openapi: 3.1.0 info: title: Cryptography Provider v2 API description: REST API for implementations of custom v2 Cryptography Provider contact: name: ILM url: https://www.otilm.com email: ilm@omnitrust.com license: name: "Apache License, Version 2.0" url: https://github.com/OmniTrustILM/interface-documentation/blob/main/LICENSE.md version: 2.20.0 x-logo: url: images/ilm-logo.svg x-metrics-profile: histograms: http_client_latency_buckets_seconds: - 0.01 - 0.025 - 0.05 - 0.1 - 0.25 - 0.5 - 1.0 - 2.5 - 5.0 - 10.0 http_server_latency_buckets_seconds: - 0.005 - 0.01 - 0.025 - 0.05 - 0.1 - 0.25 - 0.5 - 1.0 - 2.5 - 5.0 - 10.0 required: - labels: - version - commit - runtime name: app_build_info type: gauge unit: "1" - labels: [] name: process_start_time_seconds type: gauge unit: seconds - labels: [] name: process_cpu_seconds_total type: counter unit: seconds - labels: [] name: process_resident_memory_bytes type: gauge unit: bytes - labels: - method - route - status name: http_requests_total type: counter unit: requests - buckets_ref: http_server_latency_buckets_seconds labels: - method - route name: http_request_duration_seconds type: histogram unit: seconds - labels: - route name: http_server_in_flight_requests type: gauge unit: requests - labels: - method - target - status name: http_client_requests_total type: counter unit: requests - buckets_ref: http_client_latency_buckets_seconds labels: - method - target name: http_client_request_duration_seconds type: histogram unit: seconds - labels: - event - outcome name: connector_events_total type: counter unit: events version: 1 externalDocs: description: ILM Documentation url: https://docs.otilm.com servers: - url: https://demo.otilm.com description: ILM Demo server tags: - name: Metrics API description: Connector metrics API. Connector metrics API is exposing standard Prometheus/OpenMetrics metrics that can be scraped by observability solutions and collectors. - name: Connector Attributes v2 description: Attribute-definition registry and stateless callback surface for NG connectors. - name: Token Management v2 description: "Token configuration, status and token-profile schema operations for\ \ cryptography providers" - name: Health check v2 description: "Connector Health check API. Connector returns own status and in some\ \ cases can return status of components on which it depends like database, HSM\ \ and so on." - name: Connector Info v2 description: "Connector Information API. Each connector may have multiple functions\ \ represented by its connector interfaces. For each connector interface there\ \ is a list of implemented endpoints. These endpoints must be according the specified\ \ interface, this is validated by the core. You can also implement helper end\ \ points that are used for callbacks and other relevant operations specific to\ \ implementation." - name: Cryptographic Operations v2 description: "Cryptographic operations scoped by token, token-profile and key metadata\ \ supplied in requests" - name: Key Management v2 description: "Key operations scoped by token, token-profile and key metadata supplied\ \ in requests" paths: /v2/cryptographyProvider/tokens/tokenProfile/attributes: post: tags: - Token Management v2 summary: List token profile attributes description: Returns the token profile attribute schema for the supplied token context operationId: listTokenProfileAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenScopedRequestV2Dto" required: true responses: "200": description: Token profile attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/tokens/status: post: tags: - Token Management v2 summary: Check token status description: "Evaluates the supplied token context and returns token reachability,\ \ readiness, and lockout information when available" operationId: getTokenStatus requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenScopedRequestV2Dto" required: true responses: "200": description: Token status retrieved content: application/json: schema: $ref: "#/components/schemas/TokenStatusResponseV2Dto" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/tokens/keyRequestTypes: post: tags: - Token Management v2 summary: List key request types supported by the Token Profile description: List key types supported for the supplied token and token-profile context operationId: listSupportedKeyRequestTypes requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenProfileScopedRequestV2Dto" required: true responses: "200": description: Supported key types retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/KeyRequestType" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/verify: post: tags: - Cryptographic Operations v2 summary: Verify data description: "Verify signatures with the given key (always synchronous). signatureAttributes\ \ must include exactly one v3 string attribute named signatureAlgorithm with\ \ UUID 9180267f-c82f-4b7b-8160-d2363d813869, selecting exactly one code from\ \ the required, single-select, non-extensible list offered by /verify/attributes." operationId: verifyData requestBody: content: application/json: schema: $ref: "#/components/schemas/VerifyDataRequestV2Dto" required: true responses: "200": description: Signatures verified content: application/json: schema: $ref: "#/components/schemas/VerifyDataResponseV2Dto" "422": description: "Request body was read successfully but violates a field validation\ \ rule (errorCode VALIDATION_FAILED), or a supplied verification parameter\ \ is not supported by the connector or key (errorCode PARAMETER_UNSUPPORTED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/verify/attributes: post: tags: - Cryptographic Operations v2 summary: List verification attributes description: "Returns the verification parameter schema supported by the connector\ \ for the supplied token, profile and key context. The schema must include\ \ exactly one v3 string data attribute named signatureAlgorithm with UUID\ \ 9180267f-c82f-4b7b-8160-d2363d813869, as a required, single-select, non-extensible\ \ list offering the signature algorithms the key supports for verification.\ \ It must offer at least one value, and every offered value must be a code\ \ from the SignatureAlgorithm enum." operationId: listVerifyAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/KeyScopedRequestV2Dto" required: true responses: "200": description: Verification attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/sign: post: tags: - Cryptographic Operations v2 summary: Sign data description: "Sign a batch using the caller-selected execution mode (synchronous\ \ 200 or asynchronous 202). signatureAttributes must include exactly one v3\ \ string attribute named signatureAlgorithm with UUID 9180267f-c82f-4b7b-8160-d2363d813869,\ \ selecting exactly one code from the required, single-select, non-extensible\ \ list offered by /sign/attributes." operationId: signData requestBody: content: application/json: schema: $ref: "#/components/schemas/SignDataRequestV2Dto" required: true responses: "200": description: Signed synchronously content: application/json: schema: $ref: "#/components/schemas/SignDataResponseV2Dto" "202": description: Signing accepted asynchronously; body carries operationMeta tracking handle for the batch content: application/json: schema: $ref: "#/components/schemas/SignDataResponseV2Dto" "422": description: "Request body was read successfully but violates a field validation\ \ rule (errorCode VALIDATION_FAILED), or the signatureAlgorithm selection\ \ names an algorithm the key does not support (errorCode PARAMETER_UNSUPPORTED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/sign/status: post: tags: - Cryptographic Operations v2 summary: Get async sign operation status description: Get status of an async sign batch using only its tracking handle. operationId: getSignStatus requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "200": description: Sign operation status retrieved content: application/json: schema: $ref: "#/components/schemas/SignOperationStatusResponseV2Dto" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/sign/cancel: post: tags: - Cryptographic Operations v2 summary: Cancel async sign operation description: Cancel an in-flight asynchronous sign batch using only its tracking handle. Individual items cannot be cancelled separately operationId: cancelSign requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "204": description: Aborted "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: "Cancellation cannot be processed: the operation is already\ \ terminal or past the point of no return (errorCode OPERATION_PAST_POINT_OF_NO_RETURN),\ \ or the request body violates a field validation rule (errorCode VALIDATION_FAILED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/sign/attributes: post: tags: - Cryptographic Operations v2 summary: List signing attributes description: "Returns the signing parameter schema supported by the connector\ \ for the supplied token, profile and key context. The schema must include\ \ exactly one v3 string data attribute named signatureAlgorithm with UUID\ \ 9180267f-c82f-4b7b-8160-d2363d813869, as a required, single-select, non-extensible\ \ list offering the signature algorithms the key supports for signing. It\ \ must offer at least one value, and every offered value must be a code from\ \ the SignatureAlgorithm enum." operationId: listSignAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/KeyScopedRequestV2Dto" required: true responses: "200": description: Signing attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/random: post: tags: - Cryptographic Operations v2 summary: Generate random data description: Generate random data on the token (always synchronous) operationId: randomData requestBody: content: application/json: schema: $ref: "#/components/schemas/RandomDataRequestV2Dto" required: true responses: "200": description: Random data generated content: application/json: schema: $ref: "#/components/schemas/RandomDataResponseV2Dto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/random/attributes: post: tags: - Cryptographic Operations v2 summary: List random generator attributes description: Random generator attribute schema given token context operationId: listRandomAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenProfileScopedRequestV2Dto" required: true responses: "200": description: Random generator attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/encrypt: post: tags: - Cryptographic Operations v2 summary: Encrypt data description: "Encrypt data with the given key (always synchronous). cipherAttributes\ \ must include exactly one v3 string attribute named encryptionAlgorithm with\ \ UUID 5e364467-fa95-4253-907b-0c73cdfb2be7, selecting exactly one code from\ \ the required, single-select, non-extensible list offered by /encrypt/attributes.\ \ RSA OAEP profiles use MGF1 with the same hash as OAEP and an empty label." operationId: encryptData requestBody: content: application/json: schema: $ref: "#/components/schemas/CipherDataRequestV2Dto" required: true responses: "200": description: Data encrypted content: application/json: schema: $ref: "#/components/schemas/EncryptDataResponseV2Dto" "422": description: "Request body was read successfully but violates a field validation\ \ rule (errorCode VALIDATION_FAILED), or the encryptionAlgorithm selection\ \ names an algorithm the key does not support (errorCode PARAMETER_UNSUPPORTED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/encrypt/attributes: post: tags: - Cryptographic Operations v2 summary: List encryption attributes description: "Returns the encryption parameter schema supported by the connector\ \ for the supplied token, profile and key context. The schema must include\ \ exactly one v3 string data attribute named encryptionAlgorithm with UUID\ \ 5e364467-fa95-4253-907b-0c73cdfb2be7, as a required, single-select, non-extensible\ \ list. It must offer at least one EncryptionAlgorithm code supported by the\ \ key and backend. The codes and profile parameters are documented on CipherDataRequestV2Dto.cipherAttributes.\ \ RSA OAEP profiles use MGF1 with the same hash as OAEP and an empty label." operationId: listEncryptAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/KeyScopedRequestV2Dto" required: true responses: "200": description: Encryption attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/decrypt: post: tags: - Cryptographic Operations v2 summary: Decrypt data description: "Decrypt data with the given key (always synchronous). cipherAttributes\ \ must include exactly one v3 string attribute named encryptionAlgorithm with\ \ UUID 5e364467-fa95-4253-907b-0c73cdfb2be7, selecting exactly one code from\ \ the required, single-select, non-extensible list offered by /decrypt/attributes.\ \ RSA OAEP profiles use MGF1 with the same hash as OAEP and an empty label." operationId: decryptData requestBody: content: application/json: schema: $ref: "#/components/schemas/CipherDataRequestV2Dto" required: true responses: "200": description: Data decrypted content: application/json: schema: $ref: "#/components/schemas/DecryptDataResponseV2Dto" "422": description: "Request body was read successfully but violates a field validation\ \ rule (errorCode VALIDATION_FAILED), or the encryptionAlgorithm selection\ \ names an algorithm the key does not support (errorCode PARAMETER_UNSUPPORTED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/operations/decrypt/attributes: post: tags: - Cryptographic Operations v2 summary: List decryption attributes description: "Returns the decryption parameter schema supported by the connector\ \ for the supplied token, profile and key context. The schema must include\ \ exactly one v3 string data attribute named encryptionAlgorithm with UUID\ \ 5e364467-fa95-4253-907b-0c73cdfb2be7, as a required, single-select, non-extensible\ \ list. It must offer at least one EncryptionAlgorithm code supported by the\ \ key and backend. The codes and profile parameters are documented on CipherDataRequestV2Dto.cipherAttributes.\ \ RSA OAEP profiles use MGF1 with the same hash as OAEP and an empty label." operationId: listDecryptAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/KeyScopedRequestV2Dto" required: true responses: "200": description: Decryption attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys: post: tags: - Key Management v2 summary: Create key description: Create a secret key or key pair synchronously or asynchronously operationId: createKey requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateKeyRequestV2Dto" required: true responses: "200": description: "Created synchronously, or existing equivalent operation returned\ \ synchronously" content: application/json: schema: $ref: "#/components/schemas/KeyCreationResponse" "202": description: "Creation accepted asynchronously, or equivalent operation\ \ replayed asynchronously; body carries the original operationMeta tracking\ \ handle" content: application/json: schema: $ref: "#/components/schemas/KeyCreationResponse" "409": description: keyCreationId reused with a non-equivalent request (RESOURCE_ALREADY_EXISTS) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: | - `EXPORTABLE_NOT_SUPPORTED` — the reserved `keyExportable` attribute asked for an exportable key and this token cannot hold one. A connector must refuse rather than create a key whose flag it cannot deliver. - `VALIDATION_FAILED` — the body is readable but breaks a field rule. content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import: post: tags: - Key Management v2 summary: Import key description: | Import protected key material synchronously or asynchronously. The `passphrase` protects this request alone and is generated by the platform, so it is never a user password. The connector decrypts `material`, stores the key bound to `keyReference`, and keeps no copy of the material or the passphrase. The response describes what was stored without carrying any of it: the derived public key of an imported key pair, the algorithm and length of an imported secret key. operationId: importKey requestBody: content: application/json: schema: $ref: "#/components/schemas/ImportKeyRequestV2Dto" required: true responses: "200": description: "Imported synchronously, or existing equivalent operation returned\ \ synchronously" content: application/json: schema: $ref: "#/components/schemas/KeyCreationResponse" "202": description: "Import accepted asynchronously, or equivalent operation replayed\ \ asynchronously; body carries the original operationMeta tracking handle" content: application/json: schema: $ref: "#/components/schemas/KeyCreationResponse" "409": description: '`RESOURCE_ALREADY_EXISTS` — `keyImportId` was reused with a request that is not equivalent to the first one' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: | - `KEY_TYPE_NOT_IMPORTABLE` — the key type or algorithm cannot be imported into this token. - `KEY_MATERIAL_MISMATCH` — the decrypted material is not the declared key type or algorithm. - `KEY_DECRYPTION_FAILED` — the material could not be decrypted with the supplied passphrase. - `EXPORTABLE_NOT_SUPPORTED` — the token cannot hold a key that stays exportable. - `VALIDATION_FAILED` — the body is readable but breaks a field rule, such as key material outside the pinned protection profile. content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import/status: post: tags: - Key Management v2 summary: Get async key import status description: Get status of an async key import using only its tracking handle operationId: getImportKeyStatus requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "200": description: Key import status retrieved content: application/json: schema: $ref: "#/components/schemas/KeyCreationStatusResponse" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import/result: post: tags: - Key Management v2 summary: Resolve a key import outcome description: | Return the recorded state of an import identified by its `keyImportId`, so a caller that lost the original response can complete its own records or remove a key it cannot account for. - An import that is still running is reported with its current status rather than withheld, so a caller can poll here without holding the original tracking handle. - Records are kept for at least 24 hours after an import reaches a final state. - Within that period a missing record means the import was never accepted, which is the only case answered with HTTP 404. operationId: getImportKeyResult requestBody: content: application/json: schema: $ref: "#/components/schemas/ImportKeyResultRequestV2Dto" required: true responses: "200": description: "Recorded import state retrieved, whether the import is still\ \ running or final" content: application/json: schema: $ref: "#/components/schemas/KeyCreationStatusResponse" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import/keyTypes: post: tags: - Key Management v2 summary: List importable key types description: "List the key types the connector can import for the supplied token\ \ context, each with the algorithms it accepts, so material the token cannot\ \ hold is recognised before it is sent. Each key type appears at most once." operationId: listImportableKeyTypes requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenProfileScopedRequestV2Dto" required: true responses: "200": description: Importable key types retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/ImportableKeyTypeV2Dto" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import/cancel: post: tags: - Key Management v2 summary: Cancel async key import description: Cancel an in-flight async key import using only its tracking handle operationId: cancelImportKey requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "204": description: Aborted "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: | - `OPERATION_PAST_POINT_OF_NO_RETURN` — the import is already terminal, or past the point where it can be abandoned. - `VALIDATION_FAILED` — the body is readable but breaks a field rule. content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/import/attributes: post: tags: - Key Management v2 summary: List key import attributes description: Returns the attribute schema used to import the requested key type. Definitions must not contain resolved credentials or secret values. operationId: listImportKeyAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/ImportKeyAttributesRequestV2Dto" required: true responses: "200": description: Schema retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/export: post: tags: - Key Management v2 summary: Export key description: | Export the key `keyMeta` identifies as protected key material. Export is synchronous, so no protected material is ever held in asynchronous tracking state. The connector protects the material under the supplied `passphrase`, derives `keyData` from the material it is returning so the caller can check it against its own record of the key, and keeps no copy of the material or the passphrase. Only a key created or imported as exportable can be exported. operationId: exportKey requestBody: content: application/json: schema: $ref: "#/components/schemas/ExportKeyRequestV2Dto" required: true responses: "200": description: Exported; body carries the protected key material content: application/json: schema: $ref: "#/components/schemas/ExportKeyResponseV2Dto" "422": description: | - `KEY_NOT_EXPORTABLE` — the key was not created or imported as exportable. - `KEY_TYPE_NOT_EXPORTABLE` — the key type or algorithm cannot be exported from this token. - `KEY_MATERIAL_MISMATCH` — the key the metadata identifies is not the declared key type. - `VALIDATION_FAILED` — the body is readable but breaks a field rule, such as an absent passphrase. content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/export/keyTypes: post: tags: - Key Management v2 summary: List exportable key types description: "List the key types the connector can export from the supplied\ \ token context, each with the algorithms it accepts, so a key the technology\ \ will never release is recognised before a user asks for it. Each key type\ \ appears at most once." operationId: listExportableKeyTypes requestBody: content: application/json: schema: $ref: "#/components/schemas/TokenProfileScopedRequestV2Dto" required: true responses: "200": description: Exportable key types retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/ExportableKeyTypeV2Dto" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/export/attributes: post: tags: - Key Management v2 summary: List key export attributes description: Returns the attribute schema used to export the key the metadata identifies. Definitions must not contain resolved credentials or secret values. operationId: listExportKeyAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/KeyScopedRequestV2Dto" required: true responses: "200": description: Schema retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: '`VALIDATION_FAILED` — the body is readable but breaks a field rule' content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/destroy: post: tags: - Key Management v2 summary: Destroy key description: "Destroy a key using the caller-selected execution mode (synchronous\ \ 200 or asynchronous 202). After accepting asynchronous destruction, the\ \ connector must reject new cryptographic operations for that key" operationId: destroyKey requestBody: content: application/json: schema: $ref: "#/components/schemas/DestroyKeyRequestV2Dto" required: true responses: "200": description: Destroyed synchronously; body contains an empty key-operation response content: application/json: schema: $ref: "#/components/schemas/KeyOperationResponseV2Dto" "202": description: Destruction accepted asynchronously; body carries operationMeta tracking handle content: application/json: schema: $ref: "#/components/schemas/KeyOperationResponseV2Dto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/destroy/status: post: tags: - Key Management v2 summary: Get async key destruction status description: Get status of an async key destruction using only its tracking handle operationId: getDestroyKeyStatus requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "200": description: Key destruction status retrieved content: application/json: schema: $ref: "#/components/schemas/KeyDestructionStatusResponseV2Dto" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/destroy/cancel: post: tags: - Key Management v2 summary: Cancel async key destruction description: Cancel an in-flight asynchronous key destruction using only its tracking handle operationId: cancelDestroyKey requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "204": description: Aborted "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: "Cancellation cannot be processed: the operation is already\ \ terminal or past the point of no return (errorCode OPERATION_PAST_POINT_OF_NO_RETURN),\ \ or the request body violates a field validation rule (errorCode VALIDATION_FAILED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/create/status: post: tags: - Key Management v2 summary: Get async key creation status description: Get status of an async secret key or key pair creation using only its tracking handle operationId: getCreateKeyStatus requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "200": description: Key creation status retrieved content: application/json: schema: $ref: "#/components/schemas/KeyCreationStatusResponse" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/create/cancel: post: tags: - Key Management v2 summary: Cancel async key creation description: Cancel an in-flight async secret key or key pair creation using only its tracking handle operationId: cancelCreateKey requestBody: content: application/json: schema: $ref: "#/components/schemas/OperationTrackingRequestV2Dto" required: true responses: "204": description: Aborted "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: "Cancellation cannot be processed: the operation is already\ \ terminal or past the point of no return (errorCode OPERATION_PAST_POINT_OF_NO_RETURN),\ \ or the request body violates a field validation rule (errorCode VALIDATION_FAILED)" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/cryptographyProvider/keys/create/attributes: post: tags: - Key Management v2 summary: List key creation attributes description: | List attributes for creating the requested key type. Definitions must not contain resolved credentials or secret values. A connector that declares `keyExport` must include the reserved `keyExportable` attribute here: a v3 data attribute named `keyExportable` with boolean content, exactly one content item, required, defaulting to `false`. That is how the exportable intent reaches key creation, so the create request needs no field of its own for it, and it takes part in `keyCreationId` replay equivalence like any other create-key attribute. A connector that does not declare `keyExport` must not publish it and is never sent it, and must create keys non-extractable wherever the technology expresses the distinction. operationId: listCreateKeyAttributes requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateKeyAttributesRequestV2Dto" required: true responses: "200": description: Schema retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "422": description: Request body was read successfully but violates a field validation rule (errorCode VALIDATION_FAILED) content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "400": description: "Request body cannot be read (errorCode BAD_REQUEST), including\ \ malformed JSON, unknown properties, and values outside the published\ \ enum values" content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/attributes/callback: post: tags: - Connector Attributes v2 summary: Execute an attribute callback description: "Resolves dynamic attribute content for the attribute identified\ \ in the request, using the supplied scope and current attribute values." operationId: callback requestBody: content: application/json: schema: $ref: "#/components/schemas/AttributeCallbackRequestDto" required: true responses: "200": description: Callback executed successfully content: application/json: schema: $ref: "#/components/schemas/AttributeCallbackResponseDto" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "422": description: Callback request failed validation at the connector content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/info: get: tags: - Connector Info v2 summary: Get Connector Info description: Returns information about the connector and implemented interfaces. operationId: getConnectorInfo responses: "200": description: Connector info retrieved successfully content: application/json: schema: $ref: "#/components/schemas/InfoResponse" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: [] /v2/health: get: tags: - Health check v2 summary: Health check operationId: checkHealth responses: "200": description: Health check retrieved successfully content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "503": description: Service Unavailable. Health check indicates service or its component is unavailable content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: [] /v2/health/readiness: get: tags: - Health check v2 summary: Health readiness check operationId: checkHealthReadiness responses: "200": description: Health readiness check retrieved successfully content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "503": description: Service Unavailable. Health readiness check indicates service or its component is not ready content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: [] /v2/health/liveness: get: tags: - Health check v2 summary: Health liveness check operationId: checkHealthLiveness responses: "200": description: Health liveness check retrieved successfully content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "503": description: Service Unavailable. Health liveness check indicates service or its component is not live content: application/json: schema: $ref: "#/components/schemas/HealthInfo" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: [] /v2/cryptographyProvider/tokens/attributes: get: tags: - Token Management v2 summary: List token attributes description: Returns the attribute schema used to configure a token operationId: listTokenAttributes responses: "200": description: Token attributes retrieved content: application/json: schema: type: array items: $ref: "#/components/schemas/BaseAttributeDto" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/attributes: get: tags: - Connector Attributes v2 summary: List attribute definitions description: "Returns the connector's attribute-definition registry. With the\ \ optional uuids parameter, returns only the matching definitions (found ones);\ \ otherwise returns the full registry." operationId: listDefinitions parameters: - name: uuids in: query description: Connector-global attribute UUIDs to look up. Repeat the parameter per UUID. required: false schema: type: array items: type: string format: uuid responses: "200": description: Attribute definitions retrieved successfully content: application/json: schema: $ref: "#/components/schemas/AttributeDefinitionsDto" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v2/attributes/{uuid}: get: tags: - Connector Attributes v2 summary: Get an attribute definition description: Returns a single attribute definition by its connector-global UUID. operationId: getDefinition parameters: - name: uuid in: path required: true schema: type: string format: uuid responses: "200": description: Attribute definition retrieved successfully content: application/json: schema: $ref: "#/components/schemas/BaseAttributeDto" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] /v1/metrics: get: tags: - Metrics API summary: Get metrics operationId: getMetrics responses: "200": description: Metrics retrieved successfully content: application/openmetrics-text; version=1.0.0; charset=utf-8: schema: type: string description: "[OpenMetrics v1.0.0 text format](https://prometheus.io/docs/specs/om/open_metrics_spec/#text-format)" example: |- # TYPE http_requests_total counter http_requests_total{method="GET"} 42 text/plain: schema: type: string description: "[Legacy Prometheus 0.0.4 text format](https://github.com/Showmax/prometheus-docs/blob/master/content/docs/instrumenting/exposition_formats.md#format-version-004)" example: |- # HELP http_requests_total Total requests # TYPE http_requests_total counter http_requests_total{method="GET"} 42 "503": description: Service Unavailable. Metrics could not be retrieved content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "401": description: Unauthorized content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "404": description: Not Found. Endpoint not found or not implemented content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" "500": description: Internal Server Error content: application/problem+json: schema: $ref: "#/components/schemas/ProblemDetailExtended" security: - ConnectorAPIKeyAuth: [] - CertificateTLSAuth: [] - NoAuth: [] - BasicAuth: [] components: schemas: ApiKeySecretContent: type: object description: Secret representing an API Key properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: string description: API Key content string minLength: 1 required: - content - type title: ApiKeySecretContent AttributeCallback: type: object properties: callbackContext: type: string description: Context part of callback URL callbackMethod: type: string description: HTTP method of the callback. This value is required for connector callbacks and optional only for callbacks defined on resource objects. mappings: type: array description: Mappings for the callback method items: $ref: "#/components/schemas/AttributeCallbackMapping" uniqueItems: true dependsOn: type: array description: "Names of the attributes, within this same form, whose values\ \ this Attributes v2 callback consumes and is triggered by. Providing\ \ this field — even as an empty list — marks the callback as an Attributes\ \ v2 callback; an empty list means the callback fires once when the form\ \ opens (it depends on no other field). At most one of dependsOn or callbackContext\ \ may be set; a callback with neither field set defines no callback. Not\ \ allowed on RESOURCE attributes. These rules are enforced by the platform." items: type: string required: - mappings AttributeCallbackMapping: type: object properties: from: type: string description: Name of the attribute whose value is to be used as value of path variable or request param or body field.It is optional and must be set only if value is not set. attributeType: $ref: "#/components/schemas/AttributeType" description: Type of the attribute. It is optional and must be set only if special behaviour is needed. attributeContentType: $ref: "#/components/schemas/AttributeContentType" description: 'Type of the attribute content. ' to: type: string description: Name of the path variable or request param or body field which is to be used to assign value of attribute targets: type: array description: Set of targets for propagating value. items: $ref: "#/components/schemas/AttributeValueTarget" uniqueItems: true value: description: Static value to be propagated to targets. It is optional and is set only if the value is known at attribute creation time. required: - targets - to AttributeConstraintType: type: string enum: - regExp - range - dateTime - jsonSchema AttributeContentType: type: string enum: - string - text - integer - boolean - float - date - time - datetime - secret - file - credential - codeblock - object - resource AttributeResource: type: string enum: - certificates - credentials - authorities - entities - locations - secrets AttributeType: type: string enum: - data - group - info - meta - custom AttributeValueTarget: type: string enum: - pathVariable - requestParameter - body - filter AttributeVersion: type: string enum: - v2 - v3 BaseAttributeConstraint: type: object description: Base Attribute Constraint definition discriminator: propertyName: type mapping: regExp: "#/components/schemas/RegexpAttributeConstraint" range: "#/components/schemas/RangeAttributeConstraint" dateTime: "#/components/schemas/DateTimeAttributeConstraint" jsonSchema: "#/components/schemas/JsonSchemaAttributeConstraint" oneOf: - $ref: "#/components/schemas/RegexpAttributeConstraint" - $ref: "#/components/schemas/RangeAttributeConstraint" - $ref: "#/components/schemas/DateTimeAttributeConstraint" - $ref: "#/components/schemas/JsonSchemaAttributeConstraint" properties: description: type: string description: Description of the constraint errorMessage: type: string description: Error message to be displayed for wrong data type: $ref: "#/components/schemas/AttributeConstraintType" description: Attribute Constraint Type required: - type BaseAttributeContentDtoV2: type: object description: Base Attribute ContentV2 definition oneOf: - $ref: "#/components/schemas/BooleanAttributeContentV2" - $ref: "#/components/schemas/CodeBlockAttributeContentV2" - $ref: "#/components/schemas/CredentialAttributeContentV2" - $ref: "#/components/schemas/DateAttributeContentV2" - $ref: "#/components/schemas/DateTimeAttributeContentV2" - $ref: "#/components/schemas/FileAttributeContentV2" - $ref: "#/components/schemas/FloatAttributeContentV2" - $ref: "#/components/schemas/IntegerAttributeContentV2" - $ref: "#/components/schemas/ObjectAttributeContentV2" - $ref: "#/components/schemas/SecretAttributeContentV2" - $ref: "#/components/schemas/StringAttributeContentV2" - $ref: "#/components/schemas/TextAttributeContentV2" - $ref: "#/components/schemas/TimeAttributeContentV2" properties: reference: type: string description: ContentV2 Reference BaseAttributeContentDtoV3: description: Base Attribute Content discriminator: propertyName: contentType mapping: boolean: "#/components/schemas/BooleanAttributeContentV3" codeblock: "#/components/schemas/CodeBlockAttributeContentV3" date: "#/components/schemas/DateAttributeContentV3" datetime: "#/components/schemas/DateTimeAttributeContentV3" file: "#/components/schemas/FileAttributeContentV3" float: "#/components/schemas/FloatAttributeContentV3" integer: "#/components/schemas/IntegerAttributeContentV3" object: "#/components/schemas/ObjectAttributeContentV3" string: "#/components/schemas/StringAttributeContentV3" text: "#/components/schemas/TextAttributeContentV3" time: "#/components/schemas/TimeAttributeContentV3" resource: "#/components/schemas/ResourceObjectContent" oneOf: - $ref: "#/components/schemas/BooleanAttributeContentV3" - $ref: "#/components/schemas/CodeBlockAttributeContentV3" - $ref: "#/components/schemas/DateAttributeContentV3" - $ref: "#/components/schemas/DateTimeAttributeContentV3" - $ref: "#/components/schemas/FileAttributeContentV3" - $ref: "#/components/schemas/FloatAttributeContentV3" - $ref: "#/components/schemas/IntegerAttributeContentV3" - $ref: "#/components/schemas/ObjectAttributeContentV3" - $ref: "#/components/schemas/StringAttributeContentV3" - $ref: "#/components/schemas/TextAttributeContentV3" - $ref: "#/components/schemas/TimeAttributeContentV3" - $ref: "#/components/schemas/ResourceObjectContent" BasicAuthSecretContent: type: object description: Secret representing Basic Authentication credentials properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey username: type: string description: Username for Basic Authentication example: admin minLength: 1 password: type: string description: Password for Basic Authentication minLength: 1 required: - password - type - username title: BasicAuthSecretContent BooleanAttributeContentV2: type: object description: Boolean attribute content to store true/false values properties: reference: type: string description: ContentV2 Reference data: type: boolean description: Boolean attribute value required: - data BooleanAttributeContentV3: type: object description: Boolean attribute content to store true/false values properties: reference: type: string description: Content Reference data: type: boolean description: Boolean attribute value contentType: $ref: "#/components/schemas/AttributeContentType" description: Boolean attribute value required: - contentType - data CertificateType: type: string enum: - X.509 - SSH CodeBlockAttributeContentData: type: object properties: language: $ref: "#/components/schemas/ProgrammingLanguageEnum" description: Definition of programming languages used for code examples: - "JAVA, PHP, C, etc" code: type: string description: Block of the code in Base64. Formatting of the code is specified by variable language required: - code - language CodeBlockAttributeContentV2: type: object description: Codeblock attribute content to store encoded snippets of programming language code properties: reference: type: string description: ContentV2 Reference data: $ref: "#/components/schemas/CodeBlockAttributeContentData" description: CodeBlock attribute content data required: - data CodeBlockAttributeContentV3: type: object description: Codeblock attribute content to store encoded snippets of programming language code properties: reference: type: string description: Content Reference data: $ref: "#/components/schemas/CodeBlockAttributeContentData" description: CodeBlock attribute content data contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data CredentialAttributeContentData: type: object properties: uuid: type: string description: Object identifier examples: - 7b55ge1c-844f-11dc-a8a3-0242ac120002 name: type: string description: Object Name examples: - Name kind: type: string description: Credential Kind examples: - "SoftKeyStore, Basic, ApiKey, etc" attributes: type: array description: List of Credential Attributes items: $ref: "#/components/schemas/DataAttributeV2" required: - attributes - kind - name - uuid CredentialAttributeContentV2: type: object description: Credential attribute content carrying information about credential to use properties: reference: type: string description: ContentV2 Reference data: $ref: "#/components/schemas/CredentialAttributeContentData" description: Credential attribute content data required: - data DataAttributeProperties: type: object properties: label: type: string description: Friendly name of the the Attribute examples: - Attribute Name visible: type: boolean default: true description: "Boolean determining if the Attribute is visible and can be\ \ displayed, otherwise it should be hidden to the user." group: type: string description: "Group of the Attribute, used for the logical grouping of the\ \ Attribute" examples: - requiredAttributes required: type: boolean default: false description: "Boolean determining if the Attribute is required. If true,\ \ the Attribute must be provided." readOnly: type: boolean default: false description: "Boolean determining if the Attribute is read only. If true,\ \ the Attribute content cannot be changed." list: type: boolean default: false description: Boolean determining if the Attribute contains list of values in the content multiSelect: type: boolean default: false description: Boolean determining if the Attribute can have multiple values protectionLevel: $ref: "#/components/schemas/ProtectionLevel" default: none description: Protection level of the attribute content resource: $ref: "#/components/schemas/AttributeResource" description: "Resource of the attribute, relevant if the attribute has Resource\ \ content type" extensibleList: type: boolean default: false description: Boolean determining if a list Attribute can have values other than predefined options required: - extensibleList - label - list - multiSelect - readOnly - required - visible DataAttributeV2: type: object description: Data attribute allows to store and transfer dynamic data. Its content can be edited and send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/DataAttributeProperties" description: Properties of the Attributes constraints: type: array description: Optional constraints used for validating the Attribute content items: $ref: "#/components/schemas/BaseAttributeConstraint" attributeCallback: $ref: "#/components/schemas/AttributeCallback" description: Optional definition of callback for getting the content of the Attribute based on the action required: - contentType - name - properties - type - uuid - version DateAttributeContentV2: type: object description: Date attribute content in predefined format properties: reference: type: string description: ContentV2 Reference data: type: string format: date description: Date attribute value in format yyyy-MM-dd required: - data DateAttributeContentV3: type: object description: Date attribute content in predefined format properties: reference: type: string description: Content Reference data: type: string format: date description: Date attribute value in format yyyy-MM-dd contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data DateTimeAttributeConstraint: type: object description: DateTime attribute constraint to specify boundaries for date value properties: description: type: string description: Description of the constraint errorMessage: type: string description: Error message to be displayed for wrong data type: $ref: "#/components/schemas/AttributeConstraintType" description: Attribute Constraint Type data: $ref: "#/components/schemas/DateTimeAttributeConstraintData" description: DateTime Range Attribute Constraint Data required: - type DateTimeAttributeConstraintData: type: object properties: from: type: string format: date-time description: Start of the datetime for validation to: type: string format: date-time description: End of the datetime for validation DateTimeAttributeContentV2: type: object description: DateTime attribute content in predefined format with timezone properties: reference: type: string description: ContentV2 Reference data: type: string format: date-time description: DateTime attribute value in format yyyy-MM-ddTHH:mm:ss.SSSXXX required: - data DateTimeAttributeContentV3: type: object description: DateTime attribute content in predefined format with timezone properties: reference: type: string description: Content Reference data: type: string format: date-time description: DateTime attribute value in format yyyy-MM-ddTHH:mm:ss.SSSXXX contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data FileAttributeContentData: type: object properties: content: type: string description: File content fileName: type: string description: Name of the file mimeType: type: string description: Type of the file uploaded required: - content - fileName - mimeType FileAttributeContentV2: type: object description: File attribute content for storing encoded file content with additional info properties: reference: type: string description: ContentV2 Reference data: $ref: "#/components/schemas/FileAttributeContentData" description: File attribute content data required: - data FileAttributeContentV3: type: object description: File attribute content for storing encoded file content with additional info properties: reference: type: string description: Content Reference data: $ref: "#/components/schemas/FileAttributeContentData" description: File attribute content data contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data FloatAttributeContentV2: type: object description: Float attribute content for decimal numbers properties: reference: type: string description: ContentV2 Reference data: type: number format: float description: Float attribute value required: - data FloatAttributeContentV3: type: object description: Float attribute content for decimal numbers properties: reference: type: string description: Content Reference data: type: number format: float description: Float attribute value contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data GenericSecretContent: type: object description: Secret representing generic content represented as string properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: string description: "Generic secret content represented as string. In case secret\ \ content is binary data, it should be encoded as BASE64 string." minLength: 1 required: - content - type title: GenericSecretContent IntegerAttributeContentV2: type: object description: Integer attribute content for integer numbers properties: reference: type: string description: ContentV2 Reference data: type: integer format: int32 description: Integer attribute value required: - data IntegerAttributeContentV3: type: object description: Integer attribute content for integer numbers properties: reference: type: string description: Content Reference data: type: integer format: int32 description: Integer attribute value contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data JsonSchemaAttributeConstraint: type: object description: JSON Schema attribute constraint restricting a string value to JSON conforming to an inline JSON Schema (draft 2020-12) properties: description: type: string description: Description of the constraint errorMessage: type: string description: Error message to be displayed for wrong data type: $ref: "#/components/schemas/AttributeConstraintType" description: Attribute Constraint Type data: type: string description: Inline JSON Schema document the value must conform to minLength: 1 required: - data - type JwtTokenSecretContent: type: object description: Secret representing JWT Token properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: string description: "JWT Token content in compact (dot-separated) format specified\ \ in [RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519#section-3)" example: eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk minLength: 1 required: - content - type title: JwtTokenSecretContent KeyStoreSecretContent: type: object description: Secret representing Key Store properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey keyStoreType: $ref: "#/components/schemas/KeyStoreType" description: Key Store type content: type: string description: BASE64 encoded content of key store minLength: 1 password: type: string description: Password for key store required: - content - keyStoreType - password - type title: KeyStoreSecretContent KeyStoreType: type: string enum: - JKS - PKCS12 KeyValueSecretContent: type: object description: Secret representing key-value pairs properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: object additionalProperties: {} description: "Key-Value pairs stored as the secret content, represented\ \ by JSON object" required: - content - type title: KeyValueSecretContent ObjectAttributeContentV2: type: object description: Object attribute content for data with custom structure properties: reference: type: string description: ContentV2 Reference data: description: Object attribute content data required: - data ObjectAttributeContentV3: type: object description: Object attribute content for data with custom structure properties: reference: type: string description: Content Reference data: description: Object attribute content data contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data PrivateKeySecretContent: type: object description: Secret representing private key properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: string description: BASE64 encoded content of key in PEM format minLength: 1 required: - content - type title: PrivateKeySecretContent ProgrammingLanguageEnum: type: string enum: - apacheconf - bash - basic - c - csharp - cpp - css - docker - fsharp - gherkin - git - go - graphql - html - http - ini - java - javascript - json - kotlin - latex - lisp - makefile - markdown - matlab - nginx - objectivec - perl - php - powershell - properties - python - ruby - rust - smalltalk - sql - typescript - vbnet - xquery - xml - yaml ProtectionLevel: type: string enum: - none - encrypted RangeAttributeConstraint: type: object description: Range attribute constraint to specify boundaries for integer value properties: description: type: string description: Description of the constraint errorMessage: type: string description: Error message to be displayed for wrong data type: $ref: "#/components/schemas/AttributeConstraintType" description: Attribute Constraint Type data: $ref: "#/components/schemas/RangeAttributeConstraintData" description: Integer Range Attribute Constraint Data required: - type RangeAttributeConstraintData: type: object properties: from: type: integer format: int32 description: Start of the range for validation to: type: integer format: int32 description: End of the range for validation RegexpAttributeConstraint: type: object description: RegExp attribute constraint to restrict string value by regular expression properties: description: type: string description: Description of the constraint errorMessage: type: string description: Error message to be displayed for wrong data type: $ref: "#/components/schemas/AttributeConstraintType" description: Attribute Constraint Type data: type: string description: Regular Expression Attribute Constraint Data required: - type RequestAttribute: type: object description: Request attribute to send attribute content for object discriminator: propertyName: version mapping: v2: "#/components/schemas/RequestAttributeV2" v3: "#/components/schemas/RequestAttributeV3" oneOf: - $ref: "#/components/schemas/RequestAttributeV3" - $ref: "#/components/schemas/RequestAttributeV2" required: - contentType - name - uuid - version RequestAttributeV2: type: object properties: uuid: type: string format: uuid description: UUID of the Attribute example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute examples: - Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the Attribute examples: - Attribute content: type: array items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" version: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute required: - contentType - name - uuid - version RequestAttributeV3: type: object properties: uuid: type: string format: uuid description: UUID of the Attribute example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute examples: - Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the Attribute examples: - Attribute content: type: array items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" version: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute required: - contentType - name - uuid - version ResourceCertificateContentData: type: object description: Content data for resource object attribute containing certificate content properties: uuid: type: string description: Resource identifier examples: - 7b55ge1c-844f-11dc-a8a3-0242ac120002 name: type: string description: Resource name examples: - Main authority resource: $ref: "#/components/schemas/AttributeResource" description: Resource contained in data example: authorities certificateType: $ref: "#/components/schemas/CertificateType" description: Certificate type content: type: string description: Base64 encoded content of the certificate required: - name - resource - uuid title: ResourceCertificateContentData ResourceObjectContent: type: object description: Resource object attribute content carrying resource object data properties: reference: type: string description: Content Reference data: $ref: "#/components/schemas/ResourceObjectContentData" description: Resource Object content data contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data ResourceObjectContentData: type: object discriminator: propertyName: resource mapping: authorities: "#/components/schemas/ResourceSimpleContentData" entities: "#/components/schemas/ResourceSimpleContentData" locations: "#/components/schemas/ResourceSimpleContentData" credentials: "#/components/schemas/ResourceSimpleContentData" certificates: "#/components/schemas/ResourceCertificateContentData" secrets: "#/components/schemas/ResourceSecretContentData" oneOf: - $ref: "#/components/schemas/ResourceSimpleContentData" - $ref: "#/components/schemas/ResourceCertificateContentData" - $ref: "#/components/schemas/ResourceSecretContentData" required: - name - resource - uuid ResourceSecretContentData: type: object description: Content data for resource object attribute containing secret content properties: uuid: type: string description: Resource identifier examples: - 7b55ge1c-844f-11dc-a8a3-0242ac120002 name: type: string description: Resource name examples: - Main authority resource: $ref: "#/components/schemas/AttributeResource" description: Resource contained in data example: authorities content: $ref: "#/components/schemas/SecretContent" description: Secret content of the resource object required: - name - resource - uuid title: ResourceSecretContentData ResourceSimpleContentData: type: object description: Content data for resource object defined by its attributes properties: resource: $ref: "#/components/schemas/AttributeResource" description: Resource contained in data example: authorities uuid: type: string description: Resource identifier examples: - 7b55ge1c-844f-11dc-a8a3-0242ac120002 name: type: string description: Resource name examples: - Main authority attributes: type: array description: Attributes of the resource object items: $ref: "#/components/schemas/ResponseAttribute" required: - name - resource - uuid title: ResourceSimpleContentData ResponseAttribute: type: object description: Response attribute to send attribute content for object discriminator: propertyName: version mapping: v2: "#/components/schemas/ResponseAttributeV2" v3: "#/components/schemas/ResponseAttributeV3" oneOf: - $ref: "#/components/schemas/ResponseAttributeV2" - $ref: "#/components/schemas/ResponseAttributeV3" required: - contentType - label - name - type - uuid - version ResponseAttributeV2: type: object properties: content: type: array items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" uuid: type: string format: uuid description: UUID of the Attribute example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute examples: - Attribute label: type: string description: Label of the the Attribute examples: - Attribute Name type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the Attribute examples: - Attribute version: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute required: - contentType - label - name - type - uuid - version ResponseAttributeV3: type: object properties: content: type: array items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" uuid: type: string format: uuid description: UUID of the Attribute example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute examples: - Attribute label: type: string description: Label of the the Attribute examples: - Attribute Name type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the Attribute examples: - Attribute version: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute required: - contentType - label - name - type - uuid - version SecretAttributeContentData: type: object properties: secret: type: string description: Secret attribute data protectionLevel: $ref: "#/components/schemas/ProtectionLevel" description: Level of protection of the data SecretAttributeContentV2: type: object description: Secret attribute content carrying secrets with defined protection level properties: reference: type: string description: ContentV2 Reference data: $ref: "#/components/schemas/SecretAttributeContentData" description: Secret attribute content data required: - data SecretContent: type: object description: Secret content dependent on secret type discriminator: propertyName: type mapping: basicAuth: "#/components/schemas/BasicAuthSecretContent" apiKey: "#/components/schemas/ApiKeySecretContent" jwtToken: "#/components/schemas/JwtTokenSecretContent" privateKey: "#/components/schemas/PrivateKeySecretContent" secretKey: "#/components/schemas/SecretKeySecretContent" keyStore: "#/components/schemas/KeyStoreSecretContent" keyValue: "#/components/schemas/KeyValueSecretContent" generic: "#/components/schemas/GenericSecretContent" oneOf: - $ref: "#/components/schemas/BasicAuthSecretContent" - $ref: "#/components/schemas/ApiKeySecretContent" - $ref: "#/components/schemas/JwtTokenSecretContent" - $ref: "#/components/schemas/PrivateKeySecretContent" - $ref: "#/components/schemas/SecretKeySecretContent" - $ref: "#/components/schemas/KeyStoreSecretContent" - $ref: "#/components/schemas/KeyValueSecretContent" - $ref: "#/components/schemas/GenericSecretContent" required: - type SecretKeySecretContent: type: object description: Secret representing secret key properties: type: $ref: "#/components/schemas/SecretType" description: Secret type examples: - apiKey content: type: string description: BASE64 encoded binary (raw) content of key minLength: 1 required: - content - type title: SecretKeySecretContent SecretType: type: string enum: - basicAuth - apiKey - jwtToken - privateKey - secretKey - keyStore - keyValue - generic StringAttributeContentV2: type: object description: String attribute content properties: reference: type: string description: ContentV2 Reference data: type: string description: String attribute value required: - data StringAttributeContentV3: type: object description: String attribute content properties: reference: type: string description: Content Reference data: type: string description: String attribute value contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data TextAttributeContentV2: type: object description: Text attribute content used to store longer formatted strings properties: reference: type: string description: ContentV2 Reference data: type: string description: Text attribute value required: - data TextAttributeContentV3: type: object description: Text attribute content used to store longer formatted strings properties: reference: type: string description: Content Reference data: type: string description: Text attribute value contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data TimeAttributeContentV2: type: object description: Time attribute content in predefined format properties: reference: type: string description: ContentV2 Reference data: type: string description: Time attribute value in format HH:mm:ss required: - data TimeAttributeContentV3: type: object description: Time attribute content in predefined format properties: reference: type: string description: Content Reference data: type: string description: Time attribute value in format HH:mm:ss contentType: $ref: "#/components/schemas/AttributeContentType" description: Content Type of the attribute required: - contentType - data TokenScopedRequestV2Dto: type: object additionalProperties: false description: Token context for token and token-profile operations. properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" required: - tokenAttributes ErrorCode: type: string enum: - VALIDATION_FAILED - RESOURCE_NOT_FOUND - RESOURCE_ALREADY_EXISTS - REQUEST_TIMEOUT - OPERATION_NOT_SUPPORTED - ATTRIBUTES_ERROR - SERVICE_UNAVAILABLE - INTERNAL_SERVER_ERROR - BAD_REQUEST - UNAUTHORIZED - FORBIDDEN - RATE_LIMIT_EXCEEDED - GATEWAY_TIMEOUT - UPSTREAM_ERROR - CREDENTIAL_INVALID - POLICY_VIOLATION - OPERATION_PAST_POINT_OF_NO_RETURN - OPERATION_NOT_TRACKED - ATTRIBUTE_DEFINITION_NOT_FOUND - DOCUMENT_MALFORMED - DOCUMENT_TOO_LARGE - SIGNATURE_NOT_FOUND - PARAMETER_UNSUPPORTED - CONTEXT_MISMATCH - CSR_MALFORMED - REVOCATION_NOT_ALLOWED - REGISTRATION_NOT_FOUND - RENEWAL_SOURCE_NOT_FOUND - CSR_SUBJECT_MISMATCH - CERTIFICATE_MISMATCH - CHECKPOINT_LOST - KEY_TYPE_NOT_IMPORTABLE - KEY_TYPE_NOT_EXPORTABLE - KEY_MATERIAL_MISMATCH - KEY_DECRYPTION_FAILED - EXPORTABLE_NOT_SUPPORTED - KEY_NOT_EXPORTABLE ProblemDetailExtended: type: object properties: type: type: string format: uri description: RFC 9457 type URI identifying the problem type example: https://docs.otilm.com/problems/common/validation-failed title: type: - string - "null" description: Short human-readable summary of the problem type example: Validation failed status: type: integer format: int32 description: HTTP status code (MUST match the actual response code) example: 422 maximum: 599 minimum: 100 detail: type: - string - "null" description: Human-readable explanation specific to this occurrence example: One or more fields failed validation. instance: type: - string - "null" format: uri description: "URI reference identifying the occurrence (e.g., request path\ \ or operation ID)." example: https://api.example.org/foo/bar/123 properties: type: - object - "null" additionalProperties: {} description: Generic map of properties that are not known ahead of time errorCode: $ref: "#/components/schemas/ErrorCode" description: Application specific error code timestamp: type: string format: date-time description: Timestamp of when the error occurred (RFC 3339 format) examples: - 2026-01-22T15:10:20.123Z - 2026-01-22T15:10:20.123+02:00 correlationId: type: string description: Correlation ID for tracking the request. Trace value from X-Request-Id or W3C Trace Context. retryable: type: boolean description: Indicates if the operation that caused the error can be retried safely retryAfterSeconds: type: integer format: int32 description: "Backoff hint, number of seconds after which the client can\ \ retry the operation. Aligns with Retry-After header." required: - errorCode - retryable - status - timestamp - type BaseAttributeDto: type: object description: Base Attribute definition oneOf: - $ref: "#/components/schemas/BaseAttributeDtoV2" - $ref: "#/components/schemas/BaseAttributeDtoV3" properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute required: - name - type - uuid BaseAttributeDtoV2: description: Base Attribute definition discriminator: propertyName: type mapping: data: "#/components/schemas/DataAttributeV2" info: "#/components/schemas/InfoAttributeV2" group: "#/components/schemas/GroupAttributeV2" meta: "#/components/schemas/MetadataAttributeV2" custom: "#/components/schemas/CustomAttributeV2" oneOf: - $ref: "#/components/schemas/DataAttributeV2" - $ref: "#/components/schemas/InfoAttributeV2" - $ref: "#/components/schemas/GroupAttributeV2" - $ref: "#/components/schemas/MetadataAttributeV2" - $ref: "#/components/schemas/CustomAttributeV2" BaseAttributeDtoV3: type: object description: Base Attribute definition discriminator: propertyName: type mapping: data: "#/components/schemas/DataAttributeV3" info: "#/components/schemas/InfoAttributeV3" group: "#/components/schemas/GroupAttributeV3" meta: "#/components/schemas/MetadataAttributeV3" custom: "#/components/schemas/CustomAttributeV3" oneOf: - $ref: "#/components/schemas/DataAttributeV3" - $ref: "#/components/schemas/InfoAttributeV3" - $ref: "#/components/schemas/GroupAttributeV3" - $ref: "#/components/schemas/MetadataAttributeV3" - $ref: "#/components/schemas/CustomAttributeV3" required: - schemaVersion CustomAttributeProperties: type: object properties: label: type: string description: Friendly name of the the Attribute examples: - Attribute Name visible: type: boolean default: true description: "Boolean determining if the Attribute is visible and can be\ \ displayed, otherwise it should be hidden to the user." group: type: string description: "Group of the Attribute, used for the logical grouping of the\ \ Attribute" examples: - requiredAttributes required: type: boolean default: false description: "Boolean determining if the Attribute is required. If true,\ \ the Attribute must be provided." readOnly: type: boolean default: false description: "Boolean determining if the Attribute is read only. If true,\ \ the Attribute content cannot be changed." list: type: boolean default: false description: Boolean determining if the Attribute contains list of values in the content multiSelect: type: boolean default: false description: Boolean determining if the Attribute can have multiple values extensibleList: type: boolean default: false description: Boolean determining if a list Attribute can have values other than predefined options protectionLevel: $ref: "#/components/schemas/ProtectionLevel" default: none description: Protection level of the attribute content required: - extensibleList - label - list - multiSelect - readOnly - required - visible CustomAttributeV2: type: object description: Custom attribute allows to store and transfer dynamic data. Its content can be edited and send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/CustomAttributeProperties" description: Properties of the Attributes required: - contentType - name - properties - type - uuid - version CustomAttributeV3: type: object description: Custom attribute allows to store and transfer dynamic data. Its content can be edited and send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/CustomAttributeProperties" description: Properties of the Attributes schemaVersion: $ref: "#/components/schemas/AttributeVersion" description: Schema version of the Attribute required: - contentType - name - properties - schemaVersion - type - uuid - version DataAttributeV3: type: object description: Data attribute allows to store and transfer dynamic data. Its content can be edited and send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/DataAttributeProperties" description: Properties of the Attributes constraints: type: array description: Optional constraints used for validating the Attribute content items: $ref: "#/components/schemas/BaseAttributeConstraint" attributeCallback: $ref: "#/components/schemas/AttributeCallback" description: Optional definition of callback for getting the content of the Attribute based on the action schemaVersion: $ref: "#/components/schemas/AttributeVersion" description: Schema version of the Attribute fieldMapping: $ref: "#/components/schemas/FieldMapping" description: Declares which certificate (or other object) fields this attribute's value projects into; presence marks this attribute as a certificate request attribute valueSource: $ref: "#/components/schemas/ValueSource" description: Declares how Core resolves the content of this attribute; orthogonal to fieldMapping required: - contentType - name - properties - schemaVersion - type - uuid - version ExtendedKeyUsageMappedField: allOf: - $ref: "#/components/schemas/MappedField" description: "Maps an attribute to the Extended Key Usage extension; the permitted\ \ purposes are the attribute's content, resolved against the EXTENDED_KEY_USAGE\ \ OID registry" required: - fieldType ExtensionMappedField: allOf: - $ref: "#/components/schemas/MappedField" - type: object properties: extensionOid: type: string description: OID of the X.509 extension (dotted-decimal) minLength: 1 criticalOverridable: type: boolean description: Whether the requester may override the default criticality of the extension description: Maps an attribute value to an X.509 extension required: - extensionOid - fieldType ExtensionValueEncoding: type: string enum: - UTF8String - IA5String - PrintableString - OctetString - BitString - DER FieldMapping: type: object description: Declares which certificate (or other object) fields an attribute value projects into properties: objectType: $ref: "#/components/schemas/ObjectType" description: Object type this mapping applies to fields: type: array description: "One or more target fields (supports 1-to-many, e.g. CN + dNSName\ \ from a single attribute)" items: oneOf: - $ref: "#/components/schemas/ExtendedKeyUsageMappedField" - $ref: "#/components/schemas/ExtensionMappedField" - $ref: "#/components/schemas/KeyUsageMappedField" - $ref: "#/components/schemas/RdnMappedField" - $ref: "#/components/schemas/SanMappedField" minItems: 1 required: - fields - objectType FieldSource: type: string enum: - csr - platform - csrThenPlatform FieldType: type: string enum: - rdn - san - extension - keyUsage - extendedKeyUsage GeneralNameType: type: string enum: - dns - email - ip - uri - otherName - directoryName - registeredId GroupAttributeV2: type: object description: Group attribute and its content represents dynamic list of additional attributes retrieved by callback. Its content can not be edited and is not send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute content: type: array description: List of all different types of attributes items: $ref: "#/components/schemas/BaseAttributeDtoV2" description: Base Attribute definition type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute attributeCallback: $ref: "#/components/schemas/AttributeCallback" description: Optional definition of callback for getting the content of the Attribute based on the action required: - name - type - uuid - version GroupAttributeV3: type: object description: Group attribute and its content represents dynamic list of additional attributes retrieved by callback. Its content can not be edited and is not send in requests to store. properties: schemaVersion: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute example: 3 uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" content: type: array description: List of all different types of attributes items: $ref: "#/components/schemas/BaseAttributeDto" version: type: integer format: int32 type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute attributeCallback: $ref: "#/components/schemas/AttributeCallback" description: Optional definition of callback for getting the content of the Attribute based on the action required: - name - schemaVersion - type - uuid InfoAttributeProperties: type: object properties: label: type: string description: Friendly name of the the Attribute examples: - Attribute Name visible: type: boolean default: true description: "Boolean determining if the Attribute is visible and can be\ \ displayed, otherwise it should be hidden to the user." group: type: string description: "Group of the Attribute, used for the logical grouping of the\ \ Attribute" examples: - requiredAttributes required: - label - visible InfoAttributeV2: type: object description: Info attribute contains content that is for information purpose or represents additional information for object (metadata). Its content can not be edited and is not send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/InfoAttributeProperties" description: Properties of the Attributes required: - content - contentType - name - properties - type - uuid - version InfoAttributeV3: type: object description: Info attribute contains content that is for information purpose or represents additional information for object (metadata). Its content can not be edited and is not send in requests to store. properties: schemaVersion: $ref: "#/components/schemas/AttributeVersion" description: Version of the Attribute example: 3 uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" version: type: integer format: int32 type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/InfoAttributeProperties" description: Properties of the Attributes required: - content - contentType - name - properties - schemaVersion - type - uuid KeyUsageMappedField: allOf: - $ref: "#/components/schemas/MappedField" description: "Maps an attribute to the Key Usage extension; the permitted bits\ \ are the attribute's content, taken from CertificateKeyUsage" required: - fieldType MappedField: type: object description: Describes a single target field within an object; concrete type is determined by fieldType discriminator: propertyName: fieldType mapping: rdn: "#/components/schemas/RdnMappedField" san: "#/components/schemas/SanMappedField" extension: "#/components/schemas/ExtensionMappedField" keyUsage: "#/components/schemas/KeyUsageMappedField" extendedKeyUsage: "#/components/schemas/ExtendedKeyUsageMappedField" properties: fieldType: $ref: "#/components/schemas/FieldType" description: "Field type, determines the concrete subtype" order: type: integer format: int32 description: Ordering index for fields of the same type (e.g. RDN components); ascending minimum: 1 source: $ref: "#/components/schemas/FieldSource" description: Provenance of the value when reconciling CSR vs platform-projected values required: - fieldType MetadataAttributeProperties: type: object properties: label: type: string description: Friendly name of the the Attribute examples: - Attribute Name visible: type: boolean default: true description: "Boolean determining if the Attribute is visible and can be\ \ displayed, otherwise it should be hidden to the user." group: type: string description: "Group of the Attribute, used for the logical grouping of the\ \ Attribute" examples: - requiredAttributes global: type: boolean default: false description: Boolean determining if the Metadata is a global metadata. overwrite: type: boolean default: false description: Boolean determining if the new metadata content should overwrite (replace) existing content instead of appending. protectionLevel: $ref: "#/components/schemas/ProtectionLevel" default: none description: Protection level of the attribute content required: - label - visible MetadataAttributeV2: type: object description: Info attribute contains content that is for metadata. Its content can not be edited and is not send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV2" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/MetadataAttributeProperties" description: Properties of the Attributes required: - contentType - name - properties - type - uuid - version MetadataAttributeV3: type: object description: Info attribute contains content that is for metadata. Its content can not be edited and is not send in requests to store. properties: uuid: type: string description: UUID of the Attribute for unique identification example: b11c9be1-b619-4ef5-be1b-a1cd9ef265b7 name: type: string description: Name of the Attribute that is used for identification examples: - Attribute description: type: string description: "Optional description of the Attribute, should contain helper\ \ text on what is expected" version: type: integer format: int32 description: Version of the attribute type: $ref: "#/components/schemas/AttributeType" description: Type of the Attribute content: type: array description: Content of the Attribute items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" contentType: $ref: "#/components/schemas/AttributeContentType" description: Type of the Content properties: $ref: "#/components/schemas/MetadataAttributeProperties" description: Properties of the Attributes schemaVersion: $ref: "#/components/schemas/AttributeVersion" description: Schema version of the Attribute required: - contentType - name - properties - schemaVersion - type - uuid - version ObjectType: type: string enum: - x509Certificate - sshCertificate - key - secret RdnMappedField: allOf: - $ref: "#/components/schemas/MappedField" - type: object properties: rdn: type: string description: RDN code (e.g. "CN") or dotted-decimal OID; resolved via the OID registry minLength: 1 description: Maps an attribute value to an X.509 RDN component required: - fieldType - rdn SanMappedField: allOf: - $ref: "#/components/schemas/MappedField" - type: object properties: generalNameType: $ref: "#/components/schemas/GeneralNameType" description: SAN type otherNameOid: type: string description: OID of the otherName type; required when generalNameType is OTHER_NAME otherNameValueEncoding: $ref: "#/components/schemas/ExtensionValueEncoding" description: ASN.1 encoding for the otherName value; required when generalNameType is OTHER_NAME because different OtherName OIDs carry differently-typed values (e.g. UPN → UTF8String) description: Maps an attribute value to a Subject Alternative Name entry required: - fieldType - generalNameType SourceParam: type: object description: Dependency filter that scopes a value source by another attribute's value properties: attributeUuid: type: string description: UUID of the attribute whose value is used as a filter parameter attributeName: type: string description: Name of the attribute; used as fallback when attributeUuid is not matched ValueSource: type: object description: Declares how Core resolves the content of an attribute; orthogonal to fieldMapping properties: kind: $ref: "#/components/schemas/ValueSourceType" description: How the attribute value is resolved params: type: array description: Optional dependency filters that scope the source by other attributes' values items: $ref: "#/components/schemas/SourceParam" required: - kind ValueSourceType: type: string enum: - none - connectorCallback - staticList TokenStatusResponseV2Dto: type: object additionalProperties: false properties: status: $ref: "#/components/schemas/TokenStatusV2" description: Token status detail: type: string description: Optional provider-supplied detail explaining the token status required: - status TokenStatusV2: type: string description: Provider-observable token status enum: - Connected - Disconnected - Warning - Unknown TokenProfileScopedRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" required: - tokenAttributes - tokenProfileAttributes KeyRequestType: type: string enum: - secret - keyPair MetadataAttribute: description: Metadata Attribute definition oneOf: - $ref: "#/components/schemas/MetadataAttributeV2" - $ref: "#/components/schemas/MetadataAttributeV3" SignatureDataV2Dto: type: object additionalProperties: false properties: data: type: string format: byte description: "Data to be signed or verified, or the resulting signature,\ \ depending on the operation direction." minLength: 1 identifier: type: string description: Identifier used to correlate the item across request and response examples: - customId minLength: 1 required: - data - identifier VerifyDataRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 signatureAttributes: type: array description: "Batch-wide signature settings. Must include exactly one v3\ \ string attribute named signatureAlgorithm with UUID 9180267f-c82f-4b7b-8160-d2363d813869,\ \ selecting exactly one signature algorithm code offered by the verification\ \ attribute schema." items: $ref: "#/components/schemas/RequestAttribute" data: type: array description: "Signed data, correlated to the signatures by identifier" items: $ref: "#/components/schemas/SignatureDataV2Dto" minItems: 1 signatures: type: array description: "Signatures to verify, correlated to the signed data by identifier" items: $ref: "#/components/schemas/SignatureDataV2Dto" minItems: 1 required: - data - keyMeta - signatureAttributes - signatures - tokenAttributes - tokenProfileAttributes VerificationResponseItemV2Dto: type: object additionalProperties: false properties: result: type: boolean description: Whether the signature is valid identifier: type: string description: Identifier of the corresponding request item examples: - customId minLength: 1 details: description: Additional result details required: - identifier - result VerifyDataResponseV2Dto: type: object additionalProperties: false properties: verifications: type: array description: "Verification results, correlated to the request items by identifier" items: $ref: "#/components/schemas/VerificationResponseItemV2Dto" minItems: 1 required: - verifications KeyScopedRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 required: - keyMeta - tokenAttributes - tokenProfileAttributes OperationExecutionMode: type: string description: Whether the connector must complete the operation inline or accept it for asynchronous processing enum: - synchronous - asynchronous SignDataRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 executionMode: $ref: "#/components/schemas/OperationExecutionMode" description: Caller-selected execution mode. The connector must not switch modes implicitly. signatureAttributes: type: array description: "Batch-wide signature settings. Must include exactly one v3\ \ string attribute named signatureAlgorithm with UUID 9180267f-c82f-4b7b-8160-d2363d813869,\ \ selecting exactly one signature algorithm code offered by the signing\ \ attribute schema." items: $ref: "#/components/schemas/RequestAttribute" data: type: array description: Data to be signed items: $ref: "#/components/schemas/SignatureDataV2Dto" minItems: 1 required: - data - executionMode - keyMeta - signatureAttributes - tokenAttributes - tokenProfileAttributes SignDataResponseV2Dto: type: object additionalProperties: false properties: signatures: type: array description: "Signatures, correlated to the request items by identifier.\ \ Populated on sync 200; absent on async 202." items: $ref: "#/components/schemas/SignatureDataV2Dto" minItems: 1 operationMeta: type: array description: Connector-defined signing operation metadata. Required and non-empty on asynchronous 202 as the tracking handle for the whole batch; must be absent on synchronous 200. Supply it by itself to /operations/sign/status and /operations/sign/cancel. It must remain valid for the operation's entire tracking lifetime. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 OperationTrackingRequestV2Dto: type: object additionalProperties: false description: Tracking handle for polling or cancelling an asynchronous cryptography operation. The connector must keep the handle valid for the operation's entire tracking lifetime. properties: operationMeta: type: array description: "Opaque connector-defined tracking handle returned in the original\ \ 202 Accepted response. It is sufficient without token, token-profile,\ \ key-usage, or key metadata and must remain valid for the operation's\ \ entire tracking lifetime." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 required: - operationMeta OperationStatus: type: string enum: - inProgress - completed - failed - cancelled SignOperationStatusResponseV2Dto: type: object additionalProperties: false properties: items: type: array description: "Per-item results, one per item of the original sign request,\ \ correlated by identifier" items: $ref: "#/components/schemas/SignatureResultItemV2Dto" minItems: 1 required: - items SignatureResultItemV2Dto: type: object additionalProperties: false properties: identifier: type: string description: Identifier of the corresponding item in the original sign request examples: - customId minLength: 1 status: $ref: "#/components/schemas/OperationStatus" description: Status of this item signature: type: string format: byte description: Signature over the item's data. Populated when status=`completed`. reason: type: string description: Failure or cancellation detail when status=`failed` or `cancelled` — curated message text (no raw exception messages) required: - identifier - status RandomDataRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" length: type: integer format: int32 description: "Number of random bytes to generate, capped at 1 MiB" maximum: 1048576 minimum: 1 operationAttributes: type: array description: Random generator attributes items: $ref: "#/components/schemas/RequestAttribute" required: - length - operationAttributes - tokenAttributes - tokenProfileAttributes RandomDataResponseV2Dto: type: object additionalProperties: false properties: data: type: string format: byte description: Random generated data minLength: 1 required: - data CipherDataRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 cipherAttributes: type: array description: "Batch-wide cipher settings. Must include exactly one v3 string\ \ attribute named encryptionAlgorithm with UUID 5e364467-fa95-4253-907b-0c73cdfb2be7,\ \ selecting exactly one code offered by the corresponding encryption or\ \ decryption attribute schema. Algorithm codes are values from the EncryptionAlgorithm\ \ enum. RSA OAEP profiles use MGF1 with the same hash as OAEP and an empty\ \ label. PKCS1 v1.5 and OAEP with SHA-1 are compatibility choices." items: $ref: "#/components/schemas/RequestAttribute" cipherData: type: array description: Data to be encrypted or decrypted items: $ref: "#/components/schemas/CipherDataV2Dto" minItems: 1 required: - cipherAttributes - cipherData - keyMeta - tokenAttributes - tokenProfileAttributes CipherDataV2Dto: type: object additionalProperties: false properties: data: type: string format: byte description: "Plaintext or a self-contained encrypted representation, depending\ \ on the operation direction." minLength: 1 identifier: type: string description: Identifier used to correlate the item across request and response examples: - customId minLength: 1 required: - data - identifier EncryptDataResponseV2Dto: type: object additionalProperties: false properties: encryptedData: type: array description: Encrypted data items: $ref: "#/components/schemas/CipherDataV2Dto" minItems: 1 required: - encryptedData DecryptDataResponseV2Dto: type: object additionalProperties: false properties: decryptedData: type: array description: Decrypted data items: $ref: "#/components/schemas/CipherDataV2Dto" minItems: 1 required: - decryptedData CreateKeyRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key to create executionMode: $ref: "#/components/schemas/OperationExecutionMode" description: Caller-selected execution mode. The connector must not switch modes implicitly. keyCreationId: type: string description: | Identifier of a key creation operation. Replays must use the same keyRequestType, executionMode, tokenAttributes, tokenProfileAttributes, and createKeyAttributes. An asynchronous replay returns HTTP 202 with the original operationMeta. A synchronous replay returns HTTP 200 with the original result. Non-equivalent reuse returns RESOURCE_ALREADY_EXISTS (HTTP 409). maxLength: 256 minLength: 1 createKeyAttributes: type: array description: Attributes to create the key items: $ref: "#/components/schemas/RequestAttribute" required: - createKeyAttributes - executionMode - keyCreationId - keyRequestType - tokenAttributes - tokenProfileAttributes KeyAlgorithm: type: string enum: - RSA - ECDSA - FALCON - ML-DSA - SLH-DSA - ML-KEM - CRYSTALS-Dilithium - SPHINCS+ - AES - Unknown KeyCreationResponse: type: object description: Key-creation response selected by key request type discriminator: propertyName: keyRequestType mapping: secret: "#/components/schemas/SecretKeyDataResponseV2Dto" keyPair: "#/components/schemas/KeyPairDataResponseV2Dto" oneOf: - $ref: "#/components/schemas/SecretKeyDataResponseV2Dto" - $ref: "#/components/schemas/KeyPairDataResponseV2Dto" properties: operationMeta: type: array items: $ref: "#/components/schemas/MetadataAttribute" keyRequestType: $ref: "#/components/schemas/KeyRequestType" KeyPairDataResponseV2Dto: type: object additionalProperties: false properties: operationMeta: type: array description: Connector-defined operation tracking metadata. Required and non-empty in the initial response accepting asynchronous execution. Absent from a synchronous response and from a completed result nested in a status response. This handle must remain valid for the operation's entire tracking lifetime. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 publicKeyData: $ref: "#/components/schemas/PublicKeyDataResponseV2Dto" description: Data of the public key. Populated on sync 200; absent on async 202. privateKeyData: $ref: "#/components/schemas/PrivateKeyDataResponseV2Dto" description: Data of the private key. Populated on sync 200; absent on async 202. keyPairMeta: type: array description: Connector-defined metadata for the pair as a whole. Required on a synchronous 200 and in a completed asynchronous creation-status result; absent from the initial asynchronous 202. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key requested and returned enum: - keyPair required: - keyRequestType PrivateKeyDataResponseV2Dto: type: object additionalProperties: false properties: keyMeta: type: array description: Connector-defined opaque private-key handle. Metadata must identify the key durably—it must remain valid across connector restarts and sessions; ephemeral handles must not be used. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyData: $ref: "#/components/schemas/PrivateKeyDataV2Dto" description: Private-key descriptor without key material required: - keyData - keyMeta PrivateKeyDataV2Dto: type: object additionalProperties: false description: Private-key descriptor without key material properties: type: type: string const: Private description: Role of the key enum: - Private algorithm: $ref: "#/components/schemas/KeyAlgorithm" description: Cryptographic algorithm of the key length: type: integer format: int32 description: "Key length in bits. Required for RSA, ECDSA and AES; optional\ \ otherwise." minimum: 1 metadata: type: array description: "Non-sensitive, provider-specific descriptive metadata" items: $ref: "#/components/schemas/MetadataAttribute" required: - algorithm - type PublicKeyDataResponseV2Dto: type: object additionalProperties: false properties: keyMeta: type: array description: Connector-defined opaque public-key handle. Metadata must identify the key durably—it must remain valid across connector restarts and sessions; ephemeral handles must not be used. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyData: $ref: "#/components/schemas/PublicKeyDataV2Dto" description: "Public-key descriptor, optionally carrying the public key\ \ as SPKI" required: - keyData - keyMeta PublicKeyDataV2Dto: type: object additionalProperties: false description: Public-key descriptor with an SPKI representation. Algorithm Unknown accepts any parseable public SPKI and skips algorithm-family matching. properties: type: type: string const: Public description: Role of the key enum: - Public algorithm: $ref: "#/components/schemas/KeyAlgorithm" description: Cryptographic algorithm of the key length: type: integer format: int32 description: "Key length in bits. Required for RSA, ECDSA and AES; optional\ \ otherwise." minimum: 1 metadata: type: array description: "Non-sensitive, provider-specific descriptive metadata" items: $ref: "#/components/schemas/MetadataAttribute" publicKeySpki: type: string format: byte description: Base64-encoded DER SubjectPublicKeyInfo. required: - algorithm - publicKeySpki - type SecretKeyDataResponseV2Dto: type: object additionalProperties: false properties: operationMeta: type: array description: Connector-defined operation tracking metadata. Required and non-empty in the initial response accepting asynchronous execution. Absent from a synchronous response and from a completed result nested in a status response. This handle must remain valid for the operation's entire tracking lifetime. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyData: $ref: "#/components/schemas/SecretKeyDataV2Dto" description: Created secret-key descriptor. Absent on an asynchronous 202 response. keyMeta: type: array description: Connector-defined key handle. Present on a synchronous 200 response. Metadata must identify the key durably—it must remain valid across connector restarts and sessions; ephemeral handles must not be used. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key requested and returned enum: - secret required: - keyRequestType SecretKeyDataV2Dto: type: object additionalProperties: false description: Secret-key descriptor without key material properties: type: type: string const: Secret description: Role of the key enum: - Secret algorithm: $ref: "#/components/schemas/KeyAlgorithm" description: Cryptographic algorithm of the key length: type: integer format: int32 description: "Key length in bits. Required for RSA, ECDSA and AES; optional\ \ otherwise." minimum: 1 metadata: type: array description: "Non-sensitive, provider-specific descriptive metadata" items: $ref: "#/components/schemas/MetadataAttribute" required: - algorithm - type EncryptedKeyMaterialV2Dto: type: object additionalProperties: false description: "Protected key material as a DER-encoded PKCS#8 `EncryptedPrivateKeyInfo`,\ \ protected with PBES2 using PBKDF2-HMAC-SHA256 and AES-256-CBC. See `encryptedPrivateKeyInfo`\ \ for the full profile." properties: encryptedPrivateKeyInfo: type: string format: byte description: | Base64-encoded DER PKCS#8 `EncryptedPrivateKeyInfo` (RFC 5958). The decrypted plaintext is `PrivateKeyInfo` syntax whose algorithm identifier states the key kind. Exactly one protection profile is accepted, and it must be readable from the envelope alone: - **Scheme** — PBES2 (RFC 8018) with PBKDF2-HMAC-SHA256 as the key derivation, its parameters `NULL` as RFC 8018 requires, and AES-256-CBC as the encryption. - **Salt** — at least 16 bytes, from a cryptographically secure random source, never reused. - **Initialisation vector** — exactly 16 bytes, from a cryptographically secure random source, never reused. - **Iterations** — between 100000 and 10000000; 600000 is recommended. - **Key length** — either absent, which the encryption scheme already implies, or exactly 32. Absent is the common case: OpenSSL does not emit it. - **Ciphertext** — a non-empty whole number of 16-byte blocks. - **Total length** — at most 65536 bytes of DER. Every way an envelope can fall short of this — bytes longer than the maximum, bytes that are not canonical DER, and a canonical envelope outside the profile — is refused as a field validation failure on this field (`VALIDATION_FAILED`), so a caller is told which rule it broke rather than that its body was unreadable. The profile carries no integrity protection of its own, so a successful decrypt is evidence about the passphrase, not about who produced the envelope. required: - encryptedPrivateKeyInfo ImportKeyRequestV2Dto: type: object additionalProperties: false description: | Key material to import, already re-protected by the platform. The platform opens whatever a user supplied, re-protects the key under a passphrase it generates for this request alone and sends it here, so a connector always receives the same protection profile and never sees a user-chosen password. Certificates are not part of this contract: the platform keeps them. properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyImportId: type: string description: | Identifier of a key import operation, so a retry cannot create a second key in the technology. A replay is the same operation only when every one of these matches the first submission: `executionMode`, `keyRequestType`, `keyReference`, `tokenAttributes`, `tokenProfileAttributes`, `importKeyAttributes`, `exportable`, and the imported key itself. Because the platform re-protects the material for every submission, the key's identity decides equivalence rather than the envelope bytes. - An asynchronous replay answers HTTP 202 with the original `operationMeta`. - A synchronous replay answers HTTP 200 with the original result. - Reuse with anything else changed answers `RESOURCE_ALREADY_EXISTS` (HTTP 409). maxLength: 256 minLength: 1 keyReference: type: string description: | Durable identity the platform assigns to the imported key. The connector must bind it in the technology wherever the technology supports one — a PKCS#11 `CKA_ID` and label, a keystore alias, a KMIP attribute, a cloud resource tag. Where the technology carries no such channel, the connector must keep its own durable record from this reference to whatever handle the technology did give it. Either way the binding is what lets a key be found again after a lost response, so it must survive connector restarts and must not be derived from anything request-scoped. The connector does not return the reference: the platform supplied it, and resolves a lost import through `POST /v2/cryptographyProvider/keys/import/result` instead. minLength: 1 pattern: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" executionMode: $ref: "#/components/schemas/OperationExecutionMode" description: "Caller-selected execution mode. The connector must not switch\ \ modes implicitly: a `synchronous` request is answered with HTTP 200\ \ and a result, an `asynchronous` request with HTTP 202 and a tracking\ \ handle." keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: "Type of key the material carries. The connector checks it\ \ against the importable key types it advertises for the token context\ \ before it decrypts anything, and refuses a mismatch with `KEY_TYPE_NOT_IMPORTABLE`." importKeyAttributes: type: array description: "Attributes to import the key, following the schema from `POST\ \ /v2/cryptographyProvider/keys/import/attributes`. A connector must not\ \ define an attribute that carries key material, a passphrase or a certificate:\ \ the material travels only in `material`." items: $ref: "#/components/schemas/RequestAttribute" material: $ref: "#/components/schemas/EncryptedKeyMaterialV2Dto" description: Protected key material to import. Its `encryptedPrivateKeyInfo` states the one protection profile the contract accepts. writeOnly: true passphrase: type: string description: | Passphrase protecting `material`. The platform generates it for this request alone, it is never a user-supplied password, and the connector must discard it once the material is decrypted. minLength: 1 writeOnly: true exportable: type: boolean description: | Whether the imported key may later be exported. The platform states it explicitly and only sends `true` to a connector that declares key export for the key type. A connector that cannot honour it must refuse the import with `EXPORTABLE_NOT_SUPPORTED` rather than import a key whose flag it cannot deliver. required: - executionMode - exportable - importKeyAttributes - keyImportId - keyReference - keyRequestType - material - passphrase - tokenAttributes - tokenProfileAttributes KeyCreationStatusResponse: type: object description: Status of an asynchronous key-creation operation selected by key request type discriminator: propertyName: keyRequestType mapping: secret: "#/components/schemas/SecretKeyOperationStatusResponseV2Dto" keyPair: "#/components/schemas/KeyPairOperationStatusResponseV2Dto" oneOf: - $ref: "#/components/schemas/SecretKeyOperationStatusResponseV2Dto" - $ref: "#/components/schemas/KeyPairOperationStatusResponseV2Dto" properties: status: $ref: "#/components/schemas/OperationStatus" reason: type: string result: $ref: "#/components/schemas/KeyCreationResponse" keyRequestType: $ref: "#/components/schemas/KeyRequestType" KeyPairOperationStatusResponseV2Dto: type: object additionalProperties: false properties: status: $ref: "#/components/schemas/OperationStatus" description: Operation status as known to the connector reason: type: string description: Failure or cancellation detail when status is `failed` or `cancelled` result: $ref: "#/components/schemas/KeyPairDataResponseV2Dto" description: Created key-pair result. Present only when status is `completed`. keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key requested enum: - keyPair required: - keyRequestType - status SecretKeyOperationStatusResponseV2Dto: type: object additionalProperties: false properties: status: $ref: "#/components/schemas/OperationStatus" description: Operation status as known to the connector reason: type: string description: Failure or cancellation detail when status is `failed` or `cancelled` result: $ref: "#/components/schemas/SecretKeyDataResponseV2Dto" description: Created secret-key result. Present only when status is `completed`. keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key requested enum: - secret required: - keyRequestType - status ImportKeyResultRequestV2Dto: type: object additionalProperties: false description: | Identifies the import whose outcome is being resolved. The connector answers from its own record of the operation, so a caller that lost the original response can complete its bookkeeping or remove a key it cannot account for. properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" keyImportId: type: string description: Identifier of the key import operation to resolve maxLength: 256 minLength: 1 required: - keyImportId - tokenAttributes ImportableKeyTypeV2Dto: type: object additionalProperties: false description: "Key type a connector can import, with the algorithms it accepts\ \ for that type" properties: keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Key type the declaration applies to algorithms: type: array description: "Algorithms accepted for this key type. `Unknown` cannot be\ \ declared: the platform decides before it sends anything, which it cannot\ \ do from an algorithm the connector could not name." items: $ref: "#/components/schemas/KeyAlgorithm" minItems: 1 uniqueItems: true required: - algorithms - keyRequestType ImportKeyAttributesRequestV2Dto: type: object additionalProperties: false description: Token context and key type to read the import attribute schema for properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key to import required: - keyRequestType - tokenAttributes - tokenProfileAttributes ExportKeyRequestV2Dto: type: object additionalProperties: false description: | The key to export and the passphrase that will protect it. Export is synchronous and its output is always protected: the connector answers with the key as a PKCS#8 EncryptedPrivateKeyInfo under the passphrase supplied here. Certificates are not part of this contract: the platform assembles any user-facing container around the envelope it receives. properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: "Type of key the metadata identifies. The connector must refuse\ \ the export with `KEY_MATERIAL_MISMATCH` when the key it finds is of\ \ another type, so a mismatch is caught before any material is decrypted." keyReference: type: string description: | Durable identity the platform holds for the key, present only for keys that carry one. - When it is supplied, the connector must read it from the key it exports and echo it unchanged. - When it is absent, the connector must not return one. Either way the platform can confirm the material it received belongs to the key it asked for. pattern: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" exportKeyAttributes: type: array description: "Attributes to export the key, following the schema from `POST\ \ /v2/cryptographyProvider/keys/export/attributes`. A connector must not\ \ define an attribute that carries key material, a passphrase or a certificate:\ \ the passphrase travels only in `passphrase`, and the material only in\ \ the `material` of the response." items: $ref: "#/components/schemas/RequestAttribute" passphrase: type: string description: | Passphrase that protects the returned material. The resulting envelope has to open in external tools, so the passphrase is used exactly as supplied, encoded as UTF-8 in Unicode normalization form C. A minimum length is platform policy, applied before the request is sent. minLength: 1 writeOnly: true required: - exportKeyAttributes - keyMeta - keyRequestType - passphrase - tokenAttributes - tokenProfileAttributes ExportKeyResponseV2Dto: type: object additionalProperties: false description: | The exported key, protected, with a description of what it is. The key never leaves the connector in the clear: it travels as the same protected envelope the import contract accepts. A descriptor accompanies it so the caller can check what it received against its own record before assembling anything around material it cannot open. properties: material: $ref: "#/components/schemas/EncryptedKeyMaterialV2Dto" description: "Exported key material, protected under the `passphrase` from\ \ the request." readOnly: true keyReference: type: string description: "Durable identity the request supplied, echoed unchanged. Absent\ \ when the request carried no `keyReference`." pattern: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" readOnly: true keyData: $ref: "#/components/schemas/KeyDataV2" description: | Non-sensitive descriptor of the key the connector exported, derived from the material it is returning. - A key pair is described by its public key, whose `publicKeySpki` the platform compares with the record it already holds for that key. - A secret key is described by its algorithm and length; a secret key never carries key material here. - A private-key descriptor is not accepted: it would say nothing the platform could check. This is the connector's account of what it exported, checked against what the platform expected. It is not proof that the envelope holds that key, because the platform does not open the envelope: whoever opens it derives the key and can verify it against the certificate. readOnly: true required: - keyData - material KeyDataV2: type: object description: Type-specific key descriptor. Secret and private keys never contain key material. discriminator: propertyName: type mapping: Secret: "#/components/schemas/SecretKeyDataV2Dto" Public: "#/components/schemas/PublicKeyDataV2Dto" Private: "#/components/schemas/PrivateKeyDataV2Dto" oneOf: - $ref: "#/components/schemas/SecretKeyDataV2Dto" - $ref: "#/components/schemas/PublicKeyDataV2Dto" - $ref: "#/components/schemas/PrivateKeyDataV2Dto" properties: type: $ref: "#/components/schemas/KeyTypeV2" algorithm: $ref: "#/components/schemas/KeyAlgorithm" length: type: integer format: int32 metadata: type: array items: $ref: "#/components/schemas/MetadataAttribute" KeyTypeV2: type: string description: Key type supported by the v2 connector contract enum: - Secret - Public - Private ExportableKeyTypeV2Dto: type: object additionalProperties: false description: "Key type a connector can export, with the algorithms it accepts\ \ for that type" properties: keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Key type the declaration applies to algorithms: type: array description: "Algorithms accepted for this key type. `Unknown` cannot be\ \ declared: the platform decides before it sends anything, which it cannot\ \ do from an algorithm the connector could not name." items: $ref: "#/components/schemas/KeyAlgorithm" minItems: 1 uniqueItems: true required: - algorithms - keyRequestType DestroyKeyRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyMeta: type: array description: "Connector-defined metadata identifying the key, as returned\ \ when the key was created, listed or identified. Supply the metadata\ \ unchanged in subsequent requests for the key. Metadata must identify\ \ the key durably—it must remain valid across connector restarts and sessions;\ \ ephemeral handles must not be used." items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 executionMode: $ref: "#/components/schemas/OperationExecutionMode" description: Caller-selected execution mode. The connector must not switch modes implicitly. required: - executionMode - keyMeta - tokenAttributes - tokenProfileAttributes KeyOperationResponseV2Dto: type: object additionalProperties: false properties: operationMeta: type: array description: Connector-defined operation tracking metadata. Required and non-empty in the initial response accepting asynchronous execution. Absent from a synchronous response and from a completed result nested in a status response. This handle must remain valid for the operation's entire tracking lifetime. items: $ref: "#/components/schemas/MetadataAttribute" minItems: 1 KeyDestructionStatusResponseV2Dto: type: object additionalProperties: false properties: status: $ref: "#/components/schemas/OperationStatus" description: Operation status as known to the connector reason: type: string description: Failure or cancellation detail when status is `failed` or `cancelled` required: - status CreateKeyAttributesRequestV2Dto: type: object additionalProperties: false properties: tokenAttributes: type: array description: Token attributes items: $ref: "#/components/schemas/RequestAttribute" tokenProfileAttributes: type: array description: Token profile attributes items: $ref: "#/components/schemas/RequestAttribute" keyRequestType: $ref: "#/components/schemas/KeyRequestType" description: Type of key whose creation attributes are requested required: - keyRequestType - tokenAttributes - tokenProfileAttributes AttributeCallbackRequestDto: type: object properties: connectorInterface: $ref: "#/components/schemas/ConnectorInterface" description: Provider interface the triggering schema belongs to. Core-stamped from /v2/info. interfaceVersion: type: string description: Version of the provider interface. Core-stamped from /v2/info. minLength: 1 attributeUuid: type: string format: uuid description: Connector-global UUID of the attribute whose callback fired — the dispatch key. attributeName: type: string description: Name of the attribute whose callback fired. Informative / logging. minLength: 1 contextAttributes: type: array description: "Route scope chain, credentials expanded inline by Core. Empty\ \ when the form has no parent scope." items: $ref: "#/components/schemas/ScopedAttributes" currentAttributes: type: array description: "The dependsOn-named form values only, reference-typed values\ \ expanded inline by Core." items: $ref: "#/components/schemas/RequestAttribute" pagination: $ref: "#/components/schemas/PaginationRequestDto" description: Optional pagination for content responses. required: - attributeName - attributeUuid - connectorInterface - contextAttributes - currentAttributes - interfaceVersion ConnectorInterface: type: string enum: - info - health - metrics - attributes - authority - discovery - entity - compliance - cryptography - notification - secret - signatureFormatting - cadesFormatting - jadesFormatting - padesFormatting - xadesFormatting PaginationRequestDto: type: object properties: itemsPerPage: type: integer format: int32 default: 10 description: Number of entries per page maximum: 1000 pageNumber: type: integer format: int32 default: 1 description: Page number for the request Resource: type: string enum: - NONE - ANY - dashboard - settings - auditLogs - credentials - connectors - attributes - jobs - proxies - users - roles - acmeAccounts - acmeProfiles - cboms - cryptoAssets - scepProfiles - cmpProfiles - authorities - raProfiles - certificates - certificateRequests - groups - complianceProfiles - discoveries - oids - entities - locations - tokenProfiles - tokens - keys - approvalProfiles - approvals - comments - notificationProfiles - notificationInstances - rules - actions - triggers - resources - resourceEvents - searchFilters - listViews - keyItems - platformEnums - notifications - conditions - executions - complianceRules - complianceGroups - customAttributes - globalMetadata - acmeOrders - acmeAuthorizations - acmeChallenges - cmpTransactions - endEntityProfiles - authenticationProviders - trustedCertificates - vaults - vaultProfiles - secrets - signingProfiles - signingRecords - timeQualityConfigurations - tspProfiles - tspProfileBasicCredentials ScopedAttributes: type: object properties: scope: $ref: "#/components/schemas/Resource" description: "Kind of the scope object. Serialized as the plural resource\ \ code, e.g. \"authorities\", \"raProfiles\", \"vaults\"." objectUuid: type: string format: uuid description: "UUID of the scope object, for correlation/logging only — never\ \ a lookup key on the connector side." attributes: type: array description: Credential-expanded attributes of the scope object. items: $ref: "#/components/schemas/RequestAttribute" required: - attributes - scope AttributeCallbackResponseDto: type: object properties: content: type: array description: Resolved attribute content (v3 content model). Set this arm for DATA-attribute dropdown options. Exactly one of content or attributes must be set; leave the other unset. items: $ref: "#/components/schemas/BaseAttributeContentDtoV3" attributes: type: array description: Runtime-injected attribute definitions. Set this arm to return GROUP children. Exactly one of content or attributes must be set; leave the other unset. items: $ref: "#/components/schemas/BaseAttributeDto" totalItems: type: integer format: int64 description: "Total number of items available, for paginated content responses." ConnectorInfo: type: object properties: id: type: string description: Unique identifier of the connector name: type: string description: Name of the connector version: type: string description: Version of the connector description: type: string description: Description of the connector metadata: type: object additionalProperties: {} description: Metadata of the connector required: - id - name - version ConnectorInterfaceInfo: type: object properties: code: $ref: "#/components/schemas/ConnectorInterface" description: Code of the implemented connector interface version: type: string description: Version of the implemented connector interface features: type: array description: Features supported by the connector interface items: $ref: "#/components/schemas/FeatureFlag" required: - code - version FeatureFlag: type: string enum: - stateless - openMetrics - asynchronous - keyImport - keyExport - secretVersioning - secretRotation - contentSigning - levelTimestamped - levelLongTerm - levelArchival - timestamping - certificateRegistration - certificateStatusPolling - certificateRequestStructured - certificateIdentityOverride - discoveryStopResume InfoResponse: type: object properties: connector: $ref: "#/components/schemas/ConnectorInfo" description: Connector Information interfaces: type: array description: Interfaces supported and implemented by the connector items: $ref: "#/components/schemas/ConnectorInterfaceInfo" required: - connector - interfaces HealthInfo: type: object properties: status: $ref: "#/components/schemas/HealthStatus" description: Current connector operational status components: type: object additionalProperties: $ref: "#/components/schemas/HealthInfoComponent" description: Health status of connector components required: - status HealthInfoComponent: type: object properties: status: $ref: "#/components/schemas/HealthStatus" description: Current status of component details: type: object additionalProperties: {} description: Additional details about the component status required: - status HealthStatus: type: string enum: - UP - DEGRADED - DOWN - OUT_OF_SERVICE - UNKNOWN AttributeDefinitionsDto: type: object properties: connectorVersion: type: string description: "Connector build version, echoed so Core can detect staleness.\ \ A version string, not a content hash." minLength: 1 definitions: type: array description: Attribute definitions keyed by connector-global UUID. Polymorphic across attribute schema v2/v3. items: $ref: "#/components/schemas/BaseAttributeDto" required: - connectorVersion - definitions securitySchemes: ConnectorAPIKeyAuth: type: apiKey description: API Key in header configured for connector name: X-API-KEY in: header BasicAuth: type: http scheme: Basic CertificateTLSAuth: type: mutualTLS description: Client certificate authentication NoAuth: type: http description: No authentication scheme: none