openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Issuer Sub CA Providers API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Issuer Sub CA Providers
  description: APIs for Issuer Sub CA Providers.
paths:
  /v1/distributedissuers/subcaproviders:
    post:
      description: Creates a sub ca provider
      operationId: subcaproviders_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubCaProviderCreateRequest'
        description: Details of the new sub CA provider.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Sub CA Provider was created; details in response body;
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Create a new Sub CA provider
      tags:
      - Issuer Sub CA Providers
    get:
      description: Returns a list of all the subordinate CA providers along with their details.
      operationId: subcaprovider_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderResponse'
          description: All Sub CA providers with details.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get the details of all Sub
      tags:
      - Issuer Sub CA Providers
  /v1/distributedissuers/subcaproviders/{id}:
    get:
      description: Retrieves the details of the subordinate CA provider that has the specified `id`.
      operationId: subcaproviders_getById
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Specified sub CA provider found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get a Sub CA provider details
      tags:
      - Issuer Sub CA Providers
    patch:
      description: Updates (replaces) details of the subordinate CA provider that has the specified `id`. Only fields specified in the request will be updated.
      operationId: subcaproviders_update
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubCaProviderUpdateRequest'
        description: Sub CA provider's details to update.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Sub CA provider updated; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Update a Sub CA provider details
      tags:
      - Issuer Sub CA Providers
    delete:
      description: Deletes the subordinate CA provider that has the specified `id`.
      operationId: subcaproviders_delete
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderDeleteResponse'
          description: Specified Sub CA provider was deleted.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Remove a Sub CA provider
      tags:
      - Issuer Sub CA Providers
components:
  schemas:
    SubCaProviderUpdateRequest:
      properties:
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        commonName:
          description: Common name
          example: example.com
          maxLength: 64
          type: string
        country:
          description: Country
          example: US
          maxLength: 64
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          maxLength: 64
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA
          maxLength: 64
          type: string
        organization:
          description: Organization
          example: Some organization
          maxLength: 64
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          maxLength: 64
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        stateOrProvince:
          description: State or province
          example: Texas
          maxLength: 64
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: PnYnMnDTnHnMnS
          type: string
      type: object
    ErrorResponse7:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation7'
          type: array
      type: object
    AnyValue7:
      description: Can be any value - string, number, boolean, array or object.
    ErrorInformation7:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue7'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    SubCaProviderResponse:
      properties:
        subCaProviders:
          items:
            $ref: '#/components/schemas/SubCaProviderInformation'
          type: array
      type: object
    SubCaProviderPkcs11ConfigurationInformation:
      properties:
        allowedClientLibraries:
          description: A collection of strings each of which represents SHA256 hash of an allowed HSM client library
          example:
          - c34d199f2e30bb679cd9b8533b99975465aefe8b023be1b37972f1ab43ab7b2d
          items:
            type: string
          type: array
        partitionLabel:
          description: HSM Partition Label
          example: workload-identity-manager-hsm-partition
          type: string
        partitionSerialNumber:
          description: HSM Partition Serial Number
          example: '1444210958933'
          pattern: ^[A-Fa-fx0-9]{0,18}$
          type: string
        pin:
          description: HSM PIN
          example: '1234'
          type: string
          writeOnly: true
        signingEnabled:
          description: Indicates whether HSM signing is enabled or not
          example: true
          type: boolean
      type: object
    SubCaProviderDeleteResponse:
      properties:
        id:
          description: UUID of the Sub CA provider
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA
          type: string
      type: object
    SubCaProviderCreateRequest:
      properties:
        caAccountId:
          description: UUID of the CA account used by this Sub CA provider
          example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
          format: uuid
          type: string
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        caType:
          description: Type of CA this Sub CA provider works with
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          example: BUILTIN
          type: string
        commonName:
          description: Common name
          example: example.com
          maxLength: 64
          type: string
        country:
          description: Country
          example: US
          maxLength: 64
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          maxLength: 64
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA provider
          maxLength: 64
          type: string
        organization:
          description: Organization
          example: Some organization
          maxLength: 64
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          maxLength: 64
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        stateOrProvince:
          description: State or province
          example: Texas
          maxLength: 64
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      required:
      - caAccountId
      - caProductOptionId
      - caType
      - commonName
      - keyAlgorithm
      - name
      - validityPeriod
      type: object
    SubCaProviderInformation:
      properties:
        caAccountId:
          description: UUID of the CA account used by this Sub CA provider
          example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
          format: uuid
          type: string
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        caType:
          description: Type of CA this Sub CA provider works with
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          example: BUILTIN
          type: string
        commonName:
          description: Common name
          example: example.com
          type: string
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        country:
          description: Country
          example: US
          type: string
        creationDate:
          description: When the Sub CA provider was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the Sub CA provider
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          type: string
        modificationDate:
          description: When the Sub CA provider was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA provider
          type: string
        organization:
          description: Organization
          example: Some organization
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this SubCA provider is shared with
            type: string
          type: array
          uniqueItems: true
        stateOrProvince:
          description: State or province
          example: Texas
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT