openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Issuer Certificates API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Issuer Certificates
  description: APIs for Issuer Certificates.
paths:
  /v1/distributedissuers/intermediatecertificates:
    get:
      description: Retrieves the details of all Issuer intermediate certificates. These are the CA certificates issued to the Issuer instances that allow them to issue short-lived certificates.
      operationId: intermediatecertificates_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntermediateCertificateResponse'
          description: All Issuer intermediate certificates and details.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get the details of all Issuer
      tags:
      - Issuer Certificates
components:
  schemas:
    JwtStandardClaimsAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: Recipients that the JWT is intended for
            example: Client1
            maxLength: 256
            type: string
          clients:
            description: List with clients, identified by processing JWTs that include standard/registered claims
            items:
              $ref: '#/components/schemas/JwtClientInformation'
            minItems: 1
            type: array
        type: object
      required:
      - audience
      - clients
      type: object
    JwtClientInformation:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          maxLength: 2048
          type: string
        jwksUri:
          description: URL used to pull the trusted singing keys used for validation
          example: https://www.example.com:6443/jwks
          maxLength: 2048
          type: string
        name:
          description: Name of the client
          example: Some client
          maxLength: 64
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          minItems: 1
          type: array
      required:
      - allowedPolicyIds
      - issuer
      - name
      - subjects
      type: object
    IntermediateCertificateInformation:
      properties:
        certificate:
          description: Intermediate certificate bytes in PEM format
          format: PEM
          type: string
        commonName:
          description: Common name of the Intermediate certificate
          example: example.com
          type: string
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        configuration:
          $ref: '#/components/schemas/ConfigurationInformation'
        creationDate:
          description: When the intermediate certificate was created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        errorInformation:
          $ref: '#/components/schemas/ErrorInformation7'
        fingerprint:
          description: Intermediate certificate fingerprint
          type: string
        id:
          description: UUID of the intermediate certificate
          example: 265f6d30-a0bb-11ed-aee0-89fe7e5f5d0c
          format: uuid
          type: string
        issuerCertificates:
          description: Intermediate certificate chain bytes in PEM format
          items:
            description: Intermediate certificate chain bytes in PEM format
            type: string
          type: array
        longLivedCertCount:
          description: Number of long lived certificates
          example: 1
          format: int64
          type: integer
        modificationDate:
          description: When the intermediate certificate was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 10
          format: int64
          type: integer
        status:
          description: Status of the Intermediate certificate request
          example: ISSUED
          type: string
        subTsgId:
          description: Sub-TSG ID this intermediate certificate belongs to; null for non-NGTS tenants
          type: string
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 100
          format: int64
          type: integer
        validityEnd:
          description: Intermediate certificate validity end date
          type: string
        validityStart:
          description: Intermediate certificate validity start date
          type: string
        workflowId:
          description: Intermediate certificate workflow id
          type: string
      type: object
    ErrorResponse7:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation7'
          type: array
      type: object
    CustomClaimsAliasesInformation:
      properties:
        allowAllPolicies:
          maxLength: 128
          type: string
        allowedPolicies:
          maxLength: 128
          type: string
        configuration:
          maxLength: 128
          type: string
      type: object
    AnyValue7:
      description: Can be any value - string, number, boolean, array or object.
    ConfigurationInformation:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettingsInformation'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationInformation'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorizationInformation'
        cloudProviders:
          $ref: '#/components/schemas/CloudProvidersInformation'
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        controllerAllowedPolicyIds:
          description: Array of UUIDs of policies that the kubernetes controller is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        creationDate:
          description: When the configuration was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        longLivedCertCount:
          description: Number of long lived certificates
          example: 2
          format: int64
          type: integer
        minTlsVersion:
          description: Minimum required TLS protocol version
          enum:
          - TLS12
          - TLS13
          type: string
        modificationDate:
          description: When the configuration was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 20
          format: int64
          type: integer
        subTsgId:
          description: Sub-TSG ID that owns this configuration (null for Primary TSG)
          example: a007d406bf
          type: string
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 200
          format: int64
          type: integer
        unixSocketAllowedPolicyIds:
          description: Array of UUIDs of policies that are permitted to be used when using the unix socket
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
      type: object
    ErrorInformation7:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue7'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    AwsCloudProviderInformation:
      properties:
        accountIds:
          description: Array of AWS account IDs each of which should be a 12-digit identifier
          example:
          - '123456789012'
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of AWS regions
          example:
          - us-west-1
          items:
            enum:
            - us-east-1
            - us-east-2
            - us-west-1
            - us-west-2
            - af-south-1
            - ap-east-1
            - ap-south-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-south-1
            - ap-northeast-3
            - ap-northeast-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-northeast-1
            - ca-central-1
            - eu-central-1
            - eu-west-1
            - eu-west-2
            - eu-south-1
            - eu-west-3
            - eu-south-2
            - eu-north-1
            - eu-central-2
            - me-south-1
            - me-central-1
            - sa-east-1
            - us-gov-east-1
            - us-gov-west-1
            type: string
          type: array
      required:
      - accountIds
      - regions
      type: object
    GoogleCloudProviderInformation:
      properties:
        projectIdentifiers:
          description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
          example:
          - '415104041262'
          - tokyo-rain-123
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of Google regions
          example:
          - us-west1
          items:
            enum:
            - asia-east1
            - asia-east2
            - asia-northeast1
            - asia-northeast2
            - asia-northeast3
            - asia-south1
            - asia-south2
            - asia-southeast1
            - asia-southeast2
            - australia-southeast1
            - australia-southeast2
            - europe-central2
            - europe-north1
            - europe-southwest1
            - europe-west1
            - europe-west12
            - europe-west2
            - europe-west3
            - europe-west4
            - europe-west6
            - europe-west8
            - europe-west9
            - me-central1
            - me-west1
            - northamerica-northeast1
            - northamerica-northeast2
            - southamerica-east1
            - southamerica-west1
            - us-central1
            - us-east1
            - us-east4
            - us-east5
            - us-south1
            - us-west1
            - us-west2
            - us-west3
            - us-west4
            type: string
          type: array
      required:
      - projectIdentifiers
      - regions
      type: object
    ClientAuthorizationInformation:
      properties:
        customClaimsAliases:
          $ref: '#/components/schemas/CustomClaimsAliasesInformation'
      type: object
    AdvancedSettingsInformation:
      properties:
        enableIssuanceAuditLog:
          description: Whether audit log entries must be generated for each issued certificate
          example: false
          type: boolean
        includeRawCertDataInAuditLog:
          description: Whether the raw certificate data must be included in the audit log entry
          example: false
          type: boolean
        requireFIPSCompliantBuild:
          description: Whether FIPS-compliant build is required
          example: false
          type: boolean
      type: object
    JwtJwksAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          urls:
            description: Array of JWT JWKS urls
            example:
            - https://jwks.example.com
            items:
              type: string
            minItems: 1
            type: array
        type: object
      required:
      - urls
      type: object
    ClientAuthenticationInformation:
      discriminator:
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/JwtStandardClaimsAuthenticationInformation'
      - $ref: '#/components/schemas/JwtJwksAuthenticationInformation'
      - $ref: '#/components/schemas/JwtOidcAuthenticationInformation'
      properties:
        type:
          type: string
      required:
      - type
      type: object
    JwtOidcAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: OpenId audience
            example: Client1
            maxLength: 256
            type: string
          baseUrl:
            description: JWT OpenId base URL
            example: https://openid.example.com
            maxLength: 2048
            type: string
        type: object
      required:
      - audience
      - baseUrl
      type: object
    IntermediateCertificateResponse:
      properties:
        intermediateCertificates:
          items:
            $ref: '#/components/schemas/IntermediateCertificateInformation'
          type: array
      type: object
    AzureCloudProviderInformation:
      properties:
        subscriptionIds:
          description: Array of Azure subscription IDs each of which should be UUID
          example:
          - 8d10da13-8125-4ba9-a717-bf7490507b3d
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - subscriptionIds
      type: object
    CloudProvidersInformation:
      properties:
        aws:
          $ref: '#/components/schemas/AwsCloudProviderInformation'
        azure:
          $ref: '#/components/schemas/AzureCloudProviderInformation'
        google:
          $ref: '#/components/schemas/GoogleCloudProviderInformation'
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT