openapi: 3.2.0 info: title: Certificate Manager - SaaS Workload Identity Manager Sub CA… version: '1.0' servers: - description: US Region url: https://api.venafi.cloud - description: EU Region url: https://api.eu.venafi.cloud - description: AU Region url: https://api.au.venafi.cloud - description: UK Region url: https://api.uk.venafi.cloud - description: SG Region url: https://api.sg.venafi.cloud - description: CA Region url: https://api.ca.venafi.cloud tags: - name: Workload Identity Manager Sub CA Providers paths: /v1/distributedissuers/subcaproviders: post: description: Creates a sub ca provider operationId: subcaproviders_create requestBody: content: application/json: examples: An example for creation of new sub CA provider.: description: An example for creation of new sub CA provider. value: caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd commonName: example.com country: US keyAlgorithm: EC_P256 locality: San Antonio name: Some Sub CA organization: Some organization organizationalUnit: Some organizational unit stateOrProvince: Texas validityPeriod: P30D schema: $ref: '#/components/schemas/SubCAProviderCreateRequest' description: Details of the new sub CA provider. required: true responses: '201': content: application/json: examples: Details of the created sub CA provider.: description: Details of the created sub CA provider. summary: Details of the created sub CA provider. value: caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd caType: BUILTIN commonName: example.com companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467 country: US creationDate: '2022-10-10T14:50:41.71Z' id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746 keyAlgorithm: EC_P256 locality: San Antonio modificationDate: '2023-12-12T20:00:10.5Z' name: Some Sub CA organization: Some organization organizationalUnit: Some organizational unit stateOrProvince: Texas validityPeriod: P30D schema: $ref: '#/components/schemas/SubCAProviderGetResponse' description: Sub CA Provider was created; details in response body; '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: "The request was rejected. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; or sharing\n is requested outside a Strata context or with both `shareWithAll` and\n `sharedWithSubTsgIds` set.\n- 50301: `name` is empty.\n- 50302: `caAccountId` is missing.\n- 50303: `caProductOptionId` is missing.\n- 50304: `validityPeriod` is empty or not a valid ISO-8601 period.\n- 50305: `commonName` is empty.\n- 50306: `keyAlgorithm` is empty.\n- 50308: `caType` is not a supported Sub CA type.\n- 50310: `caType` is empty.\n- 50311: A Sub CA provider with the same `name` already exists.\n- 50312: `name` is longer than 64 characters.\n- 50313: `commonName` is longer than 64 characters.\n- 50314: `organization` is longer than 64 characters.\n- 50315: `organizationalUnit` is longer than 64 characters.\n- 50316: `locality` is longer than 64 characters.\n- 50317: `stateOrProvince` is longer than 64 characters.\n- 50318: `country` is longer than 64 characters.\n- 50319: When signing is enabled, the PKCS11 partition label is empty or\n longer than 32 characters, or the PIN is empty.\n- 50320: A PKCS11 allowed client library is not a 64-character SHA-256 hash.\n- 50321: The PKCS11 partition serial number is not up to 18 numeric/hex characters.\n- 50322: A sub-TSG id is not a 10-digit number starting with 1." '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The request was forbidden. Possible causes, by error code: - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.' '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The referenced entity was not found. Possible causes, by error code: - 50307: The referenced CA account does not exist (or belongs to another tenant). - 50309: The referenced CA product option does not exist on that CA account.' security: - tppl-api-key: [] summary: Create a new Sub CA provider tags: - Workload Identity Manager Sub CA Providers x-rbac: permissions: access_type: write description: Ability to create sub CA provider name: ngts.sub_ca_provider.create roles: - PKIAdmin get: description: Returns a list of all the subordinate CA providers along with their details. operationId: subcaproviders_getAll responses: '200': content: application/json: examples: The details of the Sub CA providers.: description: The details of the Sub CA providers. summary: The details of the Sub CA providers. value: subCaProviders: - caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd caType: BUILTIN commonName: example.com companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467 country: US creationDate: '2022-10-10T14:50:41.71Z' id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746 keyAlgorithm: EC_P256 locality: San Antonio modificationDate: '2023-12-12T20:00:10.5Z' name: Some Sub CA organization: Some organization organizationalUnit: Some organizational unit stateOrProvince: Texas validityPeriod: P30D schema: $ref: '#/components/schemas/SubCAProviderListResponse' description: All Sub CA providers with details. security: - tppl-api-key: [] summary: Get the details of all Sub CA providers tags: - Workload Identity Manager Sub CA Providers x-rbac: permissions: access_type: read description: Ability to get sub CA provider name: ngts.sub_ca_provider.get roles: - PKIAdmin - PlatformAdmin - ResourceOwner - Guest /v1/distributedissuers/subcaproviders/{id}: get: description: Retrieves the details of the subordinate CA provider that has the specified `id`. operationId: subcaproviders_getById parameters: - description: Sub CA provider UUID in: path name: id required: true schema: format: uuid type: string responses: '200': content: application/json: examples: Details of the sub CA provider.: description: Details of the sub CA provider. summary: Details of the sub CA provider. value: caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd caType: BUILTIN commonName: example.com companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467 country: US creationDate: '2022-10-10T14:50:41.71Z' id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746 keyAlgorithm: EC_P256 locality: San Antonio modificationDate: '2023-12-12T20:00:10.5Z' name: Some Sub CA organization: Some organization organizationalUnit: Some organizational unit stateOrProvince: Texas validityPeriod: P30D schema: $ref: '#/components/schemas/SubCAProviderGetResponse' description: Specified sub CA provider found; details in response body. '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The request was rejected. Possible causes, by error code: - 10055: The `id` path parameter is not a valid UUID.' '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The referenced entity was not found. Possible causes, by error code: - 10051: No Sub CA provider with the given `id` exists in this tenant.' security: - tppl-api-key: [] summary: Get a Sub CA provider's details tags: - Workload Identity Manager Sub CA Providers x-rbac: permissions: access_type: read description: Ability to get sub CA provider name: ngts.sub_ca_provider.get roles: - PKIAdmin - PlatformAdmin - ResourceOwner - Guest patch: description: Updates (replaces) details of the subordinate CA provider that has the specified `id`. Only fields specified in the request will be updated. operationId: subcaproviders_update parameters: - description: Sub CA provider UUID in: path name: id required: true schema: format: uuid type: string requestBody: content: application/json: examples: An example for updating some details of a Sub CA provider.: description: An example for updating some details of a Sub CA provider. value: locality: Chicago stateOrProvince: Illinois schema: $ref: '#/components/schemas/SubCAProviderUpdateRequest' description: Sub CA provider's details to update. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SubCAProviderGetResponse' description: Sub CA provider updated; details in response body. '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: "The request was rejected. Supplied fields are validated with the same\nrules as on create. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; or sharing\n is requested outside a Strata context or with both `shareWithAll` and\n `sharedWithSubTsgIds` set.\n- 10055: The `id` path parameter is not a valid UUID.\n- 50301: `name` is empty.\n- 50304: `validityPeriod` is not a valid ISO-8601 period.\n- 50305: `commonName` is empty.\n- 50311: A different Sub CA provider with the same `name` already exists.\n- 50312: `name` is longer than 64 characters.\n- 50313: `commonName` is longer than 64 characters.\n- 50314: `organization` is longer than 64 characters.\n- 50315: `organizationalUnit` is longer than 64 characters.\n- 50316: `locality` is longer than 64 characters.\n- 50317: `stateOrProvince` is longer than 64 characters.\n- 50318: `country` is longer than 64 characters.\n- 50319: When signing is enabled, the PKCS11 partition label is empty or\n longer than 32 characters, or the PIN is empty.\n- 50320: A PKCS11 allowed client library is not a 64-character SHA-256 hash.\n- 50321: The PKCS11 partition serial number is not up to 18 numeric/hex characters.\n- 50322: A sub-TSG id is not a 10-digit number starting with 1.\n- 50247: HSM signing cannot be enabled because the Sub CA provider is\n referenced by one or more forward-trust proxy configurations." '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The request was forbidden. Possible causes, by error code: - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.' '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: "The referenced entity was not found. Possible causes, by error code:\n- 10051: No Sub CA provider with the given `id` exists in this tenant.\n- 50307: When `caProductOptionId` is changed, the referenced CA account\n does not exist (or belongs to another tenant).\n- 50309: When `caProductOptionId` is changed, the referenced CA product\n option does not exist on that CA account." security: - tppl-api-key: [] summary: Update a Sub CA provider's details tags: - Workload Identity Manager Sub CA Providers x-rbac: permissions: access_type: write description: Ability to update sub CA provider name: ngts.sub_ca_provider.update roles: - PKIAdmin delete: description: Deletes the subordinate CA provider that has the specified `id`. operationId: subcaproviders_delete parameters: - description: Sub CA provider UUID in: path name: id required: true schema: format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SubCAProviderDeleteResponse' description: Specified Sub CA provider was deleted. '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: "The request was rejected. Possible causes, by error code:\n- 10055: The `id` path parameter is not a valid UUID.\n- 50300: The Sub CA provider cannot be deleted because it is still\n referenced by one or more Issuer configurations; the response lists the\n blocking configuration ids." '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The request was forbidden. Possible causes, by error code: - 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.' '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse3' description: 'The referenced entity was not found. Possible causes, by error code: - 10051: No Sub CA provider with the given `id` exists in this tenant.' security: - tppl-api-key: [] summary: Remove a Sub CA provider tags: - Workload Identity Manager Sub CA Providers x-rbac: permissions: access_type: write description: Ability to delete sub CA provider name: ngts.sub_ca_provider.delete roles: - PKIAdmin components: schemas: SubCAProviderDeleteResponse: properties: id: description: UUID of the Sub CA provider example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746 format: uuid type: string name: description: Name of the Sub CA provider example: Some Sub CA type: string type: object SubCAProviderGetResponse: properties: caAccountId: description: UUID of the CA account used by this Sub CA provider example: 4ece3180-b1e0-11ed-862d-ad36b18e787a format: uuid type: string caProductOptionId: description: UUID of the CA product option used by this Sub CA provider example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd format: uuid type: string caType: $ref: '#/components/schemas/CAType' commonName: description: Common name example: example.com type: string companyId: description: UUID specific to your company example: 03eb6e61-9806-11ed-84f2-c747fb71e467 format: uuid type: string country: description: Country example: US type: string creationDate: description: When the Sub CA provider was initially created example: '2022-10-10T14:50:41.71Z' format: date-time type: string id: description: UUID of the Sub CA provider example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746 format: uuid type: string keyAlgorithm: $ref: '#/components/schemas/KeyAlgorithm1' locality: description: Locality example: San Antonio type: string modificationDate: description: When the Sub CA provider was last modified example: '2023-12-12T20:00:10.5Z' format: date-time type: string name: description: Name of the Sub CA provider example: Some Sub CA provider type: string organization: description: Organization example: Some organization type: string organizationalUnit: description: Organizational unit example: Some organizational unit type: string pkcs11: $ref: '#/components/schemas/SubCAProviderPKCS11Configuration' shareWithAll: description: Shared with all sub-TSGs example: false type: boolean sharedWithSubTsgIds: items: description: Sub-TSG IDs this SubCA provider is shared with type: string type: array uniqueItems: true stateOrProvince: description: State or province example: Texas type: string validityPeriod: description: ISO8601 Period Format example: P30D format: PnYnMnDTnHnMnS type: string type: object ErrorResponse3: properties: errors: items: $ref: '#/components/schemas/Error1' type: array type: object SubCAProviderCreateRequest: allOf: - $ref: '#/components/schemas/SubCAProviderUpdateRequest' - properties: caAccountId: description: UUID of the CA account used by this Sub CA provider example: 4ece3180-b1e0-11ed-862d-ad36b18e787a format: uuid type: string caType: $ref: '#/components/schemas/CAType' required: - caAccountId - caProductOptionId - caType - commonName - keyAlgorithm - name - validityPeriod type: object SubCAProviderPKCS11Configuration: properties: allowedClientLibraries: description: A collection of strings each of which represents SHA256 hash of an allowed HSM client library example: - c34d199f2e30bb679cd9b8533b99975465aefe8b023be1b37972f1ab43ab7b2d items: type: string type: array partitionLabel: description: HSM Partition Label example: workload-identity-manager-hsm-partition type: string partitionSerialNumber: description: HSM Partition Serial Number example: '1444210958933' pattern: ^[A-Fa-fx0-9]{0,18}$ type: string pin: description: HSM PIN example: '1234' type: string writeOnly: true signingEnabled: description: Indicates whether HSM signing is enabled or not example: true type: boolean type: object CAType: description: Type of CA this Sub CA provider works with enum: - MOCKCA - DIGICERT - GLOBALSIGN - BUILTIN - ENTRUST - MICROSOFT - ACME - ZTPKI - GLOBALSIGNMSSL - TPP example: BUILTIN type: string Error1: description: A single error. The numeric `code` is stable and matches the codes listed at the start of each cause in the endpoints' error-response descriptions, so clients can branch on it instead of parsing `message`. properties: args: description: Positional values interpolated into the message (e.g. the offending field value or entity id). items: type: object type: array code: description: Stable numeric error code identifying the specific failure. format: int32 type: integer message: description: Human-readable description of the error. type: string type: object KeyAlgorithm1: description: Key algorithm type enum: - RSA_2048 - RSA_3072 - RSA_4096 - EC_P256 - EC_P384 - EC_P521 - EC_ED25519 example: EC_P256 type: string SubCAProviderListResponse: properties: subCaProviders: items: $ref: '#/components/schemas/SubCAProviderGetResponse' type: array type: object SubCAProviderUpdateRequest: properties: caProductOptionId: description: UUID of the CA product option used by this Sub CA provider example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd format: uuid type: string commonName: description: Common name example: example.com maxLength: 64 type: string country: description: Country example: US maxLength: 64 type: string keyAlgorithm: $ref: '#/components/schemas/KeyAlgorithm1' locality: description: Locality example: San Antonio maxLength: 64 type: string name: description: Name of the Sub CA provider example: Some Sub CA maxLength: 64 type: string organization: description: Organization example: Some organization maxLength: 64 type: string organizationalUnit: description: Organizational unit example: Some organizational unit maxLength: 64 type: string pkcs11: $ref: '#/components/schemas/SubCAProviderPKCS11Configuration' shareWithAll: description: Share with all sub-TSGs type: boolean sharedWithSubTsgIds: example: - '1378242802' - '1896239460' items: description: Specific sub-TSG IDs to share with type: string type: array stateOrProvince: description: State or province example: Texas maxLength: 64 type: string validityPeriod: description: ISO8601 Period Format example: P30D format: PnYnMnDTnHnMnS type: string type: object securitySchemes: service-account: in: header name: service-account type: apiKey tppl-api-key: in: header name: tppl-api-key type: apiKey x-readme: samples-languages: - curl - go - java - javascript - node - python