openapi: 3.0.3 info: title: Infisical Admin PKI Certificate Profiles API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: PKI Certificate Profiles paths: /api/v1/cert-manager/certificate-profiles: post: operationId: createCertificateProfile tags: - PKI Certificate Profiles requestBody: required: true content: application/json: schema: type: object properties: caId: type: string format: uuid certificatePolicyId: type: string format: uuid slug: type: string minLength: 1 maxLength: 255 pattern: ^[a-z0-9-]+$ description: type: string maxLength: 1000 issuerType: type: string enum: - ca - self-signed default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: integer exclusiveMinimum: true minimum: 0 commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: integer minimum: 0 required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true required: - certificatePolicyId - slug additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: listCertificateProfiles tags: - PKI Certificate Profiles parameters: - schema: type: number minimum: 0 default: 0 in: query name: offset required: false - schema: type: number minimum: 1 maximum: 100 default: 20 in: query name: limit required: false - schema: type: string in: query name: search required: false - schema: type: string enum: - api - est - acme - scep in: query name: enrollmentType required: false - schema: type: string enum: - ca - self-signed in: query name: issuerType required: false - schema: type: string format: uuid in: query name: caId required: false - schema: type: string format: uuid in: query name: applicationId required: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfiles: type: array items: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true certificateAuthority: type: object properties: id: type: string status: type: string name: type: string isExternal: type: boolean externalType: type: string nullable: true required: - id - status - name additionalProperties: false metrics: type: object properties: profileId: type: string totalCertificates: type: number activeCertificates: type: number expiredCertificates: type: number expiringCertificates: type: number revokedCertificates: type: number required: - profileId - totalCertificates - activeCertificates - expiredCertificates - expiringCertificates - revokedCertificates additionalProperties: false estConfig: type: object properties: id: type: string disableBootstrapCaValidation: type: boolean passphrase: type: string caChain: type: string required: - id - disableBootstrapCaValidation additionalProperties: false apiConfig: type: object properties: id: type: string autoRenew: type: boolean renewBeforeDays: type: number required: - id - autoRenew additionalProperties: false acmeConfig: type: object properties: id: type: string directoryUrl: type: string skipDnsOwnershipVerification: type: boolean skipEabBinding: type: boolean required: - id - directoryUrl additionalProperties: false scepConfig: type: object properties: id: type: string scepEndpointUrl: type: string raCertificatePem: type: string raCertExpiresAt: type: string format: date-time includeCaCertInResponse: type: boolean allowCertBasedRenewal: type: boolean challengeType: type: string challengeEndpointUrl: type: string dynamicChallengeExpiryMinutes: type: number dynamicChallengeMaxPending: type: number required: - id - scepEndpointUrl - raCertificatePem - raCertExpiresAt - includeCaCertInResponse - allowCertBasedRenewal - challengeType additionalProperties: false required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false totalCount: type: number required: - certificateProfiles - totalCount additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-profiles/{id}: get: operationId: getCertificateProfile tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true certificateAuthority: type: object properties: id: type: string status: type: string name: type: string isExternal: type: boolean externalType: type: string nullable: true required: - id - status - name additionalProperties: false certificatePolicy: type: object properties: id: type: string name: type: string description: type: string required: - id - name additionalProperties: false estConfig: type: object properties: id: type: string disableBootstrapCaValidation: type: boolean caChain: type: string required: - id - disableBootstrapCaValidation additionalProperties: false apiConfig: type: object properties: id: type: string autoRenew: type: boolean renewBeforeDays: type: number required: - id - autoRenew additionalProperties: false acmeConfig: type: object properties: id: type: string directoryUrl: type: string skipDnsOwnershipVerification: type: boolean skipEabBinding: type: boolean required: - id - directoryUrl additionalProperties: false scepConfig: type: object properties: id: type: string scepEndpointUrl: type: string raCertificatePem: type: string raCertExpiresAt: type: string format: date-time includeCaCertInResponse: type: boolean allowCertBasedRenewal: type: boolean challengeType: type: string challengeEndpointUrl: type: string dynamicChallengeExpiryMinutes: type: number dynamicChallengeMaxPending: type: number required: - id - scepEndpointUrl - raCertificatePem - raCertExpiresAt - includeCaCertInResponse - allowCertBasedRenewal - challengeType additionalProperties: false required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false patch: operationId: updateCertificateProfile tags: - PKI Certificate Profiles requestBody: required: true content: application/json: schema: type: object properties: slug: type: string minLength: 1 maxLength: 255 pattern: ^[a-z0-9-]+$ description: type: string maxLength: 1000 nullable: true issuerType: type: string enum: - ca - self-signed externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: integer exclusiveMinimum: true minimum: 0 commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: integer minimum: 0 required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true additionalProperties: false parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: operationId: deleteCertificateProfile tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-profiles/slug/{slug}: get: operationId: getCertificateProfileBySlug tags: - PKI Certificate Profiles parameters: - schema: type: string minLength: 1 in: path name: slug required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-profiles/{id}/certificates: get: operationId: listCertificateProfileCertificates tags: - PKI Certificate Profiles parameters: - schema: type: number minimum: 0 default: 0 in: query name: offset required: false - schema: type: number minimum: 1 maximum: 100 default: 20 in: query name: limit required: false - schema: type: string enum: - active - expired - revoked in: query name: status required: false - schema: type: string in: query name: search required: false - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificates: type: array items: type: object properties: id: type: string serialNumber: type: string cn: type: string status: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true createdAt: type: string format: date-time required: - id - serialNumber - cn - status - notBefore - notAfter - createdAt additionalProperties: false required: - certificates additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-profiles/{id}/certificates/latest-active-bundle: get: operationId: getCertificateProfileLatestActiveBundle tags: - PKI Certificate Profiles description: Get latest active certificate bundle for a profile parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string nullable: true certificateChain: type: string nullable: true privateKey: type: string nullable: true serialNumber: type: string nullable: true required: - certificate - certificateChain - privateKey - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/cert-manager/certificate-profiles/{id}/acme/eab-secret/reveal: get: operationId: revealCertificateProfileAcmeEabSecret tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: eabKid: type: string eabSecret: type: string required: - eabKid - eabSecret additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles: post: tags: - PKI Certificate Profiles requestBody: required: true content: application/json: schema: type: object properties: caId: type: string format: uuid certificatePolicyId: type: string format: uuid slug: type: string minLength: 1 maxLength: 255 pattern: ^[a-z0-9-]+$ description: type: string maxLength: 1000 issuerType: type: string enum: - ca - self-signed default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: integer exclusiveMinimum: true minimum: 0 commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: integer minimum: 0 required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true required: - certificatePolicyId - slug additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: tags: - PKI Certificate Profiles parameters: - schema: type: number minimum: 0 default: 0 in: query name: offset required: false - schema: type: number minimum: 1 maximum: 100 default: 20 in: query name: limit required: false - schema: type: string in: query name: search required: false - schema: type: string enum: - api - est - acme - scep in: query name: enrollmentType required: false - schema: type: string enum: - ca - self-signed in: query name: issuerType required: false - schema: type: string format: uuid in: query name: caId required: false - schema: type: string format: uuid in: query name: applicationId required: false responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfiles: type: array items: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true certificateAuthority: type: object properties: id: type: string status: type: string name: type: string isExternal: type: boolean externalType: type: string nullable: true required: - id - status - name additionalProperties: false metrics: type: object properties: profileId: type: string totalCertificates: type: number activeCertificates: type: number expiredCertificates: type: number expiringCertificates: type: number revokedCertificates: type: number required: - profileId - totalCertificates - activeCertificates - expiredCertificates - expiringCertificates - revokedCertificates additionalProperties: false estConfig: type: object properties: id: type: string disableBootstrapCaValidation: type: boolean passphrase: type: string caChain: type: string required: - id - disableBootstrapCaValidation additionalProperties: false apiConfig: type: object properties: id: type: string autoRenew: type: boolean renewBeforeDays: type: number required: - id - autoRenew additionalProperties: false acmeConfig: type: object properties: id: type: string directoryUrl: type: string skipDnsOwnershipVerification: type: boolean skipEabBinding: type: boolean required: - id - directoryUrl additionalProperties: false scepConfig: type: object properties: id: type: string scepEndpointUrl: type: string raCertificatePem: type: string raCertExpiresAt: type: string format: date-time includeCaCertInResponse: type: boolean allowCertBasedRenewal: type: boolean challengeType: type: string challengeEndpointUrl: type: string dynamicChallengeExpiryMinutes: type: number dynamicChallengeMaxPending: type: number required: - id - scepEndpointUrl - raCertificatePem - raCertExpiresAt - includeCaCertInResponse - allowCertBasedRenewal - challengeType additionalProperties: false required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false totalCount: type: number required: - certificateProfiles - totalCount additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles/{id}: get: tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true certificateAuthority: type: object properties: id: type: string projectId: type: string status: type: string name: type: string isExternal: type: boolean externalType: type: string nullable: true required: - id - projectId - status - name additionalProperties: false certificatePolicy: type: object properties: id: type: string projectId: type: string name: type: string description: type: string required: - id - projectId - name additionalProperties: false estConfig: type: object properties: id: type: string disableBootstrapCaValidation: type: boolean caChain: type: string required: - id - disableBootstrapCaValidation additionalProperties: false apiConfig: type: object properties: id: type: string autoRenew: type: boolean renewBeforeDays: type: number required: - id - autoRenew additionalProperties: false acmeConfig: type: object properties: id: type: string directoryUrl: type: string skipDnsOwnershipVerification: type: boolean skipEabBinding: type: boolean required: - id - directoryUrl additionalProperties: false scepConfig: type: object properties: id: type: string scepEndpointUrl: type: string raCertificatePem: type: string raCertExpiresAt: type: string format: date-time includeCaCertInResponse: type: boolean allowCertBasedRenewal: type: boolean challengeType: type: string challengeEndpointUrl: type: string dynamicChallengeExpiryMinutes: type: number dynamicChallengeMaxPending: type: number required: - id - scepEndpointUrl - raCertificatePem - raCertExpiresAt - includeCaCertInResponse - allowCertBasedRenewal - challengeType additionalProperties: false required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false patch: tags: - PKI Certificate Profiles requestBody: required: true content: application/json: schema: type: object properties: slug: type: string minLength: 1 maxLength: 255 pattern: ^[a-z0-9-]+$ description: type: string maxLength: 1000 nullable: true issuerType: type: string enum: - ca - self-signed externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: integer exclusiveMinimum: true minimum: 0 commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: integer minimum: 0 required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true additionalProperties: false parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles/slug/{slug}: get: tags: - PKI Certificate Profiles parameters: - schema: type: string minLength: 1 in: path name: slug required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificateProfile: type: object properties: id: type: string format: uuid projectId: type: string caId: type: string format: uuid nullable: true certificatePolicyId: type: string format: uuid slug: type: string description: type: string nullable: true enrollmentType: type: string estConfigId: type: string format: uuid nullable: true apiConfigId: type: string format: uuid nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time acmeConfigId: type: string format: uuid nullable: true issuerType: type: string default: ca externalConfigs: anyOf: - type: object properties: template: type: string minLength: 1 description: Certificate template name for Azure AD CS required: - template additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false - type: object properties: {} additionalProperties: false nullable: true defaults: type: object properties: ttlDays: type: number commonName: type: string keyAlgorithm: type: string enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_prime256v1 - EC_secp384r1 - EC_secp521r1 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s signatureAlgorithm: type: string enum: - RSA-SHA256 - RSA-SHA384 - RSA-SHA512 - ECDSA-SHA256 - ECDSA-SHA384 - ECDSA-SHA512 - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - SLH-DSA-SHA2-128f - SLH-DSA-SHA2-128s - SLH-DSA-SHA2-192f - SLH-DSA-SHA2-192s - SLH-DSA-SHA2-256f - SLH-DSA-SHA2-256s - SLH-DSA-SHAKE-128f - SLH-DSA-SHAKE-128s - SLH-DSA-SHAKE-192f - SLH-DSA-SHAKE-192s - SLH-DSA-SHAKE-256f - SLH-DSA-SHAKE-256s keyUsages: type: array items: type: string enum: - digital_signature - key_encipherment - non_repudiation - data_encipherment - key_agreement - key_cert_sign - crl_sign - encipher_only - decipher_only extendedKeyUsages: type: array items: type: string enum: - client_auth - server_auth - code_signing - email_protection - ocsp_signing - time_stamping basicConstraints: type: object properties: isCA: type: boolean pathLength: type: number required: - isCA additionalProperties: false organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string additionalProperties: false nullable: true scepConfigId: type: string format: uuid nullable: true required: - id - projectId - certificatePolicyId - slug - enrollmentType - createdAt - updatedAt additionalProperties: false required: - certificateProfile additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles/{id}/certificates: get: tags: - PKI Certificate Profiles parameters: - schema: type: number minimum: 0 default: 0 in: query name: offset required: false - schema: type: number minimum: 1 maximum: 100 default: 20 in: query name: limit required: false - schema: type: string enum: - active - expired - revoked in: query name: status required: false - schema: type: string in: query name: search required: false - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificates: type: array items: type: object properties: id: type: string serialNumber: type: string cn: type: string status: type: string notBefore: type: string format: date-time notAfter: type: string format: date-time revokedAt: type: string format: date-time nullable: true createdAt: type: string format: date-time required: - id - serialNumber - cn - status - notBefore - notAfter - createdAt additionalProperties: false required: - certificates additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles/{id}/certificates/latest-active-bundle: get: tags: - PKI Certificate Profiles description: Get latest active certificate bundle for a profile parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: certificate: type: string nullable: true certificateChain: type: string nullable: true privateKey: type: string nullable: true serialNumber: type: string nullable: true required: - certificate - certificateChain - privateKey - serialNumber additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/pki/certificate-profiles/{id}/acme/eab-secret/reveal: get: tags: - PKI Certificate Profiles parameters: - schema: type: string format: uuid in: path name: id required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: eabKid: type: string eabSecret: type: string required: - eabKid - eabSecret additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical