openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Issuer Configurations API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Issuer Configurations
  description: APIs for Issuer Configurations.
paths:
  /v1/distributedissuers/configurations:
    post:
      description: Adds a new Issuer Configuration, which links the following together - Sub CA Provider, Policies used to determine which certificates can be issued, and the IdP (Identity Provider) the Issuer should trust when receiving signed JWTs from its clients.
      operationId: configurations_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigurationCreateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedConfigurationInformation'
          description: Issuer configuration successfully created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Create a new Issuer configuration
      tags:
      - Issuer Configurations
    get:
      description: Retrieves a list of all Issuer Configurations. Configurations link together Sub CA Providers, Workload Issuance Policies and Identity Provider information. Together these allow an instance of an Issuer to obtain a Sub CA certificate and use it to issue certificates.
      operationId: configurations_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfigurationResponse'
          description: All Issuer configurations.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get the details of all Issuer
      tags:
      - Issuer Configurations
  /v1/distributedissuers/configurations/{id}:
    get:
      description: Retrieves the details of the existing Issuer configuration for the specified `id`.
      operationId: configurations_getById
      parameters:
      - description: Issuer configuration UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedConfigurationInformation'
          description: Specified Issuer configuration found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Issuer configuration was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get configurations details for a specific
      tags:
      - Issuer Configurations
    patch:
      description: Updates (replaces) fields on an Issuer configuration that has the specified `id`. Only fields specified in the request will be updated. Fields not specified in the request are not modified.
      operationId: configurations_update
      parameters:
      - description: Issuer configuration UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigurationUpdateRequest'
        description: Issuer configuration's details to update.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedConfigurationInformation'
          description: Specified Issuer configuration updated; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Issuer configuration was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Update an Issuer configuration details
      tags:
      - Issuer Configurations
    delete:
      description: Deletes the Issuer configuration for the specified `id`. Before deleting a configuration, be sure no Issuer instances use that configuration, or they will no longer function.
      operationId: configurations_delete
      parameters:
      - description: Issuer configuration UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfigurationDeleteResponse'
          description: Specified Issuer configuration was deleted.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Issuer configuration was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Remove an Issuer configuration
      tags:
      - Issuer Configurations
components:
  schemas:
    JwtStandardClaimsAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: Recipients that the JWT is intended for
            example: Client1
            maxLength: 256
            type: string
          clients:
            description: List with clients, identified by processing JWTs that include standard/registered claims
            items:
              $ref: '#/components/schemas/JwtClientInformation'
            minItems: 1
            type: array
        type: object
      required:
      - audience
      - clients
      type: object
    ConfigurationDeleteResponse:
      properties:
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
      type: object
    ConfigurationCreateRequest:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettingsInformation'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationInformation'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorizationInformation'
        cloudProviders:
          $ref: '#/components/schemas/CloudProvidersInformation'
        minTlsVersion:
          description: Minimum required TLS protocol version
          enum:
          - TLS12
          - TLS13
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          maxLength: 64
          type: string
        policyIds:
          description: Array of UUIDs of policies to associate with the new configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        subCaProviderId:
          description: UUID of Sub CA provider to associate with the new configuration
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
      required:
      - name
      - policyIds
      - subCaProviderId
      type: object
    AnyValue7:
      description: Can be any value - string, number, boolean, array or object.
    JwtStandardClaimsAuthenticationOpenApi:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationOpenApi'
      - properties:
          audience:
            description: Recipients that the JWT is intended for
            example: Client1
            type: string
          clients:
            description: List with clients, identified by processing JWTs that include standard/registered claims
            items:
              $ref: '#/components/schemas/JwtClient'
            type: array
        type: object
      type: object
    ErrorInformation7:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue7'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    ClientAuthorizationInformation:
      properties:
        customClaimsAliases:
          $ref: '#/components/schemas/CustomClaimsAliasesInformation'
      type: object
    JwtJwksAuthenticationOpenApi:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationOpenApi'
      - properties:
          urls:
            description: Array of JWT JWKS urls
            example:
            - https://jwks.example.com
            items:
              type: string
            type: array
        type: object
      type: object
    JwtOidcAuthenticationOpenApi:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationOpenApi'
      - properties:
          audience:
            description: OpenId audience
            example: Alpha testers
            type: string
          baseUrl:
            description: JWT OpenId base URL
            example: https://oidc.example.com/
            type: string
        type: object
      type: object
    ConfigurationResponse:
      properties:
        configurations:
          items:
            $ref: '#/components/schemas/ExtendedConfigurationInformation'
          type: array
      type: object
    PropertyInformation:
      properties:
        allowedValues:
          items:
            type: string
          type: array
        defaultValues:
          items:
            type: string
          type: array
        maxOccurrences:
          format: int32
          type: integer
        minOccurrences:
          format: int32
          type: integer
        type:
          enum:
          - IGNORED
          - FORBIDDEN
          - OPTIONAL
          - REQUIRED
          - LOCKED
          type: string
      type: object
    AwsCloudProviderInformation:
      properties:
        accountIds:
          description: Array of AWS account IDs each of which should be a 12-digit identifier
          example:
          - '123456789012'
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of AWS regions
          example:
          - us-west-1
          items:
            enum:
            - us-east-1
            - us-east-2
            - us-west-1
            - us-west-2
            - af-south-1
            - ap-east-1
            - ap-south-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-south-1
            - ap-northeast-3
            - ap-northeast-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-northeast-1
            - ca-central-1
            - eu-central-1
            - eu-west-1
            - eu-west-2
            - eu-south-1
            - eu-west-3
            - eu-south-2
            - eu-north-1
            - eu-central-2
            - me-south-1
            - me-central-1
            - sa-east-1
            - us-gov-east-1
            - us-gov-west-1
            type: string
          type: array
      required:
      - accountIds
      - regions
      type: object
    GoogleCloudProviderInformation:
      properties:
        projectIdentifiers:
          description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
          example:
          - '415104041262'
          - tokyo-rain-123
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of Google regions
          example:
          - us-west1
          items:
            enum:
            - asia-east1
            - asia-east2
            - asia-northeast1
            - asia-northeast2
            - asia-northeast3
            - asia-south1
            - asia-south2
            - asia-southeast1
            - asia-southeast2
            - australia-southeast1
            - australia-southeast2
            - europe-central2
            - europe-north1
            - europe-southwest1
            - europe-west1
            - europe-west12
            - europe-west2
            - europe-west3
            - europe-west4
            - europe-west6
            - europe-west8
            - europe-west9
            - me-central1
            - me-west1
            - northamerica-northeast1
            - northamerica-northeast2
            - southamerica-east1
            - southamerica-west1
            - us-central1
            - us-east1
            - us-east4
            - us-east5
            - us-south1
            - us-west1
            - us-west2
            - us-west3
            - us-west4
            type: string
          type: array
      required:
      - projectIdentifiers
      - regions
      type: object
    SubjectAttributesInformation:
      description: Subject attributes
      properties:
        commonName:
          $ref: '#/components/schemas/PropertyInformation'
        country:
          $ref: '#/components/schemas/PropertyInformation'
        locality:
          $ref: '#/components/schemas/PropertyInformation'
        organization:
          $ref: '#/components/schemas/PropertyInformation'
        organizationalUnit:
          $ref: '#/components/schemas/PropertyInformation'
        stateOrProvince:
          $ref: '#/components/schemas/PropertyInformation'
      type: object
    ExtendedConfigurationInformation:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettingsInformation'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationInformation'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorizationInformation'
        cloudProviders:
          $ref: '#/components/schemas/CloudProvidersInformation'
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        controllerAllowedPolicyIds:
          description: Array of UUIDs of policies that the kubernetes controller is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        creationDate:
          description: When the configuration was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        longLivedCertCount:
          description: Number of long lived certificates
          example: 2
          format: int64
          type: integer
        minTlsVersion:
          description: Minimum required TLS protocol version
          enum:
          - TLS12
          - TLS13
          type: string
        modificationDate:
          description: When the configuration was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
        policies:
          items:
            $ref: '#/components/schemas/PolicyInformation'
          type: array
        policyDefinitions:
          items:
            $ref: '#/components/schemas/PolicyInformation'
          type: array
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 20
          format: int64
          type: integer
        subCaProvider:
          $ref: '#/components/schemas/SubCaProviderInformation'
        subTsgId:
          description: Sub-TSG ID that owns this configuration (null for Primary TSG)
          example: a007d406bf
          type: string
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 200
          format: int64
          type: integer
        unixSocketAllowedPolicyIds:
          description: Array of UUIDs of policies that are permitted to be used when using the unix socket
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
      type: object
    SubCaProviderPkcs11ConfigurationInformation:
      properties:
        allowedClientLibraries:
          description: A collection of strings each of which represents SHA256 hash of an allowed HSM client library
          example:
          - c34d199f2e30bb679cd9b8533b99975465aefe8b023be1b37972f1ab43ab7b2d
          items:
            type: string
          type: array
        partitionLabel:
          description: HSM Partition Label
          example: workload-identity-manager-hsm-partition
          type: string
        partitionSerialNumber:
          description: HSM Partition Serial Number
          example: '1444210958933'
          pattern: ^[A-Fa-fx0-9]{0,18}$
          type: string
        pin:
          description: HSM PIN
          example: '1234'
          type: string
          writeOnly: true
        signingEnabled:
          description: Indicates whether HSM signing is enabled or not
          example: true
          type: boolean
      type: object
    JwtClient:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          type: string
        jwksUri:
          description: URL used to pull the trusted singing keys used for validation
          example: https://www.example.com:6443/jwks
          type: string
        name:
          description: Name of the client
          example: Some client
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          type: array
      type: object
    ClientAuthenticationRequestOpenApi:
      properties:
        clientAuthentication:
          oneOf:
          - $ref: '#/components/schemas/JwtStandardClaimsAuthenticationOpenApi'
          - $ref: '#/components/schemas/JwtJwksAuthenticationOpenApi'
          - $ref: '#/components/schemas/JwtOidcAuthenticationOpenApi'
          type: object
      type: object
    SansInformation:
      description: Subject alternative names
      properties:
        dnsNames:
          $ref: '#/components/schemas/PropertyInformation'
        ipAddresses:
          $ref: '#/components/schemas/PropertyInformation'
        rfc822Names:
          $ref: '#/components/schemas/PropertyInformation'
        uniformResourceIdentifiers:
          $ref: '#/components/schemas/PropertyInformation'
      type: object
    AzureCloudProviderInformation:
      properties:
        subscriptionIds:
          description: Array of Azure subscription IDs each of which should be UUID
          example:
          - 8d10da13-8125-4ba9-a717-bf7490507b3d
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - subscriptionIds
      type: object
    CloudProvidersInformation:
      properties:
        aws:
          $ref: '#/components/schemas/AwsCloudProviderInformation'
        azure:
          $ref: '#/components/schemas/AzureCloudProviderInformation'
        google:
          $ref: '#/components/schemas/GoogleCloudProviderInformation'
      type: object
    ClientAuthenticationOpenApi:
      discriminator:
        mapping:
          JWT_JWKS: '#/components/schemas/JwtJwksAuthenticationOpenApi'
          JWT_OIDC: '#/components/schemas/JwtOidcAuthenticationOpenApi'
          JWT_STANDARD_CLAIMS: '#/components/schemas/JwtStandardClaimsAuthenticationOpenApi'
        propertyName: type
      properties:
        type:
          type: string
      type: object
    KeyAlgorithmInformation:
      description: Key algorithm
      properties:
        allowedValues:
          description: Key algorithm allowed values
          items:
            enum:
            - RSA_2048
            - RSA_3072
            - RSA_4096
            - EC_P256
            - EC_P384
            - EC_P521
            - EC_ED25519
            type: string
          minItems: 1
          type: array
        defaultValue:
          description: Key algorithm default value
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: RSA_4096
          type: string
      required:
      - allowedValues
      - defaultValue
      type: object
    ErrorResponse7:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation7'
          type: array
      type: object
    PolicyInformation:
      properties:
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        creationDate:
          description: When the policy was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            enum:
            - ANY
            - SERVER_AUTH
            - CLIENT_AUTH
            - CODE_SIGNING
            - EMAIL_PROTECTION
            - IPSEC_ENDSYSTEM
            - IPSEC_TUNNEL
            - IPSEC_USER
            - TIME_STAMPING
            - OCSP_SIGNING
            - DVCS
            - SBGP_CERT_AA_SERVER_AUTH
            - SCVP_RESPONDER
            - EAP_OVER_PPP
            - EAP_OVER_LAN
            - SCVP_SERVER
            - SCVP_CLIENT
            - IPSEC_IKE
            - CAPWAP_AC
            - CAPWAP_WTP
            - IPSEC_IKE_INTERMEDIATE
            - SMARTCARD_LOGON
            type: string
          type: array
        id:
          description: UUID of the policy
          example: 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          type: string
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            enum:
            - digitalSignature
            - nonRepudiation
            - keyEncipherment
            - dataEncipherment
            - keyAgreement
            - keyCertSign
            - cRLSign
            - encipherOnly
            - decipherOnly
            type: string
          type: array
        modificationDate:
          description: When the policy was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the policy
          example: Some policy
          type: string
        sans:
          $ref: '#/components/schemas/SansInformation'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this policy is shared with
            type: string
          type: array
          uniqueItems: true
        subject:
          $ref: '#/components/schemas/SubjectAttributesInformation'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    ConfigurationUpdateRequest:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettingsInformation'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationRequestOpenApi'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorizationInformation'
        cloudProviders:
          $ref: '#/components/schemas/CloudProvidersInformation'
        minTlsVersion:
          description: Minimum required TLS protocol version
          enum:
          - TLS12
          - TLS13
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          maxLength: 64
          type: string
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        subCaProviderId:
          description: UUID of Sub CA provider to associate with the configuration
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
      type: object
    ClientAuthenticationInformation:
      discriminator:
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/JwtStandardClaimsAuthenticationInformation'
      - $ref: '#/components/schemas/JwtJwksAuthenticationInformation'
      - $ref: '#/components/schemas/JwtOidcAuthenticationInformation'
      properties:
        type:
          type: string
      required:
      - type
      type: object
    JwtOidcAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: OpenId audience
            example: Client1
            maxLength: 256
            type: string
          baseUrl:
            description: JWT OpenId base URL
            example: https://openid.example.com
            maxLength: 2048
            type: string
        type: object
      required:
      - audience
      - baseUrl
      type: object
    SubCaProviderInformation:
      properties:
        caAccountId:
          description: UUID of the CA account used by this Sub CA provider
          example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
          format: uuid
          type: string
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        caType:
          description: Type of CA this Sub CA provider works with
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          example: BUILTIN
          type: string
        commonName:
          description: Common name
          example: example.com
          type: string
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        country:
          description: Country
          example: US
          type: string
        creationDate:
          description: When the Sub CA provider was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the Sub CA provider
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          type: string
        modificationDate:
          description: When the Sub CA provider was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA provider
          type: string
        organization:
          description: Organization
          example: Some organization
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this SubCA provider is shared with
            type: string
          type: array
          uniqueItems: true
        stateOrProvince:
          description: State or province
          example: Texas
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    JwtClientInformation:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          maxLength: 2048
          type: string
        jwksUri:
          description: URL used to pull the trusted singing keys used for validation
          example: https://www.example.com:6443/jwks
          maxLength: 2048
          type: string
        name:
          description: Name of the client
          example: Some client
          maxLength: 64
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          minItems: 1
          type: array
      required:
      - allowedPolicyIds
      - issuer
      - name
      - subjects
      type: object
    CustomClaimsAliasesInformation:
      properties:
        allowAllPolicies:
          maxLength: 128
          type: string
        allowedPolicies:
          maxLength: 128
          type: string
        configuration:
          maxLength: 128
          type: string
      type: object
    JwtJwksAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          urls:
            description: Array of JWT JWKS urls
            example:
            - https://jwks.example.com
            items:
              type: string
            minItems: 1
            type: array
        type: object
      required:
      - urls
      type: object
    AdvancedSettingsInformation:
      properties:
        enableIssuanceAuditLog:
          description: Whether audit log entries must be generated for each issued certificate
          example: false
          type: boolean
        includeRawCertDataInAuditLog:
          description: Whether the raw certificate data must be included in the audit log entry
          example: false
          type: boolean
        requireFIPSCompliantBuild:
          description: Whether FIPS-compliant build is required
          example: false
          type: boolean
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT