openapi: 3.2.0
info:
  title: Certificate Manager - SaaS Workload Identity Manager…
  version: '1.0'
servers:
- description: US Region
  url: https://api.venafi.cloud
- description: EU Region
  url: https://api.eu.venafi.cloud
- description: AU Region
  url: https://api.au.venafi.cloud
- description: UK Region
  url: https://api.uk.venafi.cloud
- description: SG Region
  url: https://api.sg.venafi.cloud
- description: CA Region
  url: https://api.ca.venafi.cloud
tags:
- name: Workload Identity Manager Intermediate Certificates
paths:
  /v1/distributedissuers/intermediatecertificates:
    get:
      description: Retrieves the details of all Issuer intermediate certificates. These are the CA certificates issued to the Issuer instances that allow them to issue short-lived certificates.
      operationId: intermediatecertificates_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntermediateCertificateListResponse'
          description: All Issuer intermediate certificates and details.
      security:
      - tppl-api-key: []
      summary: Get the details of all Issuer intermediate certificates
      tags:
      - Workload Identity Manager Intermediate Certificates
      x-rbac:
        permissions:
          access_type: read
          description: Ability to get issuer intermediate certificate
          name: ngts.issuer_intermediate_certificate.get
        roles:
        - PKIAdmin
        - PlatformAdmin
        - ResourceOwner
        - Guest
components:
  schemas:
    IntermediateCertificateGetResponse:
      properties:
        certificate:
          description: Intermediate certificate bytes in PEM format
          format: PEM
          type: string
        commonName:
          description: Common name of the Intermediate certificate
          example: example.com
          type: string
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        configuration:
          $ref: '#/components/schemas/ConfigurationGetResponse'
        creationDate:
          description: When the intermediate certificate was created
          example: '2022-10-10T14:50:41.71Z'
          format: date-time
          type: string
        errorInformation:
          $ref: '#/components/schemas/Error1'
        fingerprint:
          description: Intermediate certificate fingerprint
          type: string
        id:
          description: UUID of the intermediate certificate
          example: 265f6d30-a0bb-11ed-aee0-89fe7e5f5d0c
          format: uuid
          type: string
        issuerCertificates:
          description: Intermediate certificate chain bytes in PEM format
          items:
            description: Intermediate certificate chain bytes in PEM format
            type: string
          type: array
        longLivedCertCount:
          description: Number of long lived certificates
          example: 1
          format: int64
          type: integer
        modificationDate:
          description: When the intermediate certificate was last modified
          example: '2023-12-12T20:00:10.5Z'
          format: date-time
          type: string
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 10
          format: int64
          type: integer
        status:
          description: Status of the Intermediate certificate request
          enum:
          - NEW
          - PENDING
          - REQUESTED
          - ISSUED
          - REJECTED
          - CANCELLED
          - REVOKED
          - FAILED
          - DELETED
          example: ISSUED
          type: string
        subTsgId:
          description: Sub-TSG ID this intermediate certificate belongs to; null for non-NGTS tenants
          type: string
        totalCertCount:
          description: Total number of certificates — the sum of `longLivedCertCount`, `shortLivedCertCount` and `ultraShortLivedCertCount`. Derived, read-only.
          example: 111
          format: int64
          type: integer
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 100
          format: int64
          type: integer
        validityEnd:
          description: Intermediate certificate validity end date
          format: date-time
          type: string
        validityStart:
          description: Intermediate certificate validity start date
          format: date-time
          type: string
        workflowId:
          description: Intermediate certificate workflow id
          type: string
      type: object
    ConfigurationGetResponse:
      discriminator:
        mapping:
          DISTRIBUTED_ISSUER: '#/components/schemas/DistributedIssuerConfigurationGetResponse'
          FORWARD_TRUST_PROXY: '#/components/schemas/ForwardTrustProxyConfigurationGetResponse'
        propertyName: issuerKind
      oneOf:
      - $ref: '#/components/schemas/DistributedIssuerConfigurationGetResponse'
      - $ref: '#/components/schemas/ForwardTrustProxyConfigurationGetResponse'
      properties:
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        creationDate:
          description: When the configuration was initially created
          example: '2022-10-10T14:50:41.71Z'
          format: date-time
          type: string
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - DISTRIBUTED_ISSUER
          - FORWARD_TRUST_PROXY
          type: string
        modificationDate:
          description: When the configuration was last modified
          example: '2023-12-12T20:00:10.5Z'
          format: date-time
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
        subTsgId:
          description: Sub-TSG ID that owns this configuration (null for Primary TSG)
          example: a007d406bf
          type: string
      required:
      - issuerKind
      type: object
    DistributedIssuerConfigurationGetResponse:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettings'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthentication'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorization'
        cloudProviders:
          $ref: '#/components/schemas/CloudProviders'
        controllerAllowedPolicyIds:
          description: Array of UUIDs of policies that the kubernetes controller is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - DISTRIBUTED_ISSUER
          type: string
        longLivedCertCount:
          description: Number of long lived certificates
          example: 2
          format: int64
          type: integer
        minTlsVersion:
          $ref: '#/components/schemas/MinTLSVersion'
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 20
          format: int64
          type: integer
        totalCertCount:
          description: Total number of certificates — the sum of `longLivedCertCount`, `shortLivedCertCount` and `ultraShortLivedCertCount`. Derived, read-only.
          example: 222
          format: int64
          type: integer
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 200
          format: int64
          type: integer
        unixSocketAllowedPolicyIds:
          description: Array of UUIDs of policies that are permitted to be used when using the unix socket
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
      required:
      - issuerKind
      type: object
    IntermediateCertificateListResponse:
      properties:
        intermediateCertificates:
          items:
            $ref: '#/components/schemas/IntermediateCertificateGetResponse'
          type: array
      type: object
    ClientAuthentication:
      discriminator:
        mapping:
          JWT_JWKS: '#/components/schemas/JWTJWKSAuthentication'
          JWT_OIDC: '#/components/schemas/JWTOIDCAuthentication'
          JWT_STANDARD_CLAIMS: '#/components/schemas/JWTStandardClaimsAuthentication'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/JWTStandardClaimsAuthentication'
      - $ref: '#/components/schemas/JWTJWKSAuthentication'
      - $ref: '#/components/schemas/JWTOIDCAuthentication'
      properties:
        type:
          type: string
      required:
      - type
      type: object
    AdvancedSettings:
      properties:
        enableIssuanceAuditLog:
          description: Whether audit log entries must be generated for each issued certificate
          example: false
          type: boolean
        includeRawCertDataInAuditLog:
          description: Whether the raw certificate data must be included in the audit log entry
          example: false
          type: boolean
        requireFIPSCompliantBuild:
          description: Whether FIPS-compliant build is required
          example: false
          type: boolean
      type: object
    AzureCloudProvider:
      properties:
        subscriptionIds:
          description: Array of Azure subscription IDs each of which should be UUID
          example:
          - 8d10da13-8125-4ba9-a717-bf7490507b3d
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - subscriptionIds
      type: object
    JWTClient:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          maxLength: 2048
          type: string
        jwksUri:
          description: URL used to pull the trusted signing keys used for validation
          example: https://www.example.com:6443/jwks
          maxLength: 2048
          type: string
        name:
          description: Name of the client
          example: Some client
          maxLength: 64
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          minItems: 1
          type: array
      required:
      - allowedPolicyIds
      - issuer
      - name
      - subjects
      type: object
    JWTOIDCAuthentication:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use. Server-populated on responses from the parent configuration's policyIds; ignored on requests.
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          readOnly: true
          type: array
        audience:
          description: OpenId audience
          example: Client1
          maxLength: 256
          type: string
        baseUrl:
          description: JWT OpenId base URL
          example: https://openid.example.com
          maxLength: 2048
          type: string
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_OIDC
          type: string
      required:
      - type
      - audience
      - baseUrl
      type: object
    ClientAuthorization:
      properties:
        customClaimsAliases:
          $ref: '#/components/schemas/CustomClaimsAliases'
      type: object
    AWSCloudProvider:
      properties:
        accountIds:
          description: Array of AWS account IDs each of which should be a 12-digit identifier
          example:
          - '123456789012'
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of AWS regions
          example:
          - us-west-1
          items:
            enum:
            - us-east-1
            - us-east-2
            - us-west-1
            - us-west-2
            - af-south-1
            - ap-east-1
            - ap-south-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-south-1
            - ap-northeast-3
            - ap-northeast-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-northeast-1
            - ca-central-1
            - eu-central-1
            - eu-west-1
            - eu-west-2
            - eu-south-1
            - eu-west-3
            - eu-south-2
            - eu-north-1
            - eu-central-2
            - me-south-1
            - me-central-1
            - sa-east-1
            - us-gov-east-1
            - us-gov-west-1
            type: string
          type: array
      required:
      - accountIds
      - regions
      type: object
    MinTLSVersion:
      description: Minimum required TLS protocol version
      enum:
      - TLS12
      - TLS13
      type: string
    CustomClaimsAliases:
      properties:
        allowAllPolicies:
          maxLength: 128
          type: string
        allowedPolicies:
          maxLength: 128
          type: string
        configuration:
          maxLength: 128
          type: string
      type: object
    CloudProviders:
      properties:
        aws:
          $ref: '#/components/schemas/AWSCloudProvider'
        azure:
          $ref: '#/components/schemas/AzureCloudProvider'
        google:
          $ref: '#/components/schemas/GoogleCloudProvider'
      type: object
    JWTStandardClaimsAuthentication:
      properties:
        audience:
          description: Recipients that the JWT is intended for
          example: Client1
          maxLength: 256
          type: string
        clients:
          description: List with clients, identified by processing JWTs that include standard/registered claims
          items:
            $ref: '#/components/schemas/JWTClient'
          minItems: 1
          type: array
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_STANDARD_CLAIMS
          type: string
      required:
      - type
      - audience
      - clients
      type: object
    ForwardTrustProxyConfigurationGetResponse:
      description: Configuration that issues forward-trust proxy intermediate certificates. It references only a Sub CA provider; the policy, client authentication/authorization, cloud-provider, advanced-settings, min-TLS-version and service-account fields do not apply.
      properties:
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - FORWARD_TRUST_PROXY
          type: string
        subCaProviderId:
          description: UUID of the Sub CA provider associated with the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
      required:
      - issuerKind
      type: object
    JWTJWKSAuthentication:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use. Server-populated on responses from the parent configuration's policyIds; ignored on requests.
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          readOnly: true
          type: array
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_JWKS
          type: string
        urls:
          description: Array of JWT JWKS urls
          example:
          - https://jwks.example.com
          items:
            type: string
          minItems: 1
          type: array
      required:
      - type
      - urls
      type: object
    GoogleCloudProvider:
      properties:
        projectIdentifiers:
          description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
          example:
          - '415104041262'
          - tokyo-rain-123
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of Google regions
          example:
          - us-west1
          items:
            enum:
            - asia-east1
            - asia-east2
            - asia-northeast1
            - asia-northeast2
            - asia-northeast3
            - asia-south1
            - asia-south2
            - asia-southeast1
            - asia-southeast2
            - australia-southeast1
            - australia-southeast2
            - europe-central2
            - europe-north1
            - europe-southwest1
            - europe-west1
            - europe-west12
            - europe-west2
            - europe-west3
            - europe-west4
            - europe-west6
            - europe-west8
            - europe-west9
            - me-central1
            - me-west1
            - northamerica-northeast1
            - northamerica-northeast2
            - southamerica-east1
            - southamerica-west1
            - us-central1
            - us-east1
            - us-east4
            - us-east5
            - us-south1
            - us-west1
            - us-west2
            - us-west3
            - us-west4
            type: string
          type: array
      required:
      - projectIdentifiers
      - regions
      type: object
    Error1:
      description: A single error. The numeric `code` is stable and matches the codes listed at the start of each cause in the endpoints' error-response descriptions, so clients can branch on it instead of parsing `message`.
      properties:
        args:
          description: Positional values interpolated into the message (e.g. the offending field value or entity id).
          items:
            type: object
          type: array
        code:
          description: Stable numeric error code identifying the specific failure.
          format: int32
          type: integer
        message:
          description: Human-readable description of the error.
          type: string
      type: object
  securitySchemes:
    service-account:
      in: header
      name: service-account
      type: apiKey
    tppl-api-key:
      in: header
      name: tppl-api-key
      type: apiKey
x-readme:
  samples-languages:
  - curl
  - go
  - java
  - javascript
  - node
  - python