}}]}`\n- `filter: {\"$and\":[{\"key_size\":{\"$gte\":256}},{\"obj_type\":{\"$eq\":\"AES\"}}]}`\n- `filter: {\"custom_attributes.custom\":{\"$text\":{\"$search\":\"1\"}}}`\n- `filter: {\"created_at\":{\"$lt\":1739794080}}`\n- `filter: {\"key_ops\":{\"$all\":{\"$ne\":\"HIGHVOLUME\"}}}`\n- `filter: {\"description\":{\"$text\":{\"$search\":\"BIPS32\"}}}`\n- `filter: {\"$and\": [{\"expires\":{\"$lt\":1739794200}},{\"expires\":{\"$gte\":1741001700}},{\"obj_type\":{\"$nin\":[\"OPAQUE\",\"SECRET\"]}},{\"creator_type\":{\"$eq\":\"App\"}}]}`\n- `filter: {\"$and\":[{\"obj_type\":{\"$eq\":\"AES\"}},{\"obj_type\":{\"$nin\":[\"DES3\",\"HMAC\"]}},{\"expires\":{\"$lt\":1739794200}},{\"state\":{\"$nin\":[\"Compromise\",\"Destroyed\"]}}]}`\n- `filter: {\"$and\": [{\"key_size\": 256}, {\"state\":{\"$eq\":\"Deactivated\"}}, {\"name\":{\"$text\":{\"$search\":\"13F977EE2B857998\"}}}]`\n- `filter: {\"$and\":[{\"obj_type\":{\"$in\":[\"AES\",\"DES3\"]}},{\"creator_type\":{\"$eq\":\"User\"}}, {\"state\":{\"$ne\":\"Compromised\"}}, {\"creator_id\":{\"$text\":{\"$search\":\"542c9eeb-333c-4b30-b0c6-b73260866cfb\"}}}]}`\n- `filter: {\"wrapping_key\":{\"$text\":{\"$search\":\"3acc3178-b1df-42e9-83c1-0c667119a132\"}}}`\n- `filter: {\"group_id\":{\"$text\":{\"$search\":\"fde289c5-55bd-48d5-b9b9-2fb2dc14388f\"}}}`\n- `filter: {\"creator_id\":{\"$text\":{\"$search\":\"542c9eeb-333c-4b30-b0c6-b73260866cfb\"}}}`\n- `filter: {\"enabled\":{\"$eq\":\"true\"}}`" } } }, { "$ref": "#/components/schemas/SobjectSort" }, { "$ref": "#/components/schemas/CustomMetadata" } ] }, "ListUsersParams": { "allOf": [ { "type": "object", "properties": { "group_id": { "type": "string", "format": "uuid" }, "acct_id": { "type": "string", "format": "uuid" }, "limit": { "type": "integer" }, "offset": { "type": "integer" }, "with_groups": { "$ref": "#/components/schemas/WithGroups" } } }, { "$ref": "#/components/schemas/UserSort" } ] }, "LmsOptions": { "allOf": [ { "type": "object", "description": "LMS specific options", "properties": { "l1_height": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The height of the top level tree. This field will be deprecated in v2." }, "l2_height": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The height of the secondary tree. This field will be deprecated in v2." }, "digest": { "$ref": "#/components/schemas/DigestAlgorithm" }, "heights": { "type": "array", "items": { "type": "integer" }, "nullable": true, "description": "Heights of the trees in each level." }, "node_size": { "type": "integer", "nullable": true, "description": "Amount of bytes associated to each node (the 'm' parameter)" }, "winternitz_width": { "type": "integer", "nullable": true, "description": "The width of the Winternitz coefficients. The default value is 8." } } } ] }, "LmsOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "LoggingConfig": { "oneOf": [ { "title": "LoggingConfigVariantSplunk", "type": "object", "properties": { "splunk": { "$ref": "#/components/schemas/SplunkLoggingConfig" } }, "required": [ "splunk" ] }, { "title": "LoggingConfigVariantStackdriver", "type": "object", "properties": { "stackdriver": { "$ref": "#/components/schemas/StackdriverLoggingConfig" } }, "required": [ "stackdriver" ] }, { "title": "LoggingConfigVariantSyslog", "type": "object", "properties": { "syslog": { "$ref": "#/components/schemas/SyslogLoggingConfig" } }, "required": [ "syslog" ] }, { "title": "LoggingConfigVariantAzureLogAnalytics", "type": "object", "properties": { "azure_log_analytics": { "$ref": "#/components/schemas/AzureLogAnalyticsLoggingConfig" } }, "required": [ "azure_log_analytics" ] }, { "title": "LoggingConfigVariantAzureLogIngestion", "type": "object", "properties": { "azure_log_ingestion": { "$ref": "#/components/schemas/AzureLogIngestionLoggingConfig" } }, "required": [ "azure_log_ingestion" ] } ] }, "LoggingConfigRequest": { "oneOf": [ { "title": "LoggingConfigRequestVariantSplunk", "type": "object", "properties": { "splunk": { "$ref": "#/components/schemas/SplunkLoggingConfigRequest" } }, "required": [ "splunk" ] }, { "title": "LoggingConfigRequestVariantStackdriver", "type": "object", "properties": { "stackdriver": { "$ref": "#/components/schemas/StackdriverLoggingConfigRequest" } }, "required": [ "stackdriver" ] }, { "title": "LoggingConfigRequestVariantSyslog", "type": "object", "properties": { "syslog": { "$ref": "#/components/schemas/SyslogLoggingConfigRequest" } }, "required": [ "syslog" ] }, { "title": "LoggingConfigRequestVariantAzureLogAnalytics", "type": "object", "properties": { "azure_log_analytics": { "$ref": "#/components/schemas/AzureLogAnalyticsLoggingConfigRequest" } }, "required": [ "azure_log_analytics" ] }, { "title": "LoggingConfigRequestVariantAzureLogIngestion", "type": "object", "properties": { "azure_log_ingestion": { "$ref": "#/components/schemas/AzureLogIngestionLoggingConfigRequest" } }, "required": [ "azure_log_ingestion" ] } ] }, "LogsParams": { "allOf": [ { "type": "object", "description": "Query parameters to get audit logs.", "properties": { "size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "Maximum number of entries to return. Upper limit for max entries is 1000." }, "from": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "Starting offset" }, "range_from": { "type": "integer", "description": "Starting time for search. This is EPOCH time." }, "range_to": { "type": "integer", "description": "Ending time for search. This is EPOCH time." }, "action_type": { "type": "array", "items": { "$ref": "#/components/schemas/ActionType" }, "description": "Action Type" }, "actor_type": { "type": "array", "items": { "type": "string" }, "description": "Actor Type\nAvailable values are: User, App & Plugin." }, "actor_id": { "type": "string", "format": "uuid", "description": "UUID of Actor (User, App or Plugin)" }, "object_id": { "type": "string", "format": "uuid", "description": "UUID of entity affected by event. For instance, if a group is created object_id will be UUID of group." }, "previous_id": { "type": "string", "format": "uuid", "description": "UUID of log after which further logs are required." }, "severity": { "type": "array", "items": { "$ref": "#/components/schemas/SeverityLevel" }, "description": "Severity of event" } } } ] }, "MacRequest": { "allOf": [ { "type": "object", "description": "Request to compute a MAC.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "data": { "type": "string", "format": "byte", "description": "The data for which to generate a MAC" } }, "required": [ "data" ] } ] }, "MacResponse": { "allOf": [ { "type": "object", "description": "Response of a MAC computation request.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the key used to compute the MAC. Returned for\nnon-transient keys" }, "mac": { "type": "string", "format": "byte", "description": "MAC generated for the input data" } }, "required": [ "mac" ] } ] }, "MarketplacePlugin": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "versions": { "type": "object", "additionalProperties": { "type": "string", "nullable": true } } }, "required": [ "name", "versions" ] } ] }, "Metadata": { "allOf": [ { "type": "object", "properties": { "total_count": { "type": "integer", "nullable": true }, "filtered_count": { "type": "integer", "nullable": true } } } ] }, "MetadataDurationConstraintRequired": { "allOf": [ { "type": "object", "properties": { "allowed_values": { "$ref": "#/components/schemas/RestrictedDuration" } } } ] }, "MetadataDurationConstraint": { "oneOf": [ { "title": "MetadataDurationConstraintVariantForbidden", "type": "object", "properties": { "forbidden": { "type": "object", "properties": {} } }, "required": [ "forbidden" ] }, { "title": "MetadataDurationConstraintVariantRequired", "type": "object", "properties": { "required": { "$ref": "#/components/schemas/MetadataDurationConstraintRequired" } }, "required": [ "required" ] } ] }, "MetadataPolicyItem": { "allOf": [ { "type": "object", "properties": { "custom_metadata": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/MetadataStringConstraint" } }, "description": { "$ref": "#/components/schemas/MetadataStringConstraint" }, "deactivation_date": { "$ref": "#/components/schemas/MetadataDurationConstraint" }, "activation_date": { "$ref": "#/components/schemas/MetadataDurationConstraint" } }, "required": [ "custom_metadata" ] } ] }, "MetadataStringConstraintRequired": { "allOf": [ { "type": "object", "properties": { "non_empty_after_trim": { "type": "boolean", "nullable": true, "description": "If set to `true`, the value must have a length > 0 after trimming\nleading and trailing whitespace characters." }, "allowed_values": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "nullable": true, "description": "If not specified or empty, it will not impose any restrictions on the value." } } } ] }, "MetadataStringConstraint": { "oneOf": [ { "title": "MetadataStringConstraintVariantForbidden", "type": "object", "properties": { "forbidden": { "type": "object", "properties": {} } }, "required": [ "forbidden" ] }, { "title": "MetadataStringConstraintVariantRequired", "type": "object", "properties": { "required": { "$ref": "#/components/schemas/MetadataStringConstraintRequired" } }, "required": [ "required" ] } ] }, "MfaAuthMethodFido2": { "allOf": [ { "type": "object", "properties": { "challenge": { "$ref": "#/components/schemas/PublicKeyCredentialRequestOptions" }, "challenge_token": { "type": "string", "format": "byte" }, "mfa_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaDevice" } } }, "required": [ "challenge", "challenge_token", "mfa_devices" ] } ] }, "MfaAuthMethod": { "oneOf": [ { "title": "MfaAuthMethodVariantFido2", "type": "object", "properties": { "Fido2": { "$ref": "#/components/schemas/MfaAuthMethodFido2" } }, "required": [ "Fido2" ] } ] }, "MfaChallengeParams": { "allOf": [ { "type": "object", "description": "Params for Mfa challenge.", "properties": { "protocol": { "$ref": "#/components/schemas/MfaProtocol" } }, "required": [ "protocol" ] } ] }, "MfaChallengeResponse": { "oneOf": [ { "$ref": "#/components/schemas/U2fMfaChallengeResponse" }, { "$ref": "#/components/schemas/Fido2MfaChallengeResponse" } ] }, "MfaDelDeviceRequest": { "allOf": [ { "type": "object", "description": "Request to delete a FIDO device.", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Name of the FIDO device to delete." } }, "required": [ "name" ] } ] }, "MfaDevice": { "allOf": [ { "type": "object", "description": "A FIDO device that may be used for second factor authentication.", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Name given to the FIDO device." }, "type": { "$ref": "#/components/schemas/MfaDeviceType" }, "origin": { "type": "string", "nullable": true, "description": "Origin of the FIDO device." } }, "required": [ "name", "type" ] } ] }, "MfaDeviceType": { "description": "Type of MFA device", "type": "string", "enum": [ "U2f", "Fido2" ] }, "MfaProtocol": { "description": "Protocols for MFA.", "type": "string", "enum": [ "u2f", "fido2" ] }, "MfaRenameDeviceRequest": { "allOf": [ { "type": "object", "description": "Request to rename a FIDO device.", "properties": { "old_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Old name of FIDO device." }, "new_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "New name of FIDO device." } }, "required": [ "old_name", "new_name" ] } ] }, "MgfMgf1": { "allOf": [ { "type": "object", "description": "MGF1 algorithm", "properties": { "hash": { "$ref": "#/components/schemas/DigestAlgorithm" } }, "required": [ "hash" ] } ] }, "Mgf": { "description": "Specifies the Mask Generating Function (MGF) to use.", "oneOf": [ { "title": "MgfVariantMgf1", "type": "object", "properties": { "mgf1": { "$ref": "#/components/schemas/MgfMgf1" } }, "required": [ "mgf1" ] } ] }, "MgfPolicyMgf1": { "allOf": [ { "type": "object", "properties": { "hash": { "$ref": "#/components/schemas/DigestAlgorithm" } } } ] }, "MgfPolicy": { "description": "MGF policy.", "oneOf": [ { "title": "MgfPolicyVariantMgf1", "type": "object", "properties": { "mgf1": { "$ref": "#/components/schemas/MgfPolicyMgf1" } }, "required": [ "mgf1" ] } ] }, "MlDsaMode": { "oneOf": [ { "$ref": "#/components/schemas/MlDsaModeVariantPure" }, { "$ref": "#/components/schemas/MlDsaModeVariantPreHash" }, { "$ref": "#/components/schemas/MlDsaModeVariantExternalMu" } ], "discriminator": { "propertyName": "variant", "mapping": { "PURE": "MlDsaModeVariantPure", "PRE_HASH": "MlDsaModeVariantPreHash", "EXTERNAL_MU": "MlDsaModeVariantExternalMu" } } }, "MlDsaModeVariantPure": { "allOf": [ { "type": "object", "properties": { "variant": { "type": "string", "enum": [ "PURE" ] } }, "required": [ "variant" ] }, { "type": "object", "properties": {} } ] }, "MlDsaModeVariantPreHash": { "allOf": [ { "type": "object", "properties": { "variant": { "type": "string", "enum": [ "PRE_HASH" ] } }, "required": [ "variant" ] }, { "type": "object", "properties": {} } ] }, "MlDsaModeVariantExternalMu": { "allOf": [ { "type": "object", "properties": { "variant": { "type": "string", "enum": [ "EXTERNAL_MU" ] } }, "required": [ "variant" ] }, { "type": "object", "properties": {} } ] }, "MlDsaOptions": { "allOf": [ { "type": "object", "description": "ML-DSA specific options", "properties": { "param_set": { "$ref": "#/components/schemas/MlDsaParamSet" } }, "required": [ "param_set" ] } ] }, "MlDsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "MlDsaParamSet": { "description": "ML-DSA parameter sets", "type": "string", "enum": [ "MlDsa44", "MlDsa65", "MlDsa87" ] }, "MlKemOptions": { "allOf": [ { "type": "object", "description": "ML-KEM specific options", "properties": { "param_set": { "$ref": "#/components/schemas/MlKemParamSet" } } } ] }, "MlKemOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "MlKemParamSet": { "description": "ML-KEM parameter sets", "type": "string", "enum": [ "MlKem512", "MlKem768", "MlKem1024" ] }, "NotificationPref": { "description": "Notification preferences.", "type": "string", "enum": [ "None", "Email", "Phone", "Both" ] }, "OauthAuthParamDisplay": { "description": "Corresponds to the `display` parameter in\nhttps://openid.net/specs/openid-connect-core-1_0.html#AuthRequest", "type": "string", "enum": [ "page", "popup", "touch", "wap" ] }, "OauthAuthParamPrompt": { "description": "Corresponds to the `prompt` parameter in\nhttps://openid.net/specs/openid-connect-core-1_0.html#AuthRequest", "type": "string", "enum": [ "login", "none", "consent", "select_account" ] }, "OauthAuthenticationParameters": { "allOf": [ { "type": "object", "description": "Parameters for the OpenID Connect Authentication Request\nhttps://openid.net/specs/openid-connect-core-1_0.html#AuthRequest", "properties": { "prompt": { "type": "array", "items": { "$ref": "#/components/schemas/OauthAuthParamPrompt" }, "nullable": true, "description": "Specifies whether the Authorization Server prompts the End-User for reauthentication and consent" }, "display": { "$ref": "#/components/schemas/OauthAuthParamDisplay" }, "max_age": { "type": "integer", "nullable": true, "description": "Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.\nIf the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User" } } } ] }, "OauthCodeData": { "allOf": [ { "type": "object", "properties": { "idp_id": { "type": "string", "format": "byte" }, "code": { "type": "string" }, "email": { "type": "string" } }, "required": [ "idp_id", "code", "email" ] } ] }, "OauthScope": { "description": "OAuth scope.", "type": "string", "enum": [ "app", "openid", "email", "profile" ] }, "ObjectCount": { "allOf": [ { "type": "object", "properties": { "count": { "type": "integer", "description": "Count of the items in the collection matching the request" }, "count_accuracy": { "$ref": "#/components/schemas/CountAccuracy" } }, "required": [ "count", "count_accuracy" ] } ] }, "ObjectCounts": { "allOf": [ { "type": "object", "description": "Counts of objects of various types in an account.", "properties": { "groups": { "type": "integer" }, "apps": { "type": "integer" }, "users": { "type": "integer" }, "plugins": { "type": "integer" }, "sobjects": { "type": "integer", "description": "The total number of sobjects in the account, or\nan approximation thereof.\n\nNote that all sobjects in the account are counted,\nregardless of whether the user has access to them." }, "sobjects_accuracy": { "$ref": "#/components/schemas/CountAccuracy" }, "child_accounts": { "type": "integer" } }, "required": [ "groups", "apps", "users", "plugins", "sobjects", "sobjects_accuracy", "child_accounts" ] } ] }, "ObjectDigestRequest": { "allOf": [ { "type": "object", "description": "Request to compute digest of a key.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/DigestAlgorithm" } }, "required": [ "key", "alg" ] } ] }, "ObjectDigestResponse": { "allOf": [ { "type": "object", "description": "Digest of a key.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "UUID, only displayed for persistent keys." }, "digest": { "type": "string", "format": "byte", "description": "Digest value" } }, "required": [ "digest" ] } ] }, "ObjectOrigin": { "description": "The origin of a security object - where it was created / generated.", "type": "string", "enum": [ "FortanixHSM", "Transient", "External" ] }, "ObjectType": { "description": "Type of security object.", "type": "string", "enum": [ "AES", "ARIA", "DES", "DES3", "SEED", "RSA", "DSA", "EC", "KCDSA", "ECKCDSA", "BIP32", "SLIP10", "BLS", "OPAQUE", "HMAC", "LEDABETA", "ROUND5BETA", "SECRET", "LMS", "XMSS", "MLDSA", "MLDSABETA", "MLKEM", "MLKEMBETA", "CERTIFICATE", "PBE" ] }, "ObjectTypeFilterSelection": { "allOf": [ { "type": "object", "properties": { "selection": { "type": "array", "items": { "$ref": "#/components/schemas/ObjectType" } } }, "required": [ "selection" ] } ] }, "ObjectTypeFilter": { "oneOf": [ { "$ref": "#/components/schemas/ObjectTypeFilterVariantAll" }, { "$ref": "#/components/schemas/ObjectTypeFilterVariantSelection" } ], "discriminator": { "propertyName": "$type", "mapping": { "All": "ObjectTypeFilterVariantAll", "Selection": "ObjectTypeFilterVariantSelection" } } }, "ObjectTypeFilterVariantAll": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "All" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "ObjectTypeFilterVariantSelection": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Selection" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/ObjectTypeFilterSelection" } ] }, "OciCredentialAuthApiKey": { "allOf": [ { "type": "object", "description": "**NOTE**: This is not to be confused with a static long-lived token.", "properties": { "user_ocid": { "type": "string", "description": "The user's OCID from Oracle who will have the public key\nconfigured as an \"API Key\" on Oracle servers. That public\nkey is part of the key-pair represented by `signing_key`." }, "tenant_ocid": { "type": "string", "description": "The tenant OCID from Oracle" }, "signing_key": { "$ref": "#/components/schemas/SobjectId" } }, "required": [ "user_ocid", "tenant_ocid", "signing_key" ] } ] }, "OciCredentialAuth": { "oneOf": [ { "$ref": "#/components/schemas/OciCredentialAuthVariantApiKey" } ], "discriminator": { "propertyName": "$type", "mapping": { "ApiKey": "OciCredentialAuthVariantApiKey" } } }, "OciCredentialAuthVariantApiKey": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "ApiKey" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/OciCredentialAuthApiKey" } ] }, "OciKeyVault": { "allOf": [ { "type": "object", "properties": { "vault_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "vault_type": { "type": "string" }, "vault_id": { "type": "string" } }, "required": [ "vault_name", "vault_type", "vault_id" ] } ] }, "OciVaultInfo": { "allOf": [ { "type": "object", "description": "Any key specific metadata that isn't already described\nby an existing security object field.", "properties": { "protection_mode": { "type": "string", "description": "Describes the OCI vault protection mode, usually\nmeaning HSM or SOFTWARE." }, "deletion_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The scheduled deletion_date of the OCI key version" }, "display_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "The name in the OCI Vault (and may differ from\nwhat the DSM virtual key shows)." } }, "required": [ "protection_mode", "display_name" ] } ] }, "OnPremSubscriptionType": { "allOf": [ { "type": "object", "description": "OnPrem subscription type", "properties": { "count_transient_ops": { "type": "boolean", "nullable": true } } } ] }, "OneAppAuthType": { "description": "Authentication method of an app.", "type": "string", "enum": [ "Secret", "GoogleServiceAccount", "SignedJwt", "Ldap", "AwsIam", "AwsXks", "GoogleWorkspaceCSE", "Certificate", "TrustedCa" ] }, "OneAppCredential": { "description": "App authentication mechanisms.", "oneOf": [ { "title": "OneAppCredentialVariantSecret", "type": "object", "properties": { "secret": { "type": "string", "description": "Authenticating credentials of an App." } }, "required": [ "secret" ] }, { "title": "OneAppCredentialVariantCertificate", "type": "object", "properties": { "certificate": { "type": "string", "format": "byte", "description": "PKI Certificate based authentication." } }, "required": [ "certificate" ] }, { "title": "OneAppCredentialVariantTrustedCa", "type": "object", "properties": { "trustedca": { "$ref": "#/components/schemas/TrustedCaCredential" } }, "required": [ "trustedca" ] }, { "title": "OneAppCredentialVariantGoogleServiceAccount", "type": "object", "properties": { "googleserviceaccount": { "$ref": "#/components/schemas/GoogleServiceAccountCredential" } }, "required": [ "googleserviceaccount" ] }, { "title": "OneAppCredentialVariantSignedJwt", "type": "object", "properties": { "signedjwt": { "$ref": "#/components/schemas/SignedJwtCredential" } }, "required": [ "signedjwt" ] }, { "title": "OneAppCredentialVariantLdap", "type": "object", "properties": { "ldap": { "type": "string", "format": "uuid", "description": "LDAP credentials of an App used for authentication." } }, "required": [ "ldap" ] }, { "title": "OneAppCredentialVariantAwsIam", "type": "object", "properties": { "awsiam": { "type": "object", "properties": {} } }, "required": [ "awsiam" ] }, { "title": "OneAppCredentialVariantAwsXks", "type": "object", "properties": { "awsxks": { "$ref": "#/components/schemas/AwsXksCredential" } }, "required": [ "awsxks" ] }, { "title": "OneAppCredentialVariantGoogleWorkspaceCse", "type": "object", "properties": { "googleworkspacecse": { "type": "object", "properties": {} } }, "required": [ "googleworkspacecse" ] } ] }, "OneAppCredentialRequest": { "oneOf": [ { "title": "OneAppCredentialRequestVariantSecret", "type": "object", "properties": { "secret": { "$ref": "#/components/schemas/SecretCredentialRequest" } }, "required": [ "secret" ] }, { "title": "OneAppCredentialRequestVariantCertificate", "type": "object", "properties": { "certificate": { "type": "string", "format": "byte", "description": "PKI Certificate based authentication." } }, "required": [ "certificate" ] }, { "title": "OneAppCredentialRequestVariantTrustedCa", "type": "object", "properties": { "trustedca": { "$ref": "#/components/schemas/TrustedCaCredential" } }, "required": [ "trustedca" ] }, { "title": "OneAppCredentialRequestVariantGoogleServiceAccount", "type": "object", "properties": { "googleserviceaccount": { "$ref": "#/components/schemas/GoogleServiceAccountCredential" } }, "required": [ "googleserviceaccount" ] }, { "title": "OneAppCredentialRequestVariantSignedJwt", "type": "object", "properties": { "signedjwt": { "$ref": "#/components/schemas/SignedJwtCredential" } }, "required": [ "signedjwt" ] }, { "title": "OneAppCredentialRequestVariantLdap", "type": "object", "properties": { "ldap": { "type": "string", "format": "uuid", "description": "LDAP credentials of an App used for authentication." } }, "required": [ "ldap" ] }, { "title": "OneAppCredentialRequestVariantAwsIam", "type": "object", "properties": { "awsiam": { "type": "object", "properties": {} } }, "required": [ "awsiam" ] }, { "title": "OneAppCredentialRequestVariantAwsXks", "type": "object", "properties": { "awsxks": { "$ref": "#/components/schemas/AwsXksCredentialRequest" } }, "required": [ "awsxks" ] }, { "title": "OneAppCredentialRequestVariantGoogleWorkspaceCse", "type": "object", "properties": { "googleworkspacecse": { "type": "object", "properties": {} } }, "required": [ "googleworkspacecse" ] } ] }, "OpaqueOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "OuterEsBucket": { "allOf": [ { "type": "object", "properties": { "doc_count": { "type": "integer" }, "key": { "type": "integer" }, "key_as_string": { "type": "string" }, "total_txn": { "$ref": "#/components/schemas/EsTotalTxn" } }, "required": [ "doc_count", "key", "key_as_string", "total_txn" ] } ] }, "PasswordChangeRequest": { "allOf": [ { "type": "object", "description": "Request to change user's password.", "properties": { "current_password": { "type": "string" }, "new_password": { "type": "string" } }, "required": [ "current_password", "new_password" ] } ] }, "PasswordResetRequest": { "allOf": [ { "type": "object", "description": "Request to perform a password reset.", "properties": { "reset_token": { "type": "string" }, "new_password": { "type": "string" } }, "required": [ "reset_token", "new_password" ] } ] }, "PersistTransientKeyRequest": { "allOf": [ { "type": "object", "description": "Request to persist a transient key.", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Intended activation date of the security object." }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Intended deactivation date of the security object." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Name of the persisted security object. Security object names must be unique within an account." }, "description": { "type": "string", "nullable": true, "description": "User-defined readable description" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User-defined metadata for the persisted key stored as key-value pairs." }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether the new security object should be enabled. Disabled security objects may not perform cryptographic operations." }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the security group that the persisted key should belong to. The user or\napplication creating this security object must be a member of this group. If no group is\nspecified, the default group for the requesting application will be used." }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient_key": { "type": "string", "format": "byte", "description": "Transient key to persist" } }, "required": [ "name", "transient_key" ] } ] }, "Pkcs11ClientConfig": { "allOf": [ { "type": "object", "properties": { "fake_rsa_x9_31_keygen_support": { "type": "boolean", "nullable": true }, "signing_aes_key_as_hmac": { "type": "boolean", "nullable": true }, "exact_key_ops": { "type": "boolean", "nullable": true }, "prevent_duplicate_opaque_objects": { "type": "boolean", "nullable": true }, "opaque_objects_are_not_certificates": { "type": "boolean", "nullable": true }, "max_concurrent_requests_per_slot": { "type": "integer", "nullable": true } } } ] }, "Plugin": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid", "description": "The id of the Account that the plugin belongs to." }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp when the plugin was created." }, "creator": { "$ref": "#/components/schemas/Principal" }, "default_group": { "type": "string", "format": "uuid", "description": "The default group a plugin belongs to." }, "description": { "type": "string", "nullable": true, "description": "Description of the plugin." }, "enabled": { "type": "boolean", "description": "Is plugin enabled." }, "lastrun_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp when the plugin was most recently used." }, "lastupdated_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp when the plugin was most recently updated." }, "legacy_access": { "type": "boolean", "description": "If a requester is updating/using a Plugin they must have the relevant\npermissions in all Groups that Plugin has access to. But for legacy Plugins,\nthe requester is required to have relevant permissions in any one of the groups\nthat Plugin has access to." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Name of the plugin, which must be unique within an account." }, "plugin_id": { "type": "string", "format": "uuid", "description": "Unique id to identify a plugin." }, "plugin_type": { "$ref": "#/components/schemas/PluginType" }, "source": { "$ref": "#/components/schemas/PluginSource" }, "groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "description": "Set of all the groups that plugin is part of." } }, "required": [ "acct_id", "created_at", "creator", "default_group", "enabled", "lastupdated_at", "legacy_access", "name", "plugin_id", "plugin_type", "source", "groups" ] } ] }, "PluginCodeSigningPolicy": { "allOf": [ { "type": "object", "description": "Plugin code signing policy.\n\nWhen a code signing policy is set, all requests to create new plugins or\nupdate existing plugins (if updating the code) would need to provide a valid\nsignature.", "properties": { "signing_keys": { "$ref": "#/components/schemas/SigningKeys" } }, "required": [ "signing_keys" ] } ] }, "PluginRequest": { "allOf": [ { "type": "object", "properties": { "default_group": { "type": "string", "format": "uuid", "nullable": true, "description": "The default group a plugin belongs to." }, "description": { "type": "string", "nullable": true, "description": "Description of the plugin." }, "enabled": { "type": "boolean", "nullable": true, "description": "Is plugin enabled." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the plugin, which must be unique within an account." }, "plugin_type": { "$ref": "#/components/schemas/PluginType" }, "signature": { "type": "string", "nullable": true, "description": "A detached OpenPGP signature over the plugin source code.\n\nThe signature packet must be armored. If the account has a plugin code signing\npolicy, the signature is required in the following cases:\n- when creating a new plugin\n- when updating the plugin code" }, "source": { "$ref": "#/components/schemas/PluginSourceRequest" }, "add_groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Set of all the groups that plugin is part of." }, "del_groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Set of all the groups that plugin is part of." }, "mod_groups": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Set of all the groups that plugin is part of." } } } ] }, "PluginSort": { "oneOf": [ { "title": "PluginSortVariantByPluginId", "type": "object", "description": "Sort plugins by Plugin Id.", "properties": { "sort": { "type": "string", "pattern": "^plugin_id:(?:asc|desc)$", "example": "plugin_id:asc" }, "start": { "type": "string", "format": "uuid", "description": "Starting offset(UUID of plugin)." } }, "required": [ "sort" ] } ] }, "PluginSourceFromRepo": { "allOf": [ { "type": "object", "properties": { "repo_url": { "type": "string" }, "name": { "type": "string" }, "version": { "$ref": "#/components/schemas/PluginVersion" }, "language": { "$ref": "#/components/schemas/Language" }, "code": { "type": "string" } }, "required": [ "repo_url", "name", "version", "language", "code" ] } ] }, "PluginSourceInline": { "allOf": [ { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Language" }, "code": { "type": "string" } }, "required": [ "language", "code" ] } ] }, "PluginSource": { "description": "Plugin code that will be executed inside SGX enclave.", "oneOf": [ { "$ref": "#/components/schemas/PluginSourceFromRepo" }, { "$ref": "#/components/schemas/PluginSourceInline" } ] }, "PluginSourceRequestFromRepo": { "allOf": [ { "type": "object", "properties": { "repo_url": { "type": "string" }, "plugin_name": { "type": "string" }, "version": { "$ref": "#/components/schemas/PluginVersion" } }, "required": [ "repo_url", "plugin_name", "version" ] } ] }, "PluginSourceRequestInline": { "allOf": [ { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Language" }, "code": { "type": "string" } }, "required": [ "language", "code" ] } ] }, "PluginSourceRequest": { "oneOf": [ { "$ref": "#/components/schemas/PluginSourceRequestFromRepo" }, { "$ref": "#/components/schemas/PluginSourceRequestInline" } ] }, "PluginType": { "description": "Type of a plugin.", "type": "string", "enum": [ "STANDARD", "IMPERSONATING", "CUSTOMALGORITHM" ] }, "PolicyDefinitionRego": { "allOf": [ { "type": "object", "description": "A policy definition defined using the Rego policy language as outlined in\nthe [Open Policy Agent](https://www.openpolicyagent.org/docs/policy-language) docs.\n\nThe DSM backend will pass an input to the Rego engine and the format is defined as such:\n- A JSON object that nests the JWT body one level, where the root key is `jwt_body`.\n- From the policy, this object is accessible via the `input` (OPA defined) variable.\n\nAn example of the input object:\n```json\n{\n\"jwt_body\": { < jwt body contents > }\n}\n```\n\nAn example policy indexing into the input:\n\n```rego\npackage my_example\n\ndefault allow := false\n\nallow if {\ninput.jwt_body.my_private_claims.employee == \"Alice\"\n}\n```\n\nThe expected policy format is defined as such:\n- A **required** variable defined as `allow` of type boolean. This should be updated true or false based on any other processing done.\n- An **optional** field defined as `additional_logging` if the client wishes to include other information not captured in existing audit logs for JWT auth apps.\n- Note: `additional_logging` is *limited to a max length of 128 UTF-8 bytes* and corresponds to the `client_provided_context` field on the `AuditLog` model.", "properties": { "value": { "type": "string" } }, "required": [ "value" ] } ] }, "PolicyDefinition": { "oneOf": [ { "$ref": "#/components/schemas/PolicyDefinitionVariantRego" } ], "discriminator": { "propertyName": "$type", "mapping": { "rego": "PolicyDefinitionVariantRego" } } }, "PolicyDefinitionVariantRego": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "rego" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/PolicyDefinitionRego" } ] }, "PreviousCredential": { "allOf": [ { "type": "object", "description": "Expired app-credentials that are still valid for a transitional period.", "properties": { "credential": { "$ref": "#/components/schemas/AppCredential" }, "valid_until": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Validity period of the App credentials." } }, "required": [ "credential", "valid_until" ] } ] }, "PrincipalUserViaApp": { "allOf": [ { "type": "object", "description": "UserViaApp signifies a user authorizing some app to act on its behalf through OAuth.", "properties": { "user_id": { "type": "string", "format": "uuid" }, "scopes": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/OauthScope" } } }, "required": [ "user_id", "scopes" ] } ] }, "Principal": { "description": "A security principal.", "oneOf": [ { "title": "PrincipalVariantApp", "type": "object", "properties": { "app": { "type": "string", "format": "uuid" } }, "required": [ "app" ] }, { "title": "PrincipalVariantUser", "type": "object", "properties": { "user": { "type": "string", "format": "uuid" } }, "required": [ "user" ] }, { "title": "PrincipalVariantPlugin", "type": "object", "properties": { "plugin": { "type": "string", "format": "uuid" } }, "required": [ "plugin" ] }, { "title": "PrincipalVariantUserViaApp", "type": "object", "properties": { "userviaapp": { "$ref": "#/components/schemas/PrincipalUserViaApp" } }, "required": [ "userviaapp" ] }, { "title": "PrincipalVariantSystem", "type": "string", "enum": [ "system" ] }, { "title": "PrincipalVariantUnregisteredUser", "type": "string", "enum": [ "unregistereduser" ] } ] }, "PrivateClaimsPolicy": { "allOf": [ { "type": "object", "properties": { "definition": { "$ref": "#/components/schemas/PolicyDefinition" } }, "required": [ "definition" ] } ] }, "ProcessInviteRequest": { "allOf": [ { "type": "object", "description": "Accept/reject invitations to join account.", "properties": { "accepts": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Optional list of account IDs to accept." }, "rejects": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Optional list of account IDs to reject." } } } ] }, "PublicKeyCredentialCreationOptions": { "allOf": [ { "type": "object", "description": "", "properties": { "rp": { "$ref": "#/components/schemas/PublicKeyCredentialEntityForRp" }, "user": { "$ref": "#/components/schemas/PublicKeyCredentialEntityForUser" }, "challenge": { "$ref": "#/components/schemas/Base64UrlSafe" }, "pubKeyCredParams": { "type": "array", "items": { "$ref": "#/components/schemas/PublicKeyCredentialParameters" }, "description": "This member contains information about the desired properties of the\ncredential to be created. The sequence is ordered from most preferred\nto least preferred." }, "timeout": { "type": "integer", "nullable": true, "description": "The time for which response from the authenticator\nwould be awaited. This should only be a hint as per the spec.\nThis is in milliseconds." }, "excludeCredentials": { "type": "array", "items": { "$ref": "#/components/schemas/PublicKeyCredentialDescriptor" }, "description": "The existing creds mapped to the current user. This tells\nthe authenticator to not create multiple creds for the same\nuser.\nNOTE: This isn't for U2F authenticators. For that, `appidExclude`\nneeds to be set instead." }, "authenticatorSelection": { "$ref": "#/components/schemas/AuthenticatorSelectionCriteria" }, "attestation": { "$ref": "#/components/schemas/AttestationConveyancePreference" }, "extensions": { "$ref": "#/components/schemas/AuthenticationExtensionsClientInputs" } }, "required": [ "rp", "user", "challenge", "pubKeyCredParams", "excludeCredentials", "attestation" ] } ] }, "PublicKeyCredentialDescriptor": { "allOf": [ { "type": "object", "description": "Used to in registration response (telling about existing creds) to prevent\ncreation of duplicate creds on the same authenticator.\nUsed in authentication as the allowed creds.", "properties": { "type": { "$ref": "#/components/schemas/PublicKeyCredentialType" }, "id": { "$ref": "#/components/schemas/Base64UrlSafe" }, "transports": { "type": "array", "items": { "$ref": "#/components/schemas/AuthenticatorTransport" }, "nullable": true, "description": "Hints by relying party on what transport client should\nuse to communicate with authenticator." } }, "required": [ "type", "id" ] } ] }, "PublicKeyCredentialParameters": { "allOf": [ { "type": "object", "description": "https://www.w3.org/TR/webauthn-2/#dictionary-credential-params", "properties": { "type": { "$ref": "#/components/schemas/PublicKeyCredentialType" }, "alg": { "$ref": "#/components/schemas/COSEAlgorithmIdentifier" } }, "required": [ "type", "alg" ] } ] }, "PublicKeyCredentialRequestOptions": { "allOf": [ { "type": "object", "description": "", "properties": { "challenge": { "$ref": "#/components/schemas/Base64UrlSafe" }, "timeout": { "type": "integer", "nullable": true, "description": "The time for which response from the authenticator\nwould be awaited. This should only be a hint as per the spec.\nThis is in milliseconds." }, "rpId": { "type": "string", "nullable": true, "description": "This optional member specifies the relying party identifier\nclaimed by the caller. If omitted, its value will be the\nCredentialsContainer object’s relevant settings object's\norigin's effective domain." }, "allowCredentials": { "type": "array", "items": { "$ref": "#/components/schemas/PublicKeyCredentialDescriptor" }, "nullable": true, "description": "This OPTIONAL member contains a list of [PublicKeyCredentialDescriptor]\nobjects representing public key credentials acceptable to the caller,\nin descending order of the caller’s preference (the first item in the\nlist is the most preferred credential, and so on down the list)." }, "userVerification": { "$ref": "#/components/schemas/UserVerificationRequirement" }, "extensions": { "$ref": "#/components/schemas/AuthenticationExtensionsClientInputs" } }, "required": [ "challenge" ] } ] }, "PublicKeyCredentialRpEntity": { "allOf": [ { "type": "object", "description": "", "properties": { "id": { "type": "string", "nullable": true, "description": "A unique identifier for the Relying Party entity, which sets the RP ID.\n\n" } } } ] }, "PublicKeyCredentialType": { "description": "https://www.w3.org/TR/webauthn-2/#enum-credentialType\n\nThis enum defines valid cred types.", "type": "string", "enum": [ "public-key" ] }, "PublicKeyCredentialUserEntity": { "allOf": [ { "type": "object", "description": "", "properties": { "id": { "$ref": "#/components/schemas/Base64UrlSafe" }, "displayName": { "type": "string", "description": "Human friendly name intended only for display." } }, "required": [ "id", "displayName" ] } ] }, "PublishPublicKeyConfigEnabled": { "allOf": [ { "type": "object", "properties": { "list_previous_version": { "type": "boolean", "description": "Additionally list the previous version of the key if not compromised." } }, "required": [ "list_previous_version" ] } ] }, "PublishPublicKeyConfig": { "description": "If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API.", "oneOf": [ { "$ref": "#/components/schemas/PublishPublicKeyConfigVariantEnabled" }, { "$ref": "#/components/schemas/PublishPublicKeyConfigVariantDisabled" } ], "discriminator": { "propertyName": "state", "mapping": { "enabled": "PublishPublicKeyConfigVariantEnabled", "disabled": "PublishPublicKeyConfigVariantDisabled" } } }, "PublishPublicKeyConfigVariantEnabled": { "allOf": [ { "type": "object", "properties": { "state": { "type": "string", "enum": [ "enabled" ] } }, "required": [ "state" ] }, { "$ref": "#/components/schemas/PublishPublicKeyConfigEnabled" } ] }, "PublishPublicKeyConfigVariantDisabled": { "allOf": [ { "type": "object", "properties": { "state": { "type": "string", "enum": [ "disabled" ] } }, "required": [ "state" ] }, { "type": "object", "properties": {} } ] }, "Quorum": { "allOf": [ { "type": "object", "description": "Quorum approval policy.", "properties": { "n": { "type": "integer" }, "members": { "type": "array", "items": { "$ref": "#/components/schemas/QuorumPolicy" } } }, "required": [ "n", "members" ] }, { "$ref": "#/components/schemas/ApprovalAuthConfig" } ] }, "QuorumApprovalConfig": { "allOf": [ { "type": "object", "description": "Quorum Policy Configurations in clients", "properties": { "wait_for_quorum_approval": { "$ref": "#/components/schemas/ApprovalWaitConfig" } } } ] }, "QuorumGroupPermissions": { "description": "Subset of GroupPermissions to represent GroupPermissions flags in use\n\n\n\n GET_SOBJECTS:\n\n\n ROTATE_SOBJECTS:\n\n\n REVOKE_SOBJECTS:\n\n\n REVERT_SOBJECTS:\n\n\n DELETE_KEY_MATERIAL:\n\n\n DELETE_SOBJECTS:\n\n\n DESTROY_SOBJECTS:\n\n\n MOVE_SOBJECTS:\n\n\n CREATE_SOBJECTS:\n\n\n UPDATE_SOBJECTS_PROFILE:\n\n\n UPDATE_SOBJECTS_ENABLED_STATE:\n\n\n UPDATE_SOBJECT_POLICIES:\n\n\n ACTIVATE_SOBJECTS:\n\n\n UPDATE_KEY_OPS:\n\n", "type": "string", "enum": [ "GET_SOBJECTS", "ROTATE_SOBJECTS", "REVOKE_SOBJECTS", "REVERT_SOBJECTS", "DELETE_KEY_MATERIAL", "DELETE_SOBJECTS", "DESTROY_SOBJECTS", "MOVE_SOBJECTS", "CREATE_SOBJECTS", "UPDATE_SOBJECTS_PROFILE", "UPDATE_SOBJECTS_ENABLED_STATE", "UPDATE_SOBJECT_POLICIES", "ACTIVATE_SOBJECTS", "UPDATE_KEY_OPS" ] }, "QuorumPolicy": { "allOf": [ { "type": "object", "description": "Approval policy.", "properties": { "quorum": { "$ref": "#/components/schemas/Quorum" }, "user": { "type": "string", "format": "uuid", "nullable": true }, "app": { "type": "string", "format": "uuid", "nullable": true } } } ] }, "RecentScanSummary": { "allOf": [ { "type": "object", "description": "A summary of the latest scans for a replication account.", "properties": { "in_progress": { "$ref": "#/components/schemas/ReplicationScan" }, "last_completed": { "$ref": "#/components/schemas/ReplicationScan" }, "last_successful": { "$ref": "#/components/schemas/ReplicationScan" } } } ] }, "RecoveryCodeAuthRequest": { "allOf": [ { "type": "object", "description": "Request to authenticate using U2F recovery code.", "properties": { "recovery_code": { "type": "string" } }, "required": [ "recovery_code" ] } ] }, "RecoveryCodes": { "allOf": [ { "type": "object", "description": "U2F recovery codes.", "properties": { "recovery_codes": { "type": "array", "items": { "type": "string" } } }, "required": [ "recovery_codes" ] } ] }, "ReplicationCredential": { "description": "Details about the admin app credential used to replicate objects from the source account.", "oneOf": [ { "$ref": "#/components/schemas/ReplicationCredentialVariantCertificate" } ], "discriminator": { "propertyName": "$type", "mapping": { "Certificate": "ReplicationCredentialVariantCertificate" } } }, "ReplicationCredentialVariantCertificate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Certificate" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/CertificateReplicationCredential" } ] }, "ReplicationCredentialId": { "description": "The ID of a replication credential.", "allOf": [ { "type": "string" } ] }, "ReplicationCredentialSelfSignedCertRequest": { "allOf": [ { "type": "object", "description": "A request to generate a new self-signed certificate for a\nreplication credential.\n\nFor now, the default attributes will include the following:\n- Version 3 certificate\n- Subject:\n- Common name is \" replication credential \",\nwhere and are replaced with the actual IDs\n- No other attributes in the subject\n- No expiry (represented by 99991231235959Z as per RFC 5280)\n- There will not be a basic constraints extension", "properties": {} } ] }, "ReplicationCredentialSelfSignedCertResponse": { "allOf": [ { "type": "object", "description": "Response from the endpoint to generate a new self-signed cert for a replication credential.", "properties": { "certificate": { "type": "string", "format": "byte", "description": "The self-signed certificate generated by DSM." } }, "required": [ "certificate" ] } ] }, "ReplicationScan": { "allOf": [ { "type": "object", "description": "Information about a scan performed under a replication account.", "properties": { "started_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the scan began." }, "finished_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the scan finished." }, "error_message": { "type": "string", "nullable": true, "description": "Any error message returned by the scan. If this field is empty, the\nscan is either ongoing, or returned successfully." } }, "required": [ "started_at" ] } ] }, "ResellerSubscriptionType": { "allOf": [ { "type": "object", "description": "Reseller subscription type", "properties": { "max_plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_operation": { "type": "integer", "nullable": true }, "max_tenant": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_tenant_plugin": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true }, "max_tenant_operation": { "type": "integer", "nullable": true }, "package_name": { "type": "string", "nullable": true }, "features": { "type": "array", "items": { "$ref": "#/components/schemas/SubscriptionFeatures" }, "nullable": true }, "add_ons": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "tenant_features": { "type": "array", "items": { "$ref": "#/components/schemas/SubscriptionFeatures" }, "nullable": true } } } ] }, "ResidentKeyRequirement": { "description": "\n\nTells Relying Party's requirement about client side discoverable\ncreds (formely known as resident keys).\nIf client side discoverable creds are there, it means that the\nauthenticator is self-sufficient in identifying the user. If this\nisn't the case, the user needs to login first so that the server\ncan identify the user and help send `allowCredentials` to authenticator.\n\nThis is mostly meant for [username-less] authentication (which we don't\nsupport in DSM). We support 2FA where we already know about the logged\nin user.\n\n[username-less]: ", "type": "string", "enum": [ "discouraged", "preferred", "required" ] }, "RestrictedDuration": { "allOf": [ { "type": "object", "properties": { "min": { "$ref": "#/components/schemas/TimeSpan" }, "max": { "$ref": "#/components/schemas/TimeSpan" }, "default": { "$ref": "#/components/schemas/TimeSpan" } } } ] }, "RevertRequest": { "allOf": [ { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } }, "required": [ "ids" ] } ] }, "Reviewer": { "allOf": [ { "type": "object", "description": "Reviewer of an approval request.", "properties": { "requires_password": { "type": "boolean", "nullable": true }, "requires_2fa": { "type": "boolean", "nullable": true } } }, { "$ref": "#/components/schemas/ReviewerPrincipal" } ] }, "ReviewerPrincipal": { "description": "A Principal who can approve or deny an approval request.", "oneOf": [ { "title": "ReviewerPrincipalVariantApp", "type": "object", "properties": { "app": { "type": "string", "format": "uuid" } }, "required": [ "app" ] }, { "title": "ReviewerPrincipalVariantUser", "type": "object", "properties": { "user": { "type": "string", "format": "uuid" } }, "required": [ "user" ] } ] }, "RevocationReason": { "allOf": [ { "type": "object", "description": "Reason for revoking a key.", "properties": { "code": { "$ref": "#/components/schemas/RevocationReasonCode" }, "message": { "type": "string", "nullable": true, "description": "Message is used exclusively for audit trail/logging purposes and MAY contain additional\ninformation about why the object was revoked." }, "compromise_occurance_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" } }, "required": [ "code" ] } ] }, "RevocationReasonCode": { "description": "Reasons to revoke a security object.", "type": "string", "enum": [ "Unspecified", "KeyCompromise", "CACompromise", "AffiliationChanged", "Superseded", "CessationOfOperation", "PrivilegeWithdrawn" ] }, "Role": { "allOf": [ { "type": "object", "properties": { "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "creator": { "$ref": "#/components/schemas/Principal" }, "description": { "type": "string" }, "details": { "$ref": "#/components/schemas/RoleDetails" }, "kind": { "$ref": "#/components/schemas/RoleKind" }, "last_updated_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "role_id": { "type": "string", "format": "uuid" }, "acct_id": { "type": "string", "format": "uuid" } }, "required": [ "created_at", "creator", "description", "details", "last_updated_at", "name", "role_id", "acct_id" ] } ] }, "RoleDetails": { "oneOf": [ { "$ref": "#/components/schemas/RoleDetailsVariantAccount" }, { "$ref": "#/components/schemas/RoleDetailsVariantGroup" } ], "discriminator": { "propertyName": "kind", "mapping": { "account": "RoleDetailsVariantAccount", "group": "RoleDetailsVariantGroup" } } }, "RoleDetailsVariantAccount": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "account" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/AccountRole" } ] }, "RoleDetailsVariantGroup": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "group" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/GroupRole" } ] }, "RoleKind": { "type": "string", "enum": [ "account", "group" ] }, "RoleRequest": { "allOf": [ { "type": "object", "properties": { "description": { "type": "string", "nullable": true }, "details": { "$ref": "#/components/schemas/RoleDetails" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true } } } ] }, "RoleSort": { "oneOf": [ { "title": "RoleSortVariantByRoleId", "type": "object", "properties": { "sort": { "type": "string", "pattern": "^role_id:(?:asc|desc)$", "example": "role_id:asc" }, "start": { "type": "string", "format": "uuid" } }, "required": [ "sort" ] } ] }, "RotateCopiedKeys": { "oneOf": [ { "title": "RotateCopiedKeysVariantAllExternal", "type": "string", "enum": [ "all_external" ] }, { "title": "RotateCopiedKeysVariantSelect", "type": "object", "properties": { "select": { "type": "array", "items": { "type": "string", "format": "uuid" } } }, "required": [ "select" ] } ] }, "RotationInterval": { "oneOf": [ { "title": "RotationIntervalVariantIntervalDays", "type": "object", "properties": { "interval_days": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "interval_days" ] }, { "title": "RotationIntervalVariantIntervalMonths", "type": "object", "properties": { "interval_months": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "interval_months" ] } ] }, "RotationMethod": { "description": "Describes the how to rotate the credential and any additional information\nthat is required for that to happen successfully.", "oneOf": [ { "$ref": "#/components/schemas/RotationMethodVariantGenerate" } ], "discriminator": { "propertyName": "$type", "mapping": { "Generate": "RotationMethodVariantGenerate" } } }, "RotationMethodVariantGenerate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Generate" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "RotationPolicy": { "allOf": [ { "type": "object", "properties": { "effective_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "deactivate_rotated_key": { "type": "boolean", "nullable": true }, "rotate_copied_keys": { "$ref": "#/components/schemas/RotateCopiedKeys" } } }, { "$ref": "#/components/schemas/RotationInterval" } ] }, "RsaEncryptionPaddingOaep": { "allOf": [ { "type": "object", "description": "Optimal Asymmetric Encryption Padding (PKCS#1 v2.1).", "properties": { "mgf": { "$ref": "#/components/schemas/Mgf" } }, "required": [ "mgf" ] } ] }, "RsaEncryptionPadding": { "description": "Type of padding to use for RSA encryption. The use of PKCS#1 v1.5 padding is strongly\ndiscouraged, because of its susceptibility to Bleichenbacher's attack. The padding specified\nmust adhere to the key's encryption policy. If not specified, the default based on the key's\npolicy will be used.", "oneOf": [ { "title": "RsaEncryptionPaddingVariantOaep", "type": "object", "properties": { "OAEP": { "$ref": "#/components/schemas/RsaEncryptionPaddingOaep" } }, "required": [ "OAEP" ] }, { "title": "RsaEncryptionPaddingVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] }, { "title": "RsaEncryptionPaddingVariantRawDecrypt", "type": "object", "properties": { "RAW_DECRYPT": { "type": "object", "properties": {} } }, "required": [ "RAW_DECRYPT" ] } ] }, "RsaEncryptionPaddingPolicyOaep": { "allOf": [ { "type": "object", "description": "The Optional Asymmetric Encryption Padding scheme, as defined\nin RFC 8017 (PKCS #1 version 2.2)", "properties": { "mgf": { "$ref": "#/components/schemas/MgfPolicy" } } } ] }, "RsaEncryptionPaddingPolicy": { "description": "RSA encryption padding policy.", "oneOf": [ { "title": "RsaEncryptionPaddingPolicyVariantOaep", "type": "object", "properties": { "OAEP": { "$ref": "#/components/schemas/RsaEncryptionPaddingPolicyOaep" } }, "required": [ "OAEP" ] }, { "title": "RsaEncryptionPaddingPolicyVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] }, { "title": "RsaEncryptionPaddingPolicyVariantRawDecrypt", "type": "object", "properties": { "RAW_DECRYPT": { "type": "object", "properties": {} } }, "required": [ "RAW_DECRYPT" ] } ] }, "RsaEncryptionPolicy": { "allOf": [ { "type": "object", "description": "Constraints on RSA encryption parameters. In general, if a constraint is not specified, anything is allowed.", "properties": { "padding": { "$ref": "#/components/schemas/RsaEncryptionPaddingPolicy" } } } ] }, "RsaOptions": { "allOf": [ { "type": "object", "description": "RSA-specific options.", "properties": { "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Size in bits (not bytes) of the RSA key. Specify on Create only. Returned on Get." }, "public_exponent": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Public exponent to use for generating the RSA key. Specify on Create only." }, "encryption_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaEncryptionPolicy" }, "nullable": true, "description": "Encryption policy for an RSA key. When doing an encryption or key wrapping operation, the\npolicies are evaluated against the specified parameters one by one. If one matches, the\noperation is allowed. If none match, including if the policy list is empty, the operation\nis disallowed. Missing optional parameters will have their defaults specified according to\nthe matched policy. The default for new keys is `[{\"padding\":{\"OAEP\":{}}]`.\nIf (part of) a constraint is not specified, anything is allowed for that constraint.\nTo impose no constraints, specify `[{}]`." }, "signature_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaSignaturePolicy" }, "nullable": true, "description": "Signature policy for an RSA key. When doing a signature operation, the policies are\nevaluated against the specified parameters one by one. If one matches, the operation is\nallowed. If none match, including if the policy list is empty, the operation is disallowed.\nMissing optional parameters will have their defaults specified according to the matched\npolicy. The default for new keys is `[{}]` (no constraints).\nIf (part of) a constraint is not specified, anything is allowed for that constraint." }, "minimum_key_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed key length. This is only relevant for group or account cryptographic\npolicies (and hence has no effect in an RSA policy on a specific key)." } } } ] }, "RsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "encryption_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaEncryptionPolicy" }, "nullable": true }, "signature_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaSignaturePolicy" }, "nullable": true, "description": "Signature policy for an RSA key. When doing a signature operation, the policies are\nevaluated against the specified parameters one by one. If one matches, the operation is\nallowed. If none match, including if the policy list is empty, the operation is disallowed.\nMissing optional parameters will have their defaults specified according to the matched\npolicy. The default for new keys is `[{}]` (no constraints).\nIf (part of) a constraint is not specified, anything is allowed for that constraint." }, "minimum_key_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed key length. This is only relevant for group or account cryptographic\npolicies (and hence has no effect in an RSA policy on a specific key)." } } } ] }, "RsaSignaturePaddingPss": { "allOf": [ { "type": "object", "description": "Probabilistic Signature Scheme (PKCS#1 v2.1).", "properties": { "mgf": { "$ref": "#/components/schemas/Mgf" } }, "required": [ "mgf" ] } ] }, "RsaSignaturePadding": { "description": "Type of padding to use for RSA signatures. The padding specified must adhere to the key's\nsignature policy. If not specified, the default based on the key's policy will be used.", "oneOf": [ { "title": "RsaSignaturePaddingVariantPss", "type": "object", "properties": { "PSS": { "$ref": "#/components/schemas/RsaSignaturePaddingPss" } }, "required": [ "PSS" ] }, { "title": "RsaSignaturePaddingVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] } ] }, "RsaSignaturePaddingPolicyPss": { "allOf": [ { "type": "object", "properties": { "mgf": { "$ref": "#/components/schemas/MgfPolicy" } } } ] }, "RsaSignaturePaddingPolicy": { "description": "RSA signature padding policy.", "oneOf": [ { "title": "RsaSignaturePaddingPolicyVariantPss", "type": "object", "properties": { "PSS": { "$ref": "#/components/schemas/RsaSignaturePaddingPolicyPss" } }, "required": [ "PSS" ] }, { "title": "RsaSignaturePaddingPolicyVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] } ] }, "RsaSignaturePolicy": { "allOf": [ { "type": "object", "description": "Constraints on RSA signature parameters. In general, if a constraint is not specified, anything is allowed.", "properties": { "padding": { "$ref": "#/components/schemas/RsaSignaturePaddingPolicy" } } } ] }, "Scan": { "allOf": [ { "type": "object", "description": "An object for representing a scan of objects from a source HSM,\nDSM cluster, or cloud KMS.", "properties": { "scan_id": { "type": "string", "format": "uuid", "description": "The ID of the scan." }, "is_async": { "type": "boolean", "description": "Whether the scan is async or not." }, "started_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the scan began." }, "finished_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time the scan finished." }, "scan_result": { "$ref": "#/components/schemas/ScanResult" }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/ScanWarning" }, "nullable": true, "description": "Any warnings thrown during the scan." } }, "required": [ "scan_id", "is_async", "started_at" ] } ] }, "ScanHmgRequest": { "allOf": [ { "type": "object", "properties": {} } ] }, "ScanResultFailed": { "allOf": [ { "type": "object", "description": "Indicates that a scan has failed. The most recent error is included\n(taken from the last retry).", "properties": { "message": { "type": "string" } }, "required": [ "message" ] } ] }, "ScanResult": { "description": "The result of a scan.", "oneOf": [ { "$ref": "#/components/schemas/ScanResultVariantSuccess" }, { "$ref": "#/components/schemas/ScanResultVariantFailed" } ], "discriminator": { "propertyName": "$type", "mapping": { "Success": "ScanResultVariantSuccess", "Failed": "ScanResultVariantFailed" } } }, "ScanResultVariantSuccess": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Success" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "ScanResultVariantFailed": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Failed" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/ScanResultFailed" } ] }, "ScanWarning": { "allOf": [ { "type": "object", "description": "A warning \"thrown\" by a scan.", "properties": { "source_key_id": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the source key for which the warning applies to." }, "virtual_key_id": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the virtual key for which the warning applies to." }, "message": { "type": "string", "description": "The warning message associated with the warning." } }, "required": [ "message" ] } ] }, "SecretCredentialRequestGenerate": { "allOf": [ { "type": "object", "description": "Generate a new secret", "properties": { "size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Size of the secret to be generated in bytes" } } } ] }, "SecretCredentialRequest": { "oneOf": [ { "type": "string", "description": "Use the existing secret (note that this must match the existing secret configured on the app)" }, { "$ref": "#/components/schemas/SecretCredentialRequestGenerate" } ] }, "SecretOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "Secs": { "allOf": [ { "type": "integer" } ] }, "SeedOptions": { "allOf": [ { "type": "object", "properties": { "cipher_mode": { "$ref": "#/components/schemas/CipherMode" }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "SeedOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "random_iv": { "type": "boolean", "nullable": true } } } ] }, "SelectAccountRequest": { "allOf": [ { "type": "object", "description": "Request to select an account.", "properties": { "acct_id": { "type": "string", "format": "uuid" } }, "required": [ "acct_id" ] } ] }, "SelectAccountResponse": { "allOf": [ { "type": "object", "description": "Response to select account request.", "properties": { "cookie": { "type": "string", "nullable": true } } } ] }, "ServerMode": { "description": "Server execution mode.", "type": "string", "enum": [ "Software", "Sgx" ] }, "Service": { "allOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "hostnames": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/HostnameInfo" } } }, "required": [ "name", "hostnames" ] } ] }, "SeverityLevel": { "type": "string", "enum": [ "INFO", "WARNING", "ERROR", "CRITICAL" ] }, "SignRequest": { "allOf": [ { "type": "object", "description": "Request to sign data (or hashed data) using an asymmetric key.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "hash_alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "hash": { "type": "string", "format": "byte", "description": "Hashed data to be signed. Either `hash` or `data` should be specified;\nit is an error to specify both or none.\nHash should be base64 encoded." }, "data": { "type": "string", "format": "byte", "description": "Data to be signed. Either `hash` or `data` should be specified; it is\nan error to specify both or none.\nData should be base64 encoded." }, "mode": { "$ref": "#/components/schemas/SignatureMode" }, "deterministic_signature": { "type": "boolean", "nullable": true, "description": "Whether signatures should be deterministic. Defaults to false. If\nspecified, the value must be compatible with the key's settings." }, "context": { "type": "string", "format": "byte", "description": "The context parameter to be provided to the sign algorithm.\n\nCurrently only ML-DSA keys accept a context parameter;\nthis parameter must not be specified for any other key types." } } } ] }, "SignResponse": { "allOf": [ { "type": "object", "description": "Response of a signing request.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the key used for signing. Returned for non-transient keys" }, "signature": { "type": "string", "format": "byte", "description": "Signed data" } }, "required": [ "signature" ] } ] }, "SignatureMode": { "description": "Signature mechanism", "oneOf": [ { "$ref": "#/components/schemas/RsaSignaturePadding" }, { "$ref": "#/components/schemas/MlDsaMode" } ] }, "SignedJwtCredential": { "allOf": [ { "type": "object", "properties": { "valid_issuers": { "type": "array", "uniqueItems": true, "items": { "type": "string" } }, "signing_keys": { "$ref": "#/components/schemas/SigningKeys" }, "private_claims_policy": { "$ref": "#/components/schemas/PrivateClaimsPolicy" } }, "required": [ "valid_issuers", "signing_keys" ] } ] }, "SigningKeysStored": { "allOf": [ { "type": "object", "properties": { "keys": { "type": "object", "additionalProperties": { "type": "string", "format": "byte" }, "description": "Mapping key ids to DER-encoded public key." } }, "required": [ "keys" ] } ] }, "SigningKeysFetched": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "cache_duration": { "type": "integer", "description": "Number of seconds that the service is allowed to cache the fetched keys." } }, "required": [ "url", "cache_duration" ] } ] }, "SigningKeys": { "description": "Signing keys used to validate JSON Web Signature objects including signed\nJSON Web Tokens.", "oneOf": [ { "$ref": "#/components/schemas/SigningKeysVariantStored" }, { "$ref": "#/components/schemas/SigningKeysVariantFetched" } ], "discriminator": { "propertyName": "kind", "mapping": { "stored": "SigningKeysVariantStored", "fetched": "SigningKeysVariantFetched" } } }, "SigningKeysVariantStored": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "stored" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/SigningKeysStored" } ] }, "SigningKeysVariantFetched": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "fetched" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/SigningKeysFetched" } ] }, "SignupRequest": { "allOf": [ { "type": "object", "description": "Request to signup a new user.", "properties": { "user_email": { "type": "string", "format": "email" }, "user_password": { "type": "string" }, "recaptcha_response": { "type": "string", "nullable": true }, "first_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "last_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true } }, "required": [ "user_email", "user_password" ] } ] }, "Slip10Options": { "allOf": [ { "type": "object", "properties": { "derivation_path": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "description": "The Slip10 path, starting from master. Master key is [].\n\nEx: m/42/42'/0 -> [42, 2**31 + 42, 0]" } }, "required": [ "derivation_path" ] } ] }, "Slip10OptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "Sobject": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid", "description": "UUID of the account which the security object belongs to." }, "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Activation date of security object in seconds since EPOCH." }, "aes": { "$ref": "#/components/schemas/AesOptions" }, "allow_credential_use": { "type": "boolean", "nullable": true, "description": "Whether this security object can be used/referenced by a credential object." }, "allow_sign_hash": { "type": "boolean", "nullable": true, "description": "Whether the sign operation response contains hash or data as output." }, "aria": { "$ref": "#/components/schemas/AriaOptions" }, "bip32": { "$ref": "#/components/schemas/Bip32Options" }, "bls": { "$ref": "#/components/schemas/BlsOptions" }, "compliant_with_policies": { "type": "boolean", "nullable": true, "description": "Whether this security object is compliant with cryptographic policies or not." }, "compromise_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Compromise date of security object in seconds since EPOCH." }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp at which the security object was created." }, "creator": { "$ref": "#/components/schemas/Principal" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User managed field for adding custom metadata to the security object." }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deactivation date of security object in seconds since EPOCH." }, "deletion_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deletion date of security object in seconds since EPOCH." }, "des": { "$ref": "#/components/schemas/DesOptions" }, "des3": { "$ref": "#/components/schemas/Des3Options" }, "description": { "type": "string", "nullable": true, "description": "Description of the security object." }, "destruction_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Destruction date of security object in seconds since EPOCH." }, "deterministic_signatures": { "type": "boolean", "nullable": true, "description": "Optionally get deterministic signatures, if algorithm is EC or RSA." }, "dsa": { "$ref": "#/components/schemas/DsaOptions" }, "eckcdsa": { "$ref": "#/components/schemas/EcKcdsaOptions" }, "effective_key_policy": { "$ref": "#/components/schemas/EffectiveKeyPolicy" }, "elliptic_curve": { "$ref": "#/components/schemas/EllipticCurve" }, "enabled": { "type": "boolean", "description": "Whether this security object has cryptographic operations enabled." }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" }, "external": { "$ref": "#/components/schemas/ExternalSobjectInfo" }, "fpe": { "$ref": "#/components/schemas/FpeOptions" }, "google_access_reason_policy": { "$ref": "#/components/schemas/GoogleAccessReasonPolicy" }, "history": { "type": "array", "items": { "$ref": "#/components/schemas/HistoryItem" }, "nullable": true, "description": "When a Key Undo Policy is in place, a list of (non-expired) history items is returned.\nEach history item represents a past key state that can be reverted to." }, "kcdsa": { "$ref": "#/components/schemas/KcdsaOptions" }, "kcv": { "type": "string", "description": "Key Checksum Value of the security object." }, "kcv_cmac": { "type": "string", "description": "Cmac Key Checksum Value of the security object." }, "key_creation_method": { "$ref": "#/components/schemas/KeyCreationMethod" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "description": "Operations allowed to be performed by a given key." }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Key size of the security object in bits." }, "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "Unique identifier of the security object." }, "links": { "$ref": "#/components/schemas/KeyLinks" }, "lms": { "$ref": "#/components/schemas/LmsOptions" }, "mldsa": { "$ref": "#/components/schemas/MlDsaOptions" }, "mlkem": { "$ref": "#/components/schemas/MlKemOptions" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the security object." }, "never_exportable": { "type": "boolean", "nullable": true, "description": "Whether the security object was exportable at some point in its lifetime." }, "obj_type": { "$ref": "#/components/schemas/ObjectType" }, "origin": { "$ref": "#/components/schemas/ObjectOrigin" }, "original_key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Key operations with which the key was created. This information is available for newly created DSM keys starting with version 5.1" }, "pub_key": { "type": "string", "format": "byte", "description": "Public key material of the security object, if it exists.\n\nFor virtual keys, this field may not be available if the key is not backed by DSM." }, "public_only": { "type": "boolean", "description": "Whether the security object only consists of public material." }, "publish_public_key": { "$ref": "#/components/schemas/PublishPublicKeyConfig" }, "revocation_reason": { "$ref": "#/components/schemas/RevocationReason" }, "rotation_policy": { "$ref": "#/components/schemas/RotationPolicy" }, "rsa": { "$ref": "#/components/schemas/RsaOptions" }, "scheduled_rotation": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Timestamp at which security object will be rotated, if rotation policy exists.\nThis time will be clamped at 31 December 9999 11:59:59 pm UTC if the calculated\nrotation time would exceed that date." }, "seed": { "$ref": "#/components/schemas/SeedOptions" }, "slip10": { "$ref": "#/components/schemas/Slip10Options" }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient_key": { "type": "string", "format": "byte", "description": "Transient key material." }, "value": { "type": "string", "format": "byte", "description": "Security object stored as byte array." }, "virtual_key_info": { "$ref": "#/components/schemas/VirtualSobjectInfo" }, "wrapping_key_group_ids": { "type": "array", "uniqueItems": true, "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "Group ids of groups that use this security object to encrypt the key material of their security objects" }, "xmss": { "$ref": "#/components/schemas/XmssOptions" }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "UUID of the group which the security object belongs to." } }, "required": [ "acct_id", "created_at", "creator", "enabled", "key_ops", "obj_type", "origin", "public_only" ] } ] }, "SobjectComponent": { "allOf": [ { "type": "object", "description": "Component of security object, held by a custodian.", "properties": { "component": { "type": "string", "format": "byte", "description": "Key component" }, "component_kcv": { "type": "string", "description": "Key component KCV" }, "custodian": { "$ref": "#/components/schemas/Principal" } }, "required": [ "component", "custodian" ] } ] }, "SobjectDescriptorInline": { "allOf": [ { "type": "object", "properties": { "value": { "type": "string", "format": "byte" }, "obj_type": { "$ref": "#/components/schemas/ObjectType" } }, "required": [ "value", "obj_type" ] } ] }, "SobjectDescriptor": { "description": "Uniquely identifies a persisted or transient sobject.", "oneOf": [ { "title": "SobjectDescriptorVariantKid", "type": "object", "properties": { "kid": { "type": "string", "format": "uuid" } }, "required": [ "kid" ] }, { "title": "SobjectDescriptorVariantName", "type": "object", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" } }, "required": [ "name" ] }, { "title": "SobjectDescriptorVariantTransientKey", "type": "object", "properties": { "transient_key": { "type": "string", "format": "byte" } }, "required": [ "transient_key" ] }, { "title": "SobjectDescriptorVariantInline", "type": "object", "properties": { "inline": { "$ref": "#/components/schemas/SobjectDescriptorInline" } }, "required": [ "inline" ] } ] }, "SobjectDescriptorPersisted": { "description": "Uniquely identifies a persisted sobject.", "oneOf": [ { "title": "SobjectDescriptorPersistedVariantKid", "type": "object", "properties": { "kid": { "type": "string", "format": "uuid" } }, "required": [ "kid" ] }, { "title": "SobjectDescriptorPersistedVariantName", "type": "object", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" } }, "required": [ "name" ] } ] }, "SobjectEncoding": { "description": "Response data encoding.", "type": "string", "enum": [ "json", "value" ] }, "SobjectExportPolicy": { "allOf": [ { "type": "object", "properties": { "allow_weakening": { "type": "boolean", "description": "When set to `false`, the `export_policy` for the sobject can never be relaxed,\nit can only be made more strict.\nThis means that\n- If the export policy is set to `Wrapped`, it can never be set back to `Unrestricted`.\n- If the export policy is set to `Wrapped` with a limited set of keys specified,\nit can never bet set back to `Wrapped` with any key. Additionally, no new keys can\nbe added to the set of wrapping keys. Also note that if all the wrapping keys (specified\nby key id) in the export policy have been deleted/destroyed/deactivated, the sobject\nbecomes effectively unexportable.\n\nNote: these rules may change in the future." } }, "required": [ "allow_weakening" ] }, { "$ref": "#/components/schemas/ExportPolicy" } ] }, "SobjectId": { "description": "A wrapper type to provide better clarity that the id referenced\nis a security object.", "allOf": [ { "type": "string", "format": "uuid" } ] }, "SobjectRekeyRequest": { "allOf": [ { "type": "object", "description": "Request to rekey a security object.", "properties": { "deactivate_rotated_key": { "type": "boolean", "nullable": true, "description": "If set to true, the old key is deactivated on rekey." } } }, { "$ref": "#/components/schemas/SobjectRequest" } ] }, "SobjectReplaceRequest": { "allOf": [ { "type": "object", "description": "Request to rotate a security object to an existing security object.", "properties": { "replaced": { "$ref": "#/components/schemas/SobjectDescriptorPersisted" }, "replaced_new_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "New name for the replaced security object." }, "replacement": { "$ref": "#/components/schemas/SobjectDescriptorPersisted" } }, "required": [ "replaced", "replaced_new_name", "replacement" ] } ] }, "SobjectRequest": { "allOf": [ { "type": "object", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Activation date of security object in seconds since EPOCH." }, "aes": { "$ref": "#/components/schemas/AesOptions" }, "allow_credential_use": { "type": "boolean", "nullable": true, "description": "Whether this security object can be used/referenced by a credential object." }, "allow_sign_hash": { "type": "boolean", "nullable": true, "description": "Whether the sign operation response contains hash or data as output." }, "aria": { "$ref": "#/components/schemas/AriaOptions" }, "bip32": { "$ref": "#/components/schemas/Bip32Options" }, "bls": { "$ref": "#/components/schemas/BlsOptions" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User managed field for adding custom metadata to the security object." }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deactivation date of security object in seconds since EPOCH." }, "des": { "$ref": "#/components/schemas/DesOptions" }, "des3": { "$ref": "#/components/schemas/Des3Options" }, "description": { "type": "string", "nullable": true, "description": "Description of the security object." }, "deterministic_signatures": { "type": "boolean", "nullable": true, "description": "Optionally get deterministic signatures, if algorithm is EC or RSA." }, "dsa": { "$ref": "#/components/schemas/DsaOptions" }, "eckcdsa": { "$ref": "#/components/schemas/EcKcdsaOptions" }, "elliptic_curve": { "$ref": "#/components/schemas/EllipticCurve" }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether this security object has cryptographic operations enabled." }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" }, "external": { "$ref": "#/components/schemas/ExternalKmsInfo" }, "fpe": { "$ref": "#/components/schemas/FpeOptions" }, "google_access_reason_policy": { "$ref": "#/components/schemas/RemovableGoogleAccessReasonPolicy" }, "kcdsa": { "$ref": "#/components/schemas/KcdsaOptions" }, "kcv": { "type": "string", "description": "Key Checksum Value of the security object." }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Operations allowed to be performed by a given key." }, "key_size": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Key size of the security object in bits." }, "links": { "$ref": "#/components/schemas/KeyLinks" }, "lms": { "$ref": "#/components/schemas/LmsOptions" }, "mldsa": { "$ref": "#/components/schemas/MlDsaOptions" }, "mlkem": { "$ref": "#/components/schemas/MlKemOptions" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the security object." }, "obj_type": { "$ref": "#/components/schemas/ObjectType" }, "pub_exponent": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "Public exponent" }, "publish_public_key": { "$ref": "#/components/schemas/PublishPublicKeyConfig" }, "rotation_policy": { "$ref": "#/components/schemas/RotationPolicy" }, "rsa": { "$ref": "#/components/schemas/RsaOptions" }, "seed": { "$ref": "#/components/schemas/SeedOptions" }, "slip10": { "$ref": "#/components/schemas/Slip10Options" }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the security object will cease to exist after session ends." }, "value": { "type": "string", "format": "byte", "description": "Security object stored as byte array." }, "xmss": { "$ref": "#/components/schemas/XmssOptions" }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "UUID of the group which the security object belongs to." } } } ] }, "SobjectSort": { "oneOf": [ { "title": "SobjectSortVariantByKid", "type": "object", "description": "Security object UUID", "properties": { "sort": { "type": "string", "pattern": "^kid:(?:asc|desc)$", "example": "kid:asc" }, "start": { "type": "string", "format": "uuid", "description": "Initial security object UUID" } }, "required": [ "sort" ] }, { "title": "SobjectSortVariantByName", "type": "object", "description": "Security object name", "properties": { "sort": { "type": "string", "pattern": "^name:(?:asc|desc)$", "example": "name:asc" }, "start": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Initial security object Name" } }, "required": [ "sort" ] } ] }, "SobjectState": { "description": "Security object operational state.", "type": "string", "enum": [ "PreActive", "Active", "Deactivated", "Compromised", "Destroyed", "Deleted" ] }, "SplittingMethod": { "description": "Method used to split the key into multiple components.", "type": "string", "enum": [ "XOR" ] }, "SplunkLoggingConfig": { "allOf": [ { "type": "object", "description": "Splunk logging configuration.", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string" }, "port": { "type": "integer", "minimum": 0, "maximum": 65535 }, "index": { "type": "string" }, "token": { "type": "string" }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "use_fqdn_hostname": { "type": "boolean", "nullable": true, "description": "Enable sending the cluster FQDN as the hostname in log entries.\n\nDefaults to `true` for newly created configs, but remains `false` when the\nfield is omitted to preserve backward compatibility." } }, "required": [ "enabled", "host", "port", "index", "tls" ] } ] }, "SplunkLoggingConfigRequest": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean", "nullable": true }, "host": { "type": "string", "nullable": true }, "port": { "type": "integer", "minimum": 0, "maximum": 65535, "nullable": true }, "index": { "type": "string", "nullable": true, "description": "The Splunk index that will receive log items." }, "token": { "type": "string", "description": "The Splunk authentication token." }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "use_fqdn_hostname": { "type": "boolean", "nullable": true, "description": "Enable sending the cluster FQDN as the hostname in log entries." } } } ] }, "StackdriverLoggingConfig": { "allOf": [ { "type": "object", "description": "Stackdriver logging configuration.", "properties": { "enabled": { "type": "boolean" }, "log_id": { "type": "string", "description": "The log ID that will receive the log items (see https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)." }, "service_account_key": { "$ref": "#/components/schemas/GoogleServiceAccountKey" } }, "required": [ "enabled", "log_id", "service_account_key" ] } ] }, "StackdriverLoggingConfigRequest": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean", "nullable": true }, "log_id": { "type": "string", "nullable": true, "description": "The log ID that will receive the log items (see https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)." }, "service_account_key": { "$ref": "#/components/schemas/GoogleServiceAccountKey" } } } ] }, "StatsParams": { "allOf": [ { "type": "object", "properties": { "num_points": { "type": "integer" }, "top_count": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "range_from": { "type": "integer" }, "range_to": { "type": "integer" } } } ] }, "SubjectGeneral": { "description": "A GeneralName that can be used as a [subject alternative name][SAN] in\na certificate.\n\nToday, the directoryName, dNSName, and iPAddress choices are supported.\nNote that directoryName can also be used to represent the subject field\nin a certificate.\n\n[SAN]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6", "oneOf": [ { "title": "SubjectGeneralVariantDirectoryName", "type": "object", "properties": { "directory_name": { "type": "array", "items": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "type": "string" } }, "description": "A directoryName, which consists of a sequence of (type, value)\npairs, where type is an OID, and value is a DER-encoded ASN.1\nvalue. (This represents a sequence of relative distinguished\nnames.)" } }, "required": [ "directory_name" ] }, { "title": "SubjectGeneralVariantDnsName", "type": "object", "properties": { "dns_name": { "type": "string", "description": "A DNS name." } }, "required": [ "dns_name" ] }, { "title": "SubjectGeneralVariantIpAddress", "type": "object", "properties": { "ip_address": { "oneOf": [ { "type": "string", "format": "ipv4" }, { "type": "string", "format": "ipv6" } ], "description": "An IP address." } }, "required": [ "ip_address" ] } ] }, "Subscription": { "allOf": [ { "type": "object", "properties": { "memo": { "type": "string", "nullable": true }, "experimental_features": { "$ref": "#/components/schemas/SubscriptionExperimentalFeatures" } } }, { "$ref": "#/components/schemas/SubscriptionType" } ] }, "SubscriptionChangeRequest": { "allOf": [ { "type": "object", "description": "A request to update subscription type.", "properties": { "subscription": { "$ref": "#/components/schemas/Subscription" }, "contact": { "type": "string", "nullable": true }, "comment": { "type": "string", "nullable": true } }, "required": [ "subscription" ] } ] }, "SubscriptionExperimentalFeatures": { "allOf": [ { "type": "object", "properties": {} } ] }, "SubscriptionFeatures": { "description": "Features in subscription\n\n\n\n TOKENIZATION:\n\n\n HMG:\n\n\n AWSBYOK:\n\n\n AZUREBYOK:\n\n\n GCPBYOK:\n\n\n GCPEKMCONTROLPLANE:\n\n\n OCIBYOK:\n\n", "type": "string", "enum": [ "TOKENIZATION", "HMG", "AWSBYOK", "AZUREBYOK", "GCPBYOK", "GCPEKMCONTROLPLANE", "OCIBYOK" ] }, "SubscriptionTypeTrial": { "allOf": [ { "type": "object", "description": "A trial subscription on DSM SaaS.", "properties": { "expires_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "The time that this subscription expires. If not set, the\nsubscription will expire 30 days after the account's creation\ndate.\n\nThe account's `trial_expires_at` field can be used to determine\nthe effective expiry date of a trial account." } } } ] }, "SubscriptionType": { "description": "Type of subscription.", "oneOf": [ { "title": "SubscriptionTypeVariantTrial", "type": "object", "properties": { "trial": { "$ref": "#/components/schemas/SubscriptionTypeTrial" } }, "required": [ "trial" ] }, { "title": "SubscriptionTypeVariantStandard", "type": "object", "properties": { "standard": { "type": "object", "properties": {} } }, "required": [ "standard" ] }, { "title": "SubscriptionTypeVariantEnterprise", "type": "object", "properties": { "enterprise": { "type": "object", "properties": {} } }, "required": [ "enterprise" ] }, { "title": "SubscriptionTypeVariantCustom", "type": "object", "properties": { "custom": { "$ref": "#/components/schemas/CustomSubscriptionType" } }, "required": [ "custom" ] }, { "title": "SubscriptionTypeVariantFreemium", "type": "object", "properties": { "freemium": { "$ref": "#/components/schemas/FreemiumSubscriptionType" } }, "required": [ "freemium" ] }, { "title": "SubscriptionTypeVariantOnPrem", "type": "object", "properties": { "on_prem": { "$ref": "#/components/schemas/OnPremSubscriptionType" } }, "required": [ "on_prem" ] }, { "title": "SubscriptionTypeVariantReseller", "type": "object", "properties": { "reseller": { "$ref": "#/components/schemas/ResellerSubscriptionType" } }, "required": [ "reseller" ] } ] }, "SyslogFacility": { "type": "string", "enum": [ "User", "Local0", "Local1", "Local2", "Local3", "Local4", "Local5", "Local6", "Local7" ] }, "SyslogLoggingConfig": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string" }, "port": { "type": "integer", "minimum": 0, "maximum": 65535 }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "facility": { "$ref": "#/components/schemas/SyslogFacility" }, "use_fqdn_hostname": { "type": "boolean", "nullable": true, "description": "Enable sending the cluster FQDN as the hostname in log entries.\n\nDefaults to `true` for newly created configs, but remains `false` when the\nfield is omitted to preserve backward compatibility." } }, "required": [ "enabled", "host", "port", "tls", "facility" ] } ] }, "SyslogLoggingConfigRequest": { "allOf": [ { "type": "object", "properties": { "enabled": { "type": "boolean", "nullable": true }, "host": { "type": "string", "nullable": true }, "port": { "type": "integer", "minimum": 0, "maximum": 65535, "nullable": true }, "tls": { "$ref": "#/components/schemas/TlsConfig" }, "facility": { "$ref": "#/components/schemas/SyslogFacility" }, "use_fqdn_hostname": { "type": "boolean", "nullable": true, "description": "Enable sending the cluster FQDN as the hostname in log entries." } } } ] }, "SystemInfoParams": { "allOf": [ { "type": "object", "properties": { "detailed_fips_info": { "type": "boolean", "description": "Include FIPS-relevant info in the response. Currently that is `plugins_digest`.\n\nOnly applicable to FIPS builds." } } } ] }, "SystemInfoResponse": { "allOf": [ { "type": "object", "description": "Information about the service version.", "properties": { "external_entropy": { "$ref": "#/components/schemas/ExternalEntropyInfo" } } }, { "$ref": "#/components/schemas/VersionResponse" } ] }, "TepClientConfig": { "allOf": [ { "type": "object", "properties": { "schema": { "$ref": "#/components/schemas/TepSchema" }, "key_map": { "$ref": "#/components/schemas/TepKeyMapList" } }, "required": [ "schema", "key_map" ] } ] }, "TepKeyContext": { "type": "string", "enum": [ "request", "response" ] }, "TepKeyMap": { "allOf": [ { "type": "object", "properties": { "path": { "$ref": "#/components/schemas/ApiPath" }, "kid": { "type": "string", "format": "uuid" }, "mode": { "$ref": "#/components/schemas/CipherMode" } }, "required": [ "path", "kid", "mode" ] } ] }, "TepKeyMapList": { "allOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/TepKeyMap" } } ] }, "TepSchema": { "oneOf": [ { "$ref": "#/components/schemas/TepSchemaVariantOpenAPI" } ], "discriminator": { "propertyName": "$type", "mapping": { "OpenAPI": "TepSchemaVariantOpenAPI" } } }, "TepSchemaVariantOpenAPI": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "OpenAPI" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": { "openapi": { "type": "string" } } } ] }, "TimeSpan": { "oneOf": [ { "title": "TimeSpanVariantSeconds", "type": "object", "properties": { "seconds": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "seconds" ] }, { "title": "TimeSpanVariantMinutes", "type": "object", "properties": { "minutes": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "minutes" ] }, { "title": "TimeSpanVariantHours", "type": "object", "properties": { "hours": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "hours" ] }, { "title": "TimeSpanVariantDays", "type": "object", "properties": { "days": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "days" ] } ] }, "TlsCertificateSpki": { "allOf": [ { "type": "object", "properties": { "cert_spki": { "type": "string", "format": "byte", "description": "The TbsCertificate's spki value." }, "is_active": { "type": "boolean", "description": "True if the certificate is currently active." } }, "required": [ "cert_spki", "is_active" ] } ] }, "TlsCertsSpkiResponse": { "allOf": [ { "type": "object", "properties": { "tls_certificates_info": { "type": "array", "items": { "$ref": "#/components/schemas/TlsCertificateSpki" }, "description": "A list of leaf server certificates used for\nTLS connections by DSM." } }, "required": [ "tls_certificates_info" ] } ] }, "TlsConfigRequired": { "allOf": [ { "type": "object", "properties": { "validate_hostname": { "type": "boolean" }, "ca": { "$ref": "#/components/schemas/CaConfig" }, "client_key": { "type": "string", "format": "byte" }, "client_cert": { "type": "string", "format": "byte" } }, "required": [ "validate_hostname", "ca" ] } ] }, "TlsConfig": { "description": "TLS client settings.", "oneOf": [ { "$ref": "#/components/schemas/TlsConfigVariantDisabled" }, { "$ref": "#/components/schemas/TlsConfigVariantOpportunistic" }, { "$ref": "#/components/schemas/TlsConfigVariantRequired" } ], "discriminator": { "propertyName": "mode", "mapping": { "disabled": "TlsConfigVariantDisabled", "opportunistic": "TlsConfigVariantOpportunistic", "required": "TlsConfigVariantRequired" } } }, "TlsConfigVariantDisabled": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "disabled" ] } }, "required": [ "mode" ] }, { "type": "object", "properties": {} } ] }, "TlsConfigVariantOpportunistic": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "opportunistic" ] } }, "required": [ "mode" ] }, { "type": "object", "properties": {} } ] }, "TlsConfigVariantRequired": { "allOf": [ { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "required" ] } }, "required": [ "mode" ] }, { "$ref": "#/components/schemas/TlsConfigRequired" } ] }, "TlsPublicKeyInfo": { "allOf": [ { "type": "object", "properties": { "spki": { "type": "string", "format": "byte", "description": "The TbsCertificate's spki value." }, "is_active": { "type": "boolean", "description": "True if the certificate is currently active." } }, "required": [ "spki", "is_active" ] } ] }, "TlsPublicKeysResponse": { "allOf": [ { "type": "object", "properties": { "tls_public_keys": { "type": "array", "items": { "$ref": "#/components/schemas/TlsPublicKeyInfo" }, "description": "A list of SPKIs(public keys) from leaf server certificates used for\nTLS connections by DSM." } }, "required": [ "tls_public_keys" ] } ] }, "TokenType": { "description": "The type of a session token.\n\n(The default session token type is Bearer.)", "type": "string", "enum": [ "Bearer", "Cookie" ] }, "TransformKeyMechanismBip32WeakChild": { "allOf": [ { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The index of a weak child is an integer between 0 and 2**31 - 1." } }, "required": [ "index" ] } ] }, "TransformKeyMechanismSlip10WeakChild": { "allOf": [ { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The index of a weak child is an integer between 0 and 2**31 - 1." } }, "required": [ "index" ] } ] }, "TransformKeyMechanism": { "description": "Options for mechanism to be used when transforming a key", "oneOf": [ { "title": "TransformKeyMechanismVariantBip32WeakChild", "type": "object", "properties": { "bip32_weak_child": { "$ref": "#/components/schemas/TransformKeyMechanismBip32WeakChild" } }, "required": [ "bip32_weak_child" ] }, { "title": "TransformKeyMechanismVariantSlip10WeakChild", "type": "object", "properties": { "slip10_weak_child": { "$ref": "#/components/schemas/TransformKeyMechanismSlip10WeakChild" } }, "required": [ "slip10_weak_child" ] } ] }, "TransformKeyRequest": { "allOf": [ { "type": "object", "description": "Request body to transform a key.", "properties": { "activation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Activation date of the transformed key" }, "deactivation_date": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z", "description": "Deactivation date of the transformed key" }, "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name of the transformed key. Key names must be unique within an account." }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Group ID of the group that this security object should belong to. The user or\napplication creating this security object must be a member of this group. If no group is\nspecified, the default group for the requesting application will be used." }, "key_type": { "$ref": "#/components/schemas/ObjectType" }, "mechanism": { "$ref": "#/components/schemas/TransformKeyMechanism" }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether the transformed key should have cryptographic operations enabled." }, "description": { "type": "string", "nullable": true, "description": "Description of the transformed key" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User-defined metadata for this key stored as key-value pairs." }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Optional array of key operations to be enabled for this security object. If not\nprovided the service will provide a default set of key operations. Note that if you\nprovide an empty array, all key operations will be disabled." }, "state": { "$ref": "#/components/schemas/SobjectState" }, "transient": { "type": "boolean", "nullable": true, "description": "If set to true, the transformed key will be transient." }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" } }, "required": [ "key_type", "mechanism" ] } ] }, "TrustAnchor": { "description": "Trust anchors (i.e., root CA certificates) for a [`TrustedCaCredential`].", "oneOf": [ { "title": "TrustAnchorVariantCaCertificate", "type": "object", "properties": { "ca_certificate": { "type": "string", "format": "byte", "description": "A single root CA certificate." } }, "required": [ "ca_certificate" ] }, { "title": "TrustAnchorVariantCaCertificates", "type": "object", "properties": { "ca_certificates": { "type": "array", "items": { "type": "string", "format": "byte" }, "description": "Multiple root CA certificates. DSM currently supports up to 16 certs." } }, "required": [ "ca_certificates" ] } ] }, "TrustAnchorSubject": { "description": "Subjects or subject alternative names (SANs) for trusted CA auth.\nDSM will check the subject field and any SANs inside incoming\nclient certificates and compare them against the subjects configured\nin the trusted CA auth config.", "oneOf": [ { "title": "TrustAnchorSubjectVariantSubject", "type": "object", "properties": { "subject": { "type": "array", "items": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "type": "string" } }, "description": "A single subject as a list of OID/value string pairs\n(representing a sequence of relative distinguished names), which\nshould appear in the client cert's subject field and/or as one\nof its SANs.\n\nThis legacy variant is retained for backcompat purposes, and is\nequivalent to specifying a directoryName via the SubjectGeneral\nvariant." } }, "required": [ "subject" ] }, { "title": "TrustAnchorSubjectVariantSubjectGeneral", "type": "object", "properties": { "subject_general": { "$ref": "#/components/schemas/SubjectGeneral" } }, "required": [ "subject_general" ] }, { "title": "TrustAnchorSubjectVariantSubjects", "type": "object", "properties": { "subjects": { "type": "array", "items": { "$ref": "#/components/schemas/SubjectGeneral" }, "description": "List of allowed GeneralName subjects. At least one of the values\nin this list must appear in the client cert, under its subject\nfield and/or as one of its SANs.\n\nCurrently, DSM supports at most 16 subjects." } }, "required": [ "subjects" ] } ] }, "TrustedCaCredential": { "allOf": [ { "type": "object", "description": "`TrustedCa` app auth configuration.", "properties": { "check_revocation": { "type": "boolean", "nullable": true, "description": "When `true`, revocation status of certificates is checked, and revoked\ncertificates are rejected" } } }, { "$ref": "#/components/schemas/TrustAnchorSubject" }, { "$ref": "#/components/schemas/TrustAnchor" } ] }, "U2fAddDeviceRequest": { "allOf": [ { "type": "object", "description": "Description of a U2F device to add for two factor authentication.", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "registrationData": { "type": "string", "format": "byte" }, "clientData": { "type": "string", "format": "byte" }, "version": { "type": "string" } }, "required": [ "name", "registrationData", "clientData", "version" ] } ] }, "U2fAuthRequest": { "allOf": [ { "type": "object", "description": "Use of U2F is deprecated, use FIDO2 for second factor authentication.", "properties": { "keyHandle": { "type": "string", "format": "byte" }, "signatureData": { "type": "string", "format": "byte" }, "clientData": { "type": "string", "format": "byte" } }, "required": [ "keyHandle", "signatureData", "clientData" ] } ] }, "U2fMfaChallengeResponse": { "allOf": [ { "type": "object", "description": "A challenge used for multi-factor authentication.", "properties": { "u2f_challenge": { "type": "string" }, "u2f_keys": { "type": "array", "items": { "$ref": "#/components/schemas/U2fRegisteredKey" } } }, "required": [ "u2f_challenge", "u2f_keys" ] } ] }, "U2fRegisteredKey": { "allOf": [ { "type": "object", "description": "Description of a registered U2F device.", "properties": { "keyHandle": { "type": "string" }, "version": { "type": "string" } }, "required": [ "keyHandle", "version" ] } ] }, "UniqueOperationsCount": { "allOf": [ { "type": "object", "properties": { "value": { "type": "integer" } }, "required": [ "value" ] } ] }, "UnwrapKeyParams": { "allOf": [ { "type": "object", "description": "Request to unwrap a security object", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector is required for symmetric algorithms." }, "ad": { "type": "string", "format": "byte", "description": "Authenticated data is only applicable if mode is GCM." }, "tag": { "type": "string", "format": "byte", "description": "Tag is required if mode is GCM." } }, "required": [ "key", "alg" ] } ] }, "UnwrapKeyRequest": { "allOf": [ { "type": "object", "description": "Request to unwrap an sobject with another sobject.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "obj_type": { "$ref": "#/components/schemas/ObjectType" }, "rsa": { "$ref": "#/components/schemas/RsaOptions" }, "wrapped_key": { "type": "string", "format": "byte", "description": "A security object previously wrapped with another key" }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector to use, required for modes that take IVs\n(and irrelevant otherwise)." }, "ad": { "type": "string", "format": "byte", "description": "The authenticated data to use. This is only applicable when using\nauthenticated decryption modes (i.e., GCM or CCM)." }, "tag": { "type": "string", "format": "byte", "description": "The authentication tag, relevant for authenticated encryption modes\n(i.e., GCM or CCM), and otherwise irrelevant." }, "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true, "description": "Name to be given to the resulting security object, if persisted" }, "group_id": { "type": "string", "format": "uuid", "nullable": true, "description": "ID of the group that the unwrapped security object should belong to\n(if persisted). The user or application creating this security object\nmust be a member of this group. If no group is specified, and the\nrequester is an app, the app's default group will be used." }, "enabled": { "type": "boolean", "nullable": true, "description": "Whether the unwrapped key should have cryptographic operations enabled.\nDefaults to true." }, "description": { "type": "string", "nullable": true, "description": "User-defined description of the unwrapped key" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true, "description": "User-defined metadata for the resulting key, stored as key-value pairs." }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true, "description": "Optional array of key operations to be enabled for the resulting security\nobject. If not provided, DSM will provide a default set of key operations.\nNote that an empty array will result in all key operations being disabled." }, "transient": { "type": "boolean", "nullable": true, "description": "Whether the unwrapped key should be a transient key" }, "kcv": { "type": "string", "description": "Checksum value of the wrapped key" }, "kcv_method": { "$ref": "#/components/schemas/KcvMethod" }, "export_policy": { "$ref": "#/components/schemas/SobjectExportPolicy" } }, "required": [ "alg", "obj_type", "wrapped_key" ] } ] }, "UpdateCertificateReplicationCredentialRequest": { "allOf": [ { "type": "object", "description": "A request to update a certificate-based replication credential.", "properties": { "app_id": { "type": "string", "format": "uuid", "nullable": true, "description": "The app ID to associate with the credential. This should be the ID of\na source-side admin app." }, "certificate_chain": { "type": "array", "items": { "type": "string", "format": "byte" }, "nullable": true, "description": "The certificate chain to associate with the credential. This is a\nlist of DER-encoded certificates, starting from the leaf certificate,\nand may consist of a single certificate if no intermediate\ncertificates are necessary when authenticating with the source\ncluster." } } } ] }, "UpdateReplicationCredentialRequest": { "description": "A request to update a replication credential (e.g., associating it with\nan app ID).\n\nNote that changing the credential from one type to another is disallowed;\nusers should create a new credential instead.", "oneOf": [ { "$ref": "#/components/schemas/UpdateReplicationCredentialRequestVariantCertificate" } ], "discriminator": { "propertyName": "$type", "mapping": { "Certificate": "UpdateReplicationCredentialRequestVariantCertificate" } } }, "UpdateReplicationCredentialRequestVariantCertificate": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Certificate" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/UpdateCertificateReplicationCredentialRequest" } ] }, "User": { "allOf": [ { "type": "object", "properties": { "account_role": { "$ref": "#/components/schemas/UserAccountFlags" }, "created_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "dependent_services": { "type": "array", "uniqueItems": true, "items": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "email_verified": { "type": "boolean", "nullable": true }, "explicit_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserGroupRole" }, "nullable": true, "description": "Explicit group assignments.\n\nThis is similar to `groups` field except that it does not include groups due to\nall-groups roles. Use this field to find out which group assignments can be\nchanged using `mod_groups` and `del_groups` fields in user update API." }, "first_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserGroupRole" }, "nullable": true }, "has_account": { "type": "boolean", "nullable": true }, "has_password": { "type": "boolean", "nullable": true }, "last_logged_in_at": { "type": "string", "pattern": "^\\d{4}\\d{2}\\d{2}T\\d{2}\\d{2}\\d{2}Z$", "example": "20170509T070912Z" }, "last_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "mfa_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaDevice" }, "description": "Mfa devices registered with the user" }, "new_email": { "type": "string", "format": "email" }, "self_provisioned": { "type": "boolean", "nullable": true }, "u2f_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaDevice" } }, "user_email": { "type": "string", "format": "email" }, "user_id": { "type": "string", "format": "uuid" } }, "required": [ "account_role", "mfa_devices", "u2f_devices", "user_email", "user_id" ] } ] }, "UserAccountFlag": { "description": "User account flag", "type": "string", "enum": [ "STATEENABLED", "PENDINGINVITE" ] }, "UserAccountFlagOrRole": { "description": "User account flag or legacy user account role name or custom role id", "oneOf": [ { "$ref": "#/components/schemas/UserAccountFlag" }, { "$ref": "#/components/schemas/LegacyUserAccountRole" }, { "type": "string", "format": "uuid" } ] }, "UserAccountFlags": { "description": "User's role(s) and state in an account.", "allOf": [ { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/UserAccountFlagOrRole" } } ] }, "UserGroupRole": { "description": "User's role(s) in a group.", "allOf": [ { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/LegacyUserGroupRoleOrRoleId" } } ] }, "UserRequest": { "allOf": [ { "type": "object", "properties": { "account_role": { "$ref": "#/components/schemas/UserAccountFlags" }, "add_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserGroupRole" }, "nullable": true }, "add_mfa_devices": { "type": "array", "items": { "$ref": "#/components/schemas/FidoAddDeviceRequest" }, "nullable": true, "description": "FIDO devices to add. Only one device can be added at present." }, "add_u2f_devices": { "type": "array", "items": { "$ref": "#/components/schemas/U2fAddDeviceRequest" }, "nullable": true }, "del_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserGroupRole" }, "nullable": true }, "del_mfa_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaDelDeviceRequest" }, "nullable": true, "description": "Mfa devices to delete" }, "del_u2f_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaDelDeviceRequest" }, "nullable": true }, "description": { "type": "string", "nullable": true }, "enable": { "type": "boolean", "nullable": true, "description": "Used to enable or disable a user's membership in an account. Always starts as enabled, regardless of input. Can be changed later by the account admin." }, "first_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "last_name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true }, "mod_groups": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserGroupRole" }, "nullable": true }, "rename_mfa_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaRenameDeviceRequest" }, "nullable": true, "description": "Mfa devices to rename" }, "rename_u2f_devices": { "type": "array", "items": { "$ref": "#/components/schemas/MfaRenameDeviceRequest" }, "nullable": true }, "user_email": { "type": "string", "format": "email" }, "user_password": { "type": "string" } } } ] }, "UserSort": { "oneOf": [ { "title": "UserSortVariantByUserId", "type": "object", "properties": { "sort": { "type": "string", "pattern": "^user_id:(?:asc|desc)$", "example": "user_id:asc" }, "start": { "type": "string", "format": "uuid" } }, "required": [ "sort" ] } ] }, "UserVerificationRequirement": { "description": "https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement\nhttps://www.w3.org/TR/webauthn-2/#user-verification", "type": "string", "enum": [ "required", "preferred", "discouraged" ] }, "ValidateTokenRequest": { "allOf": [ { "type": "object", "properties": { "reset_token": { "type": "string" } }, "required": [ "reset_token" ] } ] }, "ValidateTokenResponse": { "allOf": [ { "type": "object", "properties": { "user_email": { "type": "string", "format": "email" } }, "required": [ "user_email" ] } ] }, "VerifyKcvRequest": { "allOf": [ { "type": "object", "description": "Verify KCV of a key", "properties": { "kcv": { "type": "string", "description": "Key Checksum Value. Could be one of following two variants:\n- Encrypt KCV: 24-bit checksum as a 6-character case-insensitive hex string (Default)\n- Cmac KCV: 40-bit checksum as a 10-character case-insensitive hex string\nNote: Cmac KCV is only available for AES or 3-key DES3 keys" }, "value": { "type": "string", "format": "byte", "description": "Key material" }, "obj_type": { "$ref": "#/components/schemas/ObjectType" }, "kcv_method": { "$ref": "#/components/schemas/KcvMethod" } }, "required": [ "kcv", "value", "obj_type" ] } ] }, "VerifyKcvResponse": { "allOf": [ { "type": "object", "description": "Key Checksum Value verification status.", "properties": { "verified": { "type": "boolean", "description": "Verification status" } }, "required": [ "verified" ] } ] }, "VerifyMacRequest": { "allOf": [ { "type": "object", "description": "Request to verify a MAC.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "data": { "type": "string", "format": "byte", "description": "The data over which the MAC needs to be verified" }, "mac": { "type": "string", "format": "byte", "description": "The MAC to verify. Note that the previously available\nfield `digest` is deprecated; this field should be used\ninstead." } }, "required": [ "data" ] } ] }, "VerifyRequest": { "allOf": [ { "type": "object", "description": "Request to verify a signature using an asymmetric key.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "hash_alg": { "$ref": "#/components/schemas/DigestAlgorithm" }, "hash": { "type": "string", "format": "byte", "description": "The hash of the data on which the signature is being verified. Either\n`hash` or `data` should be specified; it is an error to specify both\nor none.\nHash should be base64 encoded." }, "data": { "type": "string", "format": "byte", "description": "The data on which the signature is being verified. Either `hash` or\n`data` should be specified; it is an error to specify both or none.\nData should be base64 encoded." }, "mode": { "$ref": "#/components/schemas/SignatureMode" }, "signature": { "type": "string", "format": "byte", "description": "The signature to verify" }, "context": { "type": "string", "format": "byte", "description": "The context parameter to be provided to the verify algorithm.\n\nCurrently only ML-DSA keys accept a context parameter;\nthis parameter must not be specified for any other key types." } }, "required": [ "signature" ] } ] }, "VerifyResponse": { "allOf": [ { "type": "object", "description": "Result of verifying a signature or MAC.", "properties": { "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "The ID of the key used for verification. Returned for non-transient keys." }, "result": { "type": "boolean", "description": "True if the signature verified and false if it did not." } }, "required": [ "result" ] } ] }, "VersionParams": { "allOf": [ { "type": "object", "properties": { "detailed_fips_info": { "type": "boolean", "description": "Include FIPS-relevant info in the response. Currently that is `plugins_digest`.\n\nOnly applicable to FIPS builds." } } } ] }, "VersionResponse": { "allOf": [ { "type": "object", "description": "Information about the service version.", "properties": { "version": { "type": "string", "description": "Server version. This is encoded as \"major.minor.build\"." }, "api_version": { "type": "string", "description": "The API version implemented by the server." }, "server_mode": { "$ref": "#/components/schemas/ServerMode" }, "fips_level": { "type": "integer", "minimum": 0, "maximum": 255, "nullable": true, "description": "FIPS level at which the service in running. If this field is absent, then the service is\nnot running in FIPS compliant mode." }, "plugins_digest": { "type": "string", "format": "byte", "description": "An opaque digest of all current plugins.\n\nOnly present when the server is running in FIPS mode." } }, "required": [ "version", "api_version", "server_mode" ] } ] }, "VirtualSobjectInfo": { "allOf": [ { "type": "object", "description": "Information specific to a virtual key. Currently, this is only relevant\nfor virtual keys backed by DSM.", "properties": { "cached_key_material": { "type": "boolean", "description": "Whether or not the source key material is cached within the key." } }, "required": [ "cached_key_material" ] } ] }, "WithGroups": { "type": "string", "enum": [ "all", "explicit_only", "none" ] }, "WorkspaceCseAuthMethod": { "description": "Authentication method for Google Workspace CSE, `User` (default choice) requires each CSE user\nto be registered as a DSM user, while `App` requires each CSE user to be represented by a DSM app.\n\nNote:\nFor large organizations where lots of users use Google Workspace CSE but are not otherwise expected\nto be able to access DSM, App authentication method could be easier to implement.", "type": "string", "enum": [ "User", "App" ] }, "WorkspaceCseAuthorizationProvider": { "allOf": [ { "type": "object", "description": "These settings will allow the service to validate the Google-issued\nauthorization tokens used in Workspace CSE APIs.\n\nFor example, the specific settings for CSE Docs & Drive are:\n- JWKS URL: https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-drive@system.gserviceaccount.com\n- Issuer: gsuitecse-tokenissuer-drive@system.gserviceaccount.com\n- Audience: cse-authorization", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Authorization provider's name" }, "jwks_url": { "type": "string", "description": "A URL pointing to the JWKS endpoint" }, "cache_duration": { "type": "integer", "description": "Number of seconds that the service is allowed to cache the fetched keys" }, "valid_issuers": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Acceptable values for the `iss` (issuer) field used in Google's\nauthorization tokens" }, "valid_audiences": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Acceptable values for the `aud` (audience) field used in Google's\nauthorization tokens" } }, "required": [ "name", "jwks_url", "cache_duration", "valid_issuers", "valid_audiences" ] } ] }, "WorkspaceCseConfig": { "allOf": [ { "type": "object", "description": "Workspace CSE API settings. Specifying these settings enables the CSE APIs\nfor the account.", "properties": { "identity_providers": { "type": "array", "items": { "$ref": "#/components/schemas/WorkspaceCseIdentityProvider" }, "description": "One or more Identity Providers (IdP) trusted to authenticate users.\nNote that we don't check if Single Sign-On (SSO) settings exist for\neach IdP listed here, but it is recommended to add these IdPs in SSO\nsettings as well (usually as OAuth/OIDC providers)." }, "authorization_providers": { "type": "array", "items": { "$ref": "#/components/schemas/WorkspaceCseAuthorizationProvider" }, "description": "One or more authorization providers used to validate authorization\ntokens. Different Workspace applications might require different\nauthorization settings." }, "auth_method": { "$ref": "#/components/schemas/WorkspaceCseAuthMethod" } }, "required": [ "identity_providers", "authorization_providers" ] } ] }, "WorkspaceCseIdentityProvider": { "allOf": [ { "type": "object", "description": "An identity provider trusted to authenticate users for Workspace CSE APIs", "properties": { "name": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "description": "Identity provider's name" }, "signing_keys": { "$ref": "#/components/schemas/SigningKeys" }, "valid_issuers": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Acceptable values for the `iss` (issuer) field used in authentication\ntokens" }, "valid_audiences": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Acceptable values for the `aud` (audience) field used in authentication\ntokens" } }, "required": [ "name", "signing_keys", "valid_issuers", "valid_audiences" ] } ] }, "WrapKeyParams": { "allOf": [ { "type": "object", "description": "Wrapping key parameters", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "Initialization vector is required for symmetric algorithms." }, "ad": { "type": "string", "format": "byte", "description": "Authenticated data is only applicable if mode is GCM." }, "tag_len": { "type": "integer", "nullable": true, "description": "Tag length is required when mode is GCM." } }, "required": [ "key", "alg" ] } ] }, "WrapKeyRequest": { "allOf": [ { "type": "object", "description": "Request to wrap an sobject with another sobject.", "properties": { "key": { "$ref": "#/components/schemas/SobjectDescriptor" }, "subject": { "$ref": "#/components/schemas/SobjectDescriptor" }, "kid": { "type": "string", "format": "uuid", "nullable": true, "description": "ID of the sobject to be wrapped. (This is a legacy field,\nmutually exclusive with `subject`)." }, "alg": { "$ref": "#/components/schemas/Algorithm" }, "mode": { "$ref": "#/components/schemas/CryptMode" }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector to use. This is only applicable to modes\nthat take IVs, and will be randomly generated if not specified." }, "ad": { "type": "string", "format": "byte", "description": "The authenticated data to use. This is only applicable when using\nauthenticated encryption modes (i.e., GCM or CCM)." }, "tag_len": { "type": "integer", "nullable": true, "description": "The length of the authentication tag, in bits, for authenticated\nencryption modes (i.e., GCM or CCM). For other modes, this field\nis irrelevant." }, "key_format": { "$ref": "#/components/schemas/KeyFormat" } }, "required": [ "alg" ] } ] }, "WrapKeyResponse": { "allOf": [ { "type": "object", "description": "Result of a key wrapping request.", "properties": { "wrapped_key": { "type": "string", "format": "byte", "description": "The wrapped key blob" }, "iv": { "type": "string", "format": "byte", "description": "The initialization vector used during encryption. This is only\napplicable for certain symmetric encryption modes." }, "tag": { "type": "string", "format": "byte", "description": "The authenticated tag returned from authenticated encryption\n(i.e., using GCM or CCM mode). For other modes, this field is\nnot applicable." } }, "required": [ "wrapped_key" ] } ] }, "WrappingKeyName": { "oneOf": [ { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$", "nullable": true } ] }, "WrappingKeysOnly": { "allOf": [ { "type": "object", "description": "Only keys in this list can be used to wrap the sobject", "properties": { "keys": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/SobjectDescriptorPersisted" } } }, "required": [ "keys" ] } ] }, "WrappingKeys": { "oneOf": [ { "$ref": "#/components/schemas/WrappingKeysVariantOnly" }, { "$ref": "#/components/schemas/WrappingKeysVariantAny" } ], "discriminator": { "propertyName": "$type", "mapping": { "Only": "WrappingKeysVariantOnly", "Any": "WrappingKeysVariantAny" } } }, "WrappingKeysVariantOnly": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Only" ] } }, "required": [ "$type" ] }, { "$ref": "#/components/schemas/WrappingKeysOnly" } ] }, "WrappingKeysVariantAny": { "allOf": [ { "type": "object", "properties": { "$type": { "type": "string", "enum": [ "Any" ] } }, "required": [ "$type" ] }, { "type": "object", "properties": {} } ] }, "XmssOptions": { "allOf": [ { "type": "object", "description": "XMSS specific options", "properties": { "height": { "type": "integer", "nullable": true, "description": "The height of the Merkle tree (10, 16 or 20)" }, "digest": { "$ref": "#/components/schemas/DigestAlgorithm" }, "node_size": { "type": "integer", "nullable": true, "description": "Amount of bytes associated to each node (24 or 32)" } } } ] }, "XmssOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "AppGroups": { "oneOf": [ { "type": "object", "additionalProperties": { "type": "array", "items": { "$ref": "#/components/schemas/AppPermissions" } } }, { "type": "array", "items": { "type": "string", "format": "uuid" }, "uniqueItems": true } ] }, "ApprovableResult": { "type": "object", "properties": { "status": { "type": "integer", "minimum": 0, "maximum": 65535 }, "body": { "type": "object" } }, "required": [ "status", "body" ] }, "Base64UrlSafe": { "type": "string", "format": "byte" }, "BatchDecryptResponseItem": { "oneOf": [ { "title": "BatchDecryptResponseItemSuccess", "type": "object", "properties": { "status": { "type": "integer" }, "body": { "$ref": "#/components/schemas/DecryptResponse" } } }, { "title": "BatchDecryptResponseItemError", "type": "object", "properties": { "status": { "type": "integer" }, "error": { "type": "string" } } } ] }, "BatchEncryptResponseItem": { "oneOf": [ { "title": "BatchEncryptResponseItemSuccess", "type": "object", "properties": { "status": { "type": "integer" }, "body": { "$ref": "#/components/schemas/EncryptResponse" } } }, { "title": "BatchEncryptResponseItemError", "type": "object", "properties": { "status": { "type": "integer" }, "error": { "type": "string" } } } ] }, "BatchSignResponseItem": { "oneOf": [ { "title": "BatchSignResponseItemSuccess", "type": "object", "properties": { "status": { "type": "integer" }, "body": { "$ref": "#/components/schemas/SignResponse" } } }, { "title": "BatchSignResponseItemError", "type": "object", "properties": { "status": { "type": "integer" }, "error": { "type": "string" } } } ] }, "BatchVerifyResponseItem": { "oneOf": [ { "title": "BatchVerifyResponseItemSuccess", "type": "object", "properties": { "status": { "type": "integer" }, "body": { "$ref": "#/components/schemas/VerifyResponse" } } }, { "title": "BatchVerifyResponseItemError", "type": "object", "properties": { "status": { "type": "integer" }, "error": { "type": "string" } } } ] }, "COSEAlgorithmIdentifier": { "description": "https://www.w3.org/TR/webauthn-2/#typedefdef-cosealgorithmidentifier\n\nSigning algorithms from [IANA COSE Algorithms registry]\nthat are supported on DSM side for verifying signed messages\nfrom authenticator.\n\n[IANA COSE Algorithms registry]: https://www.iana.org/assignments/cose/cose.xhtml#algorithms", "type": "string", "enum": [ "Es256" ] }, "CustomMetadata": { "type": "object" }, "ListSobjectsResponse": { "oneOf": [ { "title": "ListSobjectsResponseWithMetadata", "type": "object", "description": "List security objects response", "properties": { "metadata": { "$ref": "#/components/schemas/Metadata" }, "items": { "type": "array", "items": { "$ref": "#/components/schemas/Sobject" } } }, "required": [ "metadata", "items" ] }, { "type": "array", "items": { "$ref": "#/components/schemas/Sobject" } } ] }, "PluginOutput": { "type": "string", "format": "byte" }, "PluginVersion": { "type": "string", "pattern": "^\\d+.\\d+$" }, "PublicKeyCredentialAuthenticatorAssertionResponse": { "allOf": [ { "type": "object", "description": "Contains the attributes that are returned to the caller when a new\ncredential is created, or a new assertion is requested.", "properties": { "id": { "$ref": "#/components/schemas/Base64UrlSafe", "description": "Credential's identifier." }, "type": { "$ref": "#/components/schemas/PublicKeyCredentialType", "description": "Type of credential." }, "response": { "$ref": "#/components/schemas/AuthenticatorAssertionResponse" }, "get_client_extension_results": { "$ref": "#/components/schemas/AuthenticationExtensionsClientOutputs", "description": "This field contains client extension output entries produced\nby the extension’s client extension processing." } } } ] }, "PublicKeyCredentialAuthenticatorAttestationResponse": { "allOf": [ { "type": "object", "description": "Contains the attributes that are returned to the caller when a new\ncredential is created, or a new assertion is requested.", "properties": { "id": { "$ref": "#/components/schemas/Base64UrlSafe", "description": "Credential's identifier." }, "type": { "$ref": "#/components/schemas/PublicKeyCredentialType", "description": "Type of credential." }, "response": { "$ref": "#/components/schemas/AuthenticatorAttestationResponse" }, "get_client_extension_results": { "$ref": "#/components/schemas/AuthenticationExtensionsClientOutputs", "description": "This field contains client extension output entries produced\nby the extension’s client extension processing." } } } ] }, "PublicKeyCredentialEntityForRp": { "allOf": [ { "description": "https://www.w3.org/TR/webauthn-2/#dictionary-pkcredentialentity", "type": "object", "properties": { "name": { "type": "string", "description": "Name of the entity." }, "entity": { "$ref": "#/components/schemas/PublicKeyCredentialRpEntity" } } } ] }, "PublicKeyCredentialEntityForUser": { "allOf": [ { "description": "https://www.w3.org/TR/webauthn-2/#dictionary-pkcredentialentity", "type": "object", "properties": { "name": { "type": "string", "description": "Name of the entity." }, "entity": { "$ref": "#/components/schemas/PublicKeyCredentialUserEntity" } } } ] }, "RemovableCommonClientConfig": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/CommonClientConfig" } ] }, "RemovableCryptographicPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/CryptographicPolicy" } ] }, "RemovableGoogleAccessReasonPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/GoogleAccessReasonPolicy" } ] }, "RemovableAutoScanSettings": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/AutoScanSettings" } ] }, "RemovableKeyHistoryPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/KeyHistoryPolicy" } ] }, "RemovableKeyMetadataPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/KeyMetadataPolicy" } ] }, "RemovableKmipClientConfig": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/KmipClientConfig" } ] }, "RemovablePkcs11ClientConfig": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/Pkcs11ClientConfig" } ] }, "RemovablePluginCodeSigningPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/PluginCodeSigningPolicy" } ] }, "RemovableTepClientConfig": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/TepClientConfig" } ] }, "RemovableWorkspaceCseConfig": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/WorkspaceCseConfig" } ] }, "RemovableHmgRedundancyScheme": { "description": "The `HmgRedundancyScheme` to set for the group. If unset, the backend will assign no particular meaning to the `hsm_order` fields of the group's `HmgConfig`s, and may error if it cannot connect to the external HSMs or DSM nodes specified in one of the `HmgConfig`.\n\nWhen creating the group, the value should either be an `HmgRedundancyScheme`, or omitted entirely. When updating the group, there are three choices:\n- A new value can be set by providing an `HmgRedundancyScheme`.\n- The string \"remove\" can be specified to unset the field.\n- Simply leaving the field blank leaves the field unchanged.", "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/HmgRedundancyScheme" } ] } }, "parameters": { "AuthDiscoverParams": { "in": "query", "name": "AuthDiscoverParams", "schema": { "$ref": "#/components/schemas/AuthDiscoverParams" }, "explode": true }, "CountParams": { "in": "query", "name": "CountParams", "schema": { "$ref": "#/components/schemas/CountParams" }, "explode": true }, "GetAccountParams": { "in": "query", "name": "GetAccountParams", "schema": { "$ref": "#/components/schemas/GetAccountParams" }, "explode": true }, "GetAppParams": { "in": "query", "name": "GetAppParams", "schema": { "$ref": "#/components/schemas/GetAppParams" }, "explode": true }, "GetGroupsParams": { "in": "query", "name": "GetGroupsParams", "schema": { "$ref": "#/components/schemas/GetGroupsParams" }, "explode": true }, "GetMarketplaceParams": { "in": "query", "name": "GetMarketplaceParams", "schema": { "$ref": "#/components/schemas/GetMarketplaceParams" }, "explode": true }, "GetSobjectParams": { "in": "query", "name": "GetSobjectParams", "schema": { "$ref": "#/components/schemas/GetSobjectParams" }, "explode": true }, "GetUserParams": { "in": "query", "name": "GetUserParams", "schema": { "$ref": "#/components/schemas/GetUserParams" }, "explode": true }, "GetUserPermissionsParams": { "in": "query", "name": "GetUserPermissionsParams", "schema": { "$ref": "#/components/schemas/GetUserPermissionsParams" }, "explode": true }, "HealthParams": { "in": "query", "name": "HealthParams", "schema": { "$ref": "#/components/schemas/HealthParams" }, "explode": true }, "ListApprovalRequestsParams": { "in": "query", "name": "ListApprovalRequestsParams", "schema": { "$ref": "#/components/schemas/ListApprovalRequestsParams" }, "explode": true }, "ListAppsParams": { "in": "query", "name": "ListAppsParams", "schema": { "$ref": "#/components/schemas/ListAppsParams" }, "explode": true }, "ListCredentialsParams": { "in": "query", "name": "ListCredentialsParams", "schema": { "$ref": "#/components/schemas/ListCredentialsParams" }, "explode": true }, "ListExternalRolesParams": { "in": "query", "name": "ListExternalRolesParams", "schema": { "$ref": "#/components/schemas/ListExternalRolesParams" }, "explode": true }, "ListPluginsParams": { "in": "query", "name": "ListPluginsParams", "schema": { "$ref": "#/components/schemas/ListPluginsParams" }, "explode": true }, "ListRolesParams": { "in": "query", "name": "ListRolesParams", "schema": { "$ref": "#/components/schemas/ListRolesParams" }, "explode": true }, "ListSobjectsParams": { "in": "query", "name": "ListSobjectsParams", "schema": { "$ref": "#/components/schemas/ListSobjectsParams" }, "explode": true }, "ListUsersParams": { "in": "query", "name": "ListUsersParams", "schema": { "$ref": "#/components/schemas/ListUsersParams" }, "explode": true }, "LogsParams": { "in": "query", "name": "LogsParams", "schema": { "$ref": "#/components/schemas/LogsParams" }, "explode": true }, "MfaChallengeParams": { "in": "query", "name": "MfaChallengeParams", "schema": { "$ref": "#/components/schemas/MfaChallengeParams" }, "explode": true }, "StatsParams": { "in": "query", "name": "StatsParams", "schema": { "$ref": "#/components/schemas/StatsParams" }, "explode": true }, "SystemInfoParams": { "in": "query", "name": "SystemInfoParams", "schema": { "$ref": "#/components/schemas/SystemInfoParams" }, "explode": true }, "VersionParams": { "in": "query", "name": "VersionParams", "schema": { "$ref": "#/components/schemas/VersionParams" }, "explode": true } } }, "paths": { "/sys/v1/accounts/{acct_id}/usage": { "get": { "operationId": "AccountUsage", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get account usage information. See input and output of this API\nfor info on what it can return.", "description": "Get account usage information. See input and output of this API\nfor info on what it can return.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/CountParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetUsageResponse" } } } } } } }, "/crypto/v1/keys/{key_id}/activate": { "post": { "operationId": "ActivateSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Transition a security object to Active state.", "description": "Transition a security object to Active state.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/apps/{app_id}/groups": { "post": { "operationId": "AddGroupMembership", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Assign the app a new group membership", "description": "Assign the app a new group membership", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateGroupMembership" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppGroupMembership" } } } } } }, "get": { "operationId": "GetAllGroupMemberships", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all group memberships for the app", "description": "Get all group memberships for the app", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetGroupsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAppGroupMemberships" } } } } } } }, "/crypto/v1/agree": { "post": { "operationId": "Agree", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Agree on a key from two other keys.", "description": "Perform a cryptographic key agreement operation between a public key and a\nprivate key. Both keys must have been generated from the same parameters (e.g.\nthe same elliptic curve). Both keys must allow the AGREEKEY operation. The\nrequest body contains the requested properties for the new key as well as the\nmechanism (e.g. Diffie-Hellman) to be used to produce the key material for the\nnew key. The output of this API should not be used directly as a cryptographic\nkey. The target object type should be HMAC or Secret, and a key derivation\nprocedure should be used to derive the actual key material.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgreeKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/approval_requests/{req_id}/approve": { "post": { "operationId": "ApproveRequest", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Approve an approval request.", "description": "If the quorum policy was configured to require extra things\nlike 2FA, then, relevant info needs to be added to the request.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApproveRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRequest" } } } } } } }, "/sys/v1/groups/{group_id}/hmg/scans": { "post": { "operationId": "AsyncScanHmg", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Scan external objects asynchronously.", "description": "Scan external objects asynchronously and create corresponding\nvirtual sobjects in the group as needed. If there is already a virtual\nsobject corresponding to a scanned object, no sobject is created.\nThis is only supported for DSM-backed groups currently.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Scan" } } } } } }, "get": { "operationId": "GetAllHmgScans", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Retrieve the scan status of an external group.", "description": "Retrieve the scan status of an external group.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAllHmgScansResponse" } } } } } } }, "/sys/v1/session/auth/discover": { "post": { "operationId": "AuthDiscover", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Returns the available auth methods for the given user email.\nExample: password, ldap, oauth, etc.", "description": "Returns the available auth methods for the given user email.\nExample: password, ldap, oauth, etc.", "parameters": [ { "$ref": "#/components/parameters/AuthDiscoverParams" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthDiscoverRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AuthMethod" } } } } } } } }, "/sys/v1/session/auth": { "post": { "operationId": "Authenticate", "tags": [ "Session" ], "security": [ { "basicAuth": [] }, { "apiKeyAuth": [] } ], "summary": "Create a session for a user or an app.", "description": "Authenticate a user or an app to begin a session.\nThe caller needs to provide a basic authentication token or\nan appropriate request body (see input type).\nThe response body contains a bearer authentication token\nwhich needs to be provided by subsequent calls for the\nduration of the session.\n\nIf this is basic auth and the user has MFA devices configured,\nthe response also contains challenge for the device to sign.\nUntil the signed assertion is passed to `POST /sys/v1/session/auth/2fa/fido2`\nto complete 2FA, the bearer token can't be used for anything else.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthResponse" } } } } } } }, "/batch/v1": { "post": { "operationId": "Batch", "tags": [ "Batch" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new batch request", "description": "This API support for quorum approval operations like encrypt, decrypt, sign, wrap, unwrap etc.\n\nSobject operations like rotate, copy, delete, destroy, update profile,\nrevoke, revert, update operations, update policies, update enabled/ disabled\nstate, export as components.\n\nCreate and update accounts, groups etc", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BatchRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BatchResponse" } } } } } } }, "/crypto/v1/keys/batch/decrypt": { "post": { "operationId": "BatchDecrypt", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Batch decrypt with one or more keys.", "description": "The order of batch items in the response matches that of the request.\nreturned in the same order. An individual status code is returned\nfor each batch item.\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchDecryptRequestItem" } } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchDecryptResponseItem" } } } } } } } }, "/crypto/v1/keys/batch/encrypt": { "post": { "operationId": "BatchEncrypt", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Batch encrypt with one or more keys.", "description": "The order of batch items in the response matches that of the request.\nAn individual status code is returned for each batch item.\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchEncryptRequestItem" } } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchEncryptResponseItem" } } } } } } } }, "/crypto/v1/keys/batch/sign": { "post": { "operationId": "BatchSign", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Batch sign with one or more private keys.", "description": "The order of batch items in the response matches that of the request.\nAn individual status code is returned for each batch item.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SignRequest" } } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchSignResponseItem" } } } } } } } }, "/crypto/v1/keys/batch/verify": { "post": { "operationId": "BatchVerify", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Batch verify with one or more public keys.", "description": "The order of batch items in the response matches that of the request.\nAn individual status code is returned for each batch item.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/VerifyRequest" } } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchVerifyResponseItem" } } } } } } } }, "/sys/v1/users/change_password": { "post": { "operationId": "ChangePassword", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Change user's password.", "description": "Change user's password.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/groups/{group_id}/hmg/check": { "post": { "operationId": "CheckHmg", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Check that the HMG configuration for a particular group is\nvalid and reachable.", "description": "Check that the HMG configuration for a particular group is\nvalid and reachable.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CheckHmgRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/groups/hmg/check": { "post": { "operationId": "CheckHmgConfig", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Check that the HMG configuration provided is valid and reachable.", "description": "Check that the HMG configuration provided is valid and reachable.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HmgConfig" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/session/auth/2fa/fido2": { "post": { "operationId": "CompleteFido2Auth", "tags": [ "Fido" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Completes a pending authentication using a FIDO2 key.", "description": "Completes a pending authentication using a FIDO2 key.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicKeyCredentialAuthenticatorAssertionResponse" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/session/config_2fa/auth": { "post": { "operationId": "Config2faAuth", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Unlock two factor configuration.", "description": "Re-authenticate to unlock two factor configuration.\nTwo factor configuration must be unlocked to enable or disable two\nfactor authentication, add or remove two factor devices, or\nregenerate recovery codes.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Config2faAuthRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Config2faAuthResponse" } } } } } } }, "/sys/v1/session/config_2fa/terminate": { "post": { "operationId": "Config2faTerminate", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lock two factor configuration.", "description": "Lock two factor configuration after completing two factor\nreconfiguration. If this API is not called, two factor\nconfiguration will be locked automatically after ten minutes.\nLocking this back is necessary if the 2FA device needs to be used\nfor other things like approval requests. It is not possible use\n2FA for other purposes when configuration mode is unlocked.", "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/users/{user_id}/confirm_email": { "post": { "operationId": "ConfirmEmail", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Confirms user's email address.", "description": "Confirms user's email address.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfirmEmailRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfirmEmailResponse" } } } } } } }, "/crypto/v1/keys/copy": { "post": { "operationId": "CopySobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Make a copy of a security object.", "description": "A new key will be created in the target group and will have the\nsame key material as the original key. Links will be maintained\nbetween all copied keys and the source key.\nIf the key is being copied to an externally linked group, it needs\nto be exportable.\n\nThis can also be used to rotate an external key by copying the\nkey material from a native DSM key. This key material will then\nfinally be imported into the external KMS.\nFor AWS KMS keys, after the rotation, the new key will have the\noriginal aliases and the old key's aliases will have\n(rotated at ) appended in front of it.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CopySobjectRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/accounts": { "post": { "operationId": "CreateAccount", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new account.", "description": "Create a new account.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Account" } } } } } }, "get": { "operationId": "ListAccounts", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get info about all accounts.", "description": "A user can have access to multiple accounts and this API gets\nall accounts the calling user has access to.", "parameters": [ { "$ref": "#/components/parameters/GetAccountParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Account" } } } } } } } }, "/sys/v1/account_extensions/{acct_id}": { "put": { "operationId": "CreateAccountExtension", "tags": [ "Account_extensions" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new account extension.", "description": "Create a new account extension.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtensionCreateRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtension" } } } } } }, "get": { "operationId": "GetAccountExtension", "tags": [ "Account_extensions" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get info for a specific account extension.", "description": "Get info for a specific account extension.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtension" } } } } } }, "patch": { "operationId": "UpdateAccountExtension", "tags": [ "Account_extensions" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update specific account extension.", "description": "Update specific account extension.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtensionRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtension" } } } } } } }, "/sys/v1/apps": { "post": { "operationId": "CreateApp", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new application with the specified properties.", "description": "Create a new application with the specified properties.", "parameters": [ { "$ref": "#/components/parameters/GetAppParams" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/App" } } } } } }, "get": { "operationId": "ListApps", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get details of all apps accessible to requester.", "description": "Get details of all apps accessible to requester.", "parameters": [ { "$ref": "#/components/parameters/ListAppsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListAppsResponse" } } } } } } }, "/sys/v1/approval_requests": { "post": { "operationId": "CreateApprovalRequest", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new approval request.", "description": "Create a new approval request.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRequestRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRequest" } } } } } }, "get": { "operationId": "ListApprovalRequests", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all approval requests.", "description": "Get all approval requests.", "parameters": [ { "$ref": "#/components/parameters/ListApprovalRequestsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalRequest" } } } } } } } }, "/sys/v1/credentials": { "post": { "operationId": "CreateCredential", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new integration credential", "description": "Create a new integration credential", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredentialCreateRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredential" } } } } } }, "get": { "operationId": "GetAllCredentials", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all credentials accessible to the requester", "description": "Get all credentials accessible to the requester", "parameters": [ { "$ref": "#/components/parameters/ListCredentialsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListCredentialsResponse" } } } } } } }, "/crypto/v1/digest": { "post": { "operationId": "CreateDigest", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Compute digest (hash) of data.", "description": "Compute digest (hash) of data.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DigestRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DigestResponse" } } } } } } }, "/sys/v1/external_roles": { "post": { "operationId": "CreateExternalRole", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new external role.", "description": "Create a new external role.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRoleRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRole" } } } } } }, "get": { "operationId": "ListExternalRoles", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all external roles.", "description": "Get all external roles.", "parameters": [ { "$ref": "#/components/parameters/ListExternalRolesParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ExternalRole" } } } } } } } }, "/sys/v1/groups": { "post": { "operationId": "CreateGroup", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new group with the specified properties.", "description": "Create a new group with the specified properties.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" } } } } } }, "get": { "operationId": "ListGroups", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all groups accessible to the requester.", "description": "Get all groups accessible to the requester.", "parameters": [ { "$ref": "#/components/parameters/GetGroupsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListGroupsResponse" } } } } } } }, "/sys/v1/plugins": { "post": { "operationId": "CreatePlugin", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new plugin.", "description": "Create a new plugin.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PluginRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plugin" } } } } } }, "get": { "operationId": "ListPlugins", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get details of all plugins accessible to the requester.", "description": "Get details of all plugins accessible to the requester.", "parameters": [ { "$ref": "#/components/parameters/ListPluginsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Plugin" } } } } } } } }, "/sys/v1/accounts/{acct_id}/replication/credentials": { "post": { "operationId": "CreateReplicationCredential", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create an admin app credential that can be used to perform\naccount replication.", "description": "Note that this does _not_ immediately create a usable credential;\nfurther processing is necessary before it can be actually used for\naccount replication.\n\nCurrently, a single replication account can store up to two\nreplication credentials.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateReplicationCredentialRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplicationCredential" } } } } } }, "get": { "operationId": "ListReplicationCredentials", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Retrieve all stored replication credentials under the account.", "description": "Retrieve all stored replication credentials under the account.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListReplicationCredentialsResponse" } } } } } } }, "/sys/v1/roles": { "post": { "operationId": "CreateRole", "tags": [ "Roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new role.", "description": "Create a new role.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Role" } } } } } }, "get": { "operationId": "ListRoles", "tags": [ "Roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all roles.", "description": "Get all roles.", "parameters": [ { "$ref": "#/components/parameters/ListRolesParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListRolesResponse" } } } } } } }, "/crypto/v1/keys": { "post": { "operationId": "CreateSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Generate a new security object.", "description": "Generate a new security object (such as an RSA key pair or an AES key)\nof the requested size, elliptic curve, etc.\n\nBy default, all key operations except for EXPORT that are implemented\nfor that type of key will be enabled. These may be overridden by\nrequesting specific operations in the key creation request.\n\nObjects of type Secret/Opaque may not be generated with this API.\nThey must be imported via the import API.\n\nFor AWS/Azure/GCP KMS keys, this generates the key material in the external KMS and a\ncorresponding virtual key is created in DSM. EC and RSA keys are supported for Azure\nwhile only 256-bit AES keys are supported for AWS and GCP.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } }, "put": { "operationId": "ImportSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Import a security object.", "description": "By default, all key operations that are implemented for that type of\nkey will be enabled. These may be overridden by requesting specific\noperations in the key import request.\n\nFor symmetric and asymmetric keys, value is base64-encoding of the\nkey material in DER format.\n\nFor AWS/Azure/GCP KMS keys, this imports the key material provided into the\nexternal KMS and a corresponding virtual key is created in DSM.\nEC and RSA keys are supported for Azure while only 256-bit AES\nkeys are supported for AWS and GCP.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } }, "get": { "operationId": "ListSobjects", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all security objects accessible to the requester.", "description": "Get all security objects accessible to the requester.", "parameters": [ { "$ref": "#/components/parameters/ListSobjectsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListSobjectsResponse" } } } } } } }, "/crypto/v1/decapsulate": { "post": { "operationId": "Decapsulate", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Decrypt an encapsulated key with this Sobject, obtaining a new\nsymmetric key in the target group.", "description": "Decrypt an encapsulated key with this Sobject, obtaining a new\nsymmetric key in the target group.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecapsulateKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/crypto/v1/decrypt": { "post": { "operationId": "Decrypt", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Decrypt data using a symmetric or asymmetric key.", "description": "For symmetric ciphers, `mode` (the block cipher mode) is a required field.\nFor GCM and CCM modes, `tag_len` is a required field.\n`iv` is required for symmetric ciphers and unused for asymmetric ciphers.\nIf the mode requires one, the request must contain the initialization vector\nused when the data was encrypted.\nObjects of type Opaque, EC, or HMAC may not be used with this API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptResponse" } } } } } } }, "/crypto/v1/decrypt/final": { "post": { "operationId": "DecryptFinal", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for\nmore details.", "description": "Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for\nmore details.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptFinalRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptFinalResponse" } } } } } } }, "/crypto/v1/decrypt/init": { "post": { "operationId": "DecryptInit", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Begin multi-part decryption.", "description": "This API is used when decrypting more data than the client wishes\nto submit in a single request. It supports only symmetric ciphers\nand CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform\nmulti-part decryption, the client makes one request to the `init`\nresource, zero or more requests to the `update` resource, followed\nby one request to the `final` resource. The response to init and\nupdate requests includes a `state` field. The `state` is an opaque\ndata blob that must be supplied unmodified by the client with each\nsubsequent request.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptInitRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptInitResponse" } } } } } } }, "/crypto/v1/decrypt/update": { "post": { "operationId": "DecryptUpdate", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Continue multi-part decryption. See `/crypto/v1/decrypt/init` for\nmore details.", "description": "Continue multi-part decryption. See `/crypto/v1/decrypt/init` for\nmore details.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptUpdateRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecryptUpdateResponse" } } } } } } }, "/sys/v1/accounts/{acct_id}": { "delete": { "operationId": "DeleteAccount", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete an account.", "description": "Delete an account.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetAccount", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get info for a specific account.", "description": "A user can have access to multiple accounts and this API tries\nto look one up given by the input id.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetAccountParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Account" } } } } } }, "patch": { "operationId": "UpdateAccount", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update account settings such as authentication, logging, etc.", "description": "Update account settings such as authentication, logging, etc.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Account" } } } } } } }, "/sys/v1/apps/{app_id}": { "delete": { "operationId": "DeleteApp", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete an app.", "description": "Delete an app.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetApp", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup an application.", "description": "Lookup an application.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetAppParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/App" } } } } } }, "patch": { "operationId": "UpdateApp", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update app settings like groups, client config, etc.", "description": "Update app settings like groups, client config, etc.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetAppParams" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/App" } } } } } } }, "/sys/v1/approval_requests/{req_id}": { "delete": { "operationId": "DeleteApprovalRequest", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete an approval request.", "description": "Delete an approval request.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetApprovalRequest", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a specific approval request.", "description": "Lookup a specific approval request.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRequest" } } } } } } }, "/sys/v1/credentials/{cred_id}": { "delete": { "operationId": "DeleteCredential", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete a credential by id", "description": "Delete a credential by id", "parameters": [ { "name": "cred_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetCredential", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get a credential specified by id", "description": "Get a credential specified by id", "parameters": [ { "name": "cred_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredential" } } } } } }, "patch": { "operationId": "UpdateCredential", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update a credential object", "description": "Update a credential object", "parameters": [ { "name": "cred_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredentialUpdateRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredential" } } } } } } }, "/sys/v1/external_roles/{external_role_id}": { "delete": { "operationId": "DeleteExternalRole", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete an external role.", "description": "Delete an external role.", "parameters": [ { "name": "external_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetExternalRole", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a particular external role by its ID.", "description": "Lookup a particular external role by its ID.", "parameters": [ { "name": "external_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRole" } } } } } }, "patch": { "operationId": "UpdateExternalRole", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update an external role.", "description": "Update an external role.", "parameters": [ { "name": "external_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRoleRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRole" } } } } } } }, "/sys/v1/groups/{group_id}": { "delete": { "operationId": "DeleteGroup", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete the group.", "description": "Delete the group.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetGroup", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a specific group.", "description": "Lookup a specific group.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" } } } } } }, "patch": { "operationId": "UpdateGroup", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Change a group's properties.", "description": "Change a group's properties.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" } } } } } } }, "/sys/v1/apps/{app_id}/groups/{group_id}": { "delete": { "operationId": "DeleteGroupMembership", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Remove an app's membership in a specific group", "description": "Remove an app's membership in a specific group", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetGroupMembership", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get an app's group membership", "description": "Get an app's group membership", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppGroupMembership" } } } } } }, "patch": { "operationId": "UpdateGroupMembership", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update an app's particular group membership", "description": "Update an app's particular group membership", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupMembershipRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppGroupMembership" } } } } } } }, "/sys/v1/plugins/{plugin_id}": { "delete": { "operationId": "DeletePlugin", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete a plugin.", "description": "Delete a plugin.", "parameters": [ { "name": "plugin_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetPlugin", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a plugin.", "description": "Lookup a plugin.", "parameters": [ { "name": "plugin_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plugin" } } } } } }, "post": { "operationId": "InvokePlugin", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Invokes a plugin execution with the provided request body\nas input to the plugin.", "description": "Invokes a plugin execution with the provided request body\nas input to the plugin.", "parameters": [ { "name": "plugin_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": {} } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PluginOutput" } } } } } }, "patch": { "operationId": "UpdatePlugin", "tags": [ "Plugins" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Change a plugin's properties, such as name, description,\ncode, group membership, etc.", "description": "Change a plugin's properties, such as name, description,\ncode, group membership, etc.", "parameters": [ { "name": "plugin_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PluginRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plugin" } } } } } } }, "/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}": { "delete": { "operationId": "DeleteReplicationCredential", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete the specified replication credential.", "description": "Delete the specified replication credential.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetReplicationCredential", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Retrieve the specified replication credential.", "description": "Retrieve the specified replication credential.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplicationCredential" } } } } } }, "patch": { "operationId": "UpdateReplicationCredential", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update the specified replication credential.", "description": "This can be used to associate an app ID with the credential,\nand/or upload cert chains for the credential.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateReplicationCredentialRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplicationCredential" } } } } } } }, "/sys/v1/roles/{custom_role_id}": { "delete": { "operationId": "DeleteRole", "tags": [ "Roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete a role.", "description": "Delete a role.", "parameters": [ { "name": "custom_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetRole", "tags": [ "Roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a role.", "description": "Lookup a role.", "parameters": [ { "name": "custom_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Role" } } } } } }, "patch": { "operationId": "UpdateRole", "tags": [ "Roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update a role given by the input ID.", "description": "Update a role given by the input ID.", "parameters": [ { "name": "custom_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Role" } } } } } } }, "/crypto/v1/keys/{key_id}": { "delete": { "operationId": "DeleteSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete the specified security object.", "description": "Delete the specified security object.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "patch": { "operationId": "UpdateSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update the properties of a security object like\nname, description, etc.", "description": "Update the properties of a security object like\nname, description, etc.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/users/{user_id}": { "delete": { "operationId": "DeleteStale", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete a stale user (for sysadmins).", "description": "Delete a stale user (for sysadmins).", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "GetUser", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a user.", "description": "Lookup a user.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetUserParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } } } }, "patch": { "operationId": "UpdateUser", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Change a user's properties like first_name, last_name,\ndescription, etc.", "description": "Change a user's properties like first_name, last_name,\ndescription, etc.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } } } } }, "/sys/v1/users": { "delete": { "operationId": "DeleteUser", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Delete the currently logged-in user.", "description": "Delete the currently logged-in user.", "responses": { "204": { "description": "Nothing is returned on success" } } }, "get": { "operationId": "ListUsers", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all users accessible to the requester.", "description": "Get all users accessible to the requester.", "parameters": [ { "$ref": "#/components/parameters/ListUsersParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/User" } } } } } } }, "post": { "operationId": "SignupUser", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new user with the given properties.", "description": "Create a new user with the given properties.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } } } } }, "/sys/v1/users/{user_id}/accounts": { "delete": { "operationId": "DeleteUserAccount", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Remove user's association with an account.", "description": "Remove user's association with an account.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/approval_requests/{req_id}/deny": { "post": { "operationId": "DenyRequest", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Deny an approval request.", "description": "Deny an approval request.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DenyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRequest" } } } } } } }, "/crypto/v1/derive": { "post": { "operationId": "Derive", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Derive a new key from an existing key.", "description": "The request body contains the requested properties for the new key\nas well as the mechanism to be used to produce the key material for\nthe new key.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeriveKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/crypto/v1/keys/{key_id}/destroy": { "post": { "operationId": "DestroySobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Transition a security object to Destroyed state. Objects in the\n`Destroyed` state cannot be used in any cryptographic operation.\nTheir metadata however, remains accessible.", "description": "Transition a security object to Destroyed state. Objects in the\n`Destroyed` state cannot be used in any cryptographic operation.\nTheir metadata however, remains accessible.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/digest": { "post": { "operationId": "DigestSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Retrieve the digest (hash) of the value of an exportable security object.", "description": "Retrieve the digest (hash) of the value of an exportable security object.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ObjectDigestRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ObjectDigestResponse" } } } } } } }, "/crypto/v1/encapsulate": { "post": { "operationId": "Encapsulate", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Obtain a new symmetric key and its encapsulated version from this Sobject.", "description": "The resulting symmetric key is created as a new Sobject in the given\ngroup. The details of this Sobject along with the ciphertext encapsulating the\nsymmetric key are returned in the response.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncapsulateKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncapsulateKeyResponse" } } } } } } }, "/crypto/v1/encrypt": { "post": { "operationId": "Encrypt", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Encrypt data using a symmetric or asymmetric key.", "description": "For symmetric ciphers, `mode` (the block cipher mode) is a required field.\nFor GCM and CCM modes, `tag_len` is a required field.\n`iv` is optional for symmetric ciphers and unused for asymmetric ciphers. If\nprovided, it will be used as the cipher initialization vector. The length of\n`iv` must match the initialization vector size for the cipher and mode. If not\nprovided, a random iv of the correct length is created and returned in the\nresponse.\nObjects of type Opaque, EC, or HMAC may not be used with this API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptResponse" } } } } } } }, "/crypto/v1/encrypt/final": { "post": { "operationId": "EncryptFinal", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Conclude multi-part encryption. See `/crypto/v1/encrypt/init`\nfor more details.", "description": "Conclude multi-part encryption. See `/crypto/v1/encrypt/init`\nfor more details.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptFinalRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptFinalResponse" } } } } } } }, "/crypto/v1/encrypt/init": { "post": { "operationId": "EncryptInit", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Begin multi-part encryption.", "description": "This API is used when encrypting more data than the client wishes\nto submit in a single request. It supports only symmetric ciphers\nand CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform\nmulti-part encryption, the client makes one request to the `init`\nresource, zero or more requests to the `update` resource, followed\nby one request to the `final` resource. The response to init and\nupdate requests includes a `state` field. The `state` is an opaque\ndata blob that must be supplied unmodified by the client with each\nsubsequent request.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptInitRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptInitResponse" } } } } } } }, "/crypto/v1/encrypt/update": { "post": { "operationId": "EncryptUpdate", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Continue multi-part encryption. See `/crypto/v1/encrypt/init`\nfor more details.", "description": "Continue multi-part encryption. See `/crypto/v1/encrypt/init`\nfor more details.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptUpdateRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptUpdateResponse" } } } } } } }, "/crypto/v1/keys/export": { "post": { "operationId": "ExportSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get the details and value of a particular exportable security object.", "description": "Get the details and value of a particular exportable security object.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectDescriptor" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/crypto/v1/keys/components/export": { "post": { "operationId": "ExportSobjectComponents", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Exports the security object as components.", "description": "Exports the security object as components. This API can only be called\nthrough an approval request and won't work if called directly. This\nrequires a key custodian policy and quorum approval policy to be set at\nthe group level. A new approval request needs to be created (see\n`POST /sys/v1/approval_requests`), then after getting the required approvals,\nthe key custodians can fetch the result of this approval request\n(See `POST /sys/v1/approval_requests/:req_id/result`).\nEach key custodian will be able to get only their component.\n\nOnly AES, DES, DES3 & HMAC objects are exportable by components.\n\nThis is described in detail in the following article:\nhttps://support.fortanix.com/hc/en-us/articles/360043559332-User-s-Guide-Key-Components", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportSobjectComponentsRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportComponentsResponse" } } } } } } }, "/sys/v1/users/forgot_password": { "post": { "operationId": "ForgotPassword", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Initiate password reset sequence for a user.", "description": "Initiate password reset sequence for a user.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ForgotPasswordRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/users/generate_recovery_codes": { "post": { "operationId": "GenerateRecoveryCodes", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Generate recovery codes for two factor authentication.", "description": "Generate backup recovery codes that may be used to complete two\nfactor authentication. Two factor configuration must be unlocked\nto use this API.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryCodes" } } } } } } }, "/sys/v1/logs": { "get": { "operationId": "GetAllLogs", "tags": [ "Logs" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get all logs visible to the requester.", "description": "Get all logs visible to the requester.", "parameters": [ { "$ref": "#/components/parameters/LogsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsAuditQueryResponse" } } } } } } }, "/sys/v1/services": { "get": { "operationId": "GetAllServices", "tags": [ "Misc" ], "summary": "Check information about all connected services", "description": "Returns the information regarding the status of all the connected services.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAllServicesResponse" } } } } } } }, "/sys/v1/stats/apps": { "get": { "operationId": "GetAppAggregate", "tags": [ "Stats" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get app aggregate transaction statistics.", "description": "Get app aggregate transaction statistics.", "parameters": [ { "$ref": "#/components/parameters/StatsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsStatsCountQueryResponse" } } } } } } }, "/sys/v1/apps/{app_id}/credential": { "get": { "operationId": "GetAppCredential", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get an application's credential.", "description": "In FIPS mode this secret will be reset after 100 failed API key authentication\nattempts in a 24 hour period.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppCredentialResponse" } } } } } } }, "/sys/v1/stats/{app_id}/app": { "get": { "operationId": "GetAppStats", "tags": [ "Stats" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get transaction statistics for a specific application.", "description": "Get transaction statistics for a specific application.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/StatsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsStatsCountQueryResponse" } } } } } } }, "/sys/v1/approval_requests/{req_id}/result": { "post": { "operationId": "GetApprovalRequestResult", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get the result for an approved or failed request.", "description": "Get the result for an approved or failed request.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovableResult" } } } } } } }, "/sys/v1/apps/client_configs": { "get": { "operationId": "GetClientConfigs", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get configurations for various clients. This API can only be called by apps", "description": "Client configurations can be set at account level, group level or app level.\nClient config set on the app itself overrides config set at group level and\nsimilarly group level config overrides account level config. This API returns\nthe combined client config according to the above explanation.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientConfigurations" } } } } } } }, "/sys/v1/groups/hmg/gcp_key_rings": { "post": { "operationId": "GetGcpKeyRings", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Given an GCP configuration, fetch a list of available\nGCP key rings which can be used to back a group.", "description": "Given an GCP configuration, fetch a list of available\nGCP key rings which can be used to back a group.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GcpKeyRingConfig" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" } } } } } } } }, "/sys/v1/stats/groups": { "get": { "operationId": "GetGroupAggregate", "tags": [ "Stats" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get group aggregate transaction statistics.", "description": "Get group aggregate transaction statistics.", "parameters": [ { "$ref": "#/components/parameters/StatsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsStatsCountQueryResponse" } } } } } } }, "/sys/v1/stats/{group_id}/group": { "get": { "operationId": "GetGroupStats", "tags": [ "Stats" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get transaction statistics for a specific group.", "description": "Get transaction statistics for a specific group.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/StatsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsStatsCountQueryResponse" } } } } } } }, "/sys/v1/health": { "get": { "operationId": "GetHealth", "tags": [ "Misc" ], "summary": "Check whether the server is handling requests", "description": "Returns a 200-class status code if the server is handling requests,\nor a 500-class status code if the server is having problems.", "parameters": [ { "$ref": "#/components/parameters/HealthParams" } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/kcv": { "post": { "operationId": "GetKcv", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Computes the KCV of the input and returns. This is\nonly valid for AES, DES & DES3 keys.", "description": "Computes the KCV of the input and returns. This is\nonly valid for AES, DES & DES3 keys.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KeyCheckValueRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KeyCheckValueResponse" } } } } } } }, "/crypto/v1/keys/key_attestation": { "post": { "operationId": "GetKeyAttestation", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Retrieve a key attestation certificate for a security object.", "description": "If the cluster is capable of key attestation, and requested security\nobject supports key attestation (currently only RSA or EC keys that have\ntheir private key component), a key attestation is returned.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KeyAttestationRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KeyAttestationResponse" } } } } } } }, "/sys/v1/marketplace": { "get": { "operationId": "GetMarketplace", "tags": [ "Marketplace" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Gets all the plugins from the input url.", "description": "Gets all the plugins from the input url.", "parameters": [ { "$ref": "#/components/parameters/GetMarketplaceParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/MarketplacePlugin" } } } } } } } }, "/crypto/v1/pubkey/{acct_id}/{name}": { "get": { "operationId": "GetPubkey", "tags": [ "Keys" ], "summary": "Get public part of an asymmetric key.", "description": "Returns the public part of an asymmetric key. This needs\naccount id and key name as input. No auth is required for this.\nThis works with RSA, EC and Certificate objects.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "name", "in": "path", "required": true, "schema": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "string", "format": "byte" } } } } } } } }, "/sys/v1/groups/{group_id}/hmg/scans/{scan_id}": { "get": { "operationId": "GetScan", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Query the status of a particular scan. Only the last five completed\nscans,as well as any in-progress scan, is queryable.", "description": "Query the status of a particular scan. Only the last five completed\nscans,as well as any in-progress scan, is queryable.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "scan_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Scan" } } } } } } }, "/sys/v1/services/{name}": { "get": { "operationId": "GetService", "tags": [ "Misc" ], "summary": "Check information about the specified service", "description": "Returns the information regarding the status of the specified service.", "parameters": [ { "name": "name", "in": "path", "required": true, "schema": { "type": "string", "maxLength": 4096, "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Service" } } } } } } }, "/crypto/v1/keys/info": { "post": { "operationId": "GetSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Lookup a security object.", "description": "Lookup a security object.", "parameters": [ { "$ref": "#/components/parameters/GetSobjectParams" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectDescriptor" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/stats/{key_id}/key": { "get": { "operationId": "GetSobjectStats", "tags": [ "Stats" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get transaction statistics for a specific security object.", "description": "Get transaction statistics for a specific security object.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/StatsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EsStatsCountQueryResponse" } } } } } } }, "/sys/v1/users/accounts": { "get": { "operationId": "GetUserAccounts", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get user's accounts.", "description": "Get user's accounts.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/UserAccountFlags" } } } } } } } }, "/sys/v1/users/permissions": { "get": { "operationId": "GetUserPermissions", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Returns the caller's permissions", "description": "Returns the caller's permissions", "parameters": [ { "$ref": "#/components/parameters/GetUserPermissionsParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetUserPermissionsResponse" } } } } } } }, "/sys/v1/groups/hmg/azure_vaults": { "post": { "operationId": "GetVaults", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Given an Azure configuration, fetch a list of available\nAzure key vaults which can be used to back a group.", "description": "Given an Azure configuration, fetch a list of available\nAzure key vaults which can be used to back a group.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HmgConfig" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/KeyVault" } } } } } } } }, "/crypto/v1/keys/components/import": { "post": { "operationId": "ImportSobjectByComponents", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Import a security object by components.", "description": "Import a security object by components. This API can only be called\nthrough an approval request and won't work if called directly. A key\ncustodian and quorum policy needs to be set at the group level. After\nan import by components request has been made, key custodians will\nneed to add their respective component via\n`POST /sys/v1/approval_requests/:req_id/approve`.\n\nOnly AES, DES, DES3 & HMAC objects are importable by components.\n\nThis is described in detail in the following article:\nhttps://support.fortanix.com/hc/en-us/articles/360043559332-User-s-Guide-Key-Components", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportSobjectComponentsRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/users/invite": { "post": { "operationId": "InviteUser", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Invite an existing user or new user to join an existing account.", "description": "Invite an existing user or new user to join an existing account.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } } } } }, "/sys/v1/ldap/search/{ldap_id}": { "post": { "operationId": "LdapSearch", "tags": [ "Misc" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Searches for LDAP objects in the specified LDAP directory.", "description": "Searches for LDAP objects in the specified LDAP directory.", "parameters": [ { "name": "ldap_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LdapSearchRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/LdapSearchResultEntry" } } } } } } } }, "/sys/v1/groups/hmg/scan_collections": { "post": { "operationId": "ListKeyCollections", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Using the chosen credential, list the key collections available.", "description": "Using the chosen credential, list the key collections available.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HmgListKeyCollectionsRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HmgListKeyCollectionsResponse" } } } } } } }, "/crypto/v1/mac": { "post": { "operationId": "Mac", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Compute a message authentication code (HMAC or CMAC). The key being used\nshould have the `MACGENERATE` key operation.", "description": "A key of type `HMAC` needs to be used for computing an HMAC, and the hash\nalgorithm should be present in the request.\n\nAES, ARIA, DES3, and SEED keys can be used for computing a CMAC. No hash\nalgorithm should be specified for CMAC computation.\nThe digest algorithm shouldn't be specified in case of CMAC.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MacRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MacResponse" } } } } } } }, "/crypto/v1/macverify": { "post": { "operationId": "MacVerify", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Verify the input MAC. The key used must have the `MACVERIFY`\nkey operation.", "description": "Verify the input MAC. The key used must have the `MACVERIFY`\nkey operation.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyMacRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyResponse" } } } } } } }, "/sys/v1/approval_requests/{req_id}/challenge": { "post": { "operationId": "MfaChallenge", "tags": [ "Approval_requests" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Creates a challenge for the FIDO2/U2F device to sign.", "description": "If the quorum policy is configured to require 2FA, then a call to this API\nproduces a challenge that needs to be signed by the respective FIDO2/U2F device.\nThe signed data that U2F device provides can be then used with\n`POST /sys/v1/approval_requests/:req_id/approve` to successfully approve the\nrequest.", "parameters": [ { "name": "req_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/MfaChallengeParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaChallengeResponse" } } } } } } }, "/sys/v1/session/config_2fa/new_challenge": { "post": { "operationId": "MfaNewChallenge", "tags": [ "Fido" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Get credential creation options as per the given request.", "description": "The response of this API needs to be used with relevant API\nfor the protocol.\nFor U2F, it is `u2f.register()`.\nFor FIDO2, it is `navigator.credentials.create()`.", "parameters": [ { "$ref": "#/components/parameters/MfaChallengeParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaChallengeResponse" } } } } } } }, "/crypto/v1/keys/persist": { "post": { "operationId": "PersistTransientKey", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Persist a transient key.", "description": "This API copies a transient key as a persisted security\nobject. If the transient key's origin is \"FortanixHSM\",\nthe origin of the persisted key will be \"Transient\". If the\ntransient key's origin is \"External\", the origin of the persisted\nkey will be \"External\".", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersistTransientKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/users/process_invite": { "post": { "operationId": "ProcessInvite", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Accept or reject pending account invitations.", "description": "Accept or reject pending account invitations.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProcessInviteRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/session/reauth": { "post": { "operationId": "Reauthenticate", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Create a new session for an App using an existing\nsession bearer token.", "description": "Create a new session for an App using an existing\nsession bearer token.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthResponse" } } } } } } }, "/sys/v1/accounts/{acct_id}/replication/recent_scan_summary": { "get": { "operationId": "RecentReplicationScanSummary", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Fetch a summary of recent scans.", "description": "Fetch a summary of recent scans.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecentScanSummary" } } } } } } }, "/sys/v1/session/auth/2fa/recovery_code": { "post": { "operationId": "RecoveryCodeAuth", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Use a backup recovery code to complete authentication.", "description": "Complete two factor authentication with a backup recovery code.\nEach recovery code may only be used once, so users should update\ntheir two factor configuration after using this API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryCodeAuthRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/session/refresh": { "post": { "operationId": "Refresh", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Perform a no-op to keep session from expiring.", "description": "Perform a no-op to keep session from expiring.", "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/{key_id}/private": { "delete": { "operationId": "RemovePrivate", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Destroy private half of an asymmetric key.", "description": "Removes the private portion of an asymmetric key. After this\noperation is performed, operations that require the private key, such\nas encryption and generating signatures, can no longer be performed.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/replace": { "post": { "operationId": "ReplaceSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Rotate a security object to an existing security object.", "description": "For two keys R and S, where R is the key to be replaced,\nand S is the intended replacement, this operation will\n- Rename R to the name provided in the request\n- Establish an replaced-replacement between R and S\n- Assign R's old name to S\nThe metadata of S should be mostly same as that of R, and\nit is not possible to update any fields of S while\nperforming this operation. If S does not have any custom\nmetadata or a rotation policy, any corresponding values\nfrom R will be copied over to S.\nFor now, this operation is not supported if R, S, or both\nare externally-backed keys.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectReplaceRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}/self_sign": { "post": { "operationId": "ReplicationCredentialSelfSignedCert", "tags": [ "Accounts" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Generate a self-signed cert for the specified credential.", "description": "Note that this does _not_ immediately associate the certificate\nwith the credential; the credential still needs to be updated\nafterwards.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplicationCredentialSelfSignedCertRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplicationCredentialSelfSignedCertResponse" } } } } } } }, "/sys/v1/users/resend_confirm_email": { "post": { "operationId": "ResendConfirmEmail", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Resend email with link to confirm user's email address.", "description": "Resend email with link to confirm user's email address.", "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/users/{user_id}/resend_invite": { "post": { "operationId": "ResendInvite", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Resend invite to the user to join a specific account.", "description": "Resend invite to the user to join a specific account.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/apps/{app_id}/reset_secret": { "post": { "operationId": "ResetAppSecret", "tags": [ "Apps" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Regenerate API key.", "description": "This will invalidate all existing sessions of this app. Although,\nif `credential_migration_period` is set in request, previous\ncredentials (or its sessions) won't invalidate until the given time.", "parameters": [ { "name": "app_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/GetAppParams" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AppResetSecretRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/App" } } } } } } }, "/sys/v1/users/{user_id}/reset_password": { "post": { "operationId": "ResetPassword", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Reset a user's password. Requires a valid password reset token.", "description": "Reset a user's password. Requires a valid password reset token.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordResetRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/{key_id}/revert": { "put": { "operationId": "RevertPrevKeyOp", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Reverts a security object to a previous state.", "description": "When a Key Undo Policy is in place, security objects maintain a list\nof history states. Using this API endpoint, clients may revert the\nsecurity object to a previous (non-expired) history state.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevertRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/keys/{key_id}/revoke": { "post": { "operationId": "RevokeSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Transition a security object to Deactivated or Compromised state.", "description": "Transition a security object to Deactivated or Compromised state.", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationReason" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/credentials/{cred_id}/rotate": { "post": { "operationId": "RotateCredential", "tags": [ "Credentials" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Rotate a specified credential", "description": "Rotate a specified credential", "parameters": [ { "name": "cred_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredentialRotationRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationCredential" } } } } } } }, "/crypto/v1/keys/rekey": { "post": { "operationId": "RotateSobject", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Rotate a security object.", "description": "Renames current key to \" (rotated at )\"\nand generates a new key with the original name of the source key.\nThe metadata of the newly generated key is mostly same as original\nkey and it is possible to update the following fields while performing\nrotation: `activation_date`, `deactivation_date`, `state`, `rsa`,\n`aes`, `aria`, `des`, `des3`, `seed`, `dsa`, `kcdsa`, `eckcdsa`,\n`pub_exponent`, `elliptic_curve`, `key_size`, `key_ops`, `description`,\n`enabled`, `custom_metadata`, `publish_public_key`, `rotation_policy`.\n\nIf the key is an external key, additional changes\nmight happen (like changes to aws-alias custom_metadata, etc).\n(yet to be documented)\n\nFor AWS KMS keys, a new key is generated in the external KMS and\nafter the rotation, the new key will have the original aliases and the old\nkey's aliases will have (rotated at ) appended in front of it.\nFor Azure KV and GCP KMS keys, this creates a new version of the target key.\n\nFor Tokenization Keys `fpe` subobject should be null or\nexcluded to allow existing fpe policy to be copied to the new key.\n\n**Note:** Key rotation requires that Encryption calls be made using Key name and\nthe corresponding returned Key UUID be stored with the encrypted value.\n\nIf the encrypting key UUID is lost, then the encrypted data can no longer\nreliably be decrypted after the key is rotated.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SobjectRekeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/saml/metadata.xml": { "get": { "operationId": "SamlSpMetadata", "tags": [ "Misc" ], "summary": "Get the SP metadata file for SAML configuration", "description": "Returns the Service Provider metadata file of this cluster, for SAML\nconfiguration. If this cluster has a SAML signing key, the public key is\nincluded in the SPSSODescriptor.", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 255 } } } } } } } }, "/sys/v1/groups/{group_id}/hmg/scan": { "post": { "operationId": "ScanHmg", "tags": [ "Groups" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Scan external objects.", "description": "Scan external objects synchronously and create corresponding\nvirtual sobjects in the group as needed. If there is already a\nvirtual sobject corresponding to a scanned object, no sobject\nis created (but the existing virtual sobject may be updated).\n\nReturns a list of all the newly-created sobjects.", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScanHmgRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Sobject" } } } } } } } }, "/sys/v1/session/select_account": { "post": { "operationId": "SelectAccount", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Select one of user's account to proceed. Even if the user has only\none account, this needs to be called.", "description": "For cluster-internal consistency, it may take several seconds for the\nnew Account to become the default one selected. Have your client code\nwait for the change to propagate across the DSM cluster. If this isn’t done,\nimmediate API calls may contain information from the old Account.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectAccountRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectAccountResponse" } } } } } } }, "/sys/v1/session/aws_temporary_credentials": { "post": { "operationId": "SetAwsTemporaryCredentials", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "This sets AWS temporary credentials in the session so that calls to\nAWS backed groups use these credentials.\nhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html", "description": "This sets AWS temporary credentials in the session so that calls to\nAWS backed groups use these credentials.\nhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AwsTemporaryCredentials" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/sign": { "post": { "operationId": "Sign", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Sign with a private key. The key must be asymmetric and have the `SIGN`\nkey operation enabled.", "description": "Note: Signing prehashed data with LMS keys\n\nWhen creating an LMS signature, the first step is to hash the message\nwith a prefix that is unknown to the caller (see RFC8554, algorithm 3).\nAs the caller cannot precompute this value, DSM follows different\nsemantics for prehashed data. Namely, when the hash field is used, DSM\nwill check the length of the digest and then feed it as raw data for the\nLMS signature generation.\n\nConsequently, if you hash your data using an algorithm such as SHA256\nand then supply this digest to the LMS signing API (putting prehashed\ndata in the `hash` field), DSM interprets the provided digest as raw\ndata, and verification of the signature should be conducted accordingly.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignResponse" } } } } } } }, "/sys/v1/external_roles/{external_role_id}/sync": { "post": { "operationId": "SyncExternalRole", "tags": [ "External_roles" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Synchronize information about the external role by retrieving it from external source.", "description": "Synchronize information about the external role by retrieving it from external source.", "parameters": [ { "name": "external_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalRole" } } } } } } }, "/sys/v1/info": { "get": { "operationId": "SystemInfo", "tags": [ "Misc" ], "summary": "Returns info about the system.", "description": "Returns info about the system.", "parameters": [ { "$ref": "#/components/parameters/SystemInfoParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SystemInfoResponse" } } } } } } }, "/sys/v1/session/terminate": { "post": { "operationId": "Terminate", "tags": [ "Session" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Terminate the current session.", "description": "Terminate an authenticated session. After this call, the provided\nbearer authentication token will be invalidated and cannot be used\nto make any further API calls.", "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/ldap/test": { "post": { "operationId": "TestLdapConfig", "tags": [ "Misc" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Test connection using the ldap SSO configuration saved in the account.", "description": "Test connection using the ldap SSO configuration saved in the account.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LdapTestRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/sys/v1/tls_certificates": { "get": { "operationId": "TlsCertsSpki", "tags": [ "Misc" ], "summary": "Returns all TLS Certs SPKIs of the DSM endpoints\nDeprecated(legacy), please use API \"/sys/v1/tls_public_keys\" instead", "description": "Returns all TLS Certs SPKIs of the DSM endpoints\nDeprecated(legacy), please use API \"/sys/v1/tls_public_keys\" instead", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TlsCertsSpkiResponse" } } } } } } }, "/sys/v1/tls_public_keys": { "get": { "operationId": "TlsPublicKeys", "tags": [ "Misc" ], "summary": "Returns all TLS Certs SPKIs of the DSM endpoints", "description": "Returns all TLS Certs SPKIs of the DSM endpoints", "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TlsPublicKeysResponse" } } } } } } }, "/crypto/v1/transform": { "post": { "operationId": "Transform", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Transform an existing key into a new one.", "description": "Some protocols (such as BIP32) require weak forms of key derivation,\nwhere the resulting key can be used to recompute the original key.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TransformKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/session/auth/2fa/u2f": { "post": { "operationId": "U2fAuth", "tags": [ "Session" ], "security": [ { "basicAuth": [] }, { "apiKeyAuth": [] } ], "summary": "Use of U2F is deprecated, this endpoint will return BadRequest.", "description": "Use of U2F is deprecated, this endpoint will return BadRequest.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/U2fAuthRequest" } } } }, "responses": { "204": { "description": "Nothing is returned on success" } } } }, "/crypto/v1/unwrapkey": { "post": { "operationId": "Unwrap", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Unwrap a security object with another security object.", "description": "Unwrap (decrypt) a wrapped key and import it into DSM. This allows one to\nsecurely import security objects into DSM that were previously wrapped by\nDSM or another key management system. A new security object will be created\nin DSM with the unwrapped data.\nThe wrapping key must have the `UNWRAPKEY` operation enabled.\nThe `obj_type` parameter specifies the object type of the security object being\nunwrapped.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnwrapKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Sobject" } } } } } } }, "/sys/v1/users/{user_id}/validate_token": { "post": { "operationId": "ValidateToken", "tags": [ "Users" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Validates password reset token for the user.", "description": "Validates password reset token for the user.", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateTokenRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateTokenResponse" } } } } } } }, "/crypto/v1/verify": { "post": { "operationId": "Verify", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Verify a signature with a public key. The verifying key must be an\nasymmetric key with the `VERIFY` key operation enabled.", "description": "Note on using LMS key: See documentation of the /crypto/v1/sign API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyResponse" } } } } } } }, "/crypto/v1/keys/kcv/verify": { "post": { "operationId": "VerifyKcv", "tags": [ "Keys" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Computes the KCV of the input blob and checks if\nit matches the input KCV.", "description": "Computes the KCV of the input blob and checks if\nit matches the input KCV.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyKcvRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyKcvResponse" } } } } } } }, "/sys/v1/version": { "get": { "operationId": "Version", "tags": [ "Version" ], "summary": "Returns information about the DSM server version and the client\nAPI version that it supports.", "description": "Returns information about the DSM server version and the client\nAPI version that it supports.", "parameters": [ { "$ref": "#/components/parameters/VersionParams" } ], "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VersionResponse" } } } } } } }, "/crypto/v1/wrapkey": { "post": { "operationId": "Wrap", "tags": [ "Crypto" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Wrap a security object with another security object.", "description": "Wrap (encrypt) an existing security object with a key. This allows keys to be\nsecurely exported from DSM so they can be later imported into DSM or\nanother key management system.\nThe key being wrapped must have the `EXPORT` operation enabled. The wrapping key\nmust have the `WRAPKEY` operation enabled.\n\nThe following wrapping operations are supported:\n* Symmetric keys, HMAC keys, opaque objects, and secret objects may be wrapped\nwith symmetric or asymmetric keys.\n* Asymmetric keys may be wrapped with symmetric keys. Wrapping an asymmetric\nkey with an asymmetric key is not supported.\nWhen wrapping with an asymmetric key, the wrapped object size must fit as\nplaintext for the wrapping key size and algorithm.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WrapKeyRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WrapKeyResponse" } } } } } } } } }