openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Certificate Revocation Approvals API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Certificate Revocation Approvals
  description: APIs for Certificate Revocation Approvals.
paths:
  /v1/certificates/revocations/approvalrules:
    post:
      description: Create certificate revocation workflow approval rule
      operationId: certificaterevocations_approval_rule_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateRevocationApprovalRulesRequest'
        description: Properties of the new approval rule.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateRevocationApprovalRuleOpenApi'
          description: Approval rule is created. Details in response body
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
      summary: Create an approval rule for certificate
      tags:
      - Certificate Revocation Approvals
    get:
      description: Retrieve all certificate revocation workflow approval rules for the current company.
      operationId: certificaterevocations_approval_rules_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateRevocationApprovalRulesResponseOpenApi'
          description: All approval rules for the current company; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
      summary: Get all certificate revocation approval rules
      tags:
      - Certificate Revocation Approvals
  /v1/certificates/revocations/approvalrules/{id}:
    get:
      description: Retrieve certificate revocation workflow approval rule with 'id' attribute matching specified value; specified value should be uuid not numeric
      operationId: certificaterevocations_approval_rule_getById
      parameters:
      - description: UUID of an approval rule.
        in: path
        name: id
        required: true
        schema:
          description: UUID of an approval rule.
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateRevocationApprovalRuleOpenApi'
          description: Approval rule matching specified id
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Approval rule not found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Request Conditions Failed
      summary: Retrieve certificate revocation approval rule by
      tags:
      - Certificate Revocation Approvals
    put:
      description: Can be used to update specific fields of the approval rule that has the specified `id`
      operationId: certificaterevocations_approval_rule_update
      parameters:
      - description: UUID of an approval rule.
        in: path
        name: id
        required: true
        schema:
          description: UUID of an approval rule.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateRevocationApprovalRulesUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateRevocationApprovalRuleOpenApi'
          description: Approval rule updated
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Approval rule Not Found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Request Conditions Failed
      summary: Update certificate revocation workflow approval ru
      tags:
      - Certificate Revocation Approvals
    delete:
      description: Delete certificate revocation workflow approval rule with 'id' attribute matching specified value; specified value should be uuid not numeric
      operationId: certificaterevocations_approval_rule_delete
      parameters:
      - description: UUID of an approval rule.
        in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateRevocationApprovalRuleDeleteResponseOpenApi'
          description: Specified approval rule was deleted
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Specified approval rule was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse2'
          description: Incomplete or malformed request.
      summary: Delete certificate revocation workflow approval ru
      tags:
      - Certificate Revocation Approvals
components:
  schemas:
    AnyValue2:
      description: Can be any value - string, number, boolean, array or object.
    ErrorResponse2:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation2'
          type: array
      type: object
    CertificateRevocationApprovalRulesResponseOpenApi:
      properties:
        approvalRules:
          items:
            $ref: '#/components/schemas/CertificateRevocationApprovalRuleOpenApi'
          type: array
      type: object
    CertificateRevocationApprovalRuleDeleteResponseOpenApi:
      properties:
        id:
          description: Approval rule `id`
          format: uuid
          type: string
        name:
          description: Approval rule name
          type: string
      type: object
    ApproverProperty:
      properties:
        id:
          format: uuid
          type: string
        type:
          enum:
          - USER
          - TEAM
          type: string
      type: object
    CertificateRevocationApprovalRuleOpenApi:
      properties:
        approvers:
          description: A collection of approvers specified by type and id
          items:
            $ref: '#/components/schemas/ApproverProperty'
          type: array
          uniqueItems: true
        atLeast:
          description: If the type of the approval is AT_LEAST then specify how many people have to approve
          format: int32
          type: integer
        autoRejectionThreshold:
          description: Auto rejection threshold. After the defined number of days since revoke request creation, the request is automatically rejected, if it is not approved
          example: 5
          maximum: 99
          minimum: 1
          type: number
        conditions:
          $ref: '#/components/schemas/CertificateRevocationApprovalConditionsFilterRuleInformation'
        creationDate:
          description: The date a approval rule was created
          example: '2023-01-10T09:12:28Z'
          format: date-time
          type: string
        exceptions:
          $ref: '#/components/schemas/CertificateRevocationApprovalExceptionsFilterRuleInformation'
        finalApprover:
          $ref: '#/components/schemas/ApproverPropertyOpenApi'
        id:
          description: Approval rule `id`
          format: uuid
          type: string
        modificationDate:
          description: The date a approval rule was modified
          example: '2023-01-11T09:12:28Z'
          format: date-time
          type: string
        name:
          description: Approval rule name
          type: string
        priority:
          description: Priority of the rule
          format: int32
          type: integer
        type:
          description: The type of the approval rule
          type: string
      type: object
    CertificateRevocationApprovalRulesRequest:
      properties:
        approvers:
          description: A collection of approvers specified by type and id
          items:
            $ref: '#/components/schemas/ApproverProperty'
          minItems: 1
          type: array
          uniqueItems: true
        atLeast:
          description: If the type of the approval is AT_LEAST then specify how many people have to approve
          example: 2
          format: int32
          minimum: 1
          type: integer
        autoRejectionThreshold:
          description: Auto rejection threshold. After the defined number of days since revocation request creation, the request is automatically rejected, if it is not approved
          example: 5
          maximum: 99
          minimum: 1
          type: number
        conditions:
          $ref: '#/components/schemas/CertificateRevocationApprovalConditionsFilterRuleInformation'
        continueProcessingOnException:
          default: false
          description: Continue with next approval rules when match an approval rule exception condition
          type: boolean
        exceptions:
          $ref: '#/components/schemas/CertificateRevocationApprovalExceptionsFilterRuleInformation'
        finalApprover:
          description: UUID of the final approver
          example: 8268d820-a08d-11ed-bbc0-252385d6d390
          format: uuid
          type: string
        name:
          description: Approval rule name
          example: Approval rule for built in CA
          maxLength: 64
          type: string
        type:
          description: The type of the approval rule
          enum:
          - ALL
          - AT_LEAST
          example: AT_LEAST
          type: string
      required:
      - approvers
      - conditions
      - name
      - type
      type: object
    ErrorInformation2:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue2'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    CertificateRevocationApprovalConditionsFilterRuleInformation:
      properties:
        certificateAuthorityAccountIds:
          description: A collection of certificate authority account ids the rule will be applicable to
          format: uuid
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - certificateAuthorityAccountIds
      type: object
    CertificateRevocationApprovalExceptionsFilterRuleInformation:
      properties:
        applicationIds:
          description: A collection of application ids the rule won't be applied to
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        requestors:
          description: A collection of approvers, specified by type and id, for which the rule won't be applied
          items:
            $ref: '#/components/schemas/ApproverProperty'
          type: array
          uniqueItems: true
      type: object
    CertificateRevocationApprovalRulesUpdateRequest:
      properties:
        approvers:
          description: A collection of approvers specified by type and id
          items:
            $ref: '#/components/schemas/ApproverProperty'
          minItems: 1
          type: array
          uniqueItems: true
        atLeast:
          description: If the type of the approval is AT_LEAST then specify how many people have to approve
          example: 2
          format: int32
          minimum: 1
          type: integer
        autoRejectionThreshold:
          description: Auto rejection threshold. After the defined number of days since revocation request creation, the request is automatically rejected, if it is not approved
          example: 5
          maximum: 99
          minimum: 1
          type: number
        conditions:
          $ref: '#/components/schemas/CertificateRevocationApprovalConditionsFilterRuleInformation'
        continueProcessingOnException:
          default: false
          description: Continue with next approval rules when match an approval rule exception condition
          type: boolean
        exceptions:
          $ref: '#/components/schemas/CertificateRevocationApprovalExceptionsFilterRuleInformation'
        finalApprover:
          description: UUID of the final approver
          example: 8268d820-a08d-11ed-bbc0-252385d6d390
          format: uuid
          type: string
        name:
          description: Approval rule name
          example: Approval rule for built in CA
          maxLength: 64
          type: string
        priority:
          description: Rule priority. The order in which the rules will be executed. Starts from 1 (highest priority).
          example: 5
          minimum: 1
          type: number
        type:
          description: The type of the approval rule
          enum:
          - ALL
          - AT_LEAST
          example: AT_LEAST
          type: string
      required:
      - approvers
      - conditions
      - name
      - type
      type: object
    ApproverPropertyOpenApi:
      description: Approver with id that can be only user type
      properties:
        id:
          description: UUID specific to the approver user/team
          example: 8268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        type:
          description: Approver type
          example: USER
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT