{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This article includes updates for Certificate Manager 8.11. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"This article describes the Certificate Manager REST API (RESTful application programming interface) in Certificate Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"Certificate Manager REST API (RESTful application programming interface) is an HTTP-based service for x.509 and attribute certificates creation, certificate searching, certificate download, certificate revocation, certificate reinstatement, creation of PKCS#12 files and token procedure listing in Certificate Manager. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The API requires client authentication over TLS using a CM officer certificate. Write operations like revoke, reinstate and certificate issuance requires the request data to be signed by a CM officer. The REST API server can also be configured to use a CM officer for signing the requests on the caller’s behalf, enabling automated services for trusted clients.","type":"text"}]},{"type":"paragraph","content":[{"text":"The accompanied files ","type":"text"},{"text":"APISigningWithOpenSSL.sh","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"APISigningWithBouncyCastle.java","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" referenced below can be found in a CM client installation together with the Protocol Gateway web archive file","type":"text"},{"text":", ","type":"text","marks":[{"type":"em"}]},{"text":"see ","type":"text"},{"text":"Install Protocol Gateway","type":"text","marks":[{"type":"link","attrs":{"href":"https://doc.nexusgroup.com/display/PUB/Install+Protocol+Gateway"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information, see:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354759"}},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Description of the Secure Key Injection Protocol (SKIP): ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65350663"}},{"text":" ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Date-time format","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected date-time format for time search fields is ","type":"text"},{"text":"ISO 8601","type":"text","marks":[{"type":"link","attrs":{"href":"https://en.wikipedia.org/wiki/ISO_8601"}}]},{"text":". Example: 2021-12-20T08:01:30Z.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This article only contains plain documentation of the Certificate Manager REST API. It is not possible to try out the commands. ","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Important! View all request bodies in Confluence.","type":"text"}]},{"type":"paragraph","content":[{"text":"Open ","type":"text"},{"text":"Nexus product documentation in Confluence","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/x/QjjlAw"}}]},{"text":" to view all request bodies in the REST API.","type":"text"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"open-api","parameters":{"macroParams":{"__bodyContent":{"value":"openapi: 3.0.0\ninfo:\n title: CM REST API\n version: \"1.0\"\n description: |\n The CM REST API is a HTTP-based service used for interacting with CM.\n It supports ways of performing certificate creation, searching, revocation,\n reinstatement, registrations and procedure listing through HTTP REST calls.\n\n ## HTTP Client Authentication\n The CM REST API requires TLS client authentication using a CM officer\n certificate, to identify the caller. The client TLS certificate must be\n an officer certificate, and must be issued by one of the CAs that are\n present in the PGWY Tomcat trust store. The officer must have all of the\n roles configured by the `requiredRoRoles` setting in `api.properties`.\n In cases where multiple CM tenants are configured, logging of the tenant\n domain may be enabled in the CM REST API logging with the `showDomainInLogs`\n setting in `api.properties` to indicate which domain a session belongs to.\n\n ## Signed requests\n Furthermore, operations that are sent to the CA that write or modify data,\n such as revoking, reinstating and issuing certificates requires the request\n data to be signed by a CM officer when sending the command to the CA.\n This signing can be done either by PGWY itself (VRO), or by PGWY requesting\n a signature from the caller. Signing by caller is the default.\n\n ### VRO signing\n To make PGWY sign such requests, PGWY must be configured to act as a Virtual\n Registration Officer (VRO) and thereby sign the requests on the caller's\n behalf. This is done by enabling server-side signing in the server\n configuration (`api.properties`).\n\n 1. Example request with VRO signing:\n ```\n POST /certificates/pkcs10\n pkcs10=(binary data)\n ```\n\n 2. Server response:\n ```\n (pkcs#7 data containing DER-encoded certificate)\n ```\n\n ### Signing by caller\n If PGWY is not configured to act as VRO, then all operations that require a\n signature will return the request data to the caller for signing using the\n CM officer's key. The request to sign is returned as the `dataToSign`\n json field, base64-encoded. The caller is then expected to sign the request\n and re-send the request with the signature in a field named `signature`.\n\n 1. Example request with signature by caller:\n ```\n POST /certificates/pkcs10\n pkcs10=(binary data)\n ```\n\n 2. Server response:\n ```\n Http Status: 200 (OK)\n {\n \"error\":-19,\n \"msg\":\"Sign request and send again\",\n \"dataToSign\":\"MIIC8...Rva2Vu\"\n }\n ```\n\n 3. Caller signs request and sends again:\n ```\n POST /certificates/pkcs10\n pkcs10=(binary data)\n signature=(base64 encoded signature)\n ```\n\n 4. Server response:\n ```\n (pkcs#7 data containing DER-encoded certificate)\n ```\n\n ### Implementation details and example code for caller signature\n Alongside this document are two examples on how to perform the CMS (PKCS#7)\n based signature of the 'dataToSign' blob. The signature requires that the\n original data (the 'dataToSign' blob) is encapsulated and that it is in\n DER-encoded format.\n\n 1. OpenSSL:\n ```\n See accompanied file 'APISigningWithOpenSSL.sh'\n ```\n\n 2. BouncyCastle:\n ```\n See accompanied file 'APISigningWithBouncyCastle.java'\n ```\n\nservers:\n - url: https://{hostname}:{port}/{basePath}\n description: PGWY\n variables:\n hostname:\n default: localhost\n port:\n enum:\n - '8444'\n - '8443'\n - '443'\n default: '8444'\n basePath:\n default: pgwy/api\n\npaths:\n /certificates:\n get:\n operationId: listCertificates\n summary: List certificates\n description: |\n Returns a list of certificates that match the provided search parameters.\n tags:\n - Certificates\n parameters:\n - $ref: '#/components/parameters/searchLimit'\n - $ref: '#/components/parameters/searchOffset'\n - $ref: '#/components/parameters/orderBy'\n - $ref: '#/components/parameters/orderDescending'\n\n - name: cardSerialNumber\n in: query\n description: Serial number of the card the certificate is on.\n schema:\n type: string\n\n - $ref: '#/components/parameters/certificateSerialNumber'\n - $ref: '#/components/parameters/revocationTimeFrom'\n - $ref: '#/components/parameters/revocationTimeTo'\n - $ref: '#/components/parameters/revocationReason'\n - $ref: '#/components/parameters/isNotRevoked'\n\n - name: subjectCommonName\n in: query\n description: The common name ( CN ) of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectGivenName\n in: query\n description: The given name ( GN ) of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectSurName\n in: query\n description: The surname ( SN ) of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectOrganisationName\n in: query\n description: The name of the organisation ( O ) of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectOrganisationUnit\n in: query\n description: The name of the organisational unit ( OU ) of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectSerialNumber\n in: query\n description: The serial number of the subject of the certificate.\n schema:\n type: string\n\n - name: subjectCountry\n in: query\n description: The country ( C ) of the subject of the certificate.\n schema:\n type: string\n\n - $ref: '#/components/parameters/publicationAllowed'\n - $ref: '#/components/parameters/publicationTimeFrom'\n - $ref: '#/components/parameters/publicationTimeTo'\n - $ref: '#/components/parameters/ocspActivationTimeFrom'\n - $ref: '#/components/parameters/ocspActivationTimeTo'\n - $ref: '#/components/parameters/validFromTimeFrom'\n - $ref: '#/components/parameters/validFromTimeTo'\n - $ref: '#/components/parameters/isNotYetValid'\n - $ref: '#/components/parameters/validToTimeFrom'\n - $ref: '#/components/parameters/validToTimeTo'\n - $ref: '#/components/parameters/isExpired'\n - $ref: '#/components/parameters/field1'\n - $ref: '#/components/parameters/field2'\n - $ref: '#/components/parameters/field3'\n - $ref: '#/components/parameters/field4'\n - $ref: '#/components/parameters/field5'\n - $ref: '#/components/parameters/field6'\n - $ref: '#/components/parameters/authorityKeyIdentifier'\n - $ref: '#/components/parameters/subjectKeyIdentifier'\n - $ref: '#/components/parameters/subjectType'\n\n - name: issuer\n in: query\n description: |\n Only return certificates whose issuer matches the provided DN.\n The value must be a URL encoded RFC1779 string.\n Example: issuer=cn%3DExample%20CM%20issuing%20CA%2Co%3DExample%20CM%2Cc%3DSE\n schema:\n type: string\n format: RFC1779 distinguished name string.\n\n responses:\n 200:\n description: OK - Returns an array of certificates.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n searchHits:\n description: |\n The total number of search hits that the given search\n parameters would yield without pagination.\n type: integer\n certificates:\n description: Array of certificates\n type: array\n items:\n $ref: \"#/components/schemas/JsonCertificate\"\n example:\n error: 0\n msg: \"Fetched certificates\"\n searchHits: 476\n certificates: [\n {\n subject: \"Super Officer 1, System, SE\",\n validfrom: 1475849262000,\n certid: \"10003\",\n validity: \"valid\",\n certificateserialnumber: \"31e96265e40b809cffa3862b073ae98b\",\n subjectType: EE,\n validto: 1633615659000,\n status: \"active\"\n }\n ]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: Too many hits\n\n /certificates/issuers:\n get:\n deprecated: true\n operationId: listIssuers\n summary: List available issuers\n description: |\n Returns a list of distinguished names of issuer CAs that match the provided search parameters.\n tags:\n - Certificates\n parameters:\n - $ref: '#/components/parameters/searchLimit'\n - $ref: '#/components/parameters/searchOffset'\n - $ref: '#/components/parameters/orderBy'\n - $ref: '#/components/parameters/orderDescending'\n - $ref: '#/components/parameters/certificateSerialNumber'\n - $ref: '#/components/parameters/revocationTimeFrom'\n - $ref: '#/components/parameters/revocationTimeTo'\n - $ref: '#/components/parameters/revocationReason'\n - $ref: '#/components/parameters/publicationAllowed'\n - $ref: '#/components/parameters/publicationTimeFrom'\n - $ref: '#/components/parameters/publicationTimeTo'\n - $ref: '#/components/parameters/ocspActivationTimeFrom'\n - $ref: '#/components/parameters/ocspActivationTimeTo'\n - $ref: '#/components/parameters/validFromTimeFrom'\n - $ref: '#/components/parameters/validFromTimeTo'\n - $ref: '#/components/parameters/isNotYetValid'\n - $ref: '#/components/parameters/validToTimeFrom'\n - $ref: '#/components/parameters/validToTimeTo'\n - $ref: '#/components/parameters/isExpired'\n\n responses:\n 200:\n description: OK - Returns an array of issuer subjects.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n searchHits:\n description: |\n The total number of search hits that the given search\n parameters would yield without pagination.\n type: integer\n subjects:\n description: Array of certificate issuer DNs.\n type: array\n items:\n $ref: \"#/components/schemas/JsonIssuer\"\n example:\n error: 0\n msg: \"Fetched issuers\"\n searchHits: 476\n issuers: [\n {\n subjectDn: \"cn=Example CM CA,o=Example CM,c=SE\",\n subject: {\n cn: \"Example CM CA\",\n o: \"Example CM\",\n c: \"SE\"\n }\n }\n ]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: Too many hits\n\n /certificates/{certid}/details:\n get:\n operationId: getCertificateDetails\n summary: Certificate details\n description: |\n Returns information about the certificate with the provided id.\n tags:\n - Certificates\n parameters:\n - name: certid\n in: path\n description: Certificate id\n required: true\n schema:\n type: string\n responses:\n 200:\n description: OK - Returns details about the requested certificate.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n certificate:\n $ref: \"#/components/schemas/JsonCertificate\"\n example:\n error: 0\n msg: \"Fetched certificate\"\n certificate:\n subject: \"Super Officer 2, System, SE\"\n validfrom: 1475849262000\n certid: \"10003\"\n validity: \"valid\"\n certificateserialnumber: \"31e96265e40b809cffa3862b073ae98b\"\n subjectType: EE\n validto: 1633615659000\n status: \"active\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"No certificate found\"\n\n /certificates/{certid}/download:\n get:\n operationId: downloadCertificate\n summary: Download certificate\n description: |\n Returns a certificate in binary form. For X.509 certificates, the\n returned certificate encoding may be DER, PEM or MIME (pkcs#7),\n depending on the media type in the provided Accept header.\n tags:\n - Certificates\n parameters:\n - name: certid\n in: path\n description: Certificate ID.\n required: true\n schema:\n type: string\n responses:\n 200:\n description: OK - Returns the requested certificate.\n content:\n application/pkix-cert:\n schema:\n type: string\n format: binary\n application/pkcs7-mime:\n schema:\n type: string\n format: binary\n application/pem-certificate-chain:\n schema:\n description: Returns full chain including
certificate specified by certid.\n type: string\n format: binary\n application/pem-certificate-chain;depth=:\n schema:\n description: ;depth=0
Returns full chain including
certificate specified by certid.

;depth=1
Returns certificate specified by certid.

;depth=value bigger than 1
Returns part of the chain
up to the given depth value, if the depth value is
bigger than the number of certificates in the chain
it returns the full chain.\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"No certificate found\"\n\n /certificates/download:\n get:\n operationId: downloadCertificates\n summary: Download certificates\n description: |\n Returns multiple certificate results as a compressed zip file.\n Single certificate results are returned in binary certificate form.\n For X.509 certificates, the encoding of each returned certificate\n (whether contained in zip or single certificate) may be DER, PEM or\n MIME (pkcs#7), depending on the media type in the provided Accept\n header.\n tags:\n - Certificates\n parameters:\n - name: certid\n in: query\n description: List of certificate IDs.\n required: true\n schema:\n type: array\n items:\n type: string\n responses:\n 200:\n description: OK - Returns the requested certificates.\n content:\n application/zip:\n schema:\n type: string\n format: binary\n application/pkix-cert:\n schema:\n type: string\n format: binary\n application/pkcs7-mime:\n schema:\n type: string\n format: binary\n application/pem-certificate-chain:\n schema:\n description: Returns full chain including
certificate specified by certid.\n type: string\n format: binary\n application/pem-certificate-chain;depth=:\n schema:\n description: ;depth=0
Returns full chain including
certificate specified by certid.

;depth=1
Returns certificate specified by certid.

;depth=value bigger than 1
Returns part of the chain
up to the given depth value, if the depth value is
bigger than the number of certificates in the chain
it returns the full chain.\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"No certificate found\"\n\n /certificates/revoke:\n post:\n operationId: revokeCertificate\n summary: Revoke certificate\n description: Revokes the certificate(s) with the matching certificate id(s).\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n certid:\n description: Certificate id(s) to revoke.\n type: array\n items:\n type: string\n reason:\n $ref: \"#/components/schemas/ApiRequest_RevocationReason\"\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - certid\n - reason\n\n responses:\n 200:\n description: OK - Requested certificates were revoked.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n example:\n error: 0\n msg: \"1 certificate(s) has been revoked\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponseWithCertIds\"\n example:\n error: -1\n msg: \"Error(s) occurred during the revocation\"\n errors: [\n {\n certid: \"1\",\n errorcode: 907,\n errormessage: \"The certificate was not found\",\n servererrormessage: \"Certificate with certSerNr: 1 is not found.\"\n }\n ]\n\n /certificates/reinstate:\n post:\n operationId: reinstateCertificate\n summary: Reinstate certificate\n description: Reinstates the certificate(s) with the matching certificate id(s).\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n certid:\n description: Certificate id(s) to reinstate\n type: array\n items:\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - certid\n responses:\n 200:\n description: OK - Requested certificates were reinstated.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n example:\n error: 0\n msg: \"1 certificate(s) has been reinstated\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponseWithCertIds\"\n example:\n error: -1\n msg: \"Error(s) occurred during the reinstatement\"\n errors: [\n {\n certid: \"1\",\n errorcode: 907,\n errormessage: \"The certificate was not found\",\n servererrormessage: \"Certificate with certSerNr: 1 is not found.\"\n }\n ]\n\n /certificates/remove:\n post:\n operationId: removeCertificates\n summary: Remove certificates\n description: Removes (deletes) the certificate(s) with the matching certificate id(s).\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n certid:\n description: Certificate id(s) to remove\n type: array\n items:\n type: string\n cleanAuditLog:\n description: Clean the audit log for the certificate.\n default: true\n type: boolean\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - certid\n responses:\n 200:\n description: OK - Requested certificates were removed.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n example:\n error: 0\n msg: \"1 certificate(s) has been removed\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponseWithCertIds\"\n example:\n error: -1\n msg: \"Error(s) occurred during the removal\"\n errors: [\n {\n certid: \"1\",\n errorcode: 513,\n errormessage: \"Certificate(s) not found\"\n }\n ]\n\n /certificates/remove-subjects:\n post:\n operationId: removeSubjects\n summary: Remove subjects\n description: Removes (deletes) all data related to the subject(s) bound to the certificate(s) matching the certificate id(s).\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n certid:\n description: Certificate id(s) for which all data related to their subject(s) shall be removed.\n type: array\n items:\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - certid\n responses:\n 200:\n description: OK - All data related to requested subjects were removed.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n example:\n error: 0\n msg: \"1 subject(s) has been removed\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponseWithCertIds\"\n example:\n error: -1\n msg: \"Error(s) occurred during the removal\"\n errors: [\n {\n certid: \"1\",\n errorcode: 513,\n errormessage: \"Certificate(s) not found\"\n }\n ]\n\n /certificates/pkcs10:\n post:\n operationId: issueCertificatePkcs10\n summary: Create certificate from PKCS10 request\n description: |\n Creates a certificate from a PKCS10 request and returns the result as either\n PKCS7 or X.509 DER or PEM encoded depending on the Accept HTTP header.\n The PKCS#7 and PEM results will contain the chain if the token procedure\n had store all. Otherwise, will return only the end certificate.\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n multipart/form-data:\n schema:\n type: object\n properties:\n pkcs10:\n description: PKCS10 request (Base64 encoded)\n type: string\n format: byte\n validfrom:\n description: |\n X.509 \"not before\" point in time. Format 'ISO 8601'.\n Example: 2007-03-01T13:00:00Z\n type: string\n format: date-time\n validto:\n description: |\n X.509 \"not after\" point in time. Format 'ISO 8601'.\n Example: 2008-05-11T15:30:00Z\n type: string\n format: date-time\n procname:\n description: |\n Name of token procedure that should be used to issue the\n certificate. If this parameter is not given, a default value\n set in the server side configuration will be used\n (`handler.(n).tokenprocedure` in `api.properties`).\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - pkcs10\n encoding:\n pkcs10:\n contentType: application/pkcs10\n responses:\n 200:\n description: OK - Returns a PKCS#7 message or X509 the issued certificate.\n headers:\n certId:\n schema:\n type: string\n description: |\n certid of produced certificate\n content:\n application/pkcs7-mime:\n schema:\n type: string\n format: binary\n application/pkix-cert:\n schema:\n type: string\n format: binary\n application/pem-certificate-chain:\n schema:\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /certificates/pkcs10-to-pkcs12:\n post:\n operationId: issueCertificatePkcs10ToPkcs12\n summary: Issue certificate to PKCS#12 from PKCS#10 request\n description: |\n Issues a certificate from a PKCS#10 request and returns the result as\n PKCS#12.\n\n This endpoint is used to issue certificates for keys that are generated\n server-side by CM. For these cases, this endpoint is by default\n configured to accept unsigned PKCS#10 requests that only contain the TBS\n parts, and by default configured to discard the public key part\n specified in the PKCS#10 request. To generate the key on the\n server-side, the token procedure should specify an applicable key\n procedure.\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n multipart/form-data:\n schema:\n type: object\n properties:\n pkcs10:\n description: PKCS10 request (Base64 encoded).\n type: string\n format: byte\n validfrom:\n description: |\n X.509 \"not before\" point in time. Format 'ISO 8601'.\n Example: 2007-03-01T13:00:00Z\n type: string\n format: date-time\n validto:\n description: |\n X.509 \"not after\" point in time. Format 'ISO 8601'.\n Example: 2008-05-11T15:30:00Z\n type: string\n format: date-time\n password:\n description: |\n Password to be used to protect the resulting PKCS12 archive.\n If this parameter is not given, the password will be\n generated by the server.\n type: string\n format: password\n procname:\n description: |\n Name of token procedure that should be used to issue the\n certificate. If this parameter is not given, a default value\n set in the server side configuration will be used\n (`handler.(n).tokenprocedure` in `api.properties`).\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - pkcs10\n encoding:\n pkcs10:\n contentType: application/pkcs10\n responses:\n 200:\n description: OK - Returns a PKCS12 archive with the issued certificate and key.\n headers:\n certId:\n schema:\n type: string\n description: |\n certid of produced certificate\n content:\n application/x-pkcs12:\n schema:\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /certificates/{certid}/pkcs10-to-attr-cert:\n post:\n operationId: issueCertificatePkcs10ToAttrCert\n summary: Issue certificate to PKCS#7 or X.509 containing attribute certificate \n from PKCS#10 request\n description: |\n Issues an attribute certificate from a PKCS#10 request and returns the result as\n PKCS#7 or X.509 DER or PEM encoded depending on the Accept HTTP header.\n The PKCS#7 and PEM results will contain the chain if the token procedure\n had store all. Otherwise, will return only the end certificate.\n \n This endpoint supports only one attribute certificate procedure in the token\n procedure. \n\n This endpoint is used to issue attribute certificates that are generated for\n a base certificate on server-side by CM. For these cases, this endpoint is by default\n configured to accept unsigned PKCS#10 requests that only contain the TBS\n parts. A public key is required by PKCS#10, while it is not required for issuing the\n attribute certificate. Therefore, by default the endpoint is configured to discard\n the public key part specified in the PKCS#10 request as it is not required.\n tags:\n - Certificates\n parameters:\n - $ref: '#/components/parameters/certid'\n requestBody:\n required: true\n content:\n multipart/form-data:\n schema:\n type: object\n properties:\n pkcs10:\n description: PKCS10 request (Base64 encoded).\n type: string\n format: byte\n validfrom:\n description: |\n X.509 \"not before\" point in time. Format 'ISO 8601'.\n Example: 2007-03-01T13:00:00Z\n type: string\n format: date-time\n validto:\n description: |\n X.509 \"not after\" point in time. Format 'ISO 8601'.\n Example: 2008-05-11T15:30:00Z\n type: string\n format: date-time\n procname:\n description: |\n Name of token procedure that should be used to issue the\n attribute certificate. If this parameter is not given, a default\n value set in the server side configuration will be used\n (`handler.(n).tokenprocedure` in `api.properties`).\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - pkcs10\n encoding:\n pkcs10:\n contentType: application/pkcs10\n responses:\n 200:\n description: OK - Returns a PKCS7 archive with the issued attribute certificate.\n content:\n application/pkcs7-mime:\n schema:\n type: string\n format: binary\n application/pkix-cert:\n schema:\n type: string\n format: binary\n application/pem-certificate-chain:\n schema:\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /certificates/skip:\n post:\n operationId: secureKeyInjectionPackage\n summary: Create a secure key injection package from a PKCS10 request\n description: |\n Creates a secure key package for IoT devices from a PKCS10 request\n and return the result as PKCS7.\n\n The PKCS10 request only need to include the public key and subject\n information and no other request data.\n The PKCS7 response content is an ASN.1 encoded list of the generated\n device keypairs, KeyPairContainers, where the public key is an encoded\n SubjectPublicKeyInfo (RFC 5280), and the private key is an encoded\n EncryptedPrivateKeyInfo (RFC 5958).\n\n KeyPairContainers ::= SEQUENCE OF KeyPairContainer\n KeyPairContainer ::= SEQUENCE {\n public SubjectPublicKeyInfo,\n encryptedPrivate EncryptedPrivateKeyInfo\n }\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n multipart/form-data:\n schema:\n type: object\n properties:\n pkcs10:\n description: |\n PKCS10 request (Base64 encoded) containing the initial\n public key and subject information.\n type: string\n format: byte\n validfrom:\n description: |\n X.509 \"not before\" point in time. Format 'ISO 8601'.\n Example: 2007-03-01T13:00:00Z\n type: string\n format: date-time\n validto:\n description: |\n X.509 \"not after\" point in time. Format 'ISO 8601'.\n Example: 2008-05-11T15:30:00Z\n type: string\n format: date-time\n procname:\n description: |\n Name of token procedure that should be used to issue the\n certificate. If this parameter is not given, a default value\n set in the server side configuration will be used\n (`handler.(n).tokenprocedure` in `api.properties`).\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - pkcs10\n encoding:\n pkcs10:\n contentType: application/pkcs10\n responses:\n 200:\n description: OK - Returns a PKCS7 message with the issued certificate.\n content:\n application/pkcs7-mime:\n schema:\n type: string\n format: binary\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /certificates/import-pki-x509:\n post:\n operationId: importPKIX509\n summary: Import externally issued X.509 certificates\n description: |\n Imports X.509 certificates from an external PKI.\n\n This endpoint is used to import certificate(s) to CM issued by an\n external PKI. Each imported certificate may be complemented with\n revocation information, such as reason code and time of revocation.\n\n The request may specify a token procedure, which must be connected to a\n CA with a SubjectDN matching imported certificates IssuerDN.\n If no Token Procedure is specified, a default is used by the server.\n tags:\n - Certificates\n requestBody:\n required: true\n content:\n application/json:\n schema:\n type: object\n properties:\n procname:\n description: |\n Name of token procedure that should be used to issue the\n certificate. If this parameter is not given, a default value\n set in the server side configuration will be used.\n type: string\n importdata:\n description: |\n Array of certificate(s) to import.\n type: array\n items:\n type: object\n properties:\n certificate:\n description: |\n Base64 encoded certificate.\n type: string\n format: byte\n reason:\n $ref: \"#/components/schemas/ApiRequest_RevocationReason\"\n revocationtime:\n description: |\n Point in time when the certificate was revoked.\n type: string\n format: date-time\n required:\n - certificate\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n required:\n - importdata\n responses:\n 200:\n description: OK - successfully imported all certificates\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n example:\n error: 0\n msg: \"1 certificate(s) has been imported\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponseWithJsonArrayIndex\"\n example:\n error: -1\n msg: \"Error(s) occurred during the PKI import\"\n errors: [\n {\n arrayindex: 0,\n errorcode: -14,\n errormessage: \"Duplicated certificate import entry\",\n },\n {\n arrayindex: 1,\n errorcode: -14,\n errormessage: \"Unable to import certificate\",\n servererrormessage: \"Invalid certificate issuer\"\n },\n {\n arrayindex: 2,\n errorcode: -40,\n errormessage: \"Maximum import limit exceeded\",\n limit: 1\n }\n ]\n\n /procedures:\n get:\n operationId: listProcedures\n summary: List procedures\n description: |\n Lists all token procedures that are available for the authenticated officer.\n tags:\n - Procedures\n parameters:\n - $ref: \"#/components/parameters/mediaType\"\n responses:\n 200:\n description: OK - Returns the list of available token procedures.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n procedures:\n description: Array of token procedures.\n type: array\n items:\n type: object\n properties:\n procid:\n type: string\n description: Unique ID of the procedure.\n name:\n type: string\n description: Human-readable name of the procedure.\n example:\n error: 0\n msg: \"Fetched procedures\"\n procedures: [\n {\n procid: \"t-scep-registr-visible-p10\",\n name: \"SCEP Registration Visible Procedure\"\n }\n ]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -1\n msg: \"No procedures found\"\n\n /procedures/{procid}/details:\n get:\n operationId: getProcedureDetails\n summary: Procedure details\n description: |\n Returns information about the procedure with the provided id.\n tags:\n - Procedures\n parameters:\n - name: procid\n in: path\n description: Procedure id\n required: true\n schema:\n type: string\n responses:\n 200:\n description: OK - Returns details about the requested procedure.\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n procedure:\n type: object\n properties:\n procid:\n type: string\n description: Unique ID of the procedure.\n name:\n type: string\n description: Human-readable name of the procedure.\n type:\n type: string\n description: |\n The media type for the procedure\n (Applies to Token Procedures only)\n protocol:\n type: string\n enum:\n - SCEP\n - CMP\n - DEVICE\n - ACME\n - EST\n - ITSS\n description: |\n The protocol associated with the procedure, calculated\n by the cpmstate setting in the corresponding \n input view configuration.\n certificateprocedures:\n type: array\n description: |\n The certificate procedures\n (Applies to Token Procedures only)\n items:\n type: object\n description: A certificate procedure used by the token procedure\n properties:\n procid:\n type: string\n description: Unique ID of the certificate procedure\n name:\n type: string\n description: The name of the certificate procedure\n validity:\n type: string\n description: |\n The validity period expressed in ISO 8601 format\n keyusage:\n type: array\n description: |\n The key usage parameters for this combination of\n token procedure and certificate procedure.\n items:\n type: string\n enum:\n - digitalsignature\n - nonrepudiation\n - keyencipherment\n - dataencipherment\n - keyagreement\n - keycertsign\n - crlsign\n - encipheronly\n - decipheronly\n signingprocedures:\n type: array\n description: |\n The signing procedures\n (Applies to Token Procedures only)\n items:\n type: object\n description: A signing procedure used by the token procedure\n properties:\n procid:\n type: string\n description: Unique ID of the signing procedure\n name:\n type: string\n description: The name of the signing procedure\n issuer:\n type: string\n description: The signing authority subject DN\n example:\n error: 0\n msg: \"Fetched procedure\"\n procedure:\n id: \"t-1234\"\n name: \"A token procedure\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"No procedure found\"\n\n /signatures/{procid}:\n post:\n operationId: signData\n summary: Sign pre-hashed data\n description: |\n Creates a signature from the provided pre-hashed data and returns it in the format that is specified in the response.\n tags:\n - Signing\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n required: true\n content:\n application/json:\n schema:\n type: object\n properties:\n hashedtbs:\n description: |\n JSON structure containing the hash algorithm name and the pre-hashed data to be signed.\n type: object\n properties:\n algid:\n description: |\n The algorithm name of the hash algorithm used when producing the pre-hashed data.\n type: string\n enum:\n - SHA-224\n - SHA-256\n - SHA-384\n - SHA-512\n - SHA-512/224\n - SHA-512/256\n - SHA3-224\n - SHA3-256\n - SHA3-384\n - SHA3-512\n hash:\n description: The pre-hashed data to be signed (Base64 encoded).\n type: string\n format: binary\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n encoding:\n hashedtbs:\n contentType: application/json\n responses:\n 200:\n description: OK - Returns the Base64 encoded signed data in the specified format.\n content:\n application/json:\n schema:\n type: object\n properties:\n response:\n type: string\n description: Base64 encoded response object\n format:\n type: string\n enum:\n - SignedData\n - Signature\n description: |\n The format of the response data.\n SignedData: indicates that the response is a Base64 encoded\n SignedData object, see https://www.rfc-editor.org/rfc/rfc5652#section-5.1\n for the definition.\n Signature: indicates that the response is a Base64 encoded\n raw signature.\n certid:\n type: string\n description: |\n The certId of the signing certificate. It is provided here\n to see if the signer has been changed, or if you want to\n download the signing certificate using the\n certificates/{certId}/download endpoint.\n example:\n response: DVjH5MPr...NDhTqbA==\n format: Signature\n certid: \"10003\"\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /registrations/{procid}:\n get:\n operationId: listRegistrations\n summary: List registrations\n description: |\n The registrations endpoint returns a list of registrations done on the\n procedure with the matching token procedure id and, if given, the other\n optional parameters.\n tags:\n - Registrations\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n - $ref: '#/components/parameters/regtype'\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseGet'\n example:\n registrations:\n - regid: akZShn8u3qcOetstcL7eyfD05Tk=\n fqdn: 'test-1-170645'\n creationdate: 1565096805000\n status: closed\n regtype: cmp\n validity: 7\n error: 0\n msg: Fetched registrations\n 500:\n $ref: '#/components/responses/ServerError'\n\n post:\n operationId: createRegistration\n summary: Creates registration\n description: |\n Either body OR file must be set.\n tags:\n - Registrations\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/CreateRegistration'\n example:\n fqdn: \"Device Test\"\n regtype: \"cmp\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistration\n summary: Update registration\n description: |\n Updates a registration with the given data.\n tags:\n - Registrations\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/UpdateRegistration'\n example:\n regid: \"regid-1234\"\n status: \"open\"\n validity: \"always\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/certificate/{certid}:\n get:\n operationId: getRegistrationsCertId\n summary: Retrieves the registration that issued the certificate.\n description: Retrieves the registration that issued the certificate.\n tags:\n - Registrations\n responses:\n 200:\n description: OK - Returns the registration.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationCertId'\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/certid'\n\n /registrations/{procid}/scep:\n get:\n operationId: listRegistrationsScep\n summary: List registrations under SCEP\n description: |\n The SCEP registrations endpoint returns a list of registrations done on the\n procedure with the matching token procedure id and, if given, the other\n optional parameters.\n tags:\n - Registrations/{procid}/SCEP\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseGet'\n example:\n registrations:\n - regid: CGEMNL39wUEB/srVptVCKYyD2nA=\n fqdn: 'test-*.example.com'\n creationdate: 1572490820000\n officer: Super Officer 2\n status: open\n regtype: scep\n validity: always\n encryptedpassword: MIIB...3yv6\n error: 0\n msg: Fetched registrations\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n\n post:\n operationId: createRegistrationScep\n summary: Creates registration for SCEP\n description: |\n Either body OR file must be set.\n tags:\n - Registrations/{procid}/SCEP\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationScep'\n required:\n - fqdn\n - password\n example:\n fqdn: \"SCEP-1234\"\n password: \"1234\"\n status: \"open\"\n validity: \"always\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistrationScep\n summary: Updates registration for SCEP\n description: |\n Updates a registration with the given data for SCEP protocol.\n tags:\n - Registrations/{procid}/SCEP\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationScep'\n required:\n - regid\n example:\n regid: \"regid-1234\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/{procid}/est:\n get:\n operationId: listRegistrationsEst\n summary: List registrations for EST\n description: |\n The EST registrations endpoint returns a list of registrations done on the\n procedure with the matching token procedure id, and if given, the other\n optional parameters.\n tags:\n - Registrations/{procid}/EST\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseGet'\n example:\n registrations:\n - regid: 2YLD25xzE9BW84WdhRSsNFyNTvk=\n fqdn: 'APIClientTest_-1835737403'\n creationdate: 1572490406000\n officer: Super Officer 1\n status: open\n regtype: est\n validity: always\n encryptedpassword: MIIB...IX9m\n error: 0\n msg: Fetched registrations\n\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n\n post:\n operationId: createRegistrationEst\n summary: Creates registration for EST\n description: |\n Either body OR file must be set.\n tags:\n - Registrations/{procid}/EST\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n anyOf:\n - $ref: '#/components/schemas/RegistrationEstHttpAuth'\n - $ref: '#/components/schemas/RegistrationEstCertAuth'\n required:\n - fqdn\n examples:\n http-authentication:\n value:\n fqdn: \"*.ad.example.com\"\n password: \"1234\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n certificate-authentication:\n value:\n fqdn: \"my.authentication.certificate\"\n subject-commonname: \"my.commonname.in.csr\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistrationEst\n summary: Updates registration for EST\n description: |\n Updates a registration with the given data for EST protocol.\n tags:\n - Registrations/{procid}/EST\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n anyOf:\n - $ref: '#/components/schemas/RegistrationEstHttpAuth'\n - $ref: '#/components/schemas/RegistrationEstCertAuth'\n required:\n - regid\n examples:\n http-authentication:\n value:\n regid: \"regid-1234\"\n fqdn: \"*.ad.example.com\"\n status: \"closed\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n certificate-authentication:\n value:\n regid: \"regid-1234\"\n fqdn: \"my.authentication.certificate\"\n subject-commonname: \"my.new.commonname.in.csr\"\n status: \"open\"\n validity: \"3\"\n signature: \"MIIFuwYJK...\"\n\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/{procid}/cmp:\n get:\n operationId: listRegistrationsCmp\n summary: List registrations for CMP\n description: |\n The CMP registrations endpoint returns a list of registrations done on the\n procedure with the matching token procedure id, and if given, the other\n optional parameters.\n tags:\n - Registrations/{procid}/CMP\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseGet'\n example:\n registrations:\n - regid: JS2rc9cTa1jlAXxHdANTg7YEvu4=\n fqdn: '*.vendor.com'\n creationdate: 1572490601000\n officer: Super Officer 2\n status: open\n regtype: cmp\n validity: always\n encryptedpassword: MIIB...fJ8D\n error: 0\n msg: Fetched registrations\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n\n post:\n operationId: createRegistrationCmp\n summary: Creates registration for CMP\n description: |\n Either body OR file must be set.\n tags:\n - Registrations/{procid}/CMP\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationCmp'\n required:\n - fqdn\n example:\n fqdn: \"*.ad.example.com\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistrationCmp\n summary: Updates registration for CMP\n description: |\n Updates a registration with the given data for CMP protocol.\n tags:\n - Registrations/{procid}/CMP\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationCmp'\n required:\n - regid\n example:\n regid: \"regid-1234\"\n fqdn: \"*.ad.example.com\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/{procid}/acme:\n get:\n operationId: listRegistrationsAcme\n summary: List registrations for ACME\n description: |\n The ACME registrations endpoint returns a list of registrations done on the\n procedure with the matching token procedure id, and if given, the other\n optional parameters.\n tags:\n - Registrations/{procid}/ACME\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseAcmeGet'\n example:\n registrations:\n - regid: 4Lvs8mYrqi73CcZjt5UFfiIa4kc=\n fqdn: 'keyId-63453491'\n creationdate: 1572490404000\n officer: Super Officer 1\n status: open\n regtype: acme\n validity: always\n error: 0\n msg: Fetched registrations\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n\n post:\n operationId: createRegistrationAcme\n summary: Creates registration for ACME\n description: |\n Either body OR file must be set.\n tags:\n - Registrations/{procid}/ACME\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationAcme'\n required:\n - fqdn\n - hmacKey\n example:\n fqdn: \"*.ad.example.com\"\n hmacKey: \"PSuC...Zoi8\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistrationAcme\n summary: Updates registration for ACME\n description: |\n Updates a registration with the given data for ACME protocol.\n tags:\n - Registrations/{procid}/ACME\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationAcme'\n required:\n - regid\n example:\n regid: \"regid-1234\"\n fqdn: \"*.ad.example.com\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/{procid}/acme/accounts:\n get:\n operationId: listAcmeAccounts\n summary: Lists ACME accounts.\n description: |\n Lists all ACME accounts from a registration. Search can be limited\n by using the query parameter 'accountid'.\n tags:\n - Registrations/{procid}/ACME\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/accountid'\n responses:\n 200:\n description: OK - Account(s) successfully retrieved\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/Account'\n example:\n registrations:\n - regid: 4Lvs8mYrqi73CcZjt5UFfiIa4kc=\n fqdn: 'CnY9c9OuvSEHGT3cfRkBlQ'\n creationdate: 1575278296000\n officer: Super Officer 1\n status: Active\n keyid: 'keyId-644251404'\n email: acme@example.com\n regType: 'acme/account'\n certIds: [10050, 10051, 11302]\n error: 0\n msg: Fetched registrations\n 500:\n description: Error - Failed to retrieve accounts\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"Code -14, invalid procedure id\"\n\n /registrations/{procid}/itss:\n get:\n operationId: listRegistrationsItss\n summary: List registrations for ITS station\n description: |\n The ITS station registrations endpoint returns a list of registrations done\n on the procedure with the matching token procedure id, and if given, the other\n optional parameters.\n tags:\n - Registrations/{procid}/ITSS\n responses:\n 200:\n description: OK - Returns all registrations matching the given query parameters.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/RegistrationResponseGet'\n example:\n registrations:\n - regid: JS2rc9cTa1jlAXxHdANTg7YEvu4=\n fqdn: 'ITS-S canonical identifier'\n creationdate: 1572490601000\n officer: Super Officer 2\n status: open\n regtype: itss\n validity: always\n error: 0\n msg: Fetched registrations\n 500:\n $ref: '#/components/responses/ServerError'\n parameters:\n - $ref: '#/components/parameters/procid'\n - $ref: '#/components/parameters/regid'\n - $ref: '#/components/parameters/fqdn'\n - $ref: '#/components/parameters/status'\n - $ref: '#/components/parameters/validity'\n - $ref: '#/components/parameters/officer'\n\n post:\n operationId: createRegistrationItss\n summary: Creates registration for ITS station\n description: |\n Either body OR file must be set.\n tags:\n - Registrations/{procid}/ITSS\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationItss'\n required:\n - fqdn\n - canonicalkey\n - namedcurve\n example:\n fqdn: \"ITS-S canonical identifier\"\n canonicalkey: \"02ce16794f77...1820\"\n namedcurve: \"nistP256\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationPost200'\n 500:\n $ref: '#/components/responses/RegistrationPost500'\n\n put:\n operationId: updateRegistrationItss\n summary: Updates registration for ITSS\n description: |\n Updates a registration with the given data for an ITS station.\n tags:\n - Registrations/{procid}/ITSS\n parameters:\n - $ref: '#/components/parameters/procid'\n requestBody:\n content:\n application/json:\n schema:\n allOf:\n - $ref: '#/components/schemas/RegistrationItss'\n required:\n - regid\n - canonicalkey\n - namedcurve\n example:\n regid: \"regid-1234\"\n fqdn: \"ITS-S new canonical identifier\"\n canonicalkey: \"02ce16794f77...1820\"\n namedcurve: \"nistP256\"\n status: \"open\"\n validity: \"7\"\n signature: \"MIIFuwYJK...\"\n responses:\n 200:\n $ref: '#/components/responses/RegistrationUpdate200'\n 500:\n $ref: '#/components/responses/RegistrationUpdate500'\n\n /registrations/v2x/{vin}:\n delete:\n deprecated: true\n operationId: v2xRegistrationsVinDelete\n summary: Removes the VIN from the system.\n description: |\n Removes all occasions of the VIN from the system. The vehicle will no\n longer be able to request certificates or communicate with the system,\n until it decides to re-initialize.\n tags:\n - V2X Registrations\n parameters:\n - name: vin\n in: path\n description: Vehicle Identification Number\n required: true\n schema:\n type: string\n - name: signature\n in: query\n description: |\n Signed request (Base64 encoded).\n Only used when CM REST API is configured to not use VRO signing.\n schema:\n $ref: '#/components/schemas/ApiRequest_Signature'\n responses:\n 200:\n description: OK - VIN successfully removed\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ApiErrorResponse'\n example:\n error: 0\n msg: The specified VIN no longer exist in the system.\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /registrations/v2x/delete:\n post:\n operationId: v2xRegistrationsVinDeletePost\n summary: Removes all traces of the VIN from the system.\n description: |\n Removes all data related to, and containing the VIN from the system.\n The vehicle will no longer be able to request certificates or communicate\n with the system until it performs a new initialization.\n tags:\n - V2X Registrations\n requestBody:\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n vin:\n description: Vehicle Identification Number\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n responses:\n 200:\n description: OK - VIN successfully removed\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ApiErrorResponse'\n example:\n error: 0\n msg: The specified VIN no longer exist in the system.\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /registrations/v2x/reset:\n post:\n operationId: v2xRegistrationsVinReset\n summary: Reset the VIN in the system.\n description: |\n Performs a reset of the VIN for V2x V2. This means that Enrollment Credentials (ECs) which are\n associated with the VIN are revoked, registrations are deactivated and that it \n is now possible to request a new EC by sending a new enrollment request.\n tags:\n - V2X Registrations\n requestBody:\n content:\n application/x-www-form-urlencoded:\n schema:\n type: object\n properties:\n vin:\n description: Vehicle Identification Number\n type: string\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n responses:\n 200:\n description: OK - VIN successfully reset\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ApiErrorResponse'\n example:\n error: 0\n msg: The specified VIN has been reset.\n 400:\n description: Bad Request\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: 'Error handling signed request, msg: Cannot reset: V2x V2 Init has not been performed for given VIN'\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -1\n msg: \n\n /statistics/certificates:\n get:\n operationId: statisticscertificates\n summary: Counts the number of certificates per status\n description: |\n Gets the number of certificates per status for a given time interval\n optionally filtered by CA\n tags:\n - Statistics\n parameters:\n - name: breakpoints\n in: query\n description: |\n Specifies which timeline breakpoints to return statistics for.\n \n Takes an array of two breakpoints in the format e.g. `20230527000000Z,20240527000000Z`\n schema:\n type: array\n items:\n type: string\n - name: issuer\n in: query\n description: |\n Specifies the DN of an issuer to filter on.\n schema:\n type: string\n responses:\n 200:\n description: OK - Fetched statistics\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n data:\n type: object\n properties:\n active:\n description: The number of active and valid certificates\n type: integer\n revoked:\n description: The number of revoked certificates\n type: integer\n closed:\n description: The number of closed certificates\n type: integer\n expired:\n description: The number of active but expired certificates\n type: integer\n notYetValid:\n description: The number of active but not yet valid certificates\n type: integer\n example:\n error: 0\n msg: \"Fetched statistics\"\n data:\n active: 134\n revoked: 12\n closed: 1\n expired: 5454\n notYetValid: 453\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /statistics/active-subjects:\n get:\n operationId: statisticsactivesubjects\n summary: Counts the number of unique active subjects per CA\n description: |\n Gets the number of unique active subjects per CA for a given time interval\n optionally filtered by CA\n tags:\n - Statistics\n parameters:\n - name: breakpoints\n in: query\n description: |\n Specifies which timeline breakpoints to return statistics for.\n \n Takes an array of two breakpoints in the format e.g. `20230527000000Z,20240527000000Z`\n schema:\n type: array\n items:\n type: string\n - name: unique\n in: query\n description: |\n Specifies how to calculate uniqueness of a subject. \n Available values are:\n * [default] - Calculates uniqueness on the subject database id \n * cn - Calculates uniqueness on the subject CN\n schema:\n type: string\n - name: issuer\n in: query\n description: |\n Specifies the DN of an issuer to filter on.\n schema:\n type: string\n responses:\n 200:\n description: OK - Fetched statistics\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n data:\n type: object\n additionalProperties:\n description: Number of active subjects for the given subject DN\n type: integer\n example:\n error: 0\n msg: \"Fetched statistics\"\n data:\n \"cn=ca1,o=nexus,c=se\": 134\n \"cn=ca2,o=nexus,c=se\": 12\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /statistics/issued-certificates:\n get:\n operationId: issuedcertificates\n summary: Counts the number of issued certificates per time interval\n description: |\n Gets the number of issued certificates per time interval and\n optionally filtered by CA\n tags:\n - Statistics\n parameters:\n - name: breakpoints\n in: query\n description: |\n Specifies which timeline breakpoints to return statistics for.\n \n Takes an array of at least 3 breakpoints in the format e.g. `20230527000000Z,20240527000000Z,20250527000000Z`\n schema:\n type: array\n items:\n type: string\n - name: issuer\n in: query\n description: |\n Specifies the DN of an issuer to filter on.\n schema:\n type: string\n responses:\n 200:\n description: OK - Fetched statistics\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n data:\n type: array\n items:\n type: integer\n example:\n error: 0\n msg: \"Fetched statistics\"\n data: [23, 32]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /statistics/expiring-certificates:\n get:\n operationId: expiringcertificates\n summary: Counts the number of expiring certificates per time interval\n description: |\n Gets the number of expiring certificates per time interval and\n optionally filtered by CA\n tags:\n - Statistics\n parameters:\n - name: breakpoints\n in: query\n description: |\n Specifies which timeline breakpoints to return statistics for.\n \n Takes an array of at least 3 breakpoints in the format e.g. `20230527000000Z,20240527000000Z,20250527000000Z`\n schema:\n type: array\n items:\n type: string\n - name: issuer\n in: query\n description: |\n Specifies the DN of an issuer to filter on.\n schema:\n type: string\n responses:\n 200:\n description: OK - Fetched statistics\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n data:\n type: array\n items:\n type: integer\n example:\n error: 0\n msg: \"Fetched statistics\"\n data: [23, 32]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /statistics/revoked-certificates:\n get:\n operationId: revokedcertificates\n summary: Counts the number of revoked certificates per time interval\n description: |\n Gets the number of revoked certificates per time interval and\n optionally filtered by CA\n tags:\n - Statistics\n parameters:\n - name: breakpoints\n in: query\n description: |\n Specifies which timeline breakpoints to return statistics for.\n \n Takes an array of at least 3 breakpoints in the format e.g. `20230527000000Z,20240527000000Z,20250527000000Z`\n schema:\n type: array\n items:\n type: string\n - name: issuer\n in: query\n description: |\n Specifies the DN of an issuer to filter on.\n schema:\n type: string\n responses:\n 200:\n description: OK - Fetched statistics\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n data:\n type: array\n items:\n type: integer\n example:\n error: 0\n msg: \"Fetched statistics\"\n data: [23, 32]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\n /officers:\n get:\n operationId: officers\n summary: Gets the officer capabilities for the logged in officer\n description: |\n Gets roles and certificate details for the logged in officer\n tags:\n - Officers\n responses:\n 200:\n description: OK - Fetched officer\n content:\n application/json:\n schema:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n officer:\n type: object\n properties:\n id:\n type: string\n description: The officer ID\n certid:\n type: string\n description: The id of the officer certificate\n certserial:\n type: string\n description: The serial number of the officer certificate\n certexpires:\n type: integer\n description: The time when the officer certificate expires\n expires:\n type: integer\n description: The time when the officer role expires\n description:\n type: string\n description: The display name of the officer\n roles:\n type: array\n description: The officer roles\n items:\n type: string\n enum:\n - attributecert.issue\n - attributecert.revoke\n - attributecert.revokewithpassword\n - awb.audit\n - awb.cakeytask\n - awb.configtask\n - awb.domaintask\n - awb.officertask\n - awb.policytask\n - awb.profiletask\n - awb.use\n - batch.create\n - batch.execute\n - cert.handover\n - cert.issue\n - cert.publish\n - cert.publishwithpassword\n - cert.republish\n - cert.revoke\n - cert.revokewithpassword\n - client.searchexport\n - client.use\n - cxl.build\n - dataretention.manage\n - key.recover\n - ppm.access\n - revocationpassword.manage\n example:\n error: 0\n msg: \"Fetched officer\"\n officer:\n id: \"r1234\"\n certid: \"10000\"\n certserial: \"a8e917347840348bd239a8ebda7c2638\"\n certexpires: 1739524937000\n expires: 1739487600000\n description: \"Officer 1\"\n roles: [\"cert.issue\", \"cert.revoke\"]\n 500:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n\ncomponents:\n schemas:\n ApiResponse_Error:\n type: integer\n description: |\n Non-zero error code if the request could not be processed, or zero\n if there was no error.\n Possible values:\n\n * 0 = Ok\n * -1 = General error\n * -7 = Missing field\n * -8 = Encoding error\n * -12 = Not initialized\n * -14 = Bad field value\n * -15 = Privilige error\n * -17 = Bad signature\n * -18 = Connection error\n * -19 = Signature required\n * -40 = Too many requests\n ApiResponse_Msg:\n type: string\n description: Developer message describing the outcome of the request.\n\n ApiRequest_Signature:\n type: string\n description: |\n Signed request (Base64 encoded).\n Only used when CM REST API is configured to not use VRO signing.\n format: byte\n writeOnly: true\n\n ApiRequest_RevocationReason:\n type: integer\n minimum: 0\n maximum: 10\n description: |\n Revocation reason code mapping\n * 0: Unspecified\n * 1: Key Compromise\n * 3: Affiliation Changed\n * 4: Superseded\n * 5: Cessation Of Operation\n * 6: Certificate Hold\n * 9: Privilege Withdrawn\n\n ApiErrorResponse:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n\n ApiErrorResponseWithCertIds:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n errors:\n type: array\n items:\n type: object\n properties:\n certid:\n description: Certificate ID.\n type: string\n errorcode:\n description: |\n Integer code of the problem that prevented this\n certificate ID from being processed.\n Possible values:\n\n * 901 = Already Revoked\n * 902 = Access Denied\n * 903 = Incorrect Password\n * 904 = Free text (non specific errorcode)\n * 906 = Already on hold\n * 907 = Certificate missing\n * 908 = Request not signed\n * 909 = Not visible from domain\n * 910 = Not on hold\n * 911 = Revocation not available extension\n * -1 = General error\n type: integer\n errormessage:\n description: |\n Developer message describing the problem that\n prevented this certificate ID from being\n processed.\n type: string\n servererrormessage:\n description: |\n Developer message given by the server.\n type: string\n\n ApiErrorResponseWithJsonArrayIndex:\n type: object\n properties:\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n errors:\n type: array\n items:\n type: object\n properties:\n arrayindex:\n description: |\n Indicates the index position of the failed certificate import.\n type: integer\n errorcode:\n description: |\n Integer code of the problem that prevented this\n certificate ID from being processed.\n type: integer\n errormessage:\n description: |\n Developer message describing the problem that\n prevented this certificate from being processed.\n type: string\n servererrormessage:\n description: |\n Developer message given by the server.\n type: string\n limit:\n description: |\n Integer indicating the maximum allowed size of\n the JsonArray in the request. The limit is added to\n clarify if the error is due to the limit being exceeded.\n type: integer\n\n JsonIssuer:\n type: object\n description: CA details.\n properties:\n subject:\n type: array\n description: Subject\n items:\n type: object\n description: |\n Relative DN of directory attributes as per RFC1779\n (for example {\"cn\":\"somecommonname\"}.)\n subjectDn:\n type: string\n description: Full subject DN string\n\n JsonCertificate:\n type: object\n description: Certificate details.\n properties:\n certid:\n type: string\n description: Unique ID of the certificate.\n\n status:\n type: string\n description: Human-readable status of the certificate, revoked/active.\n\n reason:\n type: string\n description: Revocation reason.\n\n revocationtime:\n type: string\n format: date-time\n description: Point in time when the certificate was revoked.\n\n validto:\n type: string\n format: date-time\n description: X.509 \"not after\" point in time.\n\n validfrom:\n type: string\n format: date-time\n description: X.509 \"not before\" point in time.\n\n certificateserialnumber:\n type: string\n description: Certificate serial number in hex format.\n\n subject:\n type: string\n description: Subject distinguished name.\n\n issuer:\n type: string\n description: Issuer distinguished name.\n\n keyusage:\n type: array\n items:\n type: string\n description: |\n List of key usage names, including those from ExtendedKeyUsage\n extension.\n\n subjectType:\n type: string\n description: |\n Identifies the subject type of the certificate, either an\n End Entity (EE) or a Certificate Authority (CA)\n\n extendedcertsearch:\n type: object\n properties:\n field1:\n type: string\n field2:\n type: string\n field3:\n type: string\n field4:\n type: string\n field5:\n type: string\n field6:\n type: string\n description: |\n List of extended certificate search criteria field values\n\n authorityKeyIdentifier:\n type: string\n description: AuthorityKeyIdentifier in hex format\n\n subjectKeyIdentifier:\n type: string\n description: SubjectKeyIdentifier in hex format\n\n validity:\n type: string\n enum:\n - valid\n - expired\n - notYetValid\n description: |\n Displays the current certificate validity status.\n\n required:\n - certid\n - status\n\n Regid:\n type: string\n description: The registration id. Created on the server side.\n readOnly: true\n\n Fqdn:\n type: string\n description: Fully qualified domain name.\n\n Validity:\n type: string\n description: |\n Determines for how long the registration will be open. Set in either\n days or 'always' to be open forever.\n\n Officer:\n type: string\n description: Officer who signed the request. Created on the server side.\n readOnly: true\n\n Creationdate:\n type: string\n description: Creation date of the registration. Created on the server side.\n readOnly: true\n\n Regtype:\n type: string\n enum:\n - est\n - cmp\n - scep\n - device\n - acme\n - acme/account\n - itss\n description: |\n Determines which type the registration can be used with.\n\n Status:\n type: string\n enum:\n - open\n - closed\n description: |\n Either 'open' or 'closed'. Determines if that registration can be\n used for certificate creation.\n\n AccountStatus:\n type: string\n enum:\n - active\n - deactivated\n - revoked\n description: |\n Either 'active', 'deactivate' or 'revoked'. Determines if the\n account registration can be used for certificate creation.\n\n Email:\n type: string\n description: Email address used with the registration.\n\n Keyid:\n type: string\n description: Keyid of the connected pre-registration.\n\n Certids:\n type: array\n description: Array of certificate ids.\n items:\n type: string\n readOnly: true\n\n Accountids:\n type: array\n description: Array of ACME account ids.\n items:\n type: string\n\n # Contains base parameters common for all types of registrations\n RegistrationBase:\n properties:\n regid:\n $ref: '#/components/schemas/Regid'\n fqdn:\n $ref: '#/components/schemas/Fqdn'\n validity:\n $ref: '#/components/schemas/Validity'\n status:\n $ref: '#/components/schemas/Status'\n signature:\n $ref: \"#/components/schemas/ApiRequest_Signature\"\n\n Registration:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n regtype:\n $ref: '#/components/schemas/Regtype'\n officer:\n $ref: '#/components/schemas/Officer'\n creationdate:\n $ref: '#/components/schemas/Creationdate'\n certids:\n $ref: '#/components/schemas/Certids'\n\n PreRegistrationAcme:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n regtype:\n $ref: '#/components/schemas/Regtype'\n officer:\n $ref: '#/components/schemas/Officer'\n creationdate:\n $ref: '#/components/schemas/Creationdate'\n accountids:\n $ref: '#/components/schemas/Accountids'\n\n RegistrationScep:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n ipaddress:\n type: string\n description: |\n IP address of the device using the registration.\n email:\n $ref: '#/components/schemas/Email'\n serialnumber:\n type: string\n description: |\n Serial number of the device using the registration.\n password:\n type: string\n description: |\n The password used to register.\n\n RegistrationEstHttpAuth:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n username:\n type: string\n description: |\n Username used with HTTP based authentication.\n realm:\n type: string\n description: |\n Realm used with HTTP based authentication.\n password:\n type: string\n description: |\n The password used to register.\n\n RegistrationEstCertAuth:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n subject-commonname:\n type: string\n description: |\n Commonname of the subject in the CSR to enroll for\n authentication-certificate-ca:\n type: string\n description: |\n AWB name of the CA of the device authentication certificate.\n\n RegistrationCmp:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n password:\n type: string\n description: |\n The password used to register.\n\n RegistrationAcme:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n hmacKey:\n type: string\n format: byte\n description: |\n HMAC key for ACME pre-registration (32 bytes in base64 url-safe encoding).\n allowedDomains:\n type: string\n description: |\n Comma separated string of allowed domains for ACME pre-registration.\n\n RegistrationItss:\n type: object\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n canonicalkey:\n type: string\n description: |\n The hexadecimal encoded ECPoint value of the elliptic curve\n canonical public key of the station. The first byte indicates\n whether the key is compressed (0x02 or 0x03) or uncompressed (0x04).\n namedcurve:\n type: string\n description: |\n The name of the elliptic curve of the canonical public key,\n nistP256, nistP384, brainpoolP256r1, brainpoolP384r1 or SM2.\n\n RegistrationCertId:\n type: object\n properties:\n registration:\n $ref: '#/components/schemas/Registration'\n error:\n $ref: '#/components/schemas/ApiResponse_Error'\n msg:\n $ref: '#/components/schemas/ApiResponse_Msg'\n\n Account:\n type: object\n allOf:\n - properties:\n regid:\n $ref: '#/components/schemas/Regid'\n fqdn:\n $ref: '#/components/schemas/Fqdn'\n creationdate:\n $ref: '#/components/schemas/Creationdate'\n officer:\n $ref: '#/components/schemas/Officer'\n status:\n $ref: '#/components/schemas/AccountStatus'\n keyid:\n $ref: '#/components/schemas/Keyid'\n email:\n $ref: '#/components/schemas/Email'\n certids:\n $ref: '#/components/schemas/Certids'\n\n\n CreateRegistration:\n allOf:\n - $ref: '#/components/schemas/RegistrationBase'\n - properties:\n regtype:\n $ref: '#/components/schemas/Regtype'\n required:\n - fqdn\n - regtype\n\n UpdateRegistration:\n allOf:\n - $ref: '#/components/schemas/Registration'\n - properties:\n regid:\n readOnly: false\n regtype:\n readOnly: true\n required:\n - regid\n\n RegistrationResponseGet:\n type: object\n properties:\n registrations:\n type: array\n description: Array of registrations connected to the given procid.\n items:\n $ref: '#/components/schemas/Registration'\n error:\n $ref: '#/components/schemas/ApiResponse_Error'\n msg:\n $ref: '#/components/schemas/ApiResponse_Msg'\n\n RegistrationResponseAcmeGet:\n type: object\n properties:\n registrations:\n type: array\n description: Array of registrations connected to the given procid.\n items:\n $ref: '#/components/schemas/PreRegistrationAcme'\n error:\n $ref: '#/components/schemas/ApiResponse_Error'\n msg:\n $ref: '#/components/schemas/ApiResponse_Msg'\n\n RegistrationResponsePostOrPut:\n type: object\n properties:\n registration:\n type: object\n properties:\n regid:\n $ref: '#/components/schemas/Regid'\n error:\n $ref: \"#/components/schemas/ApiResponse_Error\"\n msg:\n $ref: \"#/components/schemas/ApiResponse_Msg\"\n\n # Defines common parameters used by multiple GET operations\n parameters:\n procid:\n name: procid\n in: path\n description: Token procedure id\n required: true\n schema:\n type: string\n regid:\n name: regid\n in: query\n description: Registration id\n schema:\n type: string\n certid:\n name: certid\n in: path\n description: Certificate id\n required: true\n schema:\n type: string\n accountid:\n name: accountid\n in: query\n description: Account id, allows wildcard(*)\n schema:\n type: string\n fqdn:\n name: fqdn\n in: query\n description: Fully qualified domain name.\n schema:\n type: string\n status:\n name: status\n in: query\n description: Registration status\n schema:\n enum:\n - open\n - closed\n type: string\n validity:\n name: validity\n in: query\n description: Number of days the registration will be open or 'always'.\n schema:\n type: string\n regtype:\n name: regtype\n in: query\n description: Registration type of the registration.\n schema:\n $ref: '#/components/schemas/Regtype'\n email:\n name: email\n in: query\n description: Email address\n schema:\n type: string\n ipaddress:\n name: ipaddress\n in: query\n description: IP address\n schema:\n type: string\n serialnumber:\n name: serialnumber\n in: query\n description: Certificate serialnumber as hex.\n schema:\n type: string\n password:\n name: password\n in: query\n description: The password used to register.\n schema:\n type: string\n username:\n name: username\n in: query\n description: The username used to register.\n schema:\n type: string\n realm:\n name: realm\n in: query\n description: The realm the user should be connected with.\n schema:\n type: string\n subject-commonname:\n name: subject-commonname\n in: query\n description: The commonname of the subject to be enrolled\n schema:\n type: string\n hmacKey:\n name: hmacKey\n in: query\n description: |\n HMAC key for ACME pre-registration (32 bytes in base64 url-safe encoding).\n The HMAC Key Id must also be specified in the fqdn field.\n schema:\n type: string\n allowedDomains:\n name: allowedDomains\n in: query\n description: Comma separated string of allowed domains.\n schema:\n type: string\n creationdate:\n name: creationdate\n in: query\n description: Creation date of the registration.\n schema:\n type: string\n officer:\n name: officer\n in: query\n description: Officer who signed the request.\n schema:\n type: string\n searchLimit:\n name: searchLimit\n in: query\n description: |\n The maximum number of certificates that should be returned.\n Please note that the highest possible value is still limited by\n server-side configuration (`certsearch.maxhits` in\n `cm.conf`).\n schema:\n type: integer\n searchOffset:\n name: searchOffset\n in: query\n description: |\n The starting offset of the first certificate that should be\n returned. This may be used for pagination of the results, together\n with the searchLimit parameter.\n schema:\n type: integer\n orderBy:\n name: orderBy\n in: query\n description: |\n The name of a field used for sorting.\n schema:\n type: string\n orderDescending:\n name: orderDescending\n in: query\n description: |\n If set to 'true' the sort order is reversed. Only used\n in combination with the orderBy parameter.\n schema:\n type: boolean\n certificateSerialNumber:\n name: certificateSerialNumber\n in: query\n description: Serial number of the certificate.\n schema:\n type: string\n revocationTimeFrom:\n name: revocationTimeFrom\n in: query\n description: |\n Only return certificates whose revocation time is after\n the provided time.\n schema:\n type: string\n format: date-time\n revocationTimeTo:\n name: revocationTimeTo\n in: query\n description: |\n Only return certificates whose revocation time is before\n the provided time.\n schema:\n type: string\n format: date-time\n revocationReason:\n name: revocationReason\n in: query\n description: |\n Only return certificates with specified revocation reasons.\n\n Takes an array of integers in the format e.g. `1,2,3,4`.\n\n Reason code mapping:\n * 0: Unspecified\n * 1: Key Compromise\n * 2: Ca Compromise\n * 3: Affiliation Changed\n * 4: Superseded\n * 5: Cessation Of Operation\n * 6: Certificate Hold\n * 8: Remove From CRL\n * 9: Privilege Withdrawn\n * 10: AACompromise\n schema:\n type: array\n items:\n type: integer\n minimum: 0\n maximum: 10\n isNotRevoked:\n name: isNotRevoked\n in: query\n description: |\n If `true`, only certificates that are not revoked will be\n returned.\n schema:\n type: boolean\n publicationAllowed:\n name: publicationAllowed\n in: query\n description: |\n If `true`, only certificates where publication is allowed\n will be returned.\n schema:\n type: boolean\n publicationTimeFrom:\n name: publicationTimeFrom\n in: query\n description: |\n Only return certificates whose publication time is after\n the provided time.\n schema:\n type: string\n format: date-time\n publicationTimeTo:\n name: publicationTimeTo\n in: query\n description: |\n Only return certificates whose publication time is before\n the provided time.\n schema:\n type: string\n format: date-time\n ocspActivationTimeFrom:\n name: ocspActivationTimeFrom\n in: query\n description: |\n Only return certificates whose OCSP-activation time is after\n the provided time.\n schema:\n type: string\n format: date-time\n ocspActivationTimeTo:\n name: ocspActivationTimeTo\n in: query\n description: |\n Only return certificates whose OCSP-activation time is before\n the provided time.\n schema:\n type: string\n format: date-time\n validFromTimeFrom:\n name: validFromTimeFrom\n in: query\n description: |\n Only return certificates whose \"valid from\" (also named\n \"not before\") is after the provided time.\n schema:\n type: string\n format: date-time\n validFromTimeTo:\n name: validFromTimeTo\n in: query\n description: |\n Only return certificates whose \"valid from\" (also named\n \"not before\") is before the provided time.\n schema:\n type: string\n format: date-time\n isNotYetValid:\n name: isNotYetValid\n in: query\n description: |\n If `true`, only certificates whose \"valid from\" (also named\n \"not before\") is in the future will be returned.\n schema:\n type: boolean\n validToTimeFrom:\n name: validToTimeFrom\n in: query\n description: |\n Only return certificates whose \"valid to (also named\n \"not after\") is after the provided time.\n schema:\n type: string\n format: date-time\n validToTimeTo:\n name: validToTimeTo\n in: query\n description: |\n Only return certificates whose \"valid to\" (also named\n \"not after\") is before the provided time.\n schema:\n type: string\n format: date-time\n isExpired:\n name: isExpired\n in: query\n description: |\n If `true`, only certificates that have already expired will\n be returned. This implies that the certificate's \"valid to\"\n (also named \"not after\") has passed.\n schema:\n type: boolean\n field1:\n name: field1\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n field2:\n name: field2\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n field3:\n name: field3\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n field4:\n name: field4\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n field5:\n name: field5\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n field6:\n name: field6\n in: query\n description: |\n Only return certificates with the specified extended\n certificate search field set\n schema:\n type: string\n authorityKeyIdentifier:\n name: authorityKeyIdentifier\n in: query\n description: |\n AKI to filter results on. Must be in hexadecimal format.\n Example: 4A3A887184A13B28\n schema:\n type: string\n subjectKeyIdentifier:\n name: subjectKeyIdentifier\n in: query\n description: |\n SKI to filter results on. Must be in hexadecimal format.\n Example: 4A3A887184A13B28\n schema:\n type: string\n subjectType:\n name: subjectType\n in: query\n description: |\n Allows for filtering on subject type. By default only End Entity (EE)\n certificates are returned. Available values are:\n * EE\n * CA\n\n Takes an array of string in the format e.g. 'EE,CA`.\n\n Enum mapping:\n * EE: End Entity\n * CA: Certificate Authority\n schema:\n type: array\n items:\n type: string\n mediaType:\n name: mediaType\n in: query\n description: |\n Selects which media type to return procedures for. Available values are:\n * pkcs10 (default)\n * pkcs12\n * smartcard\n * attributecertificate\n * data\n required: false\n schema:\n type: string\n signalg:\n name: signalg\n in: query\n description: |\n Allows for filtering on signature algorithm name.\n Example: SHA256withRSA\n required: false\n schema:\n type: string\n\n\n # Defines common responses used by multiple PATHS\n responses:\n RegistrationPost200:\n description: OK - Registration was successful\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/RegistrationResponsePostOrPut\"\n example:\n registration: {'regid':'kplclzbq4KeoaS86KimttAUlXKw='}\n error: 0\n msg: \"Registration has been successful\"\n RegistrationPost500:\n description: Error - Registration failed, invalid input parameters\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"Code -14, Registration type not supported\"\n RegistrationUpdate200:\n description: OK - The updated registration\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/RegistrationResponsePostOrPut\"\n example:\n registration: {'regid':'kplclzbq4KeoaS86KimttAUlXKw='}\n error: 0\n msg: \"Registration has been successful\"\n RegistrationUpdate500:\n description: Error - Registration update failed, no such registration\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"Code -14, Registration type not supported\"\n ServerError:\n description: Internal server error - An unexpected error occurred.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/ApiErrorResponse\"\n example:\n error: -14\n msg: \"Code -14, Internal bad request\""}},"macroMetadata":{"macroId":{"value":"f4cdbe1e-892b-49f8-9eb2-1d2f67cf7fe5"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://confluence-open-api.herokuapp.com/images/open-api-icon.png"}}],"title":"Open API (Swagger) Documentation"}},"localId":"fcaaee07-8cfa-4402-9975-839feb087d8d"}},{"type":"paragraph"}],"version":1}

Browser not supported