openapi: 3.2.0
info:
  title: Live Objects REST API Guide CA certificates API
  description: API description for Live Objects service
  contact:
    name: Live Objects Support
    url: https://liveobjects.orange-business.com/#/cms/support
  version: 2026.7.0
servers:
- url: https://liveobjects.orange-business.com
security:
- X-API-KEY: []
  OAuth2.0: []
tags:
- name: CA certificates
  description: CA certificates for MQTT client cert. authentication
paths:
  /api/v0/certificates/ca:
    get:
      tags:
      - CA certificates
      summary: List CA certificates
      description: 'Restricted to API keys with at least one of the following roles: API_KEY_R.'
      operationId: listCertificates
      responses:
        '200':
          description: Ca certificates Successfully retrieved
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CaCertificate'
    post:
      tags:
      - CA certificates
      summary: Upload CA certificate
      description: 'Usage of this API will be reported in your access log under ''security'' category.<br/><br/>Restricted to API keys with at least one of the following roles: API_KEY_W.'
      operationId: createCertificate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CaCertificateDefinition'
        required: true
      responses:
        '200':
          description: PEM X.509 CA certificate uploaded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaCertificateRef'
        '400':
          description: Invalid X.509 certificate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaCertificateRef'
  /api/v0/certificates/ca/{certificateId}:
    get:
      tags:
      - CA certificates
      summary: Retrieve CA certificate
      description: 'Restricted to API keys with at least one of the following roles: API_KEY_R.'
      operationId: getCertificate
      parameters:
      - name: certificateId
        in: path
        description: id of the CA certificate
        required: true
        schema:
          type: string
      responses:
        '200':
          description: CA certificate Successfully retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaCertificate'
        '404':
          description: Unknown CA certificate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaCertificate'
    delete:
      tags:
      - CA certificates
      summary: Delete CA certificate
      description: 'Usage of this API will be reported in your access log under ''security'' category.<br/><br/>Restricted to API keys with at least one of the following roles: API_KEY_W.'
      operationId: deleteCertificate
      parameters:
      - name: certificateId
        in: path
        description: id of the CA certificate to delete
        required: true
        schema:
          type: string
      responses:
        '204':
          description: CA certificate Successfully deleted
        '404':
          description: Unknown CA certificate
components:
  schemas:
    CaCertificateRef:
      type: object
      properties:
        id:
          type: string
    CaCertificateDefinition:
      type: object
      description: Root or intermediate Certification Authority (CA) certificate. Only PEM format is supported. Certificate chains are not allowed. In case that intermediates CA are used, it must be the intermediate CA certificate which signs the devices certificates.
      properties:
        certificate:
          type: string
          description: PEM X.509 public certificate
          example: '-----BEGIN CERTIFICATE-----

            MIIDhzCCAm+gAwIBAgIJAKG3BbVszHbbMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNV

            BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX

            aWRnaXRzIFB0eSBMdGQxEzARBgNVBAMMCk15IFJvb3QgQ0EwHhcNMTgwNTI0MDcx

            NDE2WhcNMjEwMzEzMDcxNDE2WjBaMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29t

            ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRMwEQYD

            VQQDDApNeSBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

            ukVDFNxEV7J6+vqmMLqbsm98kJIqKvogvl+yC0HWxpueSrewI5KrNnNGFveNeGCA

            Fgk886rK17/nA3wiauZc2st92MbESUYSr0PF+72wsYCHBeMhOiLygaSEYiLEGExc

            aIlidYH5b501m/PecbtwfZCs/H0jWqJ34XRzF7yq64iZQ1gt9TzWkYDsH9bjxSmk

            3iSQWkYmpz7SM+b19q0D0punlYNZo5TxmpNF2P8Iiy2Qj2eEKak1BvqOY6xUkNKE

            pb9toQ5r+qGH3ZVRWEgdV4PRqhGTY8nsJUq4lAlPGI2GqVSYuY6Z/CUn/ZtB6lq/

            iuG9e+6VgQA3zDLq4TdS9QIDAQABo1AwTjAdBgNVHQ4EFgQUClL5PFn9wW3dNoOc

            X7OfrxCc8+YwHwYDVR0jBBgwFoAUClL5PFn9wW3dNoOcX7OfrxCc8+YwDAYDVR0T

            BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMnVSahn7iaQdZgMqJtuokuijTkFU

            y4IwXGMf9psq18UMvjeWG0LauWQyBGdMQ6yNLC8YeboLbc19xbdvTBrMSAj7c1VY

            MZ3hpOkOo9jpQxAzCF8o+IDEisuZbRN+ZSRnoW5ruIeU9FT/3JlKm6xYFBbP3ijH

            kxFfLlJeLhhgbkB1wPLhQsO5rP/6DRD+CA9ympxn+gO2YX/5gqgzEQSN3RQANaBG

            U4yLz+t2SO2AgIKBDxwFGws+ciTEnu+9NLx9BYUI1BtbKuS/nwFIcJ0FkpAUOn0+

            6yN6vwM0t9bfXG8mLizAecWpbodz0YsizQwA8wJeKnmbR/u0ZOxp4qXpfg==

            -----END CERTIFICATE-----'
        comment:
          type: string
          description: Certificate description.
          example: my awesome intermediate CA certificate
      required:
      - certificate
      - comment
    CaCertificate:
      type: object
      properties:
        id:
          type: string
        certificate:
          type: string
        comment:
          type: string
        expires:
          type: string
          format: date-time
      required:
      - certificate
      - comment
  securitySchemes:
    X-API-KEY:
      type: apiKey
      name: X-API-KEY
      in: header
    OAuth2.0:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://liveobjects.orange-business.com/api/v1/oauth2/authorize
          tokenUrl: https://liveobjects.orange-business.com/api/v1/oauth2/token
          refreshUrl: https://liveobjects.orange-business.com/api/v1/oauth2/token
          scopes:
            API_KEY_R: Read parameters and status of an API key.
            API_KEY_W: Create, modify, disable an API key.
            BOOTSTRAP_R: Read parameters and status of the LwM2M Bootstrap configurations and entries.
            BOOTSTRAP_W: Create ans modify LwM2M Bootstrap configurations and entries.
            BUS_CONFIG_R: Read config parameters of a FIFO queue.
            BUS_CONFIG_W: Create, modify a FIFO queue.
            BUS_R: Read data on the Live Objects bus. Minimum permission for the API key of an application collecting data on Live Objects in MQTT(s).
            BUS_W: Publish data on the Live Objects bus.
            CAMPAIGN_R: Read parameters and status of a massive deployment campaign on your Device Fleet.
            CAMPAIGN_W: Create, modify a campaign on your Device Fleet.
            CONNECTOR_ACCESS: Role to set on a external connector API key to allow only MQTT external connector mode
            DATA_PROCESSING_R: Read parameters and status of an event processing rule or a Data decoder.
            DATA_PROCESSING_W: Create, modify, disable an event processing rule or a Data decoder.
            DATA_R: Read the data collected by the Store Service or search into this data using the Search Service.
            DATA_W: Insert a data record to the Store Service. Minimum permission required for the API key of a device pushing data to Live Objects in HTTPS.
            DEVICE_ACCESS: Role to set on a Device API key to allow only MQTT Device mode
            DEVICE_R: Read parameters and status of a Device management.
            DEVICE_W: Create, modify, disable a Device management, send command, modify config, update resource of a Device.
            LOGS_R: Read the logs collected by the Audit Log service. This right allows users to use the Audit Log service as debugging tool.
            SETTINGS_R: Read the tenant account custom settings.
            SETTINGS_W: Create, modify tenant account custom settings.
            USER_R: Read parameters and status of a user.
            USER_W: Create, modify, disable a user.
externalDocs:
  description: Live Objects Developer Guide
  url: https://liveobjects.orange-business.com/doc/html/lo_manual_v2.html
x-examples: ''