openapi: 3.2.0
info:
  title: Certificate Manager - SaaS Certificate Policy API
  version: '1.0'
servers:
- description: US Region
  url: https://api.venafi.cloud
- description: EU Region
  url: https://api.eu.venafi.cloud
- description: AU Region
  url: https://api.au.venafi.cloud
- description: UK Region
  url: https://api.uk.venafi.cloud
- description: SG Region
  url: https://api.sg.venafi.cloud
- description: CA Region
  url: https://api.ca.venafi.cloud
tags:
- name: Certificate Policy
paths:
  /v1/certificateissuingtemplates:
    get:
      description: Retrieves the details of issuing templates ordered by `priority` and `certificateAuthority`.
      operationId: certificateissuingtemplate_getAll
      parameters:
      - description: UUID of a Certificate Authority Account.
        in: query
        name: certificateAuthorityAccountId
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateIssuingTemplateResponse'
          description: Details of Issuing Templates in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
      security:
      - tppl-api-key: []
      summary: Get the details of issuing templates matching simple criteria
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: read
          description: Ability to get certificate issuing template details
          name: ngts.certificate_issuing_template.get
        roles:
        - PKIAdmin
        - PlatformAdmin
        - ResourceOwner
        - Guest
        - cert-manager-enterprise-issuer
    post:
      description: Creates an issuing template.
      operationId: certificateissuingtemplate_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateIssuingTemplateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateIssuingTemplateResponse'
          description: Issuing Template was created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Issuing Template not found.
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Issuing Template already exists.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
      security:
      - tppl-api-key: []
      summary: Add an issuing template
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: write
          description: Ability to create a certificate issuing template
          name: ngts.certificate_issuing_template.create
        roles:
        - PKIAdmin
  /v1/certificateissuingtemplates/{id}:
    get:
      description: Retrieve the details of the issuing template that has the specified `id`.
      operationId: certificateissuingtemplate_getById
      parameters:
      - description: UUID of an Issuing Template.
        in: path
        name: id
        required: true
        schema:
          description: UUID of an Issuing Template.
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateIssuingTemplateInformation2'
          description: Issuing Template was found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Issuing Template not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
      security:
      - tppl-api-key: []
      summary: Get an issuing template's details
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: read
          description: Ability to get certificate issuing template details
          name: ngts.certificate_issuing_template.get
        roles:
        - PKIAdmin
        - PlatformAdmin
        - ResourceOwner
        - Guest
    put:
      description: Updates all the details of the issuing template that has the specified `id`.
      operationId: certificateissuingtemplate_update
      parameters:
      - description: UUID of an Issuing Template.
        in: path
        name: id
        required: true
        schema:
          description: UUID of an Issuing Template.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateIssuingTemplateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateIssuingTemplateInformation2'
          description: Issuing Template was updated; details in response body.
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateIssuingTemplateInformation2'
          description: Issuing Template exists.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Issuing Template not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
      security:
      - tppl-api-key: []
      summary: Overwrite an issuing template's details
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: write
          description: Ability to update existing certificate issuing templates
          name: ngts.certificate_issuing_template.update
        roles:
        - PKIAdmin
    delete:
      description: Deletes the issuing template that has the specified `id`.
      operationId: certificateissuingtemplate_delete
      parameters:
      - description: UUID of an Issuing Template.
        in: path
        name: id
        required: true
        schema:
          description: UUID of an Issuing Template.
          format: uuid
          type: string
      responses:
        '204':
          description: Issuing Template was deleted
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Issuing Template not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse10'
          description: Incomplete or malformed request.
      security:
      - tppl-api-key: []
      summary: Remove an issuing template
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: write
          description: Ability to delete certificate issuing templates
          name: ngts.certificate_issuing_template.delete
        roles:
        - PKIAdmin
  /v1/certificateissuingtemplates/domainssynchronization:
    post:
      description: Loads domain list from CA and updates the issuing templates with it
      operationId: domainssynchronization
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IssuingTemplatesDomainsSyncRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssuingTemplateDomainsSyncResponse'
          description: List with the information about the status of the sync of every issuing template
      security:
      - tppl-api-key: []
      summary: Synchronize issuing templates domains with CA
      tags:
      - Certificate Policy
      x-rbac:
        permissions:
          access_type: write
          description: Ability to synchronize certificate issuing template domains with CA
          name: ngts.certificate_issuing_template_domain_sync.update
        roles:
        - PKIAdmin
components:
  schemas:
    CertificateIssuingTemplateInformation2:
      properties:
        certificateAuthority:
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          - CONNECTOR
          - BUILTIN_GEN2
          type: string
        certificateAuthorityAccountId:
          format: uuid
          type: string
        certificateAuthorityProductOptionId:
          format: uuid
          type: string
        companyId:
          format: uuid
          type: string
        consumerTsgIds:
          items:
            type: string
          type: array
          uniqueItems: true
        creationDate:
          format: date-time
          type: string
        csrUploadAllowed:
          type: boolean
        description:
          type: string
        driverGeneratedCsr:
          type: boolean
        driverId:
          format: uuid
          type: string
        everyoneIsConsumer:
          type: boolean
        extendedKeyUsageValues:
          items:
            enum:
            - SERVER
            - CLIENT
            type: string
          type: array
          uniqueItems: true
        id:
          format: uuid
          type: string
        keyGeneratedByVenafiAllowed:
          type: boolean
        keyPairId:
          format: uuid
          type: string
        keyReuse:
          type: boolean
        keyTypes:
          items:
            $ref: '#/components/schemas/KeyTypeInformation2'
          type: array
        locationId:
          format: uuid
          type: string
        modificationDate:
          format: date-time
          type: string
        name:
          type: string
        priority:
          format: int32
          type: integer
        product:
          $ref: '#/components/schemas/CertificateAuthorityProductInformation2'
        reason:
          type: string
        recommendedSettings:
          $ref: '#/components/schemas/RecommendedSettingsInformation2'
        referencingApplicationIds:
          items:
            format: uuid
            type: string
          type: array
        resourceConsumerTeamIds:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        resourceConsumerUserIds:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        sanDnsNameRegexes:
          items:
            type: string
          type: array
        sanIpAddressRegexes:
          items:
            type: string
          type: array
        sanRegexes:
          items:
            type: string
          type: array
        sanRfc822NameRegexes:
          items:
            type: string
          type: array
        sanUniformResourceIdentifierRegexes:
          items:
            type: string
          type: array
        shareWithAll:
          type: boolean
        status:
          enum:
          - AVAILABLE
          - UNAVAILABLE
          type: string
        subjectCNRegexes:
          items:
            type: string
          type: array
        subjectCValues:
          items:
            type: string
          type: array
        subjectLRegexes:
          items:
            type: string
          type: array
        subjectORegexes:
          items:
            type: string
          type: array
        subjectOURegexes:
          items:
            type: string
          type: array
        subjectSTRegexes:
          items:
            type: string
          type: array
        systemGenerated:
          type: boolean
        trackingData:
          $ref: '#/components/schemas/TrackingDataInformation'
      type: object
    RecommendedSettingsRequest:
      properties:
        key:
          $ref: '#/components/schemas/RecommendedSettingsKeyTypeParameter'
        keyGeneratedBy:
          type: string
        sanRegexes:
          items:
            type: string
          type: array
        subjectCNRegexes:
          items:
            type: string
          type: array
        subjectCValue:
          pattern: ^(([A-Z]{2})|(\.\*))$
          type: string
        subjectLValue:
          pattern: '[^\*]*'
          type: string
        subjectOUValue:
          pattern: '[^\*]*'
          type: string
        subjectOValue:
          pattern: '[^\*]*'
          type: string
        subjectSTValue:
          pattern: '[^\*]*'
          type: string
      type: object
    KeyTypeInformation2:
      discriminator:
        propertyName: keyType
      properties:
        keyType:
          type: string
      type: object
    CertificateIssuingTemplateResponse:
      properties:
        certificateIssuingTemplates:
          items:
            $ref: '#/components/schemas/CertificateIssuingTemplateInformation2'
          type: array
      type: object
    ErrorInformation8:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue8'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    IssuingTemplateDomainsSyncResponse:
      properties:
        issuingTemplatesInformationList:
          items:
            $ref: '#/components/schemas/IssuingTemplateDomainsSyncInformation'
          type: array
      type: object
    ErrorResponse10:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation8'
          type: array
      type: object
    IssuingTemplateDomainsSyncInformation:
      properties:
        error:
          $ref: '#/components/schemas/ErrorInformation8'
        issuingTemplateId:
          format: uuid
          type: string
        status:
          enum:
          - COMPLETED
          - FAILED
          type: string
      type: object
    AnyValue8:
      description: Can be any value - string, number, boolean, array or object.
    IssuingTemplatesDomainsSyncRequest:
      properties:
        action:
          enum:
          - REPLACE
          type: string
        certificateAuthorityAccountId:
          format: uuid
          type: string
        issuingTemplatesIds:
          description: Set of UUIDs of the issuing templates
          example:
          - 265f6d30-a0bb-11ed-aee0-89fe7e5f5d0c
          items:
            description: Set of UUIDs of the issuing templates
            format: uuid
            type: string
          minItems: 1
          type: array
          uniqueItems: true
      required:
      - action
      - certificateAuthorityAccountId
      - issuingTemplatesIds
      type: object
    RecommendedSettingsKeyTypeParameter:
      properties:
        curve:
          enum:
          - P256
          - P384
          - P521
          - ED25519
          - UNKNOWN
          type: string
        length:
          format: int32
          type: integer
        type:
          enum:
          - RSA
          - EC
          type: string
      type: object
    RecommendedSettingsInformation2:
      properties:
        key:
          $ref: '#/components/schemas/RecommendedSettingsKeyTypeInformation2'
        keyGeneratedBy:
          type: string
        sanRegexes:
          items:
            type: string
          type: array
        subjectCNRegexes:
          items:
            type: string
          type: array
        subjectCValue:
          type: string
        subjectLValue:
          type: string
        subjectOUValue:
          type: string
        subjectOValue:
          type: string
        subjectSTValue:
          type: string
      type: object
    RecommendedSettingsKeyTypeInformation2:
      properties:
        curve:
          enum:
          - P256
          - P384
          - P521
          - ED25519
          - UNKNOWN
          type: string
        length:
          format: int32
          type: integer
        type:
          enum:
          - RSA
          - EC
          type: string
      type: object
    TrackingDataInformation:
      discriminator:
        propertyName: certificateAuthority
      properties:
        certificateAuthority:
          type: string
      required:
      - certificateAuthority
      type: object
    CertificateIssuingTemplateRequest:
      properties:
        certificateAuthority:
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          - CONNECTOR
          - BUILTIN_GEN2
          type: string
        certificateAuthorityProductOptionId:
          format: uuid
          type: string
        consumerTsgIds:
          items:
            type: string
          type: array
          uniqueItems: true
        csrUploadAllowed:
          type: boolean
        description:
          maxLength: 1024
          type: string
        driverGeneratedCsr:
          type: boolean
        driverId:
          format: uuid
          type: string
        everyoneIsConsumer:
          type: boolean
        extendedKeyUsageValues:
          items:
            enum:
            - SERVER
            - CLIENT
            type: string
          type: array
          uniqueItems: true
        keyGeneratedByVenafiAllowed:
          type: boolean
        keyPairId:
          format: uuid
          type: string
        keyReuse:
          type: boolean
        keyTypes:
          items:
            $ref: '#/components/schemas/KeyTypeParameters2'
          type: array
        locationId:
          format: uuid
          type: string
        name:
          maxLength: 64
          type: string
        priority:
          format: int32
          type: integer
        product:
          $ref: '#/components/schemas/CertificateAuthorityProductInformation2'
        recommendedSettings:
          $ref: '#/components/schemas/RecommendedSettingsRequest'
        resourceConsumerTeamIds:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        resourceConsumerUserIds:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        sanIpAddressRegexes:
          items:
            type: string
          type: array
        sanRegexes:
          items:
            type: string
          type: array
        sanRfc822NameRegexes:
          items:
            type: string
          type: array
        sanUniformResourceIdentifierRegexes:
          items:
            type: string
          type: array
        shareWithAll:
          type: boolean
        subjectCNRegexes:
          items:
            type: string
          type: array
        subjectCValues:
          items:
            type: string
          type: array
        subjectLRegexes:
          items:
            type: string
          type: array
        subjectORegexes:
          items:
            type: string
          type: array
        subjectOURegexes:
          items:
            type: string
          type: array
        subjectSTRegexes:
          items:
            type: string
          type: array
        trackingData:
          $ref: '#/components/schemas/TrackingDataInformation'
      required:
      - certificateAuthority
      - certificateAuthorityProductOptionId
      - keyReuse
      - keyTypes
      - name
      - product
      type: object
    CertificateAuthorityProductInformation2:
      description: Product specific for external certificate authority
      discriminator:
        propertyName: certificateAuthority
      properties:
        certificateAuthority:
          type: string
        certificateType:
          enum:
          - OTHER
          - DOMAIN_VALIDATED_SSL
          type: string
        hashAlgorithm:
          enum:
          - MD5
          - SHA1
          - MD2
          - SHA224
          - SHA256
          - SHA384
          - SHA512
          - UNKNOWN
          - GOSTR3411_94
          - SHA3_224
          - SHA3_256
          - SHA3_384
          - SHA3_512
          - RIPEMD128
          - RIPEMD160
          - RIPEMD256
          - SHA512_224
          - SHA512_256
          - SM3
          - GOSTR3411_2012_256
          - GOSTR3411_2012_512
          - SHAKE128
          - SHAKE256
          type: string
        productName:
          type: string
        productTypes:
          items:
            enum:
            - SSL
            - CODESIGN
            type: string
          readOnly: true
          type: array
        validityPeriod:
          description: ISO8601 Period Format
          example: PnYnMnDTnHnMnS
          type: string
      required:
      - certificateAuthority
      type: object
    KeyTypeParameters2:
      properties:
        keyCurves:
          items:
            enum:
            - P256
            - P384
            - P521
            - ED25519
            - UNKNOWN
            type: string
          type: array
        keyLengths:
          items:
            format: int32
            type: integer
          type: array
        keyType:
          enum:
          - RSA
          - EC
          type: string
      required:
      - keyType
      type: object
  securitySchemes:
    service-account:
      in: header
      name: service-account
      type: apiKey
    tppl-api-key:
      in: header
      name: tppl-api-key
      type: apiKey
x-readme:
  samples-languages:
  - curl
  - go
  - java
  - javascript
  - node
  - python