openapi: 3.2.0 info: title: Trust Protection Foundation WebSDK Authentication Server… description: '# Introduction The Trust Protection Foundation Web SDK is a subset of REST APIs that allow you to: * Automate certificate management * Integrate with DevOps processes * Discover machine identities * Extract data to integrate with data warehouses * Perform bulk actions * Set up and administer Trust Protection Foundation * Onboard teams * Create custom, automated business logic and flows between internal systems All these use cases can be accomplished using the Trust Protection Foundation REST…' version: 26.1.1 servers: - url: / description: Current Host - url: https://REPLACEdnsnameME/ description: System - url: https://{dnsname}/ description: Configurable Hostname variables: dnsname: default: localhost description: Production API Hostname security: - AccessToken: [] tags: - name: Authentication Server APIs description: 'The Auth REST SDK manages authorization bearer tokens. The tokens you need are based on the set of API calls that your client uses. The Auth SDK uses the VEDauth service to grant access and manage tokens. No installation is necessary. However, configuration is required. For more information, see Setting up token authentication.' paths: /vedauth/authorize/device: post: tags: - Authentication Server APIs summary: Request a device grant description: 'Triggers a grant request via device authorization flow (See RFC 8628 Section 3.1) _Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_RequestDeviceAuth requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_device' required: true responses: '200': description: Grant issued content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_device' '400': description: Grant issuance denied content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthError' /vedauth/authorize/oauth: post: tags: - Authentication Server APIs summary: Request a grant with user credentials description: '_Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_AuthorizeOAuth requestBody: content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_oauth' required: true responses: '200': description: Grant issued content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_oauth' '400': description: Grant issuance denied content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthError' /vedauth/authorize/integrated: post: tags: - Authentication Server APIs summary: Request a grant via NTLM/Kerberos description: '_Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_IntegratedAuthorize requestBody: content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_integrated' required: true responses: '200': description: Grant issued content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_integrated' '400': description: Grant issuance denied content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthError' /vedauth/authorize/certificate: post: tags: - Authentication Server APIs summary: Request a grant via certificate description: '_Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_CertificateAuthorize requestBody: content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_certificate' required: true responses: '200': description: Grant issued content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_certificate' '400': description: Grant issuance denied content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthError' /vedauth/authorize/jwt: post: tags: - Authentication Server APIs summary: Request a grant via JWT description: '_Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_JwtAuthorize requestBody: content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_jwt' required: true responses: '200': description: Grant issued content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_jwt' '400': description: Grant issuance denied content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthError' /vedauth/authorize/token: post: tags: - Authentication Server APIs summary: Refresh a bearer/device token description: 'This endpoint supports refreshing bearer tokens as well as device access tokens (OAuth 2.0 Device Authorization Grant). _Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_Token requestBody: content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_TokenOAuthRequest' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse' '403': description: ' The API requires a scope not granted to the provided access token ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' '400': description: ' Missing or invalid request property. ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' '401': description: ' A valid access token is required. ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' security: - AccessToken: [] /vedauth/authorize/verify: get: tags: - Authentication Server APIs summary: Verify bearer token validity description: '_Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_VerifyToken responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeVerifyResponse' '403': description: ' The API requires a scope not granted to the provided access token ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' '400': description: ' Missing or invalid request property. ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' '401': description: ' A valid access token is required. ' content: application/json: schema: $ref: '#/components/schemas/Web_SDK_Authentication_OAuthError' security: - AccessToken: [] /vedauth/authorize/IsAuthServer: get: tags: - Authentication Server APIs summary: Verify server availability description: 'This endpoint can be used by a client to ensure the auth server is running before attempting to perform grant tasks _Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Authorize_IsAuthServer responses: '200': description: Server available security: - AccessToken: [] /vedauth/revoke/token: get: tags: - Authentication Server APIs summary: Revoke grant description: 'Revokes the grant passed in via a bearer token in the header _Required scope: Any_' operationId: Venafi_Web_SDK_Authentication_Revoke_RevokeGrant responses: '200': description: Grant revoked '202': description: Grant revocation failed security: - AccessToken: [] components: schemas: Web_SDK_Authentication_AuthorizeOAuthResponse_jwt: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for Web_SDK_Authentication_AuthorizeOAuthRequest_oauth: type: object properties: client_id: type: string description: Client (Application) ID username: type: string description: Valid username; can be prefixed with provider password: type: string description: Valid password for _Username_ scope: type: string description: Desired Scope Web_SDK_Authentication_AuthorizeVerifyResponse: type: object properties: identity: type: string description: The PrefixedUniversal identity the grant has been issued to scope: type: string description: The scope (WebSDK, CSP, etc) this grant applies to valid_for: type: integer description: Number of seconds the access token is valid format: int64 access_issued_on: type: string description: The date and time (UTC) when the access token was issued last access_issued_on_unix_time: type: integer description: Unixtime when the access token was issued last format: int64 access_issued_on_ISO8601: type: string description: The date and time (UTC) when the access token was issued last, in ISO-8601 format expires: type: - string - 'null' description: The date and time (UTC) when the grant expires and cannot be refreshed, null if it does not expire expires_unix_time: type: integer description: Unixtime when the grant expires and cannot be refreshed anymore, 0 if it does not expire format: int64 expires_ISO8601: type: string description: The date and time (UTC) when the grant expires and cannot be refreshed, null if it does not expire (in ISO-8601 format) grant_issued_on: type: string description: The date and time (UTC) when the grant was issued grant_issued_on_unix_time: type: integer description: Unixtime when the grant was issued format: int64 grant_issued_on_ISO8601: type: string description: The date and time (UTC) when the grant was issued (in ISO-8601 format) application: type: string description: The application this grant applies to description: Holds information about a particular access grant Web_SDK_Authentication_AuthorizeOAuthRequest_certificate: type: object properties: client_id: type: string description: Client (Application) ID scope: type: string description: Desired Scope Web_SDK_Authentication_TokenOAuthRequest: type: object properties: refresh_token: type: string description: Gets or sets the refresh token being used to obtain a new access token. client_id: type: string description: Gets or sets the client id. grant_type: type: string description: OAuth grant type. device_code: type: string description: The device verification code, "device_code" from the device authorization response. description: RFC6749 token request. Web_SDK_Authentication_AuthError: type: object properties: error: type: string description: One of the errors defined in RFC 6749 Section 5.2 error_description: type: string description: Detailed error explanation description: Class to generate OAuth Authentication Server error responses (See RFC6749, Section 5.2) Web_SDK_Authentication_AuthorizeOAuthResponse_certificate: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for Web_SDK_Authentication_AuthorizeOAuthRequest_integrated: type: object properties: client_id: type: string description: Client (Application) ID scope: type: string description: Desired Scope Web_SDK_Authentication_AuthorizeOAuthRequest_device: type: object properties: client_id: type: string description: Client (Application) ID scope: type: string description: Desired Scope Web_SDK_Authentication_OAuthError: type: object properties: error: type: string description: Gets or sets the short error name error_description: type: string description: Gets or sets the description of the error description: REST OAuth Error Response Web_SDK_Authentication_AuthorizeOAuthResponse_device: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for Web_SDK_Authentication_AuthorizeOAuthResponse_oauth: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for Web_SDK_Authentication_AuthorizeOAuthRequest_jwt: type: object properties: client_id: type: string description: Client (Application) ID jwt: type: string description: Trusted Json Web Token scope: type: string description: Desired Scope Web_SDK_Authentication_AuthorizeOAuthResponse_integrated: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for Web_SDK_Authentication_AuthorizeOAuthResponse: type: object properties: access_token: type: string description: The scope (WebSDK, CSP, etc) this grant applies to refresh_token: type: string description: The token to use to get an updated access token error: type: string description: OAuth Error error_description: type: string description: OAuth Error description expires: type: integer description: The date and time (UTC) when the access token expires format: int64 expires_in: type: integer description: The number of seconds until the token expires format: int64 token_type: type: string description: The application this grant applies to scope: type: string description: The scope of the grant identity: type: string description: The identity the grant is for refresh_until: type: integer description: Unixtime when the grant expires and cannot be refreshed anymore format: int64 device_code: type: string description: Device code. Used to poll "token" endpoint. user_code: type: string description: User code. Used to approve or reject the authorization request. verification_uri: type: string description: Verification URI. This URL is supposed to be opened by the user. verification_uri_complete: type: string description: Verification URI that has user code as part of it. interval: type: integer description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint. format: int64 description: Holds information about a particular access grant securitySchemes: AccessToken: type: http scheme: bearer