openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Workload Issuance Policies API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Workload Issuance Policies
  description: APIs for Workload Issuance Policies.
paths:
  /v1/distributedissuers/policies:
    post:
      description: Add a new a Workload Issuance Policy for an Issuer to use to ensure compliance with company restrictions for creating certificates.
      operationId: policies_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyCreateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyInformation'
          description: Workload Issuance policy was created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Create a new Workload Issuance policy
      tags:
      - Workload Issuance Policies
    get:
      description: Retrieves all policy details for all Workload Issuance policies. Policies are sets of rules that constrain how certificates can be issued, as well as set default values for some fields.
      operationId: policies_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyResponse'
          description: All Workload Issuance policies; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get the details of all Workload
      tags:
      - Workload Issuance Policies
  /v1/distributedissuers/policies/{id}:
    get:
      description: Retrieves the details of the Workload Issuance policy with the specified `id`.
      operationId: policies_getById
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyInformation'
          description: Specified Workload Issuance policy found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Workload Issuance policy was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get a Workload Issuance policy details
      tags:
      - Workload Issuance Policies
    patch:
      description: Updates (replaces) details of the Workload Issuance policy that has the specified `id`. Only fields specified in the request will be updated. Fields not included in the request will be ignored.
      operationId: policies_update
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyInformation'
          description: Workload Issuance policy updated.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Workload Issuance policy was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Update a Workload Issuance policy details
      tags:
      - Workload Issuance Policies
    delete:
      description: Deletes the Workload Issuance policy that has the specified `id`.
      operationId: policies_delete
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyDeleteResponse'
          description: Specified Workload Issuance policy was deleted
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Workload Issuance policy was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Remove a Workload Issuance policy
      tags:
      - Workload Issuance Policies
components:
  schemas:
    JwtStandardClaimsAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: Recipients that the JWT is intended for
            example: Client1
            maxLength: 256
            type: string
          clients:
            description: List with clients, identified by processing JWTs that include standard/registered claims
            items:
              $ref: '#/components/schemas/JwtClientInformation'
            minItems: 1
            type: array
        type: object
      required:
      - audience
      - clients
      type: object
    AnyValue7:
      description: Can be any value - string, number, boolean, array or object.
    ErrorInformation7:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue7'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    ExtendedPolicyInformation:
      properties:
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        configurations:
          items:
            $ref: '#/components/schemas/ConfigurationInformation'
          type: array
        creationDate:
          description: When the policy was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            enum:
            - ANY
            - SERVER_AUTH
            - CLIENT_AUTH
            - CODE_SIGNING
            - EMAIL_PROTECTION
            - IPSEC_ENDSYSTEM
            - IPSEC_TUNNEL
            - IPSEC_USER
            - TIME_STAMPING
            - OCSP_SIGNING
            - DVCS
            - SBGP_CERT_AA_SERVER_AUTH
            - SCVP_RESPONDER
            - EAP_OVER_PPP
            - EAP_OVER_LAN
            - SCVP_SERVER
            - SCVP_CLIENT
            - IPSEC_IKE
            - CAPWAP_AC
            - CAPWAP_WTP
            - IPSEC_IKE_INTERMEDIATE
            - SMARTCARD_LOGON
            type: string
          type: array
        id:
          description: UUID of the policy
          example: 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          type: string
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            enum:
            - digitalSignature
            - nonRepudiation
            - keyEncipherment
            - dataEncipherment
            - keyAgreement
            - keyCertSign
            - cRLSign
            - encipherOnly
            - decipherOnly
            type: string
          type: array
        modificationDate:
          description: When the policy was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the policy
          example: Some policy
          type: string
        sans:
          $ref: '#/components/schemas/SansInformation'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this policy is shared with
            type: string
          type: array
          uniqueItems: true
        subject:
          $ref: '#/components/schemas/SubjectAttributesInformation'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    ClientAuthorizationInformation:
      properties:
        customClaimsAliases:
          $ref: '#/components/schemas/CustomClaimsAliasesInformation'
      type: object
    PolicyUpdateRequest:
      properties:
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            enum:
            - ANY
            - SERVER_AUTH
            - CLIENT_AUTH
            - CODE_SIGNING
            - EMAIL_PROTECTION
            - IPSEC_ENDSYSTEM
            - IPSEC_TUNNEL
            - IPSEC_USER
            - TIME_STAMPING
            - OCSP_SIGNING
            - DVCS
            - SBGP_CERT_AA_SERVER_AUTH
            - SCVP_RESPONDER
            - EAP_OVER_PPP
            - EAP_OVER_LAN
            - SCVP_SERVER
            - SCVP_CLIENT
            - IPSEC_IKE
            - CAPWAP_AC
            - CAPWAP_WTP
            - IPSEC_IKE_INTERMEDIATE
            - SMARTCARD_LOGON
            type: string
          type: array
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            enum:
            - digitalSignature
            - nonRepudiation
            - keyEncipherment
            - dataEncipherment
            - keyAgreement
            - keyCertSign
            - cRLSign
            - encipherOnly
            - decipherOnly
            type: string
          type: array
        name:
          description: Name of the policy
          example: Some policy
          maxLength: 64
          type: string
        sans:
          $ref: '#/components/schemas/SansInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        subject:
          $ref: '#/components/schemas/SubjectAttributesInformation'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    PolicyDeleteResponse:
      properties:
        id:
          description: UUID of the policy
          example: 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          type: string
        name:
          description: Name of the policy
          example: Some policy
          type: string
      type: object
    PropertyInformation:
      properties:
        allowedValues:
          items:
            type: string
          type: array
        defaultValues:
          items:
            type: string
          type: array
        maxOccurrences:
          format: int32
          type: integer
        minOccurrences:
          format: int32
          type: integer
        type:
          enum:
          - IGNORED
          - FORBIDDEN
          - OPTIONAL
          - REQUIRED
          - LOCKED
          type: string
      type: object
    AwsCloudProviderInformation:
      properties:
        accountIds:
          description: Array of AWS account IDs each of which should be a 12-digit identifier
          example:
          - '123456789012'
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of AWS regions
          example:
          - us-west-1
          items:
            enum:
            - us-east-1
            - us-east-2
            - us-west-1
            - us-west-2
            - af-south-1
            - ap-east-1
            - ap-south-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-south-1
            - ap-northeast-3
            - ap-northeast-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-northeast-1
            - ca-central-1
            - eu-central-1
            - eu-west-1
            - eu-west-2
            - eu-south-1
            - eu-west-3
            - eu-south-2
            - eu-north-1
            - eu-central-2
            - me-south-1
            - me-central-1
            - sa-east-1
            - us-gov-east-1
            - us-gov-west-1
            type: string
          type: array
      required:
      - accountIds
      - regions
      type: object
    GoogleCloudProviderInformation:
      properties:
        projectIdentifiers:
          description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
          example:
          - '415104041262'
          - tokyo-rain-123
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of Google regions
          example:
          - us-west1
          items:
            enum:
            - asia-east1
            - asia-east2
            - asia-northeast1
            - asia-northeast2
            - asia-northeast3
            - asia-south1
            - asia-south2
            - asia-southeast1
            - asia-southeast2
            - australia-southeast1
            - australia-southeast2
            - europe-central2
            - europe-north1
            - europe-southwest1
            - europe-west1
            - europe-west12
            - europe-west2
            - europe-west3
            - europe-west4
            - europe-west6
            - europe-west8
            - europe-west9
            - me-central1
            - me-west1
            - northamerica-northeast1
            - northamerica-northeast2
            - southamerica-east1
            - southamerica-west1
            - us-central1
            - us-east1
            - us-east4
            - us-east5
            - us-south1
            - us-west1
            - us-west2
            - us-west3
            - us-west4
            type: string
          type: array
      required:
      - projectIdentifiers
      - regions
      type: object
    SubjectAttributesInformation:
      description: Subject attributes
      properties:
        commonName:
          $ref: '#/components/schemas/PropertyInformation'
        country:
          $ref: '#/components/schemas/PropertyInformation'
        locality:
          $ref: '#/components/schemas/PropertyInformation'
        organization:
          $ref: '#/components/schemas/PropertyInformation'
        organizationalUnit:
          $ref: '#/components/schemas/PropertyInformation'
        stateOrProvince:
          $ref: '#/components/schemas/PropertyInformation'
      type: object
    SansInformation:
      description: Subject alternative names
      properties:
        dnsNames:
          $ref: '#/components/schemas/PropertyInformation'
        ipAddresses:
          $ref: '#/components/schemas/PropertyInformation'
        rfc822Names:
          $ref: '#/components/schemas/PropertyInformation'
        uniformResourceIdentifiers:
          $ref: '#/components/schemas/PropertyInformation'
      type: object
    AzureCloudProviderInformation:
      properties:
        subscriptionIds:
          description: Array of Azure subscription IDs each of which should be UUID
          example:
          - 8d10da13-8125-4ba9-a717-bf7490507b3d
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - subscriptionIds
      type: object
    CloudProvidersInformation:
      properties:
        aws:
          $ref: '#/components/schemas/AwsCloudProviderInformation'
        azure:
          $ref: '#/components/schemas/AzureCloudProviderInformation'
        google:
          $ref: '#/components/schemas/GoogleCloudProviderInformation'
      type: object
    PolicyCreateRequest:
      properties:
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            enum:
            - ANY
            - SERVER_AUTH
            - CLIENT_AUTH
            - CODE_SIGNING
            - EMAIL_PROTECTION
            - IPSEC_ENDSYSTEM
            - IPSEC_TUNNEL
            - IPSEC_USER
            - TIME_STAMPING
            - OCSP_SIGNING
            - DVCS
            - SBGP_CERT_AA_SERVER_AUTH
            - SCVP_RESPONDER
            - EAP_OVER_PPP
            - EAP_OVER_LAN
            - SCVP_SERVER
            - SCVP_CLIENT
            - IPSEC_IKE
            - CAPWAP_AC
            - CAPWAP_WTP
            - IPSEC_IKE_INTERMEDIATE
            - SMARTCARD_LOGON
            type: string
          minItems: 1
          type: array
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            enum:
            - digitalSignature
            - nonRepudiation
            - keyEncipherment
            - dataEncipherment
            - keyAgreement
            - keyCertSign
            - cRLSign
            - encipherOnly
            - decipherOnly
            type: string
          minItems: 1
          type: array
        name:
          description: Name of the policy
          example: Some policy
          maxLength: 64
          type: string
        sans:
          $ref: '#/components/schemas/SansInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        subject:
          $ref: '#/components/schemas/SubjectAttributesInformation'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      required:
      - extendedKeyUsages
      - keyAlgorithm
      - keyUsages
      - name
      - sans
      - subject
      - validityPeriod
      type: object
    KeyAlgorithmInformation:
      description: Key algorithm
      properties:
        allowedValues:
          description: Key algorithm allowed values
          items:
            enum:
            - RSA_2048
            - RSA_3072
            - RSA_4096
            - EC_P256
            - EC_P384
            - EC_P521
            - EC_ED25519
            type: string
          minItems: 1
          type: array
        defaultValue:
          description: Key algorithm default value
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: RSA_4096
          type: string
      required:
      - allowedValues
      - defaultValue
      type: object
    ErrorResponse7:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation7'
          type: array
      type: object
    ConfigurationInformation:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettingsInformation'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationInformation'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorizationInformation'
        cloudProviders:
          $ref: '#/components/schemas/CloudProvidersInformation'
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        controllerAllowedPolicyIds:
          description: Array of UUIDs of policies that the kubernetes controller is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        creationDate:
          description: When the configuration was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        longLivedCertCount:
          description: Number of long lived certificates
          example: 2
          format: int64
          type: integer
        minTlsVersion:
          description: Minimum required TLS protocol version
          enum:
          - TLS12
          - TLS13
          type: string
        modificationDate:
          description: When the configuration was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 20
          format: int64
          type: integer
        subTsgId:
          description: Sub-TSG ID that owns this configuration (null for Primary TSG)
          example: a007d406bf
          type: string
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 200
          format: int64
          type: integer
        unixSocketAllowedPolicyIds:
          description: Array of UUIDs of policies that are permitted to be used when using the unix socket
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          type: array
      type: object
    ClientAuthenticationInformation:
      discriminator:
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/JwtStandardClaimsAuthenticationInformation'
      - $ref: '#/components/schemas/JwtJwksAuthenticationInformation'
      - $ref: '#/components/schemas/JwtOidcAuthenticationInformation'
      properties:
        type:
          type: string
      required:
      - type
      type: object
    JwtOidcAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          audience:
            description: OpenId audience
            example: Client1
            maxLength: 256
            type: string
          baseUrl:
            description: JWT OpenId base URL
            example: https://openid.example.com
            maxLength: 2048
            type: string
        type: object
      required:
      - audience
      - baseUrl
      type: object
    PolicyResponse:
      properties:
        policies:
          items:
            $ref: '#/components/schemas/ExtendedPolicyInformation'
          type: array
      type: object
    JwtClientInformation:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          maxLength: 2048
          type: string
        jwksUri:
          description: URL used to pull the trusted singing keys used for validation
          example: https://www.example.com:6443/jwks
          maxLength: 2048
          type: string
        name:
          description: Name of the client
          example: Some client
          maxLength: 64
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          minItems: 1
          type: array
      required:
      - allowedPolicyIds
      - issuer
      - name
      - subjects
      type: object
    CustomClaimsAliasesInformation:
      properties:
        allowAllPolicies:
          maxLength: 128
          type: string
        allowedPolicies:
          maxLength: 128
          type: string
        configuration:
          maxLength: 128
          type: string
      type: object
    JwtJwksAuthenticationInformation:
      allOf:
      - $ref: '#/components/schemas/ClientAuthenticationInformation'
      - properties:
          urls:
            description: Array of JWT JWKS urls
            example:
            - https://jwks.example.com
            items:
              type: string
            minItems: 1
            type: array
        type: object
      required:
      - urls
      type: object
    AdvancedSettingsInformation:
      properties:
        enableIssuanceAuditLog:
          description: Whether audit log entries must be generated for each issued certificate
          example: false
          type: boolean
        includeRawCertDataInAuditLog:
          description: Whether the raw certificate data must be included in the audit log entry
          example: false
          type: boolean
        requireFIPSCompliantBuild:
          description: Whether FIPS-compliant build is required
          example: false
          type: boolean
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT