openapi: 3.2.0
info:
  title: Certificate Manager - SaaS Workload Identity Manager…
  version: '1.0'
servers:
- description: US Region
  url: https://api.venafi.cloud
- description: EU Region
  url: https://api.eu.venafi.cloud
- description: AU Region
  url: https://api.au.venafi.cloud
- description: UK Region
  url: https://api.uk.venafi.cloud
- description: SG Region
  url: https://api.sg.venafi.cloud
- description: CA Region
  url: https://api.ca.venafi.cloud
tags:
- name: Workload Identity Manager Policies
paths:
  /v1/distributedissuers/policies:
    post:
      description: Add a new a Workload Issuance Policy for an Issuer to use to ensure compliance with company restrictions for creating certificates.
      operationId: policies_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyCreateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyGetResponse'
          description: Workload Issuance policy was created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: "The request was rejected. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; a\n  `keyUsages` value is unsupported; a `keyAlgorithm` allowed or default\n  value is unsupported; or sharing is requested outside a Strata context\n  or with both `shareWithAll` and `sharedWithSubTsgIds` set.\n- 50100: `name` is empty.\n- 50101: `validityPeriod` is empty or not a valid ISO-8601 period.\n- 50102: `subject` is omitted from the body.\n- 50103: `sans` is omitted from the body.\n- 50104: `keyUsages` list is empty.\n- 50105: `extendedKeyUsages` list is empty.\n- 50106: `keyAlgorithm` is omitted.\n- 50107: `keyAlgorithm.allowedValues` list is empty.\n- 50108: `keyAlgorithm.defaultValue` is empty.\n- 50111: A policy with the same `name` already exists.\n- 50112: Invalid subject common name.\n- 50113: Invalid subject organization.\n- 50114: Invalid subject organizational unit.\n- 50115: Invalid subject locality.\n- 50116: Invalid subject state or province.\n- 50117: Invalid subject country.\n- 50118: Invalid SAN DNS name.\n- 50119: Invalid SAN IP address.\n- 50120: Invalid SAN RFC822/email name.\n- 50121: Invalid SAN URI.\n- 50122: `name` is longer than 64 characters.\n- 50123: `extendedKeyUsages` contains a value unsupported by Workload Identity Manager.\n- 50124: A sub-TSG id is not a 10-digit number starting with 1."
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The request was forbidden. Possible causes, by error code:

            - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
      security:
      - tppl-api-key: []
      summary: Create a new Workload Issuance policy
      tags:
      - Workload Identity Manager Policies
      x-rbac:
        permissions:
          access_type: write
          description: Ability to create workload issuance policy
          name: ngts.workload_issuance_policy.create
        roles:
        - PKIAdmin
    get:
      description: Retrieves all policy details for all Workload Issuance policies. Policies are sets of rules that constrain how certificates can be issued, as well as set default values for some fields.
      operationId: policies_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyListResponse'
          description: All Workload Issuance policies; details in response body.
      security:
      - tppl-api-key: []
      summary: Get the details of all Workload Issuance policies
      tags:
      - Workload Identity Manager Policies
      x-rbac:
        permissions:
          access_type: read
          description: Ability to get workload issuance policy
          name: ngts.workload_issuance_policy.get
        roles:
        - PKIAdmin
        - PlatformAdmin
        - ResourceOwner
        - Guest
  /v1/distributedissuers/policies/{id}:
    get:
      description: Retrieves the details of the Workload Issuance policy with the specified `id`.
      operationId: policies_getById
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyGetResponse'
          description: Specified Workload Issuance policy found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The request was rejected. Possible causes, by error code:

            - 10055: The `id` path parameter is not a valid UUID.'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The referenced entity was not found. Possible causes, by error code:

            - 10051: No Workload Issuance policy with the given `id` exists in this tenant.'
      security:
      - tppl-api-key: []
      summary: Get a Workload Issuance policy's details
      tags:
      - Workload Identity Manager Policies
      x-rbac:
        permissions:
          access_type: read
          description: Ability to get workload issuance policy
          name: ngts.workload_issuance_policy.get
        roles:
        - PKIAdmin
        - PlatformAdmin
        - ResourceOwner
        - Guest
    patch:
      description: Updates (replaces) details of the Workload Issuance policy that has the specified `id`. Only fields specified in the request will be updated. Fields not included in the request will be ignored.
      operationId: policies_update
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtendedPolicyGetResponse'
          description: Workload Issuance policy updated.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: "The request was rejected. Supplied fields are validated with the same\nrules as on create. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; a\n  `keyUsages` value is unsupported; a `keyAlgorithm` allowed or default\n  value is unsupported; or sharing is requested outside a Strata context\n  or with both `shareWithAll` and `sharedWithSubTsgIds` set.\n- 10055: The `id` path parameter is not a valid UUID.\n- 50100: `name` is empty.\n- 50101: `validityPeriod` is not a valid ISO-8601 period.\n- 50107: `keyAlgorithm.allowedValues` list is empty (only when `keyAlgorithm` is supplied).\n- 50108: `keyAlgorithm.defaultValue` is empty (only when `keyAlgorithm` is supplied).\n- 50111: A different policy with the same `name` already exists.\n- 50112: Invalid subject common name.\n- 50113: Invalid subject organization.\n- 50114: Invalid subject organizational unit.\n- 50115: Invalid subject locality.\n- 50116: Invalid subject state or province.\n- 50117: Invalid subject country.\n- 50118: Invalid SAN DNS name.\n- 50119: Invalid SAN IP address.\n- 50120: Invalid SAN RFC822/email name.\n- 50121: Invalid SAN URI.\n- 50122: `name` is longer than 64 characters.\n- 50123: `extendedKeyUsages` contains a value unsupported by Workload Identity Manager.\n- 50124: A sub-TSG id is not a 10-digit number starting with 1."
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The request was forbidden. Possible causes, by error code:

            - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The referenced entity was not found. Possible causes, by error code:

            - 10051: No Workload Issuance policy with the given `id` exists in this tenant.'
      security:
      - tppl-api-key: []
      summary: Update a Workload Issuance policy's details
      tags:
      - Workload Identity Manager Policies
      x-rbac:
        permissions:
          access_type: write
          description: Ability to update workload issuance policy
          name: ngts.workload_issuance_policy.update
        roles:
        - PKIAdmin
    delete:
      description: Deletes the Workload Issuance policy that has the specified `id`.
      operationId: policies_delete
      parameters:
      - description: Workload Issuance policy UUID
        in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyDeleteResponse'
          description: Specified Workload Issuance policy was deleted
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: "The request was rejected. Possible causes, by error code:\n- 10055: The `id` path parameter is not a valid UUID.\n- 50110: The policy cannot be deleted because it is still referenced by\n  one or more Issuer configurations; the response lists the blocking\n  configuration ids."
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The request was forbidden. Possible causes, by error code:

            - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: 'The referenced entity was not found. Possible causes, by error code:

            - 10051: No Workload Issuance policy with the given `id` exists in this tenant.'
      security:
      - tppl-api-key: []
      summary: Remove a Workload Issuance policy
      tags:
      - Workload Identity Manager Policies
      x-rbac:
        permissions:
          access_type: write
          description: Ability to delete workload issuance policy
          name: ngts.workload_issuance_policy.delete
        roles:
        - PKIAdmin
components:
  schemas:
    ExtendedPolicyGetResponse:
      allOf:
      - $ref: '#/components/schemas/PolicyGetResponse'
      - properties:
          configurations:
            items:
              $ref: '#/components/schemas/ConfigurationGetResponse'
            type: array
        type: object
    PolicyListResponse:
      properties:
        policies:
          items:
            $ref: '#/components/schemas/ExtendedPolicyGetResponse'
          type: array
      type: object
    ConfigurationGetResponse:
      discriminator:
        mapping:
          DISTRIBUTED_ISSUER: '#/components/schemas/DistributedIssuerConfigurationGetResponse'
          FORWARD_TRUST_PROXY: '#/components/schemas/ForwardTrustProxyConfigurationGetResponse'
        propertyName: issuerKind
      oneOf:
      - $ref: '#/components/schemas/DistributedIssuerConfigurationGetResponse'
      - $ref: '#/components/schemas/ForwardTrustProxyConfigurationGetResponse'
      properties:
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        creationDate:
          description: When the configuration was initially created
          example: '2022-10-10T14:50:41.71Z'
          format: date-time
          type: string
        id:
          description: UUID of the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - DISTRIBUTED_ISSUER
          - FORWARD_TRUST_PROXY
          type: string
        modificationDate:
          description: When the configuration was last modified
          example: '2023-12-12T20:00:10.5Z'
          format: date-time
          type: string
        name:
          description: Name of the configuration
          example: Some configuration
          type: string
        subTsgId:
          description: Sub-TSG ID that owns this configuration (null for Primary TSG)
          example: a007d406bf
          type: string
      required:
      - issuerKind
      type: object
    DistributedIssuerConfigurationGetResponse:
      properties:
        advancedSettings:
          $ref: '#/components/schemas/AdvancedSettings'
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthentication'
        clientAuthorization:
          $ref: '#/components/schemas/ClientAuthorization'
        cloudProviders:
          $ref: '#/components/schemas/CloudProviders'
        controllerAllowedPolicyIds:
          description: Array of UUIDs of policies that the kubernetes controller is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - DISTRIBUTED_ISSUER
          type: string
        longLivedCertCount:
          description: Number of long lived certificates
          example: 2
          format: int64
          type: integer
        minTlsVersion:
          $ref: '#/components/schemas/MinTLSVersion'
        policyIds:
          description: Array of UUIDs of policies to associate with the configuration
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
        serviceAccountIds:
          items:
            format: uuid
            type: string
          type: array
        shortLivedCertCount:
          description: Number of short lived certificates
          example: 20
          format: int64
          type: integer
        totalCertCount:
          description: Total number of certificates — the sum of `longLivedCertCount`, `shortLivedCertCount` and `ultraShortLivedCertCount`. Derived, read-only.
          example: 222
          format: int64
          type: integer
        ultraShortLivedCertCount:
          description: Number of ultra short lived certificates
          example: 200
          format: int64
          type: integer
        unixSocketAllowedPolicyIds:
          description: Array of UUIDs of policies that are permitted to be used when using the unix socket
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          type: array
      required:
      - issuerKind
      type: object
    KeyAlgorithm1:
      description: Key algorithm type
      enum:
      - RSA_2048
      - RSA_3072
      - RSA_4096
      - EC_P256
      - EC_P384
      - EC_P521
      - EC_ED25519
      example: EC_P256
      type: string
    ClientAuthentication:
      discriminator:
        mapping:
          JWT_JWKS: '#/components/schemas/JWTJWKSAuthentication'
          JWT_OIDC: '#/components/schemas/JWTOIDCAuthentication'
          JWT_STANDARD_CLAIMS: '#/components/schemas/JWTStandardClaimsAuthentication'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/JWTStandardClaimsAuthentication'
      - $ref: '#/components/schemas/JWTJWKSAuthentication'
      - $ref: '#/components/schemas/JWTOIDCAuthentication'
      properties:
        type:
          type: string
      required:
      - type
      type: object
    AdvancedSettings:
      properties:
        enableIssuanceAuditLog:
          description: Whether audit log entries must be generated for each issued certificate
          example: false
          type: boolean
        includeRawCertDataInAuditLog:
          description: Whether the raw certificate data must be included in the audit log entry
          example: false
          type: boolean
        requireFIPSCompliantBuild:
          description: Whether FIPS-compliant build is required
          example: false
          type: boolean
      type: object
    Property:
      properties:
        allowedValues:
          items:
            type: string
          type: array
        defaultValues:
          items:
            type: string
          type: array
        maxOccurrences:
          format: int32
          type: integer
        minOccurrences:
          format: int32
          type: integer
        type:
          enum:
          - IGNORED
          - FORBIDDEN
          - OPTIONAL
          - REQUIRED
          - LOCKED
          type: string
      type: object
    AzureCloudProvider:
      properties:
        subscriptionIds:
          description: Array of Azure subscription IDs each of which should be UUID
          example:
          - 8d10da13-8125-4ba9-a717-bf7490507b3d
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - subscriptionIds
      type: object
    JWTClient:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
        issuer:
          description: Issuer of the JWT
          example: https://kubernetes.default.svc
          maxLength: 2048
          type: string
        jwksUri:
          description: URL used to pull the trusted signing keys used for validation
          example: https://www.example.com:6443/jwks
          maxLength: 2048
          type: string
        name:
          description: Name of the client
          example: Some client
          maxLength: 64
          type: string
        subjects:
          description: Array of subjects of the JWT
          example:
          - system:serviceaccount:venafi:application-team-1
          items:
            type: string
          minItems: 1
          type: array
      required:
      - allowedPolicyIds
      - issuer
      - name
      - subjects
      type: object
    JWTOIDCAuthentication:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use. Server-populated on responses from the parent configuration's policyIds; ignored on requests.
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          readOnly: true
          type: array
        audience:
          description: OpenId audience
          example: Client1
          maxLength: 256
          type: string
        baseUrl:
          description: JWT OpenId base URL
          example: https://openid.example.com
          maxLength: 2048
          type: string
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_OIDC
          type: string
      required:
      - type
      - audience
      - baseUrl
      type: object
    ClientAuthorization:
      properties:
        customClaimsAliases:
          $ref: '#/components/schemas/CustomClaimsAliases'
      type: object
    ErrorResponse3:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/Error1'
          type: array
      type: object
    AWSCloudProvider:
      properties:
        accountIds:
          description: Array of AWS account IDs each of which should be a 12-digit identifier
          example:
          - '123456789012'
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of AWS regions
          example:
          - us-west-1
          items:
            enum:
            - us-east-1
            - us-east-2
            - us-west-1
            - us-west-2
            - af-south-1
            - ap-east-1
            - ap-south-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-south-1
            - ap-northeast-3
            - ap-northeast-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-northeast-1
            - ca-central-1
            - eu-central-1
            - eu-west-1
            - eu-west-2
            - eu-south-1
            - eu-west-3
            - eu-south-2
            - eu-north-1
            - eu-central-2
            - me-south-1
            - me-central-1
            - sa-east-1
            - us-gov-east-1
            - us-gov-west-1
            type: string
          type: array
      required:
      - accountIds
      - regions
      type: object
    MinTLSVersion:
      description: Minimum required TLS protocol version
      enum:
      - TLS12
      - TLS13
      type: string
    ExtendedKeyUsage:
      description: Extended key usage
      enum:
      - ANY
      - SERVER_AUTH
      - CLIENT_AUTH
      - CODE_SIGNING
      - EMAIL_PROTECTION
      - IPSEC_ENDSYSTEM
      - IPSEC_TUNNEL
      - IPSEC_USER
      - TIME_STAMPING
      - OCSP_SIGNING
      - DVCS
      - SBGP_CERT_AA_SERVER_AUTH
      - SCVP_RESPONDER
      - EAP_OVER_PPP
      - EAP_OVER_LAN
      - SCVP_SERVER
      - SCVP_CLIENT
      - IPSEC_IKE
      - CAPWAP_AC
      - CAPWAP_WTP
      - IPSEC_IKE_INTERMEDIATE
      - SMARTCARD_LOGON
      type: string
    CustomClaimsAliases:
      properties:
        allowAllPolicies:
          maxLength: 128
          type: string
        allowedPolicies:
          maxLength: 128
          type: string
        configuration:
          maxLength: 128
          type: string
      type: object
    PolicyCreateRequest:
      allOf:
      - $ref: '#/components/schemas/PolicyUpdateRequest'
      - required:
        - extendedKeyUsages
        - keyAlgorithm
        - keyUsages
        - name
        - sans
        - subject
        - validityPeriod
        type: object
    CloudProviders:
      properties:
        aws:
          $ref: '#/components/schemas/AWSCloudProvider'
        azure:
          $ref: '#/components/schemas/AzureCloudProvider'
        google:
          $ref: '#/components/schemas/GoogleCloudProvider'
      type: object
    JWTStandardClaimsAuthentication:
      properties:
        audience:
          description: Recipients that the JWT is intended for
          example: Client1
          maxLength: 256
          type: string
        clients:
          description: List with clients, identified by processing JWTs that include standard/registered claims
          items:
            $ref: '#/components/schemas/JWTClient'
          minItems: 1
          type: array
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_STANDARD_CLAIMS
          type: string
      required:
      - type
      - audience
      - clients
      type: object
    SANs:
      description: Subject alternative names
      properties:
        dnsNames:
          $ref: '#/components/schemas/Property'
        ipAddresses:
          $ref: '#/components/schemas/Property'
        rfc822Names:
          $ref: '#/components/schemas/Property'
        uniformResourceIdentifiers:
          $ref: '#/components/schemas/Property'
      type: object
    PolicyGetResponse:
      properties:
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        creationDate:
          description: When the policy was initially created
          example: '2022-10-10T14:50:41.71Z'
          format: date-time
          type: string
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            $ref: '#/components/schemas/ExtendedKeyUsage'
          type: array
        id:
          description: UUID of the policy
          example: 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          type: string
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            $ref: '#/components/schemas/KeyUsage'
          type: array
        modificationDate:
          description: When the policy was last modified
          example: '2023-12-12T20:00:10.5Z'
          format: date-time
          type: string
        name:
          description: Name of the policy
          example: Some policy
          type: string
        sans:
          $ref: '#/components/schemas/SANs'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this policy is shared with
            type: string
          type: array
          uniqueItems: true
        subject:
          $ref: '#/components/schemas/SubjectAttributes'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    ForwardTrustProxyConfigurationGetResponse:
      description: Configuration that issues forward-trust proxy intermediate certificates. It references only a Sub CA provider; the policy, client authentication/authorization, cloud-provider, advanced-settings, min-TLS-version and service-account fields do not apply.
      properties:
        issuerKind:
          description: The kind of issuer this configuration represents
          enum:
          - FORWARD_TRUST_PROXY
          type: string
        subCaProviderId:
          description: UUID of the Sub CA provider associated with the configuration
          example: 7268d820-a08d-11ed-bbc0-252385d6d389
          format: uuid
          type: string
      required:
      - issuerKind
      type: object
    JWTJWKSAuthentication:
      properties:
        allowedPolicyIds:
          description: Array of UUIDs of policies that the client is permitted to use. Server-populated on responses from the parent configuration's policyIds; ignored on requests.
          example:
          - 8ae92800-b1e0-11ed-859d-b39255f965ee
          items:
            format: uuid
            type: string
          readOnly: true
          type: array
        type:
          description: Discriminator for the client authentication method
          enum:
          - JWT_JWKS
          type: string
        urls:
          description: Array of JWT JWKS urls
          example:
          - https://jwks.example.com
          items:
            type: string
          minItems: 1
          type: array
      required:
      - type
      - urls
      type: object
    GoogleCloudProvider:
      properties:
        projectIdentifiers:
          description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
          example:
          - '415104041262'
          - tokyo-rain-123
          items:
            type: string
          minItems: 1
          type: array
        regions:
          description: Array of Google regions
          example:
          - us-west1
          items:
            enum:
            - asia-east1
            - asia-east2
            - asia-northeast1
            - asia-northeast2
            - asia-northeast3
            - asia-south1
            - asia-south2
            - asia-southeast1
            - asia-southeast2
            - australia-southeast1
            - australia-southeast2
            - europe-central2
            - europe-north1
            - europe-southwest1
            - europe-west1
            - europe-west12
            - europe-west2
            - europe-west3
            - europe-west4
            - europe-west6
            - europe-west8
            - europe-west9
            - me-central1
            - me-west1
            - northamerica-northeast1
            - northamerica-northeast2
            - southamerica-east1
            - southamerica-west1
            - us-central1
            - us-east1
            - us-east4
            - us-east5
            - us-south1
            - us-west1
            - us-west2
            - us-west3
            - us-west4
            type: string
          type: array
      required:
      - projectIdentifiers
      - regions
      type: object
    Error1:
      description: A single error. The numeric `code` is stable and matches the codes listed at the start of each cause in the endpoints' error-response descriptions, so clients can branch on it instead of parsing `message`.
      properties:
        args:
          description: Positional values interpolated into the message (e.g. the offending field value or entity id).
          items:
            type: object
          type: array
        code:
          description: Stable numeric error code identifying the specific failure.
          format: int32
          type: integer
        message:
          description: Human-readable description of the error.
          type: string
      type: object
    KeyAlgorithmInformation:
      description: Key algorithm
      properties:
        allowedValues:
          description: Key algorithm allowed values
          items:
            $ref: '#/components/schemas/KeyAlgorithm1'
          minItems: 1
          type: array
        defaultValue:
          $ref: '#/components/schemas/KeyAlgorithm1'
      required:
      - allowedValues
      - defaultValue
      type: object
    PolicyDeleteResponse:
      properties:
        id:
          description: UUID of the policy
          example: 8ae92800-b1e0-11ed-859d-b39255f965ee
          format: uuid
          type: string
        name:
          description: Name of the policy
          example: Some policy
          type: string
      type: object
    KeyUsage:
      description: Key usage
      enum:
      - digitalSignature
      - nonRepudiation
      - keyEncipherment
      - dataEncipherment
      - keyAgreement
      - keyCertSign
      - cRLSign
      - encipherOnly
      - decipherOnly
      type: string
    SubjectAttributes:
      description: Subject attributes
      properties:
        commonName:
          $ref: '#/components/schemas/Property'
        country:
          $ref: '#/components/schemas/Property'
        locality:
          $ref: '#/components/schemas/Property'
        organization:
          $ref: '#/components/schemas/Property'
        organizationalUnit:
          $ref: '#/components/schemas/Property'
        stateOrProvince:
          $ref: '#/components/schemas/Property'
      type: object
    PolicyUpdateRequest:
      properties:
        extendedKeyUsages:
          description: Extended key usages
          example:
          - CLIENT_AUTH
          - SERVER_AUTH
          items:
            $ref: '#/components/schemas/ExtendedKeyUsage'
          minItems: 1
          type: array
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithmInformation'
        keyUsages:
          description: Key usages
          example:
          - keyEncipherment
          - digitalSignature
          items:
            $ref: '#/components/schemas/KeyUsage'
          minItems: 1
          type: array
        name:
          description: Name of the policy
          example: Some policy
          maxLength: 64
          type: string
        sans:
          $ref: '#/components/schemas/SANs'
        shareWithAll:
          description: Share with all sub-TSGs
          type: boolean
        sharedWithSubTsgIds:
          example:
          - '1378242802'
          - '1896239460'
          items:
            description: Specific sub-TSG IDs to share with
            type: string
          type: array
        subject:
          $ref: '#/components/schemas/SubjectAttributes'
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
  securitySchemes:
    service-account:
      in: header
      name: service-account
      type: apiKey
    tppl-api-key:
      in: header
      name: tppl-api-key
      type: apiKey
x-readme:
  samples-languages:
  - curl
  - go
  - java
  - javascript
  - node
  - python