openapi: 3.0.1
info:
  description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n  --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n  --header \"Content-Type: application/x-www-form-urlencoded\" \\\n  --header \"Accept: application/json\" \\\n  --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
  license:
    name: CC BY-NC-SA 3.0 US
    url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
  termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
  title: MongoDB Atlas Administration Access Tracking X.509 Authentication API
  version: '2.0'
  x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, edits, and removes user-managed X.509 configurations. Also returns and generates MongoDB Cloud-managed X.509 certificates for database users. The following resources help manage database users who authenticate using X.509 certificates. You can manage these X.509 certificates or let MongoDB Cloud do it for you. If MongoDB Cloud manages your certificates, it also manages your Certificate Authority and can generate certificates for your database users. No additional X.509 configuration is required. If you manage your certificates, you must provide a Certificate Authority and generate certificates for your database users.
  externalDocs:
    description: Self-Managed X.509 Certificates
    url: https://www.mongodb.com/docs/atlas/security-self-managed-x509/
  name: X.509 Authentication
paths:
  /api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs:
    get:
      description: Returns all unexpired X.509 certificates for the specified MongoDB user. This MongoDB user belongs to one project. Atlas manages these certificates and the MongoDB user. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
      operationId: listGroupDatabaseUserCerts
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/includeCount'
      - $ref: '#/components/parameters/itemsPerPage'
      - $ref: '#/components/parameters/pageNum'
      - $ref: '#/components/parameters/pretty'
      - description: Human-readable label that represents the MongoDB database user account whose certificates you want to return.
        in: path
        name: username
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/PaginatedUserCertView'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return All X.509 Certificates Assigned to One Database User
      tags:
      - X.509 Authentication
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api x509Authentication listDatabaseUserCerts --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupDatabaseUserCertsApiParams{}\n\tsdkResp, httpResp, err := client.X509AuthenticationApi.\n\t\tListGroupDatabaseUserCertsWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs?pretty=true\""
      x-rolesRequirements:
      - Project Read Only
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/listGroupDatabaseUserCerts
      x-xgen-operation-id-override: listDatabaseUserCerts
    post:
      description: 'Generates one X.509 certificate for the specified MongoDB user. Atlas manages the certificate and MongoDB user that belong to one project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.


        To get MongoDB Cloud to generate a managed certificate for a database user, set `"x509Type" : "MANAGED"` on the desired MongoDB Database User.


        If you are managing your own Certificate Authority (CA) in Self-Managed X.509 mode, you must generate certificates for database users using your own CA.'
      externalDocs:
        description: Self-Managed X.509
        url: https://www.mongodb.com/docs/atlas/security-self-managed-x509/#std-label-self-managed-x509
      operationId: createGroupDatabaseUserCert
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      - description: Human-readable label that represents the MongoDB database user account for whom to create a certificate.
        in: path
        name: username
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/UserCert'
        description: Generates one X.509 certificate for the specified MongoDB user.
        required: true
      responses:
        '201':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                description: PEM file that contains the user's X.509 certificate and private key.
                type: string
              x-xgen-version: '2023-01-01'
          description: This endpoint returns a PEM file with the certificate and private key.
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '409':
          $ref: '#/components/responses/conflict'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Create One X.509 Certificate for One Database User
      tags:
      - X.509 Authentication
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api x509Authentication createDatabaseUserCert --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupDatabaseUserCertApiParams{}\n\tsdkResp, httpResp, err := client.X509AuthenticationApi.\n\t\tCreateGroupDatabaseUserCertWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/createGroupDatabaseUserCert
      x-xgen-operation-id-override: createDatabaseUserCert
  /api/atlas/v2/groups/{groupId}/userSecurity/customerX509:
    delete:
      description: "Clears the customer-managed X.509 settings on a project, including the uploaded Certificate Authority, which disables self-managed X.509.\n\n Updating this configuration triggers a rolling restart of the database. You must have the Project Owner role to use this endpoint."
      operationId: disableGroupUserSecurityCustomerX509
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      responses:
        '202':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/UserSecurity'
              x-xgen-version: '2023-01-01'
          description: Accepted
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Disable Customer-Managed X.509
      tags:
      - X.509 Authentication
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api x509Authentication disableSecurityCustomerX509 --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DisableGroupUserSecurityCustomerX509ApiParams{}\n\thttpResp, err := client.X509AuthenticationApi.\n\t\tDisableGroupUserSecurityCustomerX509WithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/customerX509\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/customerX509\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/disableGroupUserSecurityCustomerX509
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: disable
      x-xgen-operation-id-override: disableSecurityCustomerX509
components:
  responses:
    internalServerError:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint)
            error: 500
            errorCode: UNEXPECTED_ERROR
            reason: Internal Server Error
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Internal Server Error.
    forbidden:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint)
            error: 403
            errorCode: CANNOT_CHANGE_GROUP_NAME
            reason: Forbidden
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Forbidden.
    tooManyRequests:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint)
            error: 429
            errorCode: RATE_LIMITED
            reason: Too Many Requests
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Too Many Requests.
      headers:
        RateLimit-Limit:
          $ref: '#/components/headers/HeaderRateLimitLimit'
        RateLimit-Remaining:
          $ref: '#/components/headers/HeaderRateLimitRemaining'
        Retry-After:
          $ref: '#/components/headers/HeaderRetryAfter'
    unauthorized:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint)
            error: 401
            errorCode: NOT_ORG_GROUP_CREATOR
            reason: Unauthorized
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Unauthorized.
    conflict:
      content:
        application/json:
          example:
            detail: '(This is just an example, the exception may not be related to this endpoint) Cannot delete organization link while there is active migration in following project ids: 60c4fd418ebe251047c50554'
            error: 409
            errorCode: CANNOT_DELETE_ORG_ACTIVE_LIVE_MIGRATION_ATLAS_ORG_LINK
            reason: Conflict
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Conflict.
    badRequest:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint) No provider AWS exists.
            error: 400
            errorCode: VALIDATION_ERROR
            reason: Bad Request
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Bad Request.
    notFound:
      content:
        application/json:
          example:
            detail: (This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS
            error: 404
            errorCode: RESOURCE_NOT_FOUND
            reason: Not Found
          schema:
            $ref: '#/components/schemas/ApiError'
      description: Not Found.
  schemas:
    LDAPSecuritySettings:
      description: Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration details that apply to the specified project.
      properties:
        authenticationEnabled:
          description: Flag that indicates whether users can authenticate using an Lightweight Directory Access Protocol (LDAP) host.
          type: boolean
        authorizationEnabled:
          description: Flag that indicates whether users can authorize access to MongoDB Cloud resources using an Lightweight Directory Access Protocol (LDAP) host.
          type: boolean
        authzQueryTemplate:
          default: '{USER}?memberOf?base'
          description: Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud runs to obtain the LDAP groups associated with the authenticated user. MongoDB Cloud uses this parameter only for user authorization. Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query according to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
          example: '{USER}?memberOf?base'
          type: string
        bindPassword:
          description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
          type: string
          writeOnly: true
        bindUsername:
          description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.
          example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
          externalDocs:
            description: RFC 2253
            url: https://tools.ietf.org/html/2253
          pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
          type: string
        caCertificate:
          description: 'Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `"caCertificate": ""`.'
          type: string
        hostname:
          description: Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.
          pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\.){1,10}[a-z]+)?$
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        port:
          default: 636
          description: Port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.
          format: int32
          type: integer
        userToDNMapping:
          description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
          items:
            $ref: '#/components/schemas/UserToDNMapping'
          type: array
      title: LDAP Security Settings
      type: object
    Link:
      properties:
        href:
          description: Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: https://cloud.mongodb.com/api/atlas
          type: string
        rel:
          description: Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: self
          type: string
      type: object
    UserToDNMapping:
      description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
      properties:
        ldapQuery:
          description: Lightweight Directory Access Protocol (LDAP) query template that inserts the LDAP name that the regular expression matches into an LDAP query Uniform Resource Identifier (URI). The formatting for the query must conform to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
          type: string
        match:
          description: Regular expression that MongoDB Cloud uses to match against the provided Lightweight Directory Access Protocol (LDAP) username. Each parenthesis-enclosed section represents a regular expression capture group that the substitution or `ldapQuery` template uses.
          example: (.*)
          type: string
        substitution:
          description: Lightweight Directory Access Protocol (LDAP) Distinguished Name (DN) template that converts the LDAP username that matches regular expression in the *match* parameter into an LDAP Distinguished Name (DN).
          example: CN={0},CN=Users,DC=my-atlas-ldap-server,DC=example,DC=com
          type: string
      required:
      - match
      title: User to Distinguished Name Mapping
      type: object
    DBUserTLSX509Settings:
      description: Settings to configure TLS Certificates for database users.
      properties:
        cas:
          description: Concatenated list of customer certificate authority (CA) certificates needed to authenticate database users. MongoDB Cloud expects this as a PEM-formatted certificate.
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
      title: Database User TLS Certificate Settings
      type: object
    ApiError:
      properties:
        badRequestDetail:
          $ref: '#/components/schemas/BadRequestDetail'
        detail:
          description: Describes the specific conditions or reasons that cause each type of error.
          type: string
        error:
          description: HTTP status code returned with this error.
          externalDocs:
            url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
          format: int32
          readOnly: true
          type: integer
        errorCode:
          description: Application error code returned with this error.
          readOnly: true
          type: string
        parameters:
          description: Parameters used to give more information about the error.
          items:
            type: object
          readOnly: true
          type: array
        reason:
          description: Application error message returned with this error.
          readOnly: true
          type: string
      required:
      - error
      - errorCode
      type: object
    PaginatedUserCertView:
      properties:
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        results:
          description: List of returned documents that MongoDB Cloud provides when completing this request.
          items:
            $ref: '#/components/schemas/UserCert'
          readOnly: true
          type: array
        totalCount:
          description: Total number of documents available. MongoDB Cloud omits this value if `includeCount` is set to `false`. The total number is an estimate and may not be exact.
          format: int32
          minimum: 0
          readOnly: true
          type: integer
      required:
      - results
      type: object
    BadRequestDetail:
      description: Bad request detail.
      properties:
        fields:
          description: Describes all violations in a client request.
          items:
            $ref: '#/components/schemas/FieldViolation'
          type: array
      readOnly: true
      type: object
    FieldViolation:
      properties:
        description:
          description: A description of why the request element is bad.
          type: string
        field:
          description: A path that leads to a field in the request body.
          type: string
      required:
      - description
      - field
      type: object
    UserSecurity:
      properties:
        customerX509:
          $ref: '#/components/schemas/DBUserTLSX509Settings'
        ldap:
          $ref: '#/components/schemas/LDAPSecuritySettings'
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
      type: object
    UserCert:
      properties:
        _id:
          description: Unique 24-hexadecimal character string that identifies this certificate.
          format: int64
          readOnly: true
          type: integer
        createdAt:
          description: Date and time when MongoDB Cloud created this certificate. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
          format: date-time
          readOnly: true
          type: string
        groupId:
          description: Unique 24-hexadecimal character string that identifies the project.
          example: 32b6e34b3d91647abb20e7b8
          pattern: ^([a-f0-9]{24})$
          readOnly: true
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        monthsUntilExpiration:
          default: 3
          description: Number of months that the certificate remains valid until it expires.
          format: int32
          maximum: 24
          type: integer
          writeOnly: true
        notAfter:
          description: Date and time when this certificate expires. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
          format: date-time
          readOnly: true
          type: string
        subject:
          description: Subject Alternative Name associated with this certificate. This parameter expresses its value as a distinguished name as defined in RFC 2253.
          example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
          externalDocs:
            description: RFC 2253
            url: https://tools.ietf.org/html/2253
          pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
          readOnly: true
          type: string
      type: object
  parameters:
    envelope:
      description: Flag that indicates whether Application wraps the response in an `envelope` JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.
      in: query
      name: envelope
      schema:
        default: false
        type: boolean
    groupId:
      description: 'Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.


        **NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.'
      in: path
      name: groupId
      required: true
      schema:
        example: 32b6e34b3d91647abb20e7b8
        pattern: ^([a-f0-9]{24})$
        type: string
    itemsPerPage:
      description: Number of items that the response returns per page.
      in: query
      name: itemsPerPage
      schema:
        default: 100
        maximum: 500
        minimum: 1
        type: integer
    pretty:
      description: Flag that indicates whether the response body should be in the prettyprint format.
      in: query
      name: pretty
      schema:
        default: false
        externalDocs:
          description: Prettyprint
          url: https://en.wikipedia.org/wiki/Prettyprint
        type: boolean
    pageNum:
      description: Number of the page that displays the current set of the total objects that the response returns.
      in: query
      name: pageNum
      schema:
        default: 1
        minimum: 1
        type: integer
    includeCount:
      description: Flag that indicates whether the response returns the total number of items (`totalCount`) in the response.
      in: query
      name: includeCount
      schema:
        default: true
        type: boolean
  headers:
    HeaderRetryAfter:
      description: The minimum time you should wait, in seconds, before retrying the API request. This header might be returned for 429 or 503 error responses.
      schema:
        type: integer
    HeaderRateLimitLimit:
      description: The maximum number of requests that a user can make within a specific time window.
      schema:
        type: integer
    HeaderRateLimitRemaining:
      description: The number of requests remaining in the current rate limit window before the limit is reached.
      schema:
        type: integer
  securitySchemes:
    DigestAuth:
      scheme: digest
      type: http
    ServiceAccounts:
      description: Learn more about [Service Accounts](https://www.mongodb.com/docs/atlas/api/service-accounts-overview).
      flows:
        clientCredentials:
          scopes: {}
          tokenUrl: https://cloud.mongodb.com/api/oauth/token
      type: oauth2
x-externalLinks:
- label: Back to Atlas Docs
  url: https://www.mongodb.com/docs/atlas/
- label: API Changelog
  url: https://www.mongodb.com/docs/atlas/reference/api-resources-spec/changelog/
x-topics:
- content: The MongoDB Atlas Administration API is rate limited. To learn more about rate limiting, see the [Atlas Documentation on Rate Limiting](http://dochub.mongodb.org/core/atlas-api-rate-limit)
  title: Rate Limiting